Three tests registered the hook that removes their temp directory before the hook
that stops their engine. node:test runs after-hooks in the order they were
registered, not last-in first-out, so the directory was gone when stop() sealed
into it, and the ENOENT (files/index.ndjson) surfaced after the test as
"generated asynchronous activity after the test ended" - which failed the whole
suite although all 8 tests passed. One hook now stops the engine first and then
removes the directory. Five runs in a row, and the suite runner, pass.
Thanks to xet7 !
How: Admin Panel / Attachments / Transfer limits, set "Attachments upload" and
"API upload" to Blocked. That is the site-wide "Disable attachments" the issue
asks for, as two settings instead of one checkbox.
Comment for the issue:
A site-wide switch for this already exists, so a new "Disable attachments"
setting is not needed. Open Admin Panel / Attachments / Transfer limits and set
"Attachments upload" and "API upload" to Blocked. While they are on, the server
refuses an upload on every path - the upload pipeline, the api.attachment.upload
and api.attachment.copy methods, and the /api/attachment upload,
upload-background and copy routes - on every board, including boards created
later, and no board's allowsAttachments flag has to be touched. Download, move
and delete are not affected, so files uploaded earlier stay reachable. What was
missing is that a card still showed the "+" button and accepted a drop for an
upload that would then be refused; since d8b3579117 the card asks the server
once a minute and hides both. There is no second setting, so nothing can
disagree with what the server enforces. Two settings instead of one checkbox
is the one difference from the request.
Thanks to Raymond-Voogt and xet7 !
Fixes#6870,
With several WeKan servers on one database, every server applied the continuous
backup setting, so each of them tailed the oplog and wrote its own archives into
the same target directory (#6861, item 3).
The leader holds a lease: one continuousBackupLease document with its id and an
expiry. Taking it is one atomic operation (an insert while there is none, else
an update that matches only an unheld, own or expired lease), the leader renews
it every 15 seconds and it lapses after 45, so another server takes over within
a minute when the leader stops. A server that loses the lease stops its stream.
Startup, saving the settings and a change saved on another server all converge
through that loop, and a restore or a fetch from the cloud takes the lease and
waits one renewal so it is the only writer. One server is always its own leader.
Checked against the real driver on FerretDB (SQLite): 24 clients at once give
exactly one leader; renewal, expiry, loss of the old leader and release behave.
tests/continuousBackupLease.test.cjs pins the same and the wiring in
server/continuousBackup.js. docs/Backup/Continuous-Backup.md no longer says
single-server only.
Thanks to Raymond-Voogt and xet7 !
Refs #6861, not closed: the remaining items of the issue were fixed in 4e28465964.
#6870 asks for a site-wide switch that turns attachments off, because the
per-board allowsAttachments flag has to be set on every board. That switch is
there already: Admin Panel / Attachments / Transfer limits, "Attachments upload"
and "API upload" set to Blocked, and the server refuses on every path - the
upload pipeline, api.attachment.upload and .copy, and the /api/attachment
upload, upload-background and copy routes. What was missing is that the card
still showed the "+" button and accepted a drop for an upload that would be
refused.
attachmentUploadPolicy tells a signed-in client the one boolean (nothing about
the limits), asked at most once a minute, and the "+" and the drop/paste upload
follow it. No second setting is added, so there is nothing that could disagree
with what the server enforces. tests/attachmentUploadPolicy.test.cjs pins the
client, the method, and the server enforcement it relies on, and that no
"disableAttachments" setting exists.
Thanks to Raymond-Voogt and xet7 !
Refs #6870, not closed: the reporter asked for a single Features checkbox, and the
two Blocked limits are two settings.
PUT /api/boards/:boardId/integrations/:intId answered 200 with the requested id
when no integration matched that id and board (PR #6871). The two activities
routes (POST and DELETE .../activities) had the same fault: they updated
nothing and answered 200 with `data: null`. All three now look the integration
up on that board after board-admin authorization and answer the JSON 404 the GET
route already uses (#6862), before validating or writing anything.
tests/restIntegrationUpdate.test.cjs and the Playwright spec are the PR's.
tests/restIntegrationWriteRoutes404.test.cjs adds the activities routes and
pins, for the whole file, that every handler that updates an integration looks
it up first and only after authorization.
Thanks to AhmedLukman and xet7 !
The board Excel export answered a missing board with HTTP 200 and the text
"Board not found" (PR #6869). The two PDF export routes had the same fault, and
the Excel and PDF routes answered an over-long auth token with 200 too, while
export.js already used 404 and 400. They now choose their status the same way.
tests/boardExcelNotFound.test.cjs and the Playwright spec are the PR's.
tests/exportErrorStatuses.test.cjs scans every models/export*.js route for a
text answer without a status, so the fault cannot return anywhere there.
Thanks to AhmedLukman and xet7 !
A Grype scan of the image found advisories in packages that Meteor's own
packages carry in programs/server/npm/node_modules/meteor/<package>, which
package.json cannot reach.
nodemailer 8.0.11 -> 10.3.1: meteor/email only calls createTransport, the
'stream' plugin hook, nodemailer/lib/well-known and nodemailer/lib/mail-composer,
and all four work in 10.3.1 (checked with the bundle's own package specifiers,
through its exports map). body-parser 1.20.6/1.20.8 -> 1.20.9 and 2.3.0 ->
2.4.0: a minimum may now be "name@MAJOR", so each major is raised inside
itself. qs -> 6.16.1, postcss-selector-parser 6.1.4 -> 6.1.5.
uuid 8.3.2 and 9.0.1 -> 11.1.1: 11 moved its entry point, which is why it was
refused before. The bumper now writes the recorded dist/index.js back as an
ESM re-export of dist/esm/index.js, which require() loads and which leaves
uuid's own ESM and CJS entry points as they are.
glob 14 and minimatch 11 are already in package.json. Run against a copy of
the published image's bundle, the bumper raises all of these and every raised
copy loads.
Thanks to the Grype scan reporter and xet7 !
The header wraps to several rows on a phone, far taller than the 8px the
floating card docks at, so the card's top row sat among the header's rows and
was only seen by dragging. Below 801px a card without an inline top, popup
cards included, starts at --wekan-header-height + 8px; a dragged place is an
inline top and is never overridden.
Thanks to the iPhone 12 mini reporter and xet7 !
On iPad Chrome and Safari (both WebKit) the opened card's top row - the collapse
caret, the card number, the menu, maximize and X - was behind the header bar,
although the card has z-index 2001 and the header 1000. iOS WebKit makes every
scrolling element (#content, the board wrapper) a stacking context of its own, so
the card's z-index is compared only inside it while the header bar, a flex item of
body and a stacking context too, is painted over all of it. While a card is open
the header bar (#header-quick-access) is now at z-index 0, the level of the
content, which comes after it in the page and so paints over it; with no card open
it keeps 1000.
A browser spec makes #content and the board wrapper stacking contexts with
isolation: isolate, which is the same trap, and shows the card over the header open
and collapsed, its close button reachable, in Chromium and WebKit; without the rule
it fails with the card's top at 8 behind a header 88 high, as in the screenshot.
Thanks to xet7 !
app/board-open.cjs seeds a board of 200, 2000 or 5000 cards, opens it in Chromium and
records the wall clock to the first card and until the DDP WebSocket is quiet, what
crossed it, the Meteor server's CPU by who spends it (Node inspector) and FerretDB's
CPU (pprof). Two runs on each database: the Meteor server's CPU is the same on both
(0.1-0.5 s) and the DDP server is 1% of it; a 5000-card board takes FerretDB (SQLite)
400-600 ms longer to open, the data sent to the browser being the same ~210 KB, a
small board 70-100 ms. FerretDB uses about 4 s of CPU for the 5000-card open: SQLite
39%, filtering in Go 34%, find/getMore/aggregate 0.7-0.8 s each. The README says what
was measured and what was not: the development build, one machine, the browser's own
time not separated, and the aggregate's source not identified.
Thanks to Raymond-Voogt and xet7 !
On an iPad the opened card did not move when dragged by a finger from the collapse
caret, the space beside it, the card number, or the drag handle, while the page
behind it scrolled. The card was moved by mousedown / mousemove / mouseup, and a
finger sends none of them while it moves; the drag areas also lacked
touch-action: none, so the browser took the gesture for a scroll. The card window
is now moved by Pointer Events: a press on the header row or the handle moves it, a
press on a link or button in the row (the caret, close, the menu) waits for a real
drag so a tap still does its job and a drag does not also collapse or close, the
title still edits, and with drag handles on the handle alone moves the window. The
card number is above the title's edit zone so it drags too, the window is kept
within reach, and touch-action: none is on the card header, its handle and every
popup's title bar and handle. Blaze hands over a jQuery event without isPrimary, so
the native event is read.
A browser spec drags with a real touch (DevTools protocol, Pointer Events) from the
caret, the number and the space beside the title, with handles on and off, a tap
that still collapses, a mouse that still drags and a popup; without the fix the
finger tests fail.
Thanks to xet7 !
A card opened as a popup (a search result, a table row, a Roadmap/Gantt bar) got
the generic wide-layout rule top: 97px and z-index 30, because the desktop-mode
rules that dock an opened card at the top (top: 8px, z-index 2001) skip a popup.
So it opened BELOW the header, and collapsed it was a bar floating over the
swimlane, while the same file's popup wrapper rule says it must cover the header
bars. The popup card now docks at top: 8px with z-index 2001 in the wide layout;
mobile mode keeps its own full-window rule. A browser spec shows the card over
the header, open and collapsed, in Chromium and WebKit, and fails without the fix
(top 97 against a header 88 high).
Thanks to xet7 !
The same button leaves full screen; its title and name were still Maximize, which
does not say so. The existing Minimize translation is used, so no language file
changes.
It puts the whole page in full screen with the Fullscreen API (the unprefixed one
and the webkit-prefixed one) and takes it out again; the icon follows the
browser's own events, so Esc is understood. The label is the existing Maximize
translation, so no language file changes. It is drawn only where the browser
offers the API and the page may use it: not on iPhone, not in an iframe without
allowfullscreen. Unit tests drive the pure part with fake documents, including a
refusal; a browser spec checks the position, the label, entering, leaving, Esc,
and that nothing is drawn where the API is not enabled, in Chromium and WebKit.
Thanks to xet7 !
minimatch before 11.0.1 (GHSA-g3hv-75wg-m249): npm-packages/exceljs still had
10.2.6 through readdir-glob 3, and the vendored jade lockfile under
meteor-jade-loader had three copies through glob 13 and test-exclude; both get
an override to minimatch 11, as the root lockfile has. A test now reads every
package-lock.json of the repository, not only the reported ones.
The benchmark module of embedded engines pulled klauspost/compress 1.18.0,
golang.org/x/net 0.23.0 and golang/glog 1.0.0 (GHSA-259r-337f-4rfw,
GHSA-5cv4-jp36-h3mw, GHSA-qxp5-gwg8-xv66, GHSA-vvgc-356p-c3xw,
GHSA-6wxm-mpqj-6jpf). They are raised to 1.18.7, 0.62.0 and 1.2.4, and
govulncheck then found more in x/net, x/text and OpenTelemetry, which are raised
too (x/net 0.62.0, x/text 0.43.0, otel 1.42.0): it now reports none. A test
holds every go.mod of the repository at or above these floors.
Thanks to dependabot and xet7 !
A benchmark of its own (docs/Databases/FerretDB/1/SpeedTest/embedded, a Go module,
no cgo) loads the speed test's cards into SQLite set up as FerretDB sets it and
into Pebble, Badger, bbolt, BuntDB, Nutsdb and Clover, and asks each the six
questions WeKan asks of cards, at 15,377 and 153,768 cards. A board's cards take
the same time on every engine that is not slower, because decoding the JSON
dominates; the key-value stores win single reads and writes by microseconds that
a FerretDB call hides; Pebble is 12x slower on fetching a board, Clover 90-190x
slower in total, and bbolt with its default fsync 100-160x slower on writes. The
README accounts for every entry of the awesome-go section.
Thanks to Raymond-Voogt and xet7 !
Dolt runs under the existing MySQL handler with no new handler and gives the same
answers, but is by far the slowest: 20,470 ms in total, every card query a
2.8 s whole-table scan. The VersionHistory scripts drive WeKan-shaped changes
through FerretDB onto Dolt (a commit per write, undo and redo with DOLT_REVERT,
AS OF, +0.4 ms a write, a conflict when the same document is restored again) and
through the REST API of TerminusDB (author and message per commit, field-level
restore). ClickHouse and StarRocks were tried with the MySQL handler and need a
handler of their own; the README says where each fails.
Thanks to Raymond-Voogt and xet7 !
TiDB (MySQL protocol, Apache-2.0) runs FerretDB after its metadata table's
generated columns became VIRTUAL, and gives the same answers as MongoDB; it is
a speed test row and opt-in for the conformance run (WEKAN_CONFORMANCE_TIDB=1).
Noria has no JSON type, triggers or generated columns, which the MySQL handler
needs; YugabyteDB refuses a CREATE INDEX on a jsonb expression, which every
FerretDB v1 PostgreSQL index is; CockroachDB is not open source. The README
also records that analyzing a PostgreSQL table after its indexes are created
took the PostgreSQL row from 454 to 145 ms, and that the same on MySQL and
MariaDB did nothing.
Thanks to Raymond-Voogt and xet7 !
Results.md now opens with an At a glance table (rank, total, how many times
slower than the fastest, the same for the slowest user), every table is ordered
by its own numbers, the header says the real data size and the real operating
system, and the load table is ordered by the whole load time. pgrust
(PostgreSQL in Rust, malisper/pgrust:v0.4-beta) is one more row through the
same PostgreSQL handler; in the conformance run it is opt-in with
WEKAN_CONFORMANCE_PGRUST=1. The run is 1/20 of a production WeKan so it takes
minutes.
Thanks to Raymond-Voogt and xet7 !
The ten newest of 30,116 users took 52 ms with an ORDER BY in the database and
38-49 ms decoded and sorted in Go, so the change was not kept; the README says
what was measured so it is not repeated.
Thanks to Raymond-Voogt and xet7 !
SQLite sorts and stores JSONB, PostgreSQL uses a GIN index for membership and
pushes down $or, $elemMatch and $and, MySQL and MariaDB read through their
indexes with multikey side tables, and WeKan stopped scanning whole collections
every hour or at every start. Results.md still shows v1.99.0, which the README
now says, and the open items are updated to match.
Thanks to Raymond-Voogt and xet7 !
GET /api/boards/:boardId/cards/:cardId/checklists/:checklistId answered 500 with
no body when the checklist did not exist or belonged to another card. It now
answers 404 with the same error text the checklist update and delete routes
use; board access and the parent-card check are unchanged. Route tests drive
the registered handler (found, missing, other card, other board, denied, lookup
failure) and a browser spec reads the checklist over REST and after a reload.
Thanks to AhmedLukman and xet7 !
tests/boardLabelLookup.test.cjs sliced the getLabel method out of models/boards.js
and then ran .replace(/^getLabel/, 'getLabel') on it, which does nothing: the
slice already starts at getLabel. tests/noIdentityReplacement.test.cjs skipped
every regular expression with an anchor, so it could not see it; a leading ^ or
a trailing $ over plain characters is now compared like any other.
Thanks to GitHub CodeQL and xet7 !
Lay-out has a new Login page background color (loginBackgroundColor). Only a
hex colour is accepted, so the value in the CSS custom property can never carry
CSS; the text under the login logo turns white on a dark colour and black on a
light one. The colour is on body only while the sign-in layout shows. The
support page and the text under the login logo get a centred column with sized,
bold headings and space between paragraphs. The label is translated into every
language file.
Thanks to Raymond-Voogt and xet7 !
Fixes#6866,
The belize and nephritis buttons, the limegreen header, the red-string and
typed-relation lines are now the darker shades that keep their contrast, and
the checklist drag released on the sortable's own bottom edge.
Change Settings has Show focus outline, on by default: the blue ring round the
focused control is an accessibility feature (WCAG 2.4.7), and it also shows
after a click on a minicard. A member who turns it off - profile.hideFocusOutline,
a toggle method that takes the signed-in user only - gets a class on body that
hides the outline and its halo for them and nobody else. The label is translated
into every language file (best effort; the low-confidence ones are listed in the
changelog).
Thanks to mimZD and xet7 !
Refs #6755,
The composer opened after a list (or in an empty swimlane) stays open after a
list is created, so several can be added, and only its X closed it. Escape now
closes it at the level of an inlined form, with the same reset as the X, and not
on a click elsewhere.
Thanks to mimZD and xet7 !
Fixes#6865,
On a Farsi (or Cyrillic) keyboard the d shortcut opened the Due date popup and
closed it at a glance. keyboard.js re-dispatched every key typed on another
script as its Latin key, a leftover from Mousetrap; hotkeys-js resolves the key
from event.code itself, so the shortcut ran twice and the repeat clicked the
same control again, closing it. The re-dispatch is removed, and a test drives
real key events for Latin, Farsi and Cyrillic at the library.
Thanks to mimZD and xet7 !
Fixes#6840,
Eight themes (nephritis, pumpkin, moderatepink, strongcyan, limegreen, relax,
corteza, modern) had white text on an accent at 2.1 to 4.3:1: their accents and
hover, selected and emphasis shades are darkened until it reads at 4.5:1. The
filter sidebar's headings, the clear themes' quiet text and cleanlight's
add-dependency link are darker. A color a member chooses is made legible: a
custom theme accent or slide end is darkened under the header's white text, the
text color is moved to read on the theme's surfaces and no longer reaches the
header, labels and primary buttons, a dependency line is drawn at 3:1, Kanri's
tag text is the better of dark and light, and a custom label, card, list or
swimlane color already derives its text. All 25 themes show no colour contrast
failure on the board, the sidebars, Card Settings, the card and its popups.
Thanks to Samunosuke and xet7 !
A label is looked up by name and color before one is added, and the lookup
compared the name as sent while the schema stores it trimmed: a padded ' Bug '
missed the stored 'Bug', and each repeat created another label with the same
name and color. The REST builder now trims, as the pull request did, and so
does the lookup itself, which the card's label form, the importers and the list
sync share. A legacy label stored with padding is still found.
Thanks to AhmedLukman and xet7 !
The accessibility audit made the quiet text greys dark for every theme, and
old rules never followed the dark themes: Card Settings drew white text on
light grey blocks, popup items, the sidebar's shortcuts row, quiet buttons and
sidebar labels were black on dark, and an !important list header beat each
theme's own. The quiet text is a variable with a light value on the dark
surfaces; Card Settings' sections, popup items and the other rules follow the
theme. axe-core finds no colour contrast failure in cleandark, moderndark, dark
and exodark on the board, sidebar, Card Settings, an opened card and the custom
fields popup.
Thanks to Samunosuke and xet7 !
Fixes#6863,
The scoped card GET (/api/boards/:boardId/lists/:listId/cards/:cardId) sent
200 with no body for a missing, wrong-list, wrong-board or archived card. The
list, swimlane, custom field, comment and integration GETs did the same, and
the user GET threw a TypeError for an unknown name. Each now answers 404 after
the board check, so a stranger still learns nothing about which ids exist.
Thanks to AhmedLukman and xet7 !
The notification cleanup ran at every start and daily on every server, reading
and rewriting the same users 24 times at a rollout; a notification added by
another server between a read and its write was lost. A run now claims a
document per job and day in dailyJobRuns, and the timer looks hourly for an
unclaimed day. The file integrity audit read 'lastRun', checked it, then wrote
it, so two servers could both scan; one atomic update now claims the run.
Continuous backup has no leader: that is documented as single-server, and the
lease it needs is not built, so #6861 item 3 stays open and this commit does
not close it.
Thanks to Raymond-Voogt and xet7 !
collection2 wraps a failed write as 'ValidationError: Failed validation <driver
text>', and the driver's 'Connection pool for <host> was cleared' names a
replica set member that MONGO_URL does not list, so the schema rule matched.
The text is now a lost connection. The board key backfill looked for boards
without a key with an $or including an exists-false branch, a scan of every
board at every start of every server; one $in on the key index finds the same
boards.
Thanks to Raymond-Voogt and xet7 !
Fixes#6860,
The default theme's blue is #2573a7, so the header's white and #f2f2f2 text
passes WCAG AA; label colours, quiet greys and grey tiles have text that
passes too. The Starred menu, the user menu and initials avatars carry their
visible text in their accessible name. The card's Pomodoro field and the
comment and description editors have a name. A card section heading is an h3
holding a real button with aria-expanded, and its menu and layout toggle sit
beside it. The sign-in form is the main landmark with a level-one title, every
page has a level-one heading, and the shortcuts list is reachable by keyboard.
After the fixes axe-core finds no violation on 22 pages. Spec 45 runs the scan
and tests/accessibilityAuditFixes.test.cjs pins each fault by its shape.
Thanks to xet7 !
npm run lint:promises runs typescript-eslint's no-floating-promises and
no-misused-promises over models/lib, server/lib and imports/lib, with type
information read from tsconfig.lint.json (nothing is type-checked). The
eleven findings were promises that never reject (their own catch) and now
say so with void, and three checks that used a promise as a boolean.
Thanks to xet7 !
Real faults: a card's original-position description formatted a promise
because it did not await the history; the attachment swipe distances and
two drag-scroll locals were undeclared globals; a file that cannot be read
during a GridFS upload left the upload open; api.py called exit() instead of
sys.exit(); a rules test redefined a property and a security-log test kept
an unreachable branch. Also 31 missing semicolons, unused imports in the
card details, exporters and attachment API, unused Python imports, and
comments on empty except clauses. The list-sync scanner test cut its source
at the last Meteor.startup, which the new index startup of #6855 had moved.
Thanks to GitHub CodeQL and xet7 !
An account found by username or e-mail that records another directory
entry's identifier (same attribute, other value) is refused at login and
skipped by the import. An existing account now records its identifier and
its attribute, so LDAP_UNIQUE_IDENTIFIER_FIELD takes effect for it.
LDAP_EMAIL_MATCH_REQUIRE looks users up by username instead of _id, which
never matched. The background sync skips an account whose username matches
several entries instead of binding it to the first.
Thanks to Raymond-Voogt and xet7 !
Fixes#6859,
#6815 checked the number of every new card, but a card also enters a board's
numbering by an update: a move from the browser, which computed the
destination number from the cards it had loaded (often none, so 1), a restore
from the archive, and a number set by the REST API or an import. A before-update
hook now does what the insert hook does: a taken number is replaced by a fresh
one from the board's counter, a free one is kept and the counter raised past it.
Thanks to Raymond-Voogt and xet7 !
Fixes#6858,
Every server read the same MongoDB log and counters and recorded each
finding itself: one collection scan became up to 24 identical rows in Admin
Panel / Problems on 24 replicas. A probe now claims the period in a shared
document, and the state that compares one probe with the next lives there.
A claim that cannot be made at all does not stop the probe.
Thanks to Raymond-Voogt and xet7 !
Fixes#6857,
minimatch before 11.0.1 grows its glob parts without bound while it
preprocesses a pattern, then compares them pairwise. archiver (readdir-glob),
@typescript-eslint/typescript-estree and @babel/cli's glob used 10.2.6; they
now use the root minimatch 11.0.4.
Thanks to dependabot and xet7 !
A row said only which fields a slow query filtered on, which is not enough
to find the query in the code or to run explain(). It now shows the command
(for a slow getMore, the query it continues, instead of 'filter on nothing'),
the operators used on each field - never values - and MongoDB's queryHash.
Thanks to Raymond-Voogt and xet7 !
Fixes#6856,
The startup schema re-check claims a run in _wekan_migration so one server
re-checks while the others skip (a claim older than 2 hours is taken over),
and a run that leaves work unresolved is retried once a day instead of at
every start. The daily due-date reminder scan is claimed per day in
dueReminderRuns, so 24 replicas no longer send 24 reminders per card.
A partial index on lists serves the 15-minute list sync scan, and a sparse
index on boards.dueReminderDays serves the due-date lookup.
Thanks to Raymond-Voogt and xet7 !
Fixes#6855,
The banner waited for membership of the current board, and Home, Remaining,
Starred, Templates and the other All Boards pages have none. It now shows to
every signed-in user there, and to the members of the open board on a board.
Signed-out visitors still do not see it.
Thanks to titver968 and xet7 !
Fixes#6854,
A list of years had to end somewhere. The year is now a whole number
(0 is 1 BC) found by jumping through the calendar in use, so thousands of
years back or ahead are one entry away, up to the range a date holds.
Thanks to brlin-tw and xet7 !
Fixes#6853,
The heading above the calendar shows the month and year only, not the
YYYY-MM-DD of the selected day. Under the calendar, year, month and day
drop-downs pick any past, present or future date, in every calendar
system.
Thanks to brlin-tw and xet7 !
Fixes#6853,
Changes since October whose commits lacked a unit, negative or browser
test:
- 2929b61c85: a new drawing refits when its window changes, and is left
alone once drawn on, edited, or zoomed or resized by hand.
- c64b3a3b1d: Due Cards, in "me" and "all users", shows an assigned-only
member only their assigned cards; the owner sees them all.
- 8a6aeba7d1: the All Boards dependency import says how many lines were
added, already there and unmatched.
- 5c50f38e25: a signed SAML Response with two Issuers is refused, which
node-saml 5.1.0 accepted; the same Response with one Issuer logs in.
The browser specs pass in Chromium.
Thanks to xet7 !
October Admin Panel changes whose commits had no test of their own:
- 85af731c1b and 2017f2871f: the Password length and Audit log panes
name themselves in the title bar, the audit log has its own URL, and
its cells align to the start - right in Hebrew - with no left/right
rule left in its CSS.
- e6f7d226ca: no help line of a storage field is shown twice.
- 77956c98ed: Data health's "Never" is its own key, also when an
administrator translates the List Sync one differently.
- 69f3358154: the card reports stay instance-wide and admin-only.
tests/playwright/specs/admin-pane-titles-and-help.e2e.js passes in
Chromium.
Thanks to xet7 !
October changes whose commits had no node test of their own:
- ffe49dd2fd: decryptFile() refuses both the OpenSSL 4 and the OpenSSL 3
wording of a failed authentication as "changed or the key is wrong",
on any OpenSSL; an unrelated error (ENOSPC) is passed through.
- 0218cd823f: the rollover and batch-job leases are claimed before every
write, another server's live lease is refused, and each lease field is
written in one place in the whole tree.
- 8cbe2605fe: on macOS, a stopped engine and one with watching off run no
catch-up scan.
Thanks to xet7 !
ecmascript implies the local dynamic-import fork, so compiling ddp-server,
listed before it in .meteor/versions, stopped the source-loaded server
with "isopack dynamic-import not yet loaded". The loader now loads the
local package asked for and retries. The source server still stops later,
on "Cannot find module 'meteor/accounts-base'"; the bundle server is what
the browser tests ran against.
Thanks to xet7 !
Chromium does not leave the focus on the minicard after its menu popup
is closed with Escape - the menu's opener is a link without href, which
cannot take the focus back - so the test asserted a state the browser
had not reached. It now focuses the minicard's link, the state of the
report, and checks that d still opens the Due date editor from there.
Passes in Chromium and WebKit.
Thanks to mimZD and xet7 !
The Rules page lost its Back with its own sidebar; only the trigger, action
and rule details pages kept one, to the rules list, so the way back to the
board was the Board View menu. The rules list and its Workflow, Bots,
Blocks and History views now have a Back link to the board at the top. The
three sub-pages keep their own Back and show no second one.
Thanks to mimZD and xet7 !
Fixes#6852.
Both are published on the Hall of Fame, so the inventory counts 143 and
names each one's unit and browser regression tests. CrossBoardExportBleed
was published without being added, which failed the whole node-suite run.
Thanks to xet7 !
An assigned-only member whose card assignment was removed kept the card and
attachment ids and, through POST /api/attachment/upload and
DELETE /api/attachment/delete/:id, still added a file to that card and
soft-deleted its existing one: both asked only for board write access. The
DDP methods api.attachment.upload/delete, and copy and move onto a target
card over REST and DDP, had the same shape.
mayWriteCardAttachment (server/lib/assignedOnlyAttachments.js) applies the
same card rule the ordinary card Delete already used to all eight handlers.
A refusal is recorded in Admin Panel / Problems as UnassignedAttachBleed
(authz.assigned-attachment-write, medium: never disables the account).
tests/unassignedAttachBleed.test.cjs reproduces the reported sequence and
fails if any attachment API write lacks the card check;
tests/playwright/specs/unassigned-attach-bleed.e2e.js replays it over REST.
GHSA-w26g-rc43-q6cm.
Thanks to Javier García Herrera and xet7 !
The shortcut filter refused every key while a link or button had the focus.
The minicard is itself a link, so a click on its date badge or its menu left
that link focused, and closing a popup returns focus to the button that
opened it: hovering a card and pressing d then did nothing until a reload.
A focused control now keeps only the keys it uses itself - Enter for any of
them, Space for a button, summary or checkbox, End/Home/arrows for a tab -
so Space still activates a focused button (audit A01) and every other key
is a shortcut again.
Thanks to mimZD and xet7 !
Fixes#6755.
Each test navigates to All Boards and at once opens Export all boards.
All Boards is still drawing just after the route changes, and in
EVERYTHING's full Firefox run the popup opened then was closed again: no
header title to read (the first test; it passed in the run before).
All five tests open the popup again until its title is there. The spec in
Firefox, three times beside the running suite: 15 of 15.
Thanks to xet7 !
The test waited until the drawing's viewBox had grown past the old 800,
then read the surface's box once. The element's layout follows the
viewBox a frame later, and in EVERYTHING's full Firefox run it was still
800 px against more than 1088 expected (it passed in the run before).
It polls the surface's width as well. The spec in Firefox, three times
beside the running suite: 9 of 9.
Thanks to xet7 !
saml-popup-error's first test failed in EVERYTHING's full Firefox run and
2 of 3 times alone: #login-error-message stayed empty after the SAML
button was clicked with a stub that fails at once.
The test clicked #at-saml (force) as soon as Meteor connected, while the
sign-in form was still drawing: the click landed on a button being
replaced, or - in another attempt - below the window ("Element is
outside of the viewport"), and no handler ran. It now waits for the form,
scrolls the button into view and clicks until the error shows. With one
worker both tests pass 6 of 6 in Firefox against a rebuilt bundle.
Found on the way: #login-error-message sits inside `if isLoading`, and
showLoginError wrote into the element - when that block is drawn again
the element is new and empty, so an error shown just before was lost. The
template now renders the message from a ReactiveVar (loginErrorText) as
escaped text, so a redraw keeps it and it can still never be HTML.
oauthProviders.test.cjs pins the same region, the translated codes and
text-only output in that form.
The other sign-in specs (44 files) pass in Firefox with it, apart from
runs where two copies of a settings-changing spec ran at once.
Thanks to xet7 !
The SMTP sink captures every mail the shared test server sends while it
listens. The test waited until user2 had exactly one mail, then read
sink.messages[0] - in EVERYTHING's full Firefox run another worker's
comment notification ("Please look", to another user) had arrived first,
so "Frozen recovery body 0" was looked for in the wrong mail.
It reads the mail addressed to user2. The whole spec in Firefox, twice:
24 passed, 2 conditionally skipped.
Thanks to xet7 !
The String Template help test opened a card and at once its custom field
settings popup. The opened card was still drawing, and in Firefox under
the whole suite the popup sometimes closed again before Create could be
clicked: ve-CC and rup failed in EVERYTHING's full Firefox run, 42
others passed.
The test opens the popup again until its Create button is there. ve-CC,
rup and en, twice each in Firefox beside the running suite: 6 of 6.
Thanks to xet7 !
All four Android bundle jobs failed: WeKan crash-looped on
No native build was found for platform=android arch=x64 runtime=node
abi=147 ... loaded from: .../meteor/accounts-password/node_modules/argon2
until the 240 s smoke test gave up. Meteor's npm rebuild had printed
"install scripts blocked because they are not covered by allowScripts",
though prepare-bundle-npm.mjs writes argon2 and bcrypt into every
rebuild directory's allowScripts.
npm 12 applies allowScripts to a project's DECLARED dependencies only.
The package.json that prepare-bundle-npm writes there declared none, so
argon2 and bcrypt were "extraneous" and their scripts stayed blocked -
reproduced with npm 12.2.1 on this release's bundle, and with the two
declared the same rebuild runs both install scripts. Linux, macOS and
Windows never noticed: prebuilds load there, and the Windows jobs compile
the two themselves. Android has no prebuild, and check-addon-arch passed
the Linux ones it cannot load.
prepare-bundle-npm.mjs now declares each reviewed installer a rebuild
directory has installed, at its installed version, and leaves a declared
one as it is. The Android build runs it itself first - the Linux bundle
it rebuilds may predate this - and loads argon2 and bcrypt with Android's
Node.js right after the install, so a missing addon stops the build with
its name instead of a smoke-test timeout.
prepareBundleNpm.test.cjs and androidBundles.test.cjs pin both; they fail
on the code before. Not run on Android here: the build needs Termux on
an Android-CPU runner.
Thanks to xet7 !
GHSA-8885-xrq4-j47h, reported by ccsimplyspolit, both findings confirmed
in the current code:
1. GET /api/boards/<board>/export?checklistId=<id> (and exportZip)
selected the scoped checklist and its items by id alone. A checklist
of another board - a private one too - was streamed with every item
and its creator, whose profile the anonymization map did not cover.
Both selectors are now bound to the exported board's cards, and a
checklist of another board is recorded in Admin Panel / Problems
(authz.export-checklist-scope).
2. The streaming CSV/TSV export asked neither Disable all export nor
Anonymize export users. Neither did, it turned out, Excel (board,
card, all boards), PDF (board and card), the chart exports, the
calendar feed or the external formats: only the WeKan JSON, ZIP and
Trello exports did, though the setting promises that "the server
rejects any export request" and names CSV and Excel.
- refuseDisabledExport() answers 403 before anything is written, and
all 13 HTTP export routes call it first; assertExportEnabled() still
guards the builders. Both record the attempt (authz.export-disabled,
never blocking the account: a page opened before the switch still
shows the menus).
- anonymizeExportIdentities() anonymizes what one exporter writes -
users, @mentions, requested-by / assigned-by, comments - with the map
build() uses, board members included. The CSV/TSV stream, Excel,
PDF, chart exports (forExport: the chart views keep names), the
calendar feed and every external format call it.
tests/crossBoardExportBleed.test.cjs drives the gate and the anonymizer
and scans the tree: no scoped checklist selected by id alone, no export
route without the gate, no exporter naming people without anonymizing.
All 7 fail on the code before. The new spec
security-cross-board-export.e2e.js replays the reporter's requests and
checks every export route while export is disabled and the CSV and
Kanboard exports while anonymizing; it passes with export-access and
scrum-export-anonymization against a rebuilt bundle.
Thanks to ccsimplyspolit and xet7 !
The splitter test measured the splitter straight after opening Card
Settings, while the popup was still placing itself. In WebKit the press
landed where the splitter had been and dragged nothing: the pane stayed
526 px against more than 606 expected (the first attempt in EVERYTHING's
WebKit stage; the retry passed).
It now measures once two reads of the splitter and the panes 150 ms apart
agree. WebKit 5 of 5, Chromium 3 of 3.
Thanks to xet7 !
After Clear emptied a refused range, WebKit kept a half-edited date
segment in the From field and fired `invalid` on it at the next submit -
though its validity read valid - so the form never submitted and the new
range never applied, with no message (card-date-range.e2e.js in WebKit,
also on retry: 0 submit events, `invalid` on .js-card-date-from). The old
Clear handler emptied the fields the same way, so this was there before.
Both range forms are novalidate now. The submit handler already decides
whether a range is valid (rangeRefused), marks the end date invalid with
the reason and says it in the form, so nothing is lost.
filterDateRangeRefusal.test.cjs pins novalidate on both forms. Against a
rebuilt bundle card-date-range and card-movement-filter pass twice each
in WebKit, Firefox and Chromium.
Thanks to xet7 !
Two causes behind most of EVERYTHING's WebKit failures so far, both in the
test pages rather than in WeKan:
- 94 specs switch language with setLanguage and then click at once. The
client loads that language afterwards and draws everything again, which
closes a popup opened before that: the board view popup of the flow and
report help specs (Latin monte-carlo in WebKit; Corsican and Scottish
Gaelic in earlier Firefox runs) had no entry left to click. The
fixture's context now wraps Meteor.callAsync in each page so that a
setLanguage call resolves once <html lang> - which client/lib/i18n.js
sets in the same flush that redraws - names the language. It waits at
most 10 s and then resolves anyway, so it can only make a spec patient,
never fail one. A page of a context a spec makes itself uses
untilLanguageShown().
- Playwright's WebKit freezes the page's main thread on
PushManager.getSubscription(): after it not even a timer runs. Member
Notification Settings asks it on opening, to show whether this device
gets push (client/lib/webPush.js), so every WebKit spec that opened it
hung in its next click - notification-activity-mute and the member
scope of notification-delivery-settings, in every language. In WebKit
the page now answers as a device with no subscription does. Chromium,
Firefox and Safari answer the real call; no spec subscribes.
WebKit: those notification specs 10 of 10, and the Latin, Corsican and
Product Backlog specs 13 of 13; Chromium and Firefox 11 of 11 each with
the same subset. playwrightPageInit.test.cjs runs both page scripts on a
fake page: setLanguage waits for the language and keeps its result,
other methods are not held, a page whose Meteor arrives later is
wrapped, the wait is capped; WebKit's getSubscription answers null and
Chromium's and Firefox's are left alone; the fixture installs both.
Thanks to xet7 !
Inside `each strokes` the template drew stroke-width=width, and Spacebars
looks a name up among the template's helpers before the line's own
fields: the width helper is the drawing's width, so every line was drawn
800 wide - one black shape over the whole whiteboard, in every browser.
The lines are mapped with strokeWidth now.
whiteboard.test.cjs: every name the line's path uses is a field of the
line and none is a helper of the template, which would win - it fails on
the code before. whiteboard.e2e.js checks each drawn path is the pen's
width (4) in both browsers.
The same spec drew the second person in another context of the same
browser. In Firefox two contexts share the pointer capture the first pen
takes: one line zig-zagged between both paths and the other page drew
nothing, 4 of 4. The second person now has a browser of their own, as
two people do; both pens are still down at once. Firefox 6 of 6 and
Chromium 4 of 4 against a rebuilt bundle.
Thanks to xet7 !
After a reload the notice for an unanswered keyboard undo or redo shows
as soon as its board is open - before the board and its members have
arrived. undoRedoLast does nothing while Utils.canModifyBoard() is false,
so a Retry clicked in that moment was dropped without a word and the
notice stayed (history-recovery-notice.e2e.js, Firefox).
Retry is disabled until the retry can act; Forget needs no right and
stays usable. For someone who may only read the board Retry stays
disabled, as it could never do anything for them.
historyRecoveryNotice.test.cjs pins the binding and the guard it mirrors,
and that Forget is not gated - it fails on the code before. The spec
waits for Retry to be enabled before it clicks; the spec passes in
Firefox against a rebuilt bundle.
Thanks to xet7 !
The filter sidebar's two date-range forms (card dates, card movement)
reported a reversed range with reportValidity(). Firefox opens that
bubble just under the end date - over the Apply and Clear buttons - and
while the field has focus it takes every click on them: no mousedown and
no click reached the page, twice in a row, so a refused range could not
be cleared at all (card-date-range.e2e.js, 4 of 4 in Firefox; with the
bubble suppressed it passed).
The end date is still marked invalid with the reason (setCustomValidity,
for :invalid and screen readers), and the reason is shown in the form as
a role="alert" line under the buttons. Typing in the range or Clear takes
it back.
filterDateRangeRefusal.test.cjs: both forms report through rangeRefused,
show the line and take it back on input and Clear, and nothing in the
filter sidebar calls reportValidity() - it fails on the code before. The
card-date-range and card-movement-filter specs check the line appears
with the reason, is gone after Clear or an edit, and is absent for an
accepted range; both pass in Firefox against a rebuilt bundle.
Thanks to xet7 !
viewport-matrix is Chromium-only (device emulation), so in Firefox and
WebKit every test of a viewport is skipped and its beforeAll never runs -
but its afterAll still does, and read board.boardId of a board that was
never seeded: each of the twelve viewports failed in EVERYTHING's Firefox
stage, on the last test of the group, in 0 ms.
afterAll returns when nothing was seeded. Firefox: 132 skipped, none
failed. Chromium: phone-portrait 11 of 11, and its board is cleaned up.
Thanks to xet7 !
The test switches language and then opens the board, and when the language
arrives the board header draws again and closes a popup opened before
that. In Firefox the click on the board view toggle often came first: no
popup at all, and no Product Backlog entry to open - 2 of 6 runs alone,
the st variant in EVERYTHING's Firefox stage.
The test opens the popup again until its Product Backlog entry is there.
9 of 9 in Firefox (st, en, haw, three times each).
Thanks to xet7 !
In Firefox a Khmer label overflows its Blocks block and widens the box the
test measures, so the first point of the block it found, scanning from the
left, was the block's outline - and a press there dragged nothing: km and
km-KH failed every time (4 of 4), every other language passed.
The grab point is now one with the block's own body on both sides of it.
The whole spec in Firefox: 104 of 104, Khmer, Georgian, Fijian,
Kinyarwanda (the long labels the search was written for) and Arabic
right-to-left among them.
Thanks to xet7 !
The member-scope test switches language just before it opens Notification
Settings, and when the language arrives the popup draws again with every
section closed. Under a whole-suite run in Firefox that came after the
click on the section's summary, so the text checks passed and the select
the test then used was hidden: vi and zh_SG failed, 101 others passed,
and vi passed 3 of 3 alone.
expand() opens the section when it is closed and waits until its content
shows, again if a redraw closes it. vi, zh_SG, en and fi twice each, and
the board-scope, webhook-form and tray tests: all pass.
Thanks to xet7 !
The list-sync specs answer as Jira or GitLab from a server in the test
process, and WeKan's server fetches from it. With the browsers in Docker
on macOS that server was on the container's loopback, which Docker
Desktop keeps from the host: "fetch failed", and every test of
list-sync-estimate, -planning, -source and -time-estimates failed in
EVERYTHING's Firefox stage.
build.sh already forwarded the test SMTP port from the host into the
container through docker exec; the same forwarder carries any TCP. On
macOS it now also forwards a small pool, 39101-39104 by default
(WEKAN_TEST_REVERSE_PORTS), and names it to the specs, which listen
through helpers/reachable-server.cjs: the first free port of the pool,
or any port when there is none, as before. Linux forwards nothing.
30 of 30 of those specs pass in Firefox in Docker now.
playwrightReachableServer.test.cjs: the pool is read strictly, a port in
use is skipped, no pool listens anywhere, and when every forwarded port
is taken it fails clearly instead of listening where WeKan cannot reach.
playwrightDockerHost.test.cjs: macOS forwards the SMTP port and the pool
(or the one configured), names it to the container and removes its ready
files; Linux forwards nothing.
Thanks to xet7 !
The test clicked Add dependency straight after the minicard. Under a
whole-suite run in Firefox that click landed while the card was still
opening, and the picker it opened was closed again when the card's route
and details settled - no popup, and the wait for its type select ran out
(the ve-PP variant; 59 of 60 passed, and it passed 3 of 3 alone).
The test waits for the opened card, then opens the picker again until its
type select shows. 6 of 6 (en, ve-PP, tlh, twice each) beside the suite.
Thanks to xet7 !
The opened card draws the sections above its checklist for a moment after
it opens, and they push the rows down: in Firefox they moved 50 px between
the test measuring them and releasing the mouse. With handles off the
release landed on item 1's own title and opened its editor, so the titles
read 2,3 (EVERYTHING's Firefox stage); with handles on the enabled drag
dropped item 1 between 2 and 3. 2 of 6 in a row failed that way.
drag() waits until two reads of the rows' positions 150 ms apart agree,
then measures and drags. 10 of 10, both variants five times, while the
whole suite ran beside it.
Thanks to xet7 !
The report is a snapshot taken when the search runs, and the live
one-second recovery worker leases each pending intent while it looks at
it. A search made during that lease shows the seeded orphan as "Delivery
reservation active" - correct - and the page keeps showing it, so the
wait for "Original activity is missing" ran out in EVERYTHING's Firefox
stage (the en variant).
The test searches again until a snapshot falls between leases, up to 30 s,
and then asserts the same status and the disabled Retry. 10 of 10 in
Firefox, every test twice, while the whole suite ran beside it.
Thanks to xet7 !
Even on the bridge network, EVERYTHING's Firefox stage lost a test now and
then to a page whose document never came (RuleBleed's cross-board test,
Red Strings, shared templates). Inside the container the cause was in
plain sight: a connect to host.docker.internal:3000 in SYN_SENT after nine
retransmits, while the next connection went straight through. Through the
container's proxy 9 of 1000 requests went unanswered; from the Mac itself
none did.
The proxy no longer waits on such a connect. It reads nothing from the
browser until a connection to the host is up (pauseOnConnect), drops a
dial that has not connected in 1.5 s - a normal one takes milliseconds -
and dials again, five times, so no byte is lost or sent twice. If none
connects the browser's connection is closed rather than left open.
playwrightDockerHostProxy.test.cjs: two unanswered dials, then one that
connects - the request arrives once and is answered, and the abandoned
dials are closed; when every dial is unanswered the client is closed after
exactly the attempts, in well under the old 30-60 s wait.
Thanks to xet7 !
43-mobile-allboards read the invitation tile's box, then each control's
box, one round trip at a time. Firefox draws the row above the board list
later than Chromium, and in between it moved the whole list down 29.4 px:
the Decline button (1102-1162) was compared with where the tile had been
(853-1139) and failed, 2 of 2, in EVERYTHING's Firefox stage. The tile was
never clipped - settled, it runs 882-1168 around all three controls.
The tile and its message and two buttons are measured in one layout now,
polled until they hold, and a missing or zero-height control fails too.
Firefox: 3 of 3. With the original #6488 bug put back (the tile forced to
4rem) it still fails, naming the message and both buttons.
Thanks to xet7 !
A spec and the server share files by path. admin-continuous-backup gives
the server a key file it wrote under .tools/tmp, and reads the stream.json
the server wrote to its target - and with the repository mounted at /repo
and the files root at /wekan-files, every such path named a file only one
side had: "The encryption key file cannot be read", and no stream.json, in
both of its tests in EVERYTHING's Firefox stage (the only browser there that
runs in Docker on this Mac, and on Linux arm64 every browser does).
Both are mounted at the path they have on the host now, the specs are told
that path in WEKAN_FILES_PATH, and the in-container script finds the proxy
and the Playwright binaries from its working directory. Both tests pass in
the container now.
playwrightDockerHost.test.cjs drives run_playwright_docker on macOS and
Linux: the repo and the files root are mounted at their own paths,
WEKAN_FILES_PATH and HOME follow, and the function names no container-only
path. It fails on the code before.
Thanks to xet7 !
Three Firefox tests of one EVERYTHING run waited the full 60 s in
waitForMeteor: their page's own document never arrived. Measured from
containers during that run, on Docker Desktop for macOS:
- host network, through the WeKan proxy: 3 of 600 requests lost
- host network, straight to host.docker.internal: 8 of 600 connects never
completed
- bridge network, through the same proxy: 0 of 1000
- from the Mac itself: 0 of 300
So it is Docker Desktop's host network, not WeKan and not the proxy. On
macOS nothing needs that network - WeKan and MongoDB are reached through
host.docker.internal and SMTP through docker exec - so the container runs
on the bridge network, where the proxy still serves localhost:3000 and the
browser keeps ROOT_URL's origin. Linux keeps the host network, which is
the real one there.
playwrightDockerHost.test.cjs drives run_playwright_docker with uname
stubbed: Darwin gets bridge and the proxy, Linux gets host and none, and
the function names no network of its own. It fails on the code before.
Thanks to xet7 !
The seven commits since the Dependabot entries: two bug fixes (continuous
backup watching before its first scan; single-file Mach-O signing and
start/backup waiting for WeKan) and five test-run fixes, grouped by topic.
The short changelog guard is a group of its own now, so the developer-
tooling subsection is grouped throughout. CHANGELOG.md regenerated.
Thanks to xet7 !
password-min-length-signup-login.e2e.js writes the password policy straight
into the settings document. The server learns it from its settings observer,
which polls on the standalone test MongoDB EVERYTHING runs: for up to ten
seconds it still answered the old policy. A sign-up form loaded meanwhile kept
the old minimum (6 instead of 10), and an administrator's Set password was
refused under the minimum the test before had left enforced - two failures in
EVERYTHING's Chromium stage that never showed on a dev server, whose MongoDB
is a replica set.
untilServerHas() asks the server (getPasswordPolicy) until it has the policy
the test wrote; the sign-up form is loaded again after it. 6 of 6 with two
workers, each test twice.
Thanks to xet7 !
"with every field allowed, the card draws exactly the Card pane's
sections" writes the board's Scrum visibility straight to the database and
reloads. The board publication's cursor has limit: 1, which Meteor's
change-stream driver does not follow, so it polls: a reload could still be
served the board as it was for up to ten seconds, and the card drew no
Scrum section - failing every time in EVERYTHING's Chromium stage. Live in
the browser the update arrived after 9.8 s; in the app itself a write
through a method re-polls at once, so only this direct write waited. The
test waits for the published board (up to 15 s) before it reads the card.
Thanks to xet7 !
button-theme-foreground.e2e.js opened Board Settings / Swimlane, List and
Card and asked each for its column-actions buttons. Card Settings has had
none since 3e5bc58105 ("Card Settings: a checkbox per section, ...":
card actions live in the card's own section hamburgers), so every theme
failed on Card, in EVERYTHING's Chromium stage. Swimlane and List are
checked, in all four themes, and the test says why Card is not.
Thanks to xet7 !
build.sh and build.bat started the test mongod on :3001 with its dbpath
in the checkout's parent directory (../mongodb-test-3001). That is the
one thing in a test run that was written outside the repository, against
the rule that everything WeKan's scripts write stays in .tools/ - and a
sandboxed editor, which may write only the repository, could not create
it, so EVERYTHING's browser stages had no database to run against. It is
.tools/mongodb-test-<port> now, which git and Meteor already ignore.
toolsDirOnly.test.cjs pins the new path in both scripts and fails on a
test database beside the checkout.
Thanks to xet7 !
The file engine scanned its sources first and started watching them
after, so a change made between the two - after the scan had passed a
file, before the watcher began - waited for the next scan, five minutes
by default. And macOS reports file events through FSEvents, which
delivers nothing for a moment after a watcher is created: an EVERYTHING
run on a loaded Mac lost a log line appended right after the start
(tests/integration/continuousBackup.test.cjs, "the appended log line was
streamed by watching", 4 !== 5).
The watchers start first now; a change seen by the scan and a watcher
too is recorded once, as they share one queue. On macOS one catch-up
scan runs two seconds after the start. Not elsewhere: inotify is
watching when fs.watch returns, and a second full scan of a large store
would double the start-up cost.
A new test, on macOS and Linux, with a watcher that never reports:
watching starts before the first scan; on macOS the catch-up scan
records a change made right after the start; on Linux no second scan
runs. It fails on the code before this change.
Thanks to xet7 !
When macOS refuses to signal a process group (EPERM, which it returns for
a group of zombies), the smoke test checked with `ps` whether any member
was still alive. A Mac that will not let the build run `ps` - "Operation
not permitted", as here, where EVERYTHING's node suites run - failed the
check itself, and with it a correct app: macAppPackaging.test.cjs, every
EVERYTHING run on this machine.
On macOS it asks the kernel through libproc now (proc_listpids for the
group, proc_pidinfo for each member: a zombie's info cannot be read, a
live one's status is not SZOMB), with no process started. Elsewhere it
uses ps exactly as before.
tests/mac-smoke-app.py: the ps cases run as the non-macOS path; on macOS
an EPERM asks libproc and never ps; and a real group - a live child, then
a zombie leader alone - is told apart. macAppPackaging.test.cjs passes,
three runs in a row.
Thanks to xet7 !
EVERYTHING's node suites run under Meteor's Node.js, which has single
executable applications, so singleFile.test.cjs built and ran a real
single executable - and it failed twice:
- The builder ad-hoc signed only a target named mac*/darwin*. Built from
this Mac's Node.js under another label (the test builds 'amd64'), the
file is still a Mach-O binary, the injected archive had invalidated its
signature, and macOS killed it (SIGKILL) before it printed anything:
status null. It signs every Mach-O output now, read from the file's
magic number.
- `start --background` and `backup` returned as soon as they had spawned
WeKan, before it wrote its pid file - which it does only after reading
its settings and extracting FerretDB. A `stop` right after them said
"WeKan was not running" and left it running. Both wait now
(status.waitUntilStarted) until the pid file names the process they
started, give up at once if it ended, and say so if it did not start.
singleFile.test.cjs: 24 of 24 under Meteor's Node.js, the real single
executable included; a new test pins waitUntilStarted, and that both
commands use it.
Thanks to xet7 !
changelogShort.test.cjs asserted an Upcoming section always, and one
Upcoming in CHANGELOG.md - but right after a release there is none until
the next real entry (CLAUDE.md, Making a release), so it failed after
every release, v12.77 included. With no Upcoming it checks that the
newest release is first and that nothing links an Upcoming that does
not exist; with one, what it checked before.
Thanks to xet7 !
Dependabot's 5.1.0 -> 5.2.0 bump (#6850) changed the app's package.json,
but a SAML login is verified by the wekan-accounts-saml package's own
copy, pinned by its Npm.depends to 5.1.0 - so nothing that runs changed.
5.2.0 is a hardening release a login relies on: it rejects a message
with more than one Issuer, checks idpIssuer on the Response and its
assertion, rejects a parsed query whose RelayState is not the signed
one, and checks a POST LogoutResponse's status and issuer.
The package pins 5.2.0 now. samlLogin.test.cjs required '5.1.0' in one
place and '^5.1.0' in the other; it requires the package and package.json
to name the SAME version, and at least 5.2.0, so a bump of one alone
fails.
A login roundtrip with the package's own copy (node-saml 5.2.0,
xml-crypto 6.4.0) and WeKan's options: a signed Response and a signed
Assertion log in; a NameID changed after signing, a signature by another
key, an unsigned response, and an answer to a request WeKan never made
are refused. saml-popup-error.e2e.js completes a real signed login in
the browser.
Thanks to xet7 !
The @aws-sdk/client-s3 3.1159.0 bump (#6844) resolved @smithy/core to
3.37.0, which npm marks deprecated: "a bug in custom logger data
redaction" (aws/aws-sdk-js-v3#8393). With a custom logger passed to an
AWS client, sensitive fields nested in a list or map reached the logger
unredacted. @smithy/core 3.24.0 to 3.38.0 have it, so 3.36.2 before the
bump did too; 3.38.1 is the fix.
WeKan's only AWS client is the S3 backup (server/methods/backup.js), and
it passes no logger, so nothing was logged. Updated all the same, in the
lockfile only and within the ranges the SDK already allows - one package,
nothing else moved. Its tarball matches the lockfile's integrity hash,
and compared with 3.37.0 it adds no network host, telemetry, process
spawning or install script. A multipart upload to a local S3 stand-in
still arrives signed AWS4-HMAC-SHA256, whole.
releases/check-telemetry.py --source failed on it: the deprecation text
links github.com, a URL origin new to package-lock.json. It passes now.
Thanks to xet7 !
Two node guards still described v12.76's behaviour before it changed on
purpose. calendarPopupResize asserted that a popup without a date editor
does not drag; every popup drags by its title bar now (#6839), and with
drag handles on only by its handle - both pinned instead, its mock no
longer answering every selector as if a drag handle were there.
calendarTodayMarker picked a month's days with filter(Boolean), which an
empty cell passes now that it is an object with its own _id (#6838); it
skips the cells marked empty.
Thanks to xet7 !
"Show rule button on minicard" is Board Settings / Card, Card buttons,
Show on Minicard (allowsCardButtonsOnMinicard), in WeKan since v12.16:
the board's card-button rules are drawn under each minicard, and a click
runs the rule on that card without opening it. Off by default, which is
why it was not seen. It had no test.
minicard-rule-button-6836.e2e.js (Chromium and WebKit): with it on, a
card-button rule's button is on the minicard and a click archives the
card without opening it; with it off, no minicard has one.
Thanks to mimZD and xet7 !
Fixes#6836,
Member Settings / Change Settings used the shared popup list as it is:
a flex row whose every line is 33px high with its icon centred. Its
settings are sentences, and most wrap - in Persian, in German - so a
setting became two tall lines with its icon floating between them and
the next setting right under it, with nothing to tell where one ended.
Each row is now an icon column, the words and the check mark at the
end; the icon sits on the first line, a wrapped line is an ordinary
line high, a rule divides the rows, and the Card settings checkbox has
the same space beside its words as an icon has.
Scoped to the popup's own list (change-settings-list): a popup keeps
the screens before it - the member menu - in the same .pop-over, so its
data-popup would have restyled those too.
change-settings-popup-6835.e2e.js, in Persian and English, Chromium and
WebKit: each row's icon is on its first line, a line is under 28px high
and a row only as tall as its lines, rows are divided, and the member
menu beside it is untouched.
Thanks to mimZD and xet7 !
Fixes#6835,
The dates row of a minicard reserved 84px at its trailing edge - a third
of a 250px card - for nothing: the avatars float after it, and clear:
both starts it below the menu. A due date with its "1 day left" was
broken over three lines beside that empty strip, in a Persian board of
the report. It reserves the drag handle's room now, 24px, and the same
badge takes two lines at the default list width.
The board header bar wrapping to a second row, and the list header icons
under the card count, in the same report, did not reproduce on the
current code at the same window width, in Persian, with the card count
on; they are in CHANGELOG TODO Later until the reporter can say which
WeKan and which browser zoom showed them.
minicard-dates-width-6834.e2e.js (Chromium and WebKit, English and
Persian): the dates row reserves at most 24px, and the due date badge is
at most two lines high.
Thanks to mimZD and xet7 !
WebKit puts the caret at the start of a field on focus and Chromium at
the end, so the d typed into the title landed at its start in WebKit and
the check for a title ending in dd failed there - while what the test is
for, that d typed in a field opens no Due date editor, held in both.
The test puts the caret at the end itself now.
Thanks to xet7 !
The opened card's title was split like a minicard's: the leading half
opened the editor and the trailing half dragged the window, so clicking
the right of the title, or beside a short last line, did not edit. Now
all of the title edits. With drag handles off, the window is moved from
the empty space of its header row above the title - between the collapse
caret and the menu; with drag handles on, only by the drag handle. A
reader who may not edit has no edit zone and still drags by the title.
Every popup now moves the same way - by its title bar with drag handles
off, by the handle before its title alone with them on - where only the
Drawing, Board View and Board Card settings popups and the date popups
moved before. A dragged popup is kept inside the window as it grows. The
drag pins a popup where it is before moving it: one placed from the
right edge (the member menu) jumped across the window, and one with a
margin by that margin, as the drag began.
card-title-edit-and-move-6839.e2e.js, in Chromium and WebKit: a two-line
title edits from its right, middle and left; the empty header row moves
the window by exactly the drag with handles off and not at all with them
on, when the handle does; and the card menu, Labels and the member menu
move by their title bar, or with handles on by the handle alone.
titleClickToEdit, popupMoveMaximize and popupBounds pin it.
Thanks to mimZD and xet7 !
Fixes#6839,
On a slower server a card's details render a few hundred milliseconds
after the click that opens it. `d` pressed in that moment found no Due
date control yet and did nothing - only the hovered-minicard path (#6755)
waited for it. Both paths now wait for THAT card's control, stop if
another card was opened meanwhile, click it once, and give up after 3
seconds.
The card details also closed any popup of their card when they were
destroyed (#6686), which a re-render of the card still open does too: a
popup could open and shut again at once. They close it now only when
the card is no longer the open one - closed, or another card opened.
The Playwright test emulates a 300 ms connection in Chromium, clicks
each card open and presses d at once: the editor opens and is still
open 1.5 s later, and closing the card still closes it. It fails on the
code before this change. dueDateKeyboardShortcut and
labelsPopupStaleCardContext pin both halves.
Thanks to mimZD and xet7 !
Fixes#6840,
The board Calendar view already has Today (and Calendar mode too), but
the date picker of every date popup - Due, Start, End, Received and the
rest - had only « ‹ › », so a user who paged to another month had to
page back. Today, between the month and ›, shows today's month and
focuses today; it changes nothing until a day is clicked and saved.
Testing it found a picker bug that was already there: going back to a
month drew it wrong - October came back as "29, empty, 30, empty", with
no 31st. Blaze matches list items by _id, and the weeks and days had
none; the empty cells, all alike, were moved around. Every week and
cell, empty ones too, now has an _id that names its month.
calendarPickerControls.test.cjs checks the ids, that Today shows today's
month and focuses today, and that it selects nothing; the Playwright test
pages two months ahead, presses Today, and checks every day of the month
in order, today focused, and the card's due date unchanged.
Thanks to mimZD and xet7 !
Fixes#6838,
The 18 new strings of Admin Panel / Problems / Password length and of the
"Change your password" dialog, written in the language and script each
locale tag names, with the terms each file already uses for password,
account, save and sign in, and __min__ kept exactly. Only those 18 keys
changed in each file, written with fill-translations.mjs --apply, which
fills English placeholders only.
Low confidence, for a speaker to correct on Transifex: ace, ak, an, ary,
ast-ES, ay, ba, bho, bi, bm, bo, br, bua, chr, co, csb, cv, cy, dz, ee,
ff, fj, fo, fur, ga, gd, gn, gv, ha, haw, hsb, ig, iu, jv, kl, kok, ks,
kw, lg, lld, mg, mi, mt, nah, nap, nd, nso, ny, om, pap, qu, rm, rn,
rup, rw, sah, sc, scn, sd, se, si, sm, sn, so, ss, st, szl, te-IN, tg,
ti, tig, tk_TM, tlh, tn, to, tpi, ts, tt, uz-AR, ve, ve-CC, ve-PP, vo,
wa, wa-RR, wal, wo, wuu-Hans, xh, yi, zgh.
Thanks to xet7 !
The title bar keeps its own copy of the menu labels, and the new pane
had none: tests/adminUrls.test.cjs failed on problems/password-length.
Thanks to xet7 !
PASSWORD_MIN_LENGTH (default 8) is now the length below which a sign-in
is REPORTED, in the new Admin Panel / Problems / Password length, and
PASSWORD_MIN_LENGTH_ENFORCE (off by default) is what makes it a rule: a
shorter new password is refused, and an account that signs in with an
older shorter one sees only "Change your password" until it has a long
enough one. Signing in is never refused, enforced or not, so nobody is
locked out by a minimum set after their password. LDAP, OAuth2, OIDC,
SAML, CAS and Sandstorm accounts are neither reported nor asked: their
password is their provider's. An administrator's Set password no longer
applies WeKan's policy to such an account.
Meteor sends a password hashed, so only the browser knows its length: it
notes it on the sign-in form and, after a sign-in that worked, says "it
was short" - never the password or its length.
The page has both settings and a table, one row per account: username,
first and last short-password login, the latest IPv4 and IPv6 address
with the country's flag and city when a CDN says where it is, the count,
and when it was fixed, with the Too short (default) / Fixed / All filter.
Fixed is a changed password not seen short since; a short one seen
again reopens the row.
Changing one's own password - Member Settings, the forced change, a
reset link - now signs EVERY session of the account out, the one that
changed it too, and only the new password signs in again. The browser
goes to the sign-in page as soon as it is signed out, since the server
closes the connection before the answer can arrive.
Documented in docs/Features/Admin-Panel/Problems/Password-length.md, the
settings on every platform. The new strings are in every locale in
English for now. Tests: passwordPolicy, passwordChangeRequired and
shortPasswordLogins (node); password-min-length-signup-login,
password-length-report and password-change-other-sessions (Playwright,
Chromium and WebKit), which change each setting on the page and check
what it does, and that sign-up with no mail server registers and signs
the user in.
Thanks to xet7 !
Registering answered "Internal server error" - and created the account
anyway, so the next try said it already existed - and the
starredPublicBoards and translation publications failed for everybody:
"Did not check() all arguments". audit-argument-checks asks,
synchronously, the moment a handler returns, whether check() saw every
argument. The REQUIRE_2FA wrapper of every method and publication, and
the Audit log's wrapper of the administrators' methods, were async and
awaited before they called the handler - even with REQUIRE_2FA off - so
the handler's own check() came after the audit had already failed the
call, and the handler went on running.
A wrapper now calls the handler at once when it needs no lookup
(REQUIRE_2FA off, nobody signed in, a cached answer). When it must await
first, it hands the audit over (server/lib/argumentChecks.js): the
arguments count as seen for the outer audit, and the handler runs under
an audit of its own that it must satisfy exactly as unwrapped.
tests/wrappedHandlerArgumentChecks.test.cjs runs both wrappers under a
model of the check package's audit: a checking handler passes, off and
on, a refusal stays a refusal, a handler that does not check still fails
on every path, and no wrapper in server/ awaits before it has checked.
Thanks to xet7 !
A build from the menu printed uname -p and sysctl hw.cpu64bit_capable
over and over and never reached its first package. With
METEOR_WAREHOUSE_DIR set and no SANDBOX, Meteor takes the running tool
to be wherever the warehouse's "meteor" link points - 3.5.4, the release
it was installed with - so with .meteor/release at 3.6-rc.1 every start
springboarded to 3.6.0-rc.1, found itself the wrong tool again and
springboarded again: 28 times in 20 seconds of meteor --version. The
earlier 1.1 GB build log was the same loop, its module trace printed
anew on every exec.
tools-env.sh and tools-env.bat now set SANDBOX=true beside the
warehouse, as Meteor's own self-test does; that one check is all it
changes. The Nextcloud test scripts and the dev-source runner, which set
the warehouse themselves, do the same. meteor --version now springboards
once, from the linked 3.5.4 to 3.6.0-rc.1.
tests/meteorSpringboardLoop.test.cjs checks both env scripts, that
nothing sets the warehouse without SANDBOX, and runs the installed
Meteor to count its springboards.
Thanks to xet7 !
Turning the NODE_DEBUG=module trace off for EVERYTHING alone was not
enough: a dev build from the build.sh menu wrote 1.1 GB, three million
lines, in its first three minutes, before it was interrupted. The trace
is now opt-in in build.sh and build.bat alike, and the diagnostics line
says whether it is on and how to turn it on. The other build diagnostics
(resolver commands, npm verbose, METEOR_PROFILE) are unchanged.
Thanks to xet7 !
The build's NODE_DEBUG=module trace wrote over 12 GB in the first half
hour of an EVERYTHING run on macOS - twice, through tee - and slowed the
build it traced, so the run would fill the disk before reaching the tests.
A build from the menu still traces by default; WEKAN_BUILD_TRACE_MODULES=0
turns it off, and EVERYTHING sets that unless the caller asked for 1. The
other build diagnostics (resolver commands, npm verbose, METEOR_PROFILE)
are unchanged.
Thanks to xet7 !
CodeQL #599 (js/insufficient-password-hash, CWE-916) flagged the SHA-1
the server computed for PASSWORD_CHECK_PWNED. That digest is not password
storage - accounts-password keeps passwords with bcrypt - and it is never
stored or logged: Have I Been Pwned's range API is keyed by SHA-1, its
first 5 hex digits are the question and the rest is compared in memory.
A slow hash cannot be used, because the service could not match it.
The browser and the server now compute it with one implementation,
breachLookupDigest in models/lib/passwordPolicy.js, which says what it is
and is not; the server no longer hashes a password with a hash of its
own, and a digest that cannot be computed lets the password through.
Tests pin that the digest is SHA-1 for ASCII and UTF-8, that it reaches
only the lookup and the comparison, and that nothing in WeKan hashes a
password-named value with a fast hash. Unreleased hardening, so no Hall
of Fame entry: docs/Security/Password-Breach-Check-Digest-2026-10-31.md.
Thanks to GitHub CodeQL and xet7 !
The 16 strings the security features added were English placeholders in
every locale; each is now in the language and script its locale tag
names, with the terms the file already uses for password, account,
attachment, backup and two-factor authentication. __min__ is kept
character for character. Where the right word is spelled like the
English ("Administrator"), the column header says "Admin" or "Who"
instead, because a value equal to English is not a translation.
fy and fy-NL: the existing two-factor strings were Dutch in a Frisian
file, and are Frisian now; tests/frisianTwoFactorLanguage.test.cjs.
tig: Tigre spells storage መክዘን, not Tigrinya's መኽዘን.
Low confidence, for a speaker to correct on Transifex: ace, ak, an, ary,
as, ast-ES, ay, ba, bho, bi, bm, bo, br, bua, chr, ckb, co, csb, cv, dz,
ee, ff, fj, fy, gn, gv, haw, hsb, ht, ig, iu, kl, kok, ks, kw, la, lg,
lld, mg, mi, nah, nd, nso, ny, om, pap, ps, qu, rm, rn, rup, rw, sah, sc,
scn, sd, se, si, sm, sn, so, ss, st, szl, tig, tlh, tn, to, tpi, ts,
uz-AR, ve, ve-CC, ve-PP, vo, wa, wa-RR, wal, wo, xh, yi, zgh.
Thanks to xet7 !
/admin/people/audit-log opens the pane and names it in the title bar like
every other People pane, and the table aligns to the start of the line,
so it reads right to left in Arabic, Hebrew, Persian and the rest.
Thanks to xet7 !
Admin Panel / Attachments / S3 / Server-side encryption: SSE-S3 (AES256)
or SSE-KMS (aws:kms, with a KMS key or the account's default). S3
encrypts each object as it is written and decrypts it for WeKan on read,
so reads, range requests and moves are unchanged. Every attachment and
avatar upload, every renamed object and every backup written to S3 now
carries the choice; a value that is not one of them, or a malformed key,
adds nothing.
On the filesystem, encryption at rest stays with the disk or volume
(LUKS, an encrypted cloud volume): exports, PDF, thumbnails, virus scans,
backups and WebDAV all read the stored files directly, and encrypting
them inside WeKan would change every one of those and convert every file
already stored.
The new interface strings are pending translation.
Thanks to xet7 !
Nothing recorded who set somebody's password, made somebody an admin,
changed a login setting or restored a backup. Every call of those
administrative methods by a site administrator is now kept, one document
each, for a year: when, who, which action, the outcome - a refused call
too - its arguments and the address. A password or a secret never
reaches the trail: values under a credential-named key, the arguments
that are a password by position, and a password inside a URL are
replaced by [redacted]. An administrator editing cards is not in it,
the trail is shown to site administrators only, and a trail that cannot
be written never changes what the method did. It and the REQUIRE_2FA
wrapper keep each other's marks, so neither wraps the other twice.
The new interface strings are pending translation.
Thanks to xet7 !
LOGOUT_WITH_TIMER ends a login at a deadline however busy its user is;
nothing ended a session somebody walked away from. LOGOUT_IDLE_MINUTES
(Admin Panel / People / Login, every platform; empty or 0 is off) does:
the browser reports a key press, click, touch or scroll at most once a
minute, the server keeps the time per login token in idleSessions, and
once a minute every token idle past the limit is removed, which signs its
connections out. A tab that reconnects and resumes its login by itself -
a laptop waking up - is not activity and does not extend the session.
REST API tokens have no session record and are never removed. The time
is kept beside the user rather than on the token, because updating one
element of the token array needs the positional $ operator, which not
every database WeKan runs on supports.
Thanks to xet7 !
New passwords: PASSWORD_MIN_LENGTH (default 8) and PASSWORD_CHECK_PWNED
(off by default), in Admin Panel / People / Login and on every platform.
The browser sends a password to Meteor hashed, so the server checks every
password that reaches it as text - Admin Panel Set password and Add user,
POST /users/register - and the sign-up, Change Password, reset and
enrolment forms check in the browser. Signing in is never checked, so an
existing shorter password keeps working until it is changed. A breached
password is found with Have I Been Pwned's k-anonymity range API: only 5
hex digits of the SHA-1 leave WeKan, and an unreachable service never
refuses a password.
REQUIRE_2FA: off (default), admins or all. It covers accounts that sign in
with a WeKan password; LDAP, OAuth2, SAML, CAS and Sandstorm accounts sign
in through an identity provider and are not asked. Such an account can
still sign in, sees only the 2FA set-up until it has 2FA, and until then
the server refuses every method and publication but signing in and
enrolling, HTTP routes do not accept its login and the REST API gives it
no token. Once required, 2FA cannot be switched off.
The new interface strings are pending translation.
Thanks to xet7 !
POST /import-trello and other HTTP routes accept the login cookie as the
login, so a page on another site could make a signed-in browser send one.
The cookie is SameSite=Strict, which keeps it off such a request in
today's browsers; this is the second line, for older browsers, same-site
sibling hosts and routes added later. A POST, PUT, PATCH or DELETE whose
only login is the cookie must carry an Origin, or Referer, naming
ROOT_URL's host or the Host / X-Forwarded-Host it was sent to, which on
Sandstorm is the grain's own host. Token-authenticated API calls, Meteor's
cookie routes and DDP are not affected. A refusal is recorded in Admin
Panel / Problems as csrf.cross-site-cookie and never blocks the account
whose cookie it was.
Thanks to xet7 !
WeKan sent no HSTS header, so a link typed as plain HTTP or a downgrade on
a hostile network could strip TLS from the next visit unless the reverse
proxy added it. It is now sent whenever ROOT_URL is https: 180 days, this
host only. HSTS_MAX_AGE, HSTS_INCLUDE_SUBDOMAINS and HSTS_PRELOAD (Admin
Panel / People / Login, every platform) change it; 0 stops it, and preload
is sent only with includeSubDomains and at least a year. Every response
also carries X-Content-Type-Options: nosniff and
Referrer-Policy: strict-origin-when-cross-origin.
Thanks to xet7 !
snapd keeps the snaps in /var/lib/snapd/snap on Fedora, RHEL, AlmaLinux,
Rocky Linux, CentOS Stream and Arch Linux, which have no /snap, so the
instructions that exported /snap/wekan/current/bin and its lib directory
did not find mongodump and mongorestore there. They now pick the directory
with one S= line and the CPU's library directory with $(uname -m), and the
scripts that can be run from a host shell find the snap in either place.
Thanks to Group-Deed and xet7 !
Boards, swimlanes, lists and cards from before the templates feature have
no `type`: the schemas' defaultValue fills it on insert only. All Boards
publishes `type: 'board'` and the card queries ask for 'cardType-card', so
a Sandstorm grain migrated from MongoDB 3 opened onto an empty All Boards
page although its board was intact in the database. The new
type-defaults-backfill startup step sets the schema default on every
document whose type is missing, null or empty, and never touches an
explicit type.
Thanks to xet7 !
A report described "failure to invalidate session on password change": the
same account signed in on two browsers, the password changed in one, and
the other's session "updated" rather than ended. WeKan does not do that.
Member Settings / Change Password is Meteor's changePassword, which removes
every login token but the changing session's; the admin's Set password is
setPasswordAsync, which removes them all, as resetPassword does; and a
session whose token is gone is closed, while WeKan's HTTP routes accept only
a token still in the list.
password-change-other-sessions.e2e.js runs the report in two browser
contexts: both signed in with the password, the password changed through
the form in one, and the other is signed out within seconds, stays signed
out after a reload, and only the new password signs in. It passes three
times in a row in Chromium and in WebKit. passwordChangeSessions.test.cjs
pins those paths and fails on a password change with logout: false, the
LDAP sign-in's password sync being the one stated exception.
Thanks to xet7 !
CVE-2026-98432 is a Linux kernel use-after-free in IPv4 TCP connection
handling, shown to give remote code execution through an MPTCP listener
(golang-announce, 2026-10). Since Go 1.24 every Linux listen socket of a
Go program is MPTCP by default, and WeKan ships two Go servers: Caddy, the
snap's web server on ports 80 and 443, and FerretDB, the default database.
Every place WeKan starts one sets GODEBUG=multipathtcp=0: the snap's
environment (every app, Caddy and FerretDB among them), the Docker
entrypoint and the bundle launcher - which keep an operator's own
multipathtcp setting - every docker-compose FerretDB service (the commented
FerretDB 2 example too), and the FerretDB the Sandstorm grain starts. Caddy
is an upstream binary, so no rebuild is needed: Go reads GODEBUG at start.
wekan/FerretDB builds with `godebug multipathtcp=0` as well. The real fix
is a patched host kernel.
Checked on Linux: a Go server's default listener reports MPTCP true;
GODEBUG=multipathtcp=0, or the go.mod setting, makes it false.
tests/goMptcpOff.test.cjs pins every launcher, runs the launcher line, and
fails when something turns MPTCP back on.
Thanks to xet7 !
"Prepare v12.73 release" renamed Upcoming, but its push was refused and
the release workflow was never dispatched: there is no v12.73 tag and no
v12.73 GitHub Release. As CLAUDE.md says for a release that published
nothing, the heading goes back to "# Upcoming WeKan ® release", so the next
release-all.sh takes v12.73 again. It also gains the entry for the fix that
keeps this from happening again.
Thanks to xet7 !
v12.73 was prepared on a main that origin had moved past: the release
bot's v12.72 version bump had landed meanwhile. release-all.sh renamed
Upcoming and committed "Prepare v12.73 release", its bare git push was
refused, and set -e stopped it before gh workflow run - so no release ran,
and no tag was made, while the CHANGELOG already said v12.73.
release-all.sh now runs build.sh's git pull right after its checks, before
it chooses the version or renames anything, and checks the Upcoming section
again after it; and it pushes with build.sh's git push, which repairs moved
CHANGELOG links and pulls and pushes once more when origin moved meanwhile.
If the push still does not finish, it says that the workflow was NOT
dispatched, and the command to dispatch it.
releaseUpcomingPreflight pins the order - the pull before the version and
the rename, the push before the dispatch - and fails on a bare git push;
releaseTelemetry and the version-selection fixture follow.
Thanks to xet7 !
CodeQL alert #598 (incomplete URL substring sanitization, CWE-20) flagged
tests/sandstormOrgHosts.test.cjs, which skipped files that did not include
the old Sandstorm host name as a substring. The file no longer names that
host at all. It finds every Sandstorm host on a top-level domain other than
org by its shape, written as a URL - a scheme or // before it, or a port or
path after it - so property paths such as services.sandstorm.id, file names
such as sandstorm.js and the domains reserved for tests are not hosts. The
demo and the store workflow's older-market publish step stay allowed by
their subdomain and place.
A new self-test checks what it finds and what it does not; run against the
docs and workflows from before the sandstorm.org switch it finds 13 old
hosts, the installer address of release-all.yml among them.
Thanks to xet7 !
CHANGELOG.md showed only the five newest releases, so what was about to be
released was only in CHANGELOG-big.md. changelog-short.mjs now puts the
unreleased # Upcoming WeKan ® release first - its In short and a link to
its full section - and the five newest releases below it; right after a
release, when there is no Upcoming yet, none is invented.
CLAUDE.md and AGENTS.md say what "update wekan changelog" means: find the
commits not in the changelog yet, add an Upcoming section when a release
was cut meanwhile, write the entries and the In short into
CHANGELOG-big.md, run changelog-short.mjs, run the changelog tests, and
commit both files.
tests/changelogShort.test.cjs: Upcoming first, whole, above the releases,
its link resolves, and no Upcoming appears after a release.
Thanks to xet7 !
CHANGELOG-big.md is the changelog as it was: # Status, # Upcoming and every
release in full, with its <details> entries. Everything that writes or edits
the changelog uses it - release-all.sh, release-notes.sh and the release
workflow, the commit-link repair in build.sh and fix-changelog-hashes.sh,
the archive, the wrapper, the version scripts - and the release notes'
"More details at ChangeLog" link goes to its section. remote-release.py,
shared with FerretDB and the patch repositories, takes the file from its
config, and only WeKan's names CHANGELOG-big.md.
CHANGELOG.md is new: no Status and no Upcoming, only the In short paragraph
of each of the five newest releases and a link to its full section, in plain
Markdown - no <details>, <summary>, </summary> or </details>, and HTML links
written as Markdown links. releases/changelog-short.mjs writes it;
release-all.sh runs it right after naming the release, so it is in the
release commit, and changelog.sh does too. The Sandstorm App Market keeps
embedding CHANGELOG.md, now the short one.
old-CHANGELOG/'s headers say they moved out of CHANGELOG-big.md. References
to Upcoming or TODO Later in code comments and docs name CHANGELOG-big.md.
CLAUDE.md and AGENTS.md describe both files: CHANGELOG-big.md is written,
CHANGELOG.md is generated and never edited by hand.
tests/changelogShort.test.cjs: CHANGELOG.md is exactly what the generator
writes, the five newest releases with their whole In short, links that
resolve, and none of the four tags or an HTML link; the changelog tests
read CHANGELOG-big.md.
Thanks to xet7 !
Only the rename, in a commit of its own, so that git log --follow and blame
keep the changelog's history; the next commit adds the new short
CHANGELOG.md and points the release tooling at CHANGELOG-big.md.
Thanks to xet7 !
#6833 publishes WeKan to both Sandstorm app markets, apps.sandstorm.org
and the older apps.sandstorm.io, whose API is alpha-api.sandstorm.io.
sandstormOrgHosts.test.cjs refused every sandstorm.io host; it allows
that publish step in sandstorm-store.yml only, and checks that both
markets are published to.
Thanks to ocdtrekkie and xet7 !
Checked against the 2024 Confusion Attacks on Apache httpd
(blog.orange.tw, CVE-2024-38472 to -38477 and CVE-2024-39573, fixed in
2.4.60). The guide's examples were reverse proxies only, with no
RewriteRule, but each passed the WebSocket with ProxyPassMatch and $1 - a
request capture in a proxy target, the shape those attacks abuse - and in
the sub-URL example that rule looked for ^/sockjs while the requests come
to /wekan/sockjs, so its WebSocket never connected.
- Both examples pass the WebSocket with "ProxyPass ... upgrade=websocket"
on their fixed prefix (2.4.47+); no ProxyPassMatch remains.
- The guide asks for httpd 2.4.60 or newer, drops NameVirtualHost (a no-op
in 2.4) and the path in the sub-URL ServerName, which is not valid.
- A "What not to add" section: no RewriteRule or ProxyPassMatch with a
request capture in the target, no <Files>/<Location> ACL in front of
WeKan, AllowEncodedSlashes Off and MergeSlashes On, <Directory /> denied.
Verified with Apache 2.4.67: both virtual hosts parse, and in front of a
WebSocket server both pass HTTP and the WebSocket, at / and at /wekan;
the old sub-URL example fails its WebSocket ("Unexpected server response:
200"). tests/apacheReverseProxy.test.cjs pins it and fails on the old guide.
WeKan's own redirects stay on its origin (CAS checks the callback's origin
against ROOT_URL; the file and avatar redirects build their own paths), so
a backend-chosen Location cannot be steered elsewhere.
Thanks to xet7 !
Custom URL schemes in card text link only when Admin Panel -> Features ->
URL lists them, and never javascript:, data: or another scheme that runs
code in the page. A listed operating-system handler was linked, though, and
some have a public code-execution history: ms-msdt (Follina,
CVE-2022-30190), search-ms and search, ms-officecmd, ms-appinstaller,
ms-cxh and ms-cxh-full, and telnet - the last step of the 2026 Edge full
chain, where Windows ran telnet.exe from a user-writable PATH directory.
An administrator listing one would let any board member plant a link that
runs something on whoever clicks it.
- They are never linked, listed or not, by the app's parser and by the
markdown package's copy of the rule (the two lists must be identical),
and a click on one does nothing should such a link reach the page.
- A card title or description, comment, checklist or checklist item that
ADDS a link to one is shown in Admin Panel -> Problems (HandlerLink,
CWE-939), with who wrote it; the text is saved as written and the writer
is told nothing. The word in prose, or a link the text already had, is
not recorded.
- docs/Features/Admin-Panel/Settings/Visibility.md lists both kinds of
never-linked scheme, and says what a listed file: does on Windows (an SMB
link outside the network sends the clicker's NTLM hash).
Tests: tests/urlSchemeAllowlist.test.cjs (positive and negative, through
the real DOMPurify, both sanitizer passes and the detector; fails on the
old code), and custom-url-schemes.e2e.js, which passes in Chromium and
WebKit: listed handlers do not link, a description saved with one through
the editor is recorded for its writer, and a kept link or a comment that
only mentions the word is not. Firefox does not start in this
environment.
Thanks to xet7 !
The v12.70 release renamed Upcoming to v12.70 at 23:59, and the entries for
the Hall of Fame guards (43c4d41877) and the Sandstorm install address
(ca2dc5fae5), committed after it, were added to its Tests and Releases
groups - inside a released section, for commits that release does not
contain, and with no Upcoming section left for release-all.sh to take the
next version from. They move to a new Upcoming section; the v12.70 section is
again exactly what v12.70 shipped. changelogEntriesBelongToTheirRelease
passes.
Thanks to xet7 !
v12.69's build-sandstorm in release-all.yml stopped because the
certificate of install.sandstorm.io had expired. It fetches the installer
from install.sandstorm.org, as sandstorm.yml and sandstorm-store.yml
already did, and so does releases/install-sandstorm.sh. That installer
downloads Sandstorm from dl.sandstorm.org and configures a development
server at local.sandstorm.org, so the docs follow: docs, apps, dl, install
and local.sandstorm.io links and addresses become sandstorm.org in the docs,
SECURITY.md, code comments and the accounts-sandstorm README, each URL
checked to answer there. demo.sandstorm.io stays, as it has no sandstorm.org
name; released CHANGELOG sections are records and stay as they are. The
release audit's baseline allows the two code comments' docs.sandstorm.org.
tests/sandstormOrgHosts.test.cjs: every Sandstorm build installs from
install.sandstorm.org, and no tracked file names a sandstorm.io host
outside those kept on purpose; it fails on the old release-all.yml.
Thanks to xet7 !
hallOfFameProblemsCoverage and securityRegressionCoverage collected the
names from <td valign="top"><b>Name</b></td>, so a name that was a link to
its page was never seen. Now that every name is one, the match takes the
link; the four it had missed - ImportPlacementBleed, SamlSubjectBleed,
StampBleed and UploadBleed - are listed as guarded by the suites that name
them, and the inventory count goes from 137 to 141.
Thanks to xet7 !
v12.69's build-sandstorm stopped because install.sandstorm.io's certificate
expired that day (Let's Encrypt, notAfter 2026-10-29 19:02 GMT), and
fetch.sh reported "The server is having an outage" for curl's exit 60. It
now says the certificate could not be verified and that only that server's
owner can fix it. dl.sandstorm.io, where Sandstorm itself is downloaded
from, is valid.
Thanks to xet7 !
releases/prepare-launchpad-source.sh uploads only the files the snap recipe
reads, and listed releases/fetch.sh without releases/tools-env.sh, which
fetch.sh sources for its TMPDIR. In v12.69's armhf build the caddy part's
fetch.sh had no TMPDIR, mktemp made nothing, and curl got an empty -o seven
times ("option -o: is badly used here"), with pauses of up to 480s, before
it was reported as a server outage.
- tools-env.sh is uploaded, and it makes .tools/tmp in a tree that has only
snapcraft.yaml and releases/, as the Launchpad source does.
- fetch.sh stops at once when it has no temporary file, and does not retry
curl's exit 2 (it could not start) or call it an outage.
- tests: every releases/ file a listed script sources or runs must be
listed; tools-env.sh and fetch.sh work in such a tree with no .git and no
TMPDIR; both fail on the old list. fetch.sh's two new refusals are tested.
s390x failed earlier, on Launchpad: even a new build answered "Could not
find repository at path" three times.
Thanks to xet7 !
releases/fetch.sh downloaded into a mktemp file and moved it into place, so
every download kept mktemp's 0600, and the bundled ferretdb and mongo-tools
were 0711 after chmod +x. A user other than the owner gets "Permission
denied" from such a file, and since today's appimagetool checks for it, all
six v12.69 AppImages (i686, x86_64, aarch64, armhf and both musl ones)
failed: "has mode 0711, but it must be readable for all users".
A download now gets the mode its umask gives a new file, and the AppDir is
made a+rX before it is packed. tests/releaseDownloads.test.cjs fails on the
old fetch.sh with 711 instead of 755 and checks that a stricter umask is
still followed; tests/appImageRuntime.test.cjs pins both.
Thanks to xet7 !
Since Board Settings / Card became the card's Card Settings (52de57c844),
the Card Draggable table is in the Card section's hamburger, not in the
popup, so board-drag-settings.e2e.js failed in every language waiting for a
table that is no longer there. It opens Card the way the cog menu does and
then that hamburger, as board-settings-columns.e2e.js already does.
Thanks to xet7 !
F02 F06 reset three cards to sort 0 in the database and waited only for the
minicards to show in id order. gamma 0, alpha .125, beta .25 already is id
order one time in six, so the wait passed while the client still had the old
sorts, the move was computed from them, and the card landed last instead of
second (1 in 3 runs here). The test waits for the client's own copy of all
three cards to read sort 0; 8 repeats pass.
Thanks to xet7 !
ReplyBleed is one Problems row per source, and the webhook's source is the
client address, so the bounce and board-address tests leave rows of their
own in the test database, which persists between runs. The test's findOne
picked one of those (source "ses"), whose count the spoofed reply never
moves, and failed although the attempt was recorded under 127.0.0.1. It sums
the count over all ReplyBleed rows, the way emailBounces.tests.js already
does.
Thanks to xet7 !
mac-smoke-app.py checked that a killed descendant was gone with ps, which a
sandboxed macOS app may not run; it waits for os.kill(pid, 0) to find the
process gone and uses ps only to tell a zombie from a live one. macosSandbox
skips its live sandbox-exec check only when even an (allow default) profile
cannot be applied, which is the case inside the sandbox it is testing.
Thanks to xet7 !
Whether a Launchpad build log belonged to the current attempt was decided by
[ "$log" -nt "$attempt_marker" ] alone. bash 3.2 compares whole seconds, so a
log written in the marker's second was not "newer": it was neither printed
nor checked for an infrastructure failure. this_attempts_log() counts a log
whose name did not exist when the attempt started, or one rewritten after the
marker; an earlier attempt's untouched log still does not count. Used by
infra_failure() and by the log printing, and tested for all three cases.
Thanks to xet7 !
hashlib.file_digest is Python 3.11+ and Path.write_text(newline=) is 3.10+,
so releases/bun/assets.py failed with AttributeError/TypeError on macOS's
python3 3.9. It hashes in chunks and writes the LF-only .sha256sum through
open(newline='\n'), and the test still pins LF on every platform.
Thanks to xet7 !
In a sandboxed macOS app ps fails with "operation not permitted", so every
live conformance run looked dead and a second run would remove its
containers. command_line_of() falls back to pgrep -lf, which still works
there. The test pins the fallback.
Thanks to xet7 !
A Node.js linked to OpenSSL 4 reports an AES-GCM tag mismatch as
ERR_OSSL_BAD_DECRYPT ("bad decrypt") instead of OpenSSL 3's "Unsupported
state or unable to authenticate data", so decryptFile() let the raw OpenSSL
error through instead of "An encrypted backup file has changed or the key is
wrong". Both are recognised now; tests/continuousBackupEncryption.test.cjs
passes with OpenSSL 4.1.0 and 3.5.9.
Thanks to xet7 !
A researcher who sent a report to security@wekan.fi, or some other way, and
is later able to add it as a GitHub security advisory: the maintainer
requests the CVE through that GHSA, and the Hall of Fame row's 3 stars
become 5. SECURITY.md says so to researchers. CLAUDE.md and AGENTS.md tell
an AI updating or auditing the Hall of Fame to check each such 3-star row
against the advisories, match by the report's subject and reporter, and
upgrade the index row, its own page, the CVE cell, the Process cell and the
star audit together.
Thanks to xet7 !
The scoped importer, reached by POST /api/import/zip and the importScoped
method, authorized the import on boardId alone. The listId and swimlaneId
beside it were written onto the new cards as given, and a cardId was looked
up with no board filter, so a writer of board A could create cards on A
whose list and swimlane were board B's, and could probe whether a card id
existed on a board they cannot see.
Before anything is written, the list, swimlane and card are now looked up
together with the board's id; an id of another board is refused (400 over
REST, error-import-placement from the method), with the same answer for a
foreign card and a missing one. Cards are placed only by what was found on
the board. A refusal is recorded in Admin Panel / Problems as
ImportPlacementBleed (authz.import-placement), without blocking the account.
Tests: the decision with the reporter's ids, the check before every write,
a negative scan for a target id written or looked up without the board, and
a browser test of the reporter's attack by both routes, which fails on the
previous code.
Thanks to Zachariah Mithani (AploSec) and xet7 !
The planner needed recover, so one job failing again in the rerun of the
full release skipped the planner and every build after it, and assets that
could be filled were not. For v12.68 the rerun failed on four Launchpad
snaps (503 / timeout) and on the OpenBSD bundle, whose start-wekan.sh fault
is in the tagged code and so in every rerun of it. The planner now runs
unless the run is cancelled, and each job after it checks the planner's own
result, since an implicit success() also counts recover. recover stays red
and now names the jobs that failed again.
Thanks to xet7 !
Meteor 3's server Accounts.createUser is createUserAsync. inviteUserToBoard
called it without await, so the new user's id was a Promise; findOneAsync
read the Promise as the empty selector {} and returned the FIRST user,
usually the site administrator. That user was added to the board and got
the invitee's language and invitedBoards, while the invitee was created but
not added. It was not FerretDB: any database did the same.
createUser and sendEnrollmentEmail are awaited (an enrollment email that
fails is logged, as the invitation email is), and the user found must be
the one just created. Every server ReactiveCache getter now refuses a
Promise as its id or selector, so a missing await fails loudly instead of
picking the first document. Tests: the guard and the reporter's case in
memory, a scan that no server file calls an async Accounts API without
await, and a browser test that inviting a new address adds exactly that new
account - it fails on the previous code.
Thanks to momosari and xet7 !
Fixes#6831.
A History row of a date-valued custom field held datePaths as an array of
path arrays, [["3","value"]]. FerretDB v1 does not store an array inside an
array, so on FerretDB the change was not recorded, and migrateTextDatabase
to FerretDB dropped those rows while it swallowed the per-document error and
still reported success.
Each path is now a JSON string, '["3","value"]'. Rows already written in
the array form on MongoDB still restore, and the migration to FerretDB
rewrites them to strings. The migration counts every document the target
refuses and ends as failed with the count per collection and the first
error, instead of success: true.
Thanks to vijlautens and xet7 !
Fixes#6832.
OpenBSD's sysctl prints nothing and exits 0 for a name it does not have, so
`sysctl -n hw.memsize || sysctl -n hw.physmem` stopped at the empty
hw.memsize and $(( / 1048576 )) ended start-wekan.sh before WeKan answered.
Both start-wekan.sh copies now try hw.memsize, hw.physmem64 (NetBSD, whose
hw.physmem is 32-bit) and hw.physmem in turn and take the first numeric one.
The test runs the lines against fake OpenBSD, NetBSD and macOS sysctls, and
shows the old chain failing on the OpenBSD one.
Thanks to xet7 !
The opened card and the minicard now draw Card Settings' sections, in
Card Settings' order, each section's fields in the order of its rows:
- Section order is per side: cardSettingsSectionOrder for the card,
the new minicardSettingsSectionOrder for the minicard. A board that
stores none: the card starts with Labels, Date, Members, Card, ...
(the card's historical order as far as the grouping allows), the
minicard with what it drew first before.
- CARD_LAYOUT's and MINICARD_LAYOUT's reorderable sections are Card
Settings' sections, so dragging a section or a row in Card Settings
moves it on the card or the minicard. Stored field orders map: a
field keeps its place relative to the others of its new section.
- On the card every section has the shared heading (its icon, title,
caret and hamburger) - Voting and Planning Poker too, which had a
heading of their own. The minicard stays compact: no headings.
Card Settings shows both sides at once: the minicard's pane first (on
the left), the card's second, each with a caret that folds it, each
scrolling on its own, stacked when the popup is too narrow for two.
The Show radio is gone. A splitter between the panes changes their
widths by dragging, like spreadsheet columns (clamped, kept per user
as a fraction, reset by a double-click, moved by the arrow keys). The
popup is wider again for two panes and its corner grip resizes it,
the panes following.
A hamburger's content opens under its line inside the pane, not in a
popup: the hamburger shows it is open (aria-expanded, highlighted, the
panel attached to it); its button, the panel's X or Escape closes it.
A custom field's edit form and the + create form open inline the same
way and close only their panel when saved. The popup layer added in
9c9742e09d is removed, as nothing uses it now.
Docs: Card-Settings.md, Card-Fields.md and Board Settings / Card.md.
New tests cardSectionsOnCard, minicardSections, cardSettingsSplit,
cardSettingsInlinePanels and card-settings-sections-order.e2e.js; the
guards of the old layouts and orders say why they changed.
Thanks to xet7 !
A hamburger of Card Settings opened its menu in Card Settings' place:
the popup slid to the menu and Card Settings disappeared until its back
arrow. Its menus, and the forms it opens (a custom field's edit form,
the + under Custom Fields, Subtask settings), now open as a popup
LAYER: on top of Card Settings, next to the button that opened them,
with Card Settings visible under it and scrolled where it was.
Popup.open(name, { layer: true }), from inside a popup, pushes the
layer on the stack as before, so Popup.back() - the layer's X, Escape,
a form's Save - closes the layer alone. The popup template draws the
popup under it with the layer on top, outside the scrolling content;
depth counts the sliding popups only, so a confirmation opened from a
layer still slides. One layer at a time: another replaces it, its own
button closes it, a press elsewhere in the popup closes it.
A layer opens toward the middle of the popup: a hamburger at the end of
a line gets its right edge, the + on the left its left edge, so the
create form no longer ran out of the popup's left side where its Save
could not be clicked; below the button, or above when there is more
room, its height and width capped to the room
(models/lib/popupLayerPosition.js). A menu's checkboxes start at its
edge rather than .check-div's form indent.
tests/popupLayer.test.cjs runs the placement and pins the Popup wiring
and that every Card Settings menu opens as a layer;
card-add-fields.e2e.js checks Card Settings stays visible under the
menu, the menu sits by its button, toggles, closes on a press elsewhere
and by its X alone, and that the + form opens inside Card Settings.
Thanks to xet7 !
Card Settings is now only Board Settings / Card. The opened card has no
Card Settings button any more: it simply shows every field its board
shows on cards, empty or not.
- On this card, Show empty and Show empty fields are removed, with the
hamburgers' Select all / Select none rows, their handlers, helpers,
board methods (setCardFieldAlwaysShown, setShowEmptyCardFields), CSS
and the three translation keys. The card no longer reads its own
shownFields / hiddenFields, nor the board's cardFieldsAlwaysShown /
showEmptyCardFields; the schema keeps them so old documents validate.
- Every section has a checkbox before its title: whether the whole
section is shown on the chosen side, whatever its rows are ticked.
Stored per side in cardSettingsHiddenOnCard / cardSettingsHiddenOnMinicard
(setCardSettingsSectionShown, board admins). The opened card's view
of the board and a new minicard view read false for every row of a
hidden section, Scrum fields included; Card Settings itself reads the
raw board, so the rows keep their ticks.
- A section with one row on the chosen side is one line: one checkbox,
the name, one hamburger.
- A hamburger is drawn only when it holds something.
- Custom Fields: its items are the board's custom fields, in their sort
order, reordered by drag and drop within the section, with a + under
them that creates one. Show on Minicard sets a field's showOnCard,
Show on Card its alwaysOnCard; its hamburger edits the field. The
section's checkbox is the board's Custom Fields flag of that side.
- Card actions (Filter: Subtasks, Edit voting, Card kind, ...) live in
the card's own section hamburgers; Card Settings keeps only board
actions.
Docs: docs/Features/Cards/Card-Settings.md replaces
Card-Settings-On-Card.md; Card-Fields.md and Board Settings / Card.md
rewritten. New tests cardSettingsSectionShown and
cardSettingsCustomFields; the guards of the removed behaviour say why
they changed; card-add-fields.e2e.js covers section hiding per side, an
empty card showing every field, empty hamburgers, the one-row line, the
Custom Fields items and +, and that the opened card has no Card
Settings.
Thanks to xet7 !
On the rows of Card Settings - on the opened card and in Board Settings /
Card - and in their hamburgers' popups, a checkbox touched its label:
the rows' grid had lost its column gap with the old pane's CSS, and a
hamburger's option put the box and the text side by side with none.
Both now have a space's width (0.3em) between them.
A ticked box still touched the label, because a tick is drawn rotated
and reaches about 3px past its box. Left to right it is drawn 3px
further left, so a ticked box keeps the same space and the label does
not move when it is ticked; right to left the tick leans away from the
label and stays as it was.
tests/cardSettingsOnCard.test.cjs pins the gaps and the tick rule, and
card-add-fields.e2e.js measures at least 3px for ticked and unticked
boxes on the rows and in Card's hamburger, with every label in the same
place.
Thanks to xet7 !
Board Settings / Card had its own layout: an Admin Panel left menu of
sections and a pane with two lists, column headings and per-column Select
all. It now renders the same template as the opened card's Card Settings
(cardSettingsInline), with no card: Show on Minicard / Show on Card, the
sections as checklists, their rows as the items, and the same section and
row hamburgers. The popup's header is the title and the close button, so
the inline's own title and X are not drawn there, and a row's hamburger
has no On this card. The popup is 600px wide, about an opened card,
instead of 1200px.
The popup no longer registers the Card Settings handlers itself: the
template inside it does, and registering them on both would handle every
click twice. The left menu, the pane, the column Select all, the
in-place action forms and the personal-only mode are removed with their
helpers and CSS. A non-admin sees what a card shows them: the board's
rows disabled, their own rows (Labels text, List title) usable.
Dragging, on the card and in Board Settings / Card:
- With drag handles on, a row or a section is dragged only by its
handle; the rest of the line scrolls the page. With them off, by its
icon and name.
- A row dropped on another section goes back where it was and nothing
is saved: the sections are unrelated kinds of fields. jQuery UI fires
a delayed "out" just before "stop", so where it was dropped is read
in beforeStop.
Found while testing both open at once:
- Each Card Settings has its own Show radio group name; one name made
the card's and the popup's radios one group.
- A section hamburger's Select all acts on the Card Settings it was
opened from.
- Rows are keyed, so switching Show moves each row with its side instead
of relabelling rows in place a flush before they reorder, when a
click could land on the neighbouring field.
Docs: Card-Settings-On-Card.md, Card-Fields.md and Board Settings /
Card.md. The node guards that pinned the old layout now pin the shared
template, with negatives that the old layout and the double handler
registration are gone; card-add-fields.e2e.js compares the two views
section by section and row by row on both sides, and tests the drag
rules, and the specs that drove the old pane drive the new one.
Thanks to xet7 !
Three Southern Sotho strings called a data field "masimo", which means
farm fields: Show empty fields in Card Settings, the five fields of a
cron schedule, and the webhook's optional fields. They now use
"dikarolo", the word the file already uses for card and custom fields.
sesotho-popup-titles.e2e.js, which checks that Card Settings names data
fields as such, now reads Card's "Show empty fields" in Board Settings /
Card and caught the first. The cron and webhook wording is low
confidence; a Southern Sotho speaker's correction on Transifex replaces
it.
Thanks to xet7 !
meteor update --release 3.6-rc.1 failed with "No version of
shell-server satisfies all constraints" (and the same for
dynamic-import, allow-deny, ddp-server, facebook-oauth and
google-oauth): those six are WeKan's forks in packages/, made because
Meteor 3.6-rc.0 lacked the 3.5.3 security fixes, and pinned to rc.0's
versions.
Meteor 3.6-rc.1 carries the security fixes of 3.5.3 and 3.5.4, but not
what is WeKan's own in the forks: the Admin Panel / Problems reports of
refused attempts, and the crypto-RNG keys of dynamic-import and meteor
shell (rc.1 still makes them with Math.random()). So the forks are kept
and rebased: each is rc.1's package with WeKan's changes over rc.0's
package merged three-way onto it. The 3.5.3 hunks merged away, as rc.1
has them; what remains over rc.1 is only the hooks and the keys. The
versions are rc.1's with a _1 wrap number.
@meteorjs/rspack moves to 3.0.0-rc.2 with the release. The Dockerfile's
METEOR_RELEASE and the snap description follow. The experimental Bun
build's Meteor patch applies unchanged to 3.6-rc.1; prepare-meteor.sh
now checks for rc.1's tag commit and applies meteor-3.6-rc.1.patch, and
the rc.0 copy is removed.
tests/meteor353SecurityFixes.test.cjs and meteorForkRandomKeys.test.cjs
are moved to rc.1 with their assertions kept;
meteor-353-security.e2e.js passes on rc.1 in Chromium and Firefox.
Thanks to xet7 !
tests/cardShownFields.test.cjs still pinned the Scrum filter of the
opened card's sections as it was before #6830, which now requires the
board's Scrum visibility before asking the card.
Thanks to jullbo and xet7 !
A rebase rewrote the commits these entries link to, so the links named commits
that no longer exist and would have 404ed on GitHub. Repointed by
releases/fix-changelog-hashes.sh, which only touches a link no ref in this clone
can reach.
Thanks to xet7 !
With Board Settings / Card's "Show empty fields" on, every opened card
showed the "Scrum settings" heading and its sections although Board
Settings / Scrum had none of its fields turned on. The Scrum fields are
the card's only sections with no board flag in the template, and
orderedSectionsOf asked only whether the card shows the field, which
Show empty fields answers yes for every field. A Scrum section now
needs the board's Scrum visibility (boardAllows) first, as Members,
Vote and Poker already do.
Thanks to jullbo and xet7 !
Fixes#6830.
The opened card's "+ Add" button is now "Card Settings". Clicking it no
longer opens the Board Settings / Card popup: the button and everything
below it on the card are replaced by Card Settings itself, until the X at
the end of its title puts the card back. Top to bottom:
- Card Settings, with its X (close) at the right of the title.
- "Show" and two radio buttons, Show on Minicard and Show on Card, which
choose what the checkboxes below are.
- The sections (Card, Date, Time, ... Comments) drawn like checklists: the
section is the checklist's title, with a count of the ticked rows and a
hamburger; its rows are the checklist items. An item's checkbox is the
board-wide Show on Card or Show on Minicard of that field.
- A row's hamburger holds On this card and Show empty; a section's holds
Select all / Select none of each column, the section's card actions and,
for Card, Show empty fields, Ask for a reason and the Draggable table.
Sections and rows reorder by drag and drop like checklists and their items,
and by the Up and Down keys. A section's order is the board's new
cardSettingsSectionOrder (normalised by sectionOrder() in
models/lib/cardSettingsSections.js); a row's is the card's or minicard's
field order, as in the popup. Sections collapse like checklists, kept per
user and board. The rows, checkboxes and handlers are the popup's, shared
rather than copied, and Board Settings / Card still opens the popup.
Design: docs/Features/Cards/Card-Settings-On-Card.md.
New strings: "Show" (card-settings-show) and the two hamburgers' titles,
"Actions". Every language takes its existing translation of the same
words; "Show" was written directly, with low confidence, for an, ary, bi,
csb, cy, cy-GB, fur, hsb, hy, jv, ka, kk, km, km-KH, km_KH, kok, lb, lld,
mai, mn, oc, or_IN, pa, sc, sn, so, szl, te-IN, tg, tk_TM, tl, tpi and tt.
Tests: tests/cardSettingsOnCard.test.cjs (the order rules, the layout, the
shared handlers, the translations) and
tests/playwright/specs/card-add-fields.e2e.js rewritten for the card's Card
Settings, the popup's own tests now opening it from Board Settings. The
guards that pinned the card template's indentation and the old opener say
why they changed.
Thanks to xet7 !
customfield-dead-board counted every custom field that names a deleted
board, but its Repair only removes dead boards from a field that is also on
a live board; a field whose boards were ALL deleted was skipped on purpose,
since removing them would leave it on no board. So those fields stayed in
the count with a Repair button that could never change it: one instance
showed 510 and "Repaired: 0" after every click.
- New check customfield-boards-deleted: fields whose boards no longer exist
(through boardIds or the legacy boardId). No existing board shows them.
Repair deletes the definitions after the confirming second click, like
the other repairs that delete data. A value a card on a live board still
holds is left alone and stays listed under card-dead-field-values.
- customfield-dead-board counts only fields that still have a live board,
so its count goes to zero when its Repair has run.
docs/Features/Admin-Panel/Problems/Data-Health.md lists the new check.
Test: tests/dataHealth6818.test.cjs.
Thanks to Raymond-Voogt and xet7 !
Fixes#6829.
The page listed Trello's Email Inbox, Complete Card Checkbox, Workspaces,
Butler scheduled and repeating tasks and Card Repeater as not yet in WeKan,
and Sync Lists and Map Card as WeKan ideas not yet implemented. Each now has
the WeKan release that added it: Workspaces v8.17 (2025-11-06), the complete
checkbox and card location v9.42 (2026-06-13), Scheduled Rules and recurring
cards v9.46 (2026-06-15), list sync v11.69 (2026-09-11), the Map view v12.10
(2026-09-29) and Email to card v12.40 (2026-10-14). The links to the 2018 and
2021 releases point to old-CHANGELOG/, where those sections are now.
Thanks to xet7 !
A list's Add card form stayed open after a card was added, for the next
card, which the reporter found unexpected. It now closes once the card - or
every card of a multi-line paste - is added. Member Settings has a new
switch, "Keep the Add card form open after adding a card", off by default,
for who types several cards in a row. The close happens after the last
title, not at submit, because addCard still reads the form between the
titles of a paste; a failed add keeps the form and its text.
The two new strings are translated into every locale. Low confidence: ace,
ak, am, an, ary, as, ast-ES, ay, ba, bho, bi, bm, bo, br, bua, chr, ckb, co,
csb, cv, dz, ee, ff, fj, fo, fur, gn, gv, ha, haw, hsb, ig, iu, kl, kok, ks,
kw, lb, lg, lld, mai, mg, nah, nap, nd, nso, ny, om, or_IN, pap, ps, qu, rn,
rup, rw, sah, sc, scn, sd, se, sm, sn, so, ss, st, szl, ti, tig, tlh, tn,
to, tpi, ts, uz-AR, ve, ve-CC, ve-PP, vo, wa, wa-RR, wal, wo, wuu-Hans, zgh.
tests/keepAddCardFormOpen6827.test.cjs pins the switch, its default and
where the form is closed, with negative cases for a paste and a failure.
tests/playwright/specs/keep-add-card-form-open-6827.e2e.js drives it: closed
after one card and after a paste, kept open with an empty title once the
switch is on. multiline-titles opens the form again for its second card, and
assist-due-from-title keeps it open to check the next card's form has no
leftover hint.
Thanks to brlin-tw and xet7 !
Fixes#6827,
tests/bunSmokeMongo.test.cjs required the workflow's docker run to say
mongo:8, the floating tag that refused to start on the runner's 6.19+ kernel
in v12.66. It now requires mongo:9.0.4, and fails if mongo:8 comes back.
Thanks to xet7 !
linux-x64: mongo:8 refused to start on the runner's kernel ("Linux kernel
versions 6.19 and newer has a known incompatibility"). The smoke test pins
mongo:9.0.4, which recognises Ubuntu kernels that have the fix
(docs/Databases/Supported.md).
linux-arm64: Chromium was installed into ~/.cache/ms-playwright, while
build-target.sh loads tools-env.sh, which points Playwright at
.tools/ms-playwright, so the browser smoke test found no browser. The install
step uses the same path.
Thanks to xet7 !
tools-env.sh made .tools/tmp only in a git checkout or where .tools already
existed, so that scripts mounted alone into a container (/releases) do not
make a /.tools there. The wekan-ondra and wekan-gantt-gpl snaps build from a
copy of the tree without .git (/root/project), so tools-env.sh found no
TMPDIR, and every fetch.sh in snapcraft.yaml stopped at "TMPDIR: unbound
variable" - reported as the Caddy download failing (v12.66). A tree with
package.json beside releases/tools-env.sh is a source tree too.
tests/toolsDirOnly.test.cjs sources it under set -euo pipefail with no
TMPDIR in such a copy, and, as the negative case, in releases/ alone, where
no .tools/ is made and no TMPDIR is invented.
Thanks to xet7 !
sandstorm-src/build-deps.sh still built meteor-spk.deps in
~/projects/meteor-spk, and the workflows put that on PATH, while
sandstorm-slim-spk.sh had moved to .tools/projects/meteor-spk with
aeff4900df: "no meteor-spk.deps at .tools/projects/..." and the v12.66 .spk
did not pack. build-deps.sh sources tools-env.sh and defaults to
WEKAN_METEOR_SPK_DIR, and the Sandstorm, Sandstorm store and meteor-spk
workflows use $GITHUB_WORKSPACE/.tools/projects/meteor-spk.
tests/toolsDirOnly.test.cjs scans sandstorm-src/ too, and fails on a workflow
that names ~/projects.
Thanks to xet7 !
The memory budget read _memory_mb=$(awk ... /proc/meminfo) with no fallback
since 1f9ada5599. awk fails where there is no /proc, and under set -eu an
assignment from a failed substitution ends the script without a word, so the
FreeBSD and OpenBSD bundles and the Mac app never started WeKan (v12.66).
It is `|| true` again, and sysctl then gives the memory.
tests/macosShellPortability.test.cjs runs the memory lines under set -eu
without /proc and requires a number, with the unguarded line as the negative
case, and fails on any set -e script with a /proc read in $(...) that has no
fallback.
Thanks to xet7 !
install-node-for-arch.sh refuses to run without TMPDIR, because the
container's own /tmp is a small part of its writable layer.
repack-bundle-for-arch.sh mounts this checkout's .tools/tmp as /tmp and sets
TMPDIR; the workflow's own docker run did not, so armhf, armv6, armv7, i386,
ppc64le, riscv64 and s390x all stopped at "TMPDIR must be the mounted
.tools/tmp" in v12.66, and win32, which builds from the i386 bundle's
Node.js, had nothing to build with.
Thanks to xet7 !
- assist-search-phrases: the feature is turned off in the database, and a
search sent before the browser had the published setting still ran the
phrase. The search is repeated until the browser has it; a phrase that is
never turned off still fails.
- board-settings-columns: a non-admin member's count of 0 passed in Chromium
before the pane had rendered, and in Firefox counted Show on Card's
Select all / Select none, which share the class and are a member's like the
checkboxes under them. It waits for the pane and counts only the board-admin
column actions.
- card-drawing-canvas: a maximized drawing fills the window, so its corner
handle is at x 1236 of 1280 and a drag 120px further was not delivered by
Firefox. The drawing is zoomed out to 80% first, which leaves room.
Thanks to xet7 !
The report lists at most 500 findings and counts the rest. They were listed
first come, first served, so on the test server 14358 baseline-move-candidate
rows of the integrity baseline took all 500, and the extension-mismatch and
mime-mismatch a type check is run to find were only numbers in the totals -
the Firefox stage's file-status-audit.e2e.js failed on it, and an
administrator would not have seen which file it was.
When the list is full, a kind with fewer rows listed now takes the place of
the last row of the kind with the most, so every kind found is listed and the
totals still count all of them. fileStatusAudit.test.cjs: 8 rows are 8
kinds with 40 orphan files crowding them, every finding is listed or counted
as omitted, and with room for all nothing is dropped.
Thanks to xet7 !
The previous fix assumed the Drawing popup grew to its drawing's width and
ran off the window. Measured in the rebuilt app, it did not grow at all:
every popup is min(380px, 55vw) wide, the drawing's min(820px, 90vw) overflowed
inside it and the popup clipped it - the larger pen sizes and Save were cut
off by the popup, not by the window. Its box never changed, so the
ResizeObserver that keeps a movable popup inside had nothing to react to.
popup.css gives the Drawing popup min(860px, calc(100vw - 20px)), not
!important so that maximized `width: auto !important` still wins. Opened from
the card's menu at the right of a 1280px window it is now 860px wide at
x 408, 12px from the edge.
popup-drawing-window.e2e.js waits for the drawing and a box that stays put
before measuring: the Drawing popup is the card menu's popup element renamed,
which for a moment still had the 960px menu's place, and a drag pressed at
that place selected the page's text and closed the popup. The first drag
goes toward the side that has room.
Thanks to xet7 !
Two faults the Chromium stage found, measured in the browser:
- A maximized new drawing was sized to its stage (1212 x 563 in a
1280 x 720 window) but drawn 784px wide. popup.css still had the rule of
the older design that kept the drawing at 800 x 500's shape -
width min(100%, (100vh - 230px) * 1.6), aspect-ratio 8 / 5 - which
overrode the surface's own size. d5d027a6f2 replaced that design; the
rule is removed. (2929b61c85's refit was right, and is kept.)
- Opened from the card's menu at the right of the window, the Drawing
popup grows to min(820px, 90vw) in the same popup the narrow menu was
placed for, and its right part - the larger pen sizes and Save - was
cut off by the window until it was dragged. A movable popup that grows
is now kept inside the window by the rule a drag keeps it there, 12px
from each edge (client/lib/popupBounds.js); not while maximized.
tests/popupBounds.test.cjs drives the bounds and fails on the 8 x 5 rule
coming back; popupMoveMaximize and popup-drawing-window.e2e.js pin the
drawing taking the window when maximized instead of its old shape.
Thanks to xet7 !
c8a15b514f moved the headings' smaller font from the heading line to its
text (.card-settings-pane-head > span, sidebar.css): on the line, the
em-sized columns shrank and each heading drifted off its cells. The
clean-task-boards spec still measured the line, which inherits the
body's 11.2px, and failed in Chromium; it measures the text, 9.6px. All
four clean-board specs pass.
Thanks to xet7 !
client/lib/autofocus.js focused an [autofocus] element whenever a re-render
added one: the LAST [autofocus] anywhere in the document, selecting its
text, 50 ms later - and decided before those 50 ms whether it was already
focused. On the import page, typing the attachment token after pasting a
Jira export moved the focus to the pasted JSON, all of it selected, and the
token replaced it: the import then said "Your text is not valid JSON"
(import-attachment-auth.e2e.js in Chromium). A focus() then select() on the
textarea, recorded in the browser and found at autofocus.js in the running
bundle, showed it.
Now only an [autofocus] element that was itself just added is a candidate,
and whether to focus it is decided when the focus happens: never while
the user is typing in another field (an input, textarea, select or
contenteditable). Opening a popup or a form still focuses its field -
focus is then on the button that opened it, or on a composer field the
re-render removed. client/lib/autofocusDecision.js is the decision;
tests/autofocusDecision.test.cjs drives it with stand-in elements.
Thanks to xet7 !
CardPage._selectBoard asked whether the popup had a boards select with
count(), which answers at once. Asked while the popup was still rendering,
it said 0 - which the helper reads as "a worker, who has no boards
select" - so the move went to the named list of the SAME board, and
#6793's Move Card spec waited in vain for the card's new boardId. A trace
showed it: one select, and that for the list. The helper now waits for
the lists select, which every picker draws, before asking about the
boards one. The #6793 specs and 03-cards-operations (29 tests) pass in
Chromium.
Thanks to xet7 !
Each storage setting (S3, Azure, Google Cloud, WebDAV ...) shows its
description and menu path in English and in the user's language, so the
product's own terms stay recognizable. The English line was typed into
the template a second time above the {{_ key}} line: in English, and in
every language without that translation yet, the same sentence stood
twice in a row - which is also why Playwright's strict getByText found
two and storage-settings-translations.e2e.js failed in Chromium.
The English now comes from en.i18n.json (englishText; all 26 typed copies
were identical to it, so no text changes), and the translated line is
shown only when it differs (translatedDiffers), reactively with the
language. tests/attachmentSettingsBilingual.test.cjs fails on a typed
English twin coming back and on a translation shown unconditionally.
Thanks to xet7 !
Both failed in Chromium on their negative case: an upload onto one's own
card answered 403 "Please sign in to upload.", and a checklist without a
foreign stamp "Access denied". The guards were right. The attempt came
first, and a signed-in account that attempts a vulnerability is blocked
(server/lib/blockOnSecurityEvent.js): loginDisabled, and the page's
session ended - so the legitimate call that followed ran signed out.
Printing Meteor.userId() around the first call showed it.
Each spec now does the legitimate case first and the attempt last, and
checks that the attempt blocked the account (services.securityBlock names
UploadBleed or StampBleed). The stamped checklist comes before the
stamped upload: its refusal names no account, so the user is still
signed in for the upload. Both pass in Chromium.
Thanks to xet7 !
The chart's commented reference of every WeKan setting was copied from
docker-compose.yml by hand once and had fallen 74 settings behind, which
tests/chartsFerretdb.test.cjs reported as soon as .tools/charts was there.
releases/charts-values-reference.mjs regenerates the block from the wekan
service's environment, and release-charts.sh runs it on every chart
release. A comment after a value goes on the line above, not into the
value.
The chart change itself, and the 512 MiB request / 2 GiB limit #6606 had
asked of it, are committed in wekan/charts. All 19 chart tests pass.
tests/chartsValuesReference.test.cjs runs the generator on a temporary
values.yaml: every compose setting written, nothing outside the block
touched, no comment inside a value, and a second run changes nothing.
Thanks to xet7 !
The Windows counterpart of the Linux Flatpak sandbox and the macOS
sandbox-exec one. Windows Sandbox is a disposable Hyper-V virtual machine
that comes with Windows 10 and 11 Pro, Enterprise and Education; it sees
nothing of the host but the folders mapped into it.
- docs/Security/Sandboxes/Windows/sandbox.ps1 (on the host; sandbox.bat
starts it) offers to turn the Windows Sandbox feature on, copies
user.name and user.email into the checkout's .git\config, and writes
.tools\sandbox\wekan-vscodium.wsb: the checkout as the only mapped
folder, read-write at the same path under the sandbox's user; network
on; microphone, camera and printers off; ProtectedClient; half of the
host's memory, 4 to 16 GiB.
- sandbox-logon.ps1 runs inside at logon: TEMP, TMP and TMPDIR in
.tools\tmp, git's configuration in .tools\home, PortableGit and the
VSCodium zip downloaded once into .tools - each verified (VSCodium's
.sha256, the SHA-256 in Git for Windows' release notes) before it is
unpacked - and VSCodium opened on the checkout, its settings and
extensions in .tools\vscodium.
- README.md is the design: what is refused and allowed, how, and the
trade-offs.
Not run on Windows yet: written and reviewed on macOS, where PowerShell is
not available. tests/windowsSandbox.test.cjs reads the scripts and pins
the single mapping, the .tools locations, verification before unpacking,
and that native commands cannot stop Windows PowerShell 5.1.
Thanks to xet7 !
The macOS counterpart of the Linux Flatpak sandbox
(docs/Security/Sandboxes/vscodium). docs/Security/Sandboxes/macOS/sandbox.sh
installs VSCodium with Homebrew when it is missing, writes a Seatbelt
profile for this checkout's path to .tools/sandbox/vscodium-macos.sb, a
Finder launcher beside it, and starts VSCodium under sandbox-exec:
- every file under /Users and /Volumes is refused - the home directory,
~/.ssh, ~/.gitconfig, other users and /Users/Shared, other disks - except
the checkout, and the login session's ssh-agent socket is refused;
- HOME is .tools/home, TMPDIR .tools/tmp, VSCodium's settings and
extensions are in .tools/vscodium, and env -i drops SSH_AUTH_SOCK and an
editor's ELECTRON_RUN_AS_NODE;
- --no-sandbox, because Chromium's own helper sandbox cannot start inside
sandbox-exec ("Operation not permitted"); every helper is inside this
one instead;
- user.name and user.email are copied into the checkout's .git/config,
since ~/.gitconfig cannot be read inside.
Verified on macOS 27 with --check (home, ~/.ssh, ~/.gitconfig and
/Users/Shared refused; the checkout, git and the network allowed) and by
starting VSCodium in it: the window, its helpers and the extension host
ran. README.md is the design: what is protected, how, and the trade-offs.
tests/macosSandbox.test.cjs pins the rules and, on macOS, runs a profile
against a shell.
Thanks to xet7 !
Syncing wekan/wekan cloned the whole GitHub repository - 365,000 objects,
500 MB - into .tools/wekan-github, although it is this checkout
(~/repos/wekan on Linux, ~/Documents/repos/wekan on macOS,
Downloads\repos\wekan on Windows). Only the destination mirrors
(wekan-gitlab, wekan-codeberg ...) need checkouts of their own.
The source's branches and tags are fetched into this checkout instead,
under the private namespace refs/mirror-source/<source>/, which already
holds nearly every object: 1.7 seconds for 1,278 refs, measured. That
namespace is not a branch; the working tree and local main are untouched,
so unpushed local commits never reach a mirror. The fetched refs are
deleted again in a finally, after the push and also when the fetch, the
push or the merge-preserving retry fails.
tests/activeForgeMirror.test.cjs and tests/mirrorGitDirectories.test.cjs
run syncGit against a stand-in checkout (WEKAN_MIRROR_SOURCE_CHECKOUT for
the CLI), assert that GitHub's wekan is not cloned, that only the
destination is, and that the source refs are cleared - also after a failed
fetch.
Thanks to xet7 !
releases\tools-env.bat is the counterpart of releases/tools-env.sh: TEMP,
TMP and TMPDIR in .tools\tmp, npm's cache and global installs, Go's caches
and the Playwright browsers in .tools\, METEOR_WAREHOUSE_DIR at
.tools\.meteor once Meteor is there, and those tools first on PATH, so no
user or system PATH setting has to change. build.bat and every
releases\ batch file call it; the bundle launchers (start-wekan.bat) do
not, as they run a finished bundle where there is no .tools\.
build.bat's install option no longer installs a system-wide Node.js with
Chocolatey: it unpacks the Dockerfile's version from nodejs.org's zip
into .tools\node-v<version>-win-<arch>, verified against SHASUMS256.txt
first, and Meteor goes into .tools\.meteor (LOCALAPPDATA is .tools for the
installer only). build-bundle-win64.bat works in .tools\tmp\win64-bundle-
<version> and says where the zip is. tools-env.sh also keeps Go's caches
and the Playwright browsers in .tools/, as tools-env.bat does.
tests/toolsDirOnly.test.cjs pins tools-env.bat, its callers and the .tools
install; tests/buildScriptParity.test.cjs reads the Playwright directory
and Node.js version from their new places.
Thanks to xet7 !
build.sh and the releases/ scripts wrote all over the machine: temporary
files to /tmp and macOS's /var/folders, downloads and release zips to
~/Downloads or ~/Lataukset, Meteor to ~/.meteor, Node.js to /usr/local
(sudo n) or ~/.nvm, the npm cache to ~/.npm, Volta to ~/.volta, the
Sandstorm toolchain to ~/projects, and PATH lines into ~/.zshrc and
~/.bashrc. A sandboxed editor (Flatpak on Linux, sandbox-exec on macOS)
can reach only the checkout, and a container's own /tmp is a few hundred
megabytes. Everything is in .tools/ now, which git and Meteor ignore:
- releases/tools-env.sh, sourced by build.sh and every script that writes
files, sets TMPDIR/TMP/TEMP to .tools/tmp (also downloads and release
zips), NVM_DIR, npm_config_cache, VOLTA_HOME and the meteor-spk
directory to .tools/, METEOR_WAREHOUSE_DIR to .tools/.meteor once Meteor
is installed there, and puts those tools first on PATH, so no shell rc
file is edited. HOME is not moved: git needs ~/.gitconfig and ~/.ssh.
A TMPDIR already inside a .tools/ is kept, so a test's own directory
there stays its own; without a writable one it stops rather than fall
back to /tmp. It never fails a caller running set -euo pipefail.
- macOS's mktemp ignores TMPDIR when given no template, so every mktemp
names one: mktemp "$TMPDIR/name.XXXXXX". Fixed /tmp files are in
$TMPDIR.
- build.sh installs Node.js on Linux into .tools/n (N_PREFIX, no sudo),
nvm on macOS into .tools/nvm (PROFILE=/dev/null: no rc file edited), and
Meteor with HOME=.tools for the installer only, into .tools/.meteor.
build.sh is replaced, not edited in place, while it may be running.
- Containers get this checkout's .tools/tmp as their /tmp: every
db-conformance database (MariaDB's temporary tables were verified to land
there, and MongoDB's socket) and the repack container, which empty it
themselves before they are removed. install-node-for-arch.sh requires
the mounted TMPDIR.
- tests/run-node-suites.cjs gives every suite TMPDIR in .tools/tmp, and the
tests that copied a script into a fixture copy tools-env.sh too; tests
that pinned ~/.meteor, the rc file edits, sudo n or /tmp/manifest.json
pin the .tools/ places now and say why.
tests/toolsDirOnly.test.cjs runs tools-env.sh against a TMPDIR already
set elsewhere and under set -euo pipefail, and fails on any script that
makes a temporary file without naming .tools/tmp, writes to the home
directory, or edits a shell rc file, or on a container whose /tmp is its
own.
Thanks to xet7 !
The checkout is at ~/repos/wekan on Linux, ~/Documents/repos/wekan on macOS
and Downloads\repos\wekan on Windows (CLAUDE.md). release.sh,
release-bundle.sh, release-snap.sh, release-sandstorm.sh, release-cleanup.sh,
install-sandstorm.sh, node-update.sh, docker-push-gantt.sh, up.sh and
rel.sh hard-coded Linux's ~/repos/wekan (rel.sh also /home/wekan/repos), so
on a Mac they cd'd into nothing - or into a stale copy - and edited or
packed the wrong tree. Each finds the checkout from its own location now
(REPO_DIR, as mirror.sh already did), which is right on every system; the
parent directory is $(dirname "$REPO_DIR").
DOWNLOAD_DIR defaulted to ~/Lataukset, the Finnish Linux name of Downloads.
macOS keeps ~/Downloads in every language, so it is Lataukset where that
exists and Downloads otherwise.
The VirtualBox appliance scripts keep /home/wekan: that image is a Linux VM
with its own fixed layout. tests/repoLocationPerOs.test.cjs pins the three
locations in CLAUDE.md and AGENTS.md and fails on any script that
hard-codes one system's checkout path or assumes Lataukset.
Thanks to xet7 !
wekan.fi, charts and docker-cleanup-volumes used to be checked out in ../w/
beside the repository, and several places kept that as a fallback after
they moved to .tools/ (CLAUDE.md). With no .tools/wekan.fi, the Hall of Fame
tests read a stale ../w/wekan.fi and failed on markup the site no longer
has.
- tests/hallOfFameProblemsCoverage.test.cjs and
tests/fixedVulnerabilityClasses.test.cjs read only .tools/wekan.fi (and
skip, saying so, when it is not there).
- release-charts.sh, backfill-charts.sh, reindex-charts.py and version.sh
look for the charts checkout only in .tools/charts.
- docker-build.sh clones and runs docker-cleanup-volumes in .tools/.
tests/noLegacySiblingRepos.test.cjs fails when a script, test or document
under releases/, tests/, docs/ or tools/, or at the root, looks in ../w/
again; tests/reindexCharts.test.cjs now requires ../w/charts to be gone.
Thanks to xet7 !
A Node.js can be compiled without single executable applications - the
Homebrew one on macOS is - and `node --build-sea` then only says "Single
executable application is disabled" and exits 9, which the build
reported as a bare failed command. build.mjs asks first (seaSupported) and
stops with what to do: build with a Node.js from nodejs.org, given with
--host-node.
tests/singleFile.test.cjs skips the end-to-end build on such a Node.js
and says why, tests seaSupported against stand-ins of both kinds, and
expects the 32-bit refusal to name the host's own arch - it expected
"x64", so it failed on an arm64 Mac.
Thanks to xet7 !
macOS and the BSDs have no /proc.
- releases/db-conformance.sh decided whether a container's run was still
going from /proc/<pid>/cmdline. On a Mac every live run looked dead, so
a second conformance run removed the first one's containers and
networks. The command line comes from ps -o command= where there is no
/proc (tests/dbConformanceStaleContainers.test.cjs passes on macOS now).
- start-wekan.sh and releases/ferretdb/start-wekan.sh sized the Node.js
and FerretDB heaps from /proc/meminfo, so on a Mac they assumed 2 GiB
whatever the machine had. They ask sysctl hw.memsize (macOS) or
hw.physmem (BSD) there, as build.sh already did.
- releases/debug-speed-watch.sh shows the load average from sysctl
vm.loadavg where there is no /proc/loadavg.
tests/macosShellPortability.test.cjs fails on a /proc memory, load or
command-line read without such a fallback (the Docker entrypoint, which
runs only on Linux, excepted). releases/nextcloud-pack.sh is listed in
tests/buildScriptParity.test.cjs as run by nextcloud.yml.
Thanks to xet7 !
tests/stripNode.test.cjs built its ELF fixture with `gcc`, which on macOS
is clang and writes a Mach-O, so the section reader found nothing and the
test failed with "the fixture has symbols and debug data". The ELF cases
now skip unless the compiler really wrote an ELF, and a new case runs
releases/strip-node.sh on a real Mach-O where there is a Mac: the local
symbol is gone, the exported one stays, the binary is re-signed ad hoc,
passes codesign --verify --strict and still runs.
Thanks to xet7 !
Started from zsh on macOS, a script gets bash 3.2 as /bin/bash and BSD
tools. Every .sh at the repository root and under releases/ was checked
with bash 3.2 and for GNU-only tool options; what failed:
- test-menu.sh: declare -A (bash 4) is a case function, runner_for, and
an empty match list no longer trips set -u in bash 3.2.
- releases/ferretdb-latest-tag.sh: with no GitHub token, "${auth[@]}"
was an unbound variable under set -u in bash 3.2; it uses
${auth[@]+...} as ferretdb-asset.sh already did.
- find-replace.sh: never worked anywhere ('$1' in single quotes searched
for the text $1) and used GNU grep -Z and sed -i. It replaces literal
text with perl now, skipping the directories find.sh skips.
- sha256sum (missing on older macOS) falls back to shasum -a 256 in
release-x2.sh, repack-bundle-for-arch.sh, install-node-for-arch.sh and
sandstorm-capnp-schemas.sh; -c works with both.
- sandstorm-capnp-schemas.sh: nproc falls back to sysctl hw.ncpu, and
sed -i takes a .bak suffix (GNU and BSD alike) that is then removed.
- sandstorm-slim-spk.sh: ln -sfT is ln -sfn, stat -c%s is wc -c.
- virtualbox/ipaddress.sh: ifconfig where there is no ip.
tests/macosShellPortability.test.cjs parses every bash script with
bash 3.2 when /bin/bash is 3.x, and fails on any of these shapes coming
back: associative arrays or mapfile, flock without a fallback, tar
--transform, a GNU-only sed -i, sha256sum / nproc / ip without a
fallback, ln -T or stat -c.
Thanks to xet7 !
The UCS App Center preinst hook locked with flock(1), which is util-linux
and missing on macOS and the BSDs, so tests/ucsMigration.test.cjs could not
run the hook there ("flock: command not found"). Without flock it now takes
the same lock with perl's flock() on the inherited fd 9: a flock(2) lock
belongs to the open file, so it is held until the hook closes fd 9, exactly
as flock -n 9 holds it. Verified: a second locker is refused and the lock
frees when the first one closes. perl is on UCS (Debian) and macOS.
The Nextcloud ExApp archive was packed with GNU tar's --transform, which
bsdtar (macOS, the BSDs) does not have. releases/nextcloud-pack.sh copies
the source under a staging <app-id>/ and packs that directory, with the
same exclusions, using only options both tars share; COPYFILE_DISABLE=1
keeps macOS tar from adding ._* AppleDouble files. The workflow and
tests/nextcloudRelease.test.py both use it, and
tests/ucsNextcloudWorkflows.test.cjs fails if --transform comes back.
Thanks to xet7 !
card-settings-both-sides read row[side].needsCard for every row, but six
rows have no minicard side by design (suggested members, checklist from
description, attachment previews and details, Drawing, action items), so
it threw "Cannot read properties of undefined". It expects what
rowsForSide lists now: rows that have the side, less the card-only List
title.
The Scrum settings title spec read the pane title right after clicking
Scrum. Card Settings opens on Card now, so it read "Card" and failed on
the "Card button" label. It waits for the pane title to be Scrum's menu
name first.
Both failed in the Chromium stage of the 2026-10-27 EVERYTHING run.
Thanks to xet7 !
API JSON uploads and the site logo stored again, the validate-and-move
method moves again, REST card placement checked, WIP limits admin-only,
AuthBleed attempts recorded and Data health's "Never" with a key of its
own - each removed from TODO Later now that its fix is in Upcoming. The
browser runs and WebKit stay there.
Thanks to xet7 !
The applyWipLimit, enableWipLimit and enableSoftLimit methods have always
required a board admin ("You must be a board admin to modify WIP
limits."), but a member with write access could still set wipLimit with a
plain list update - the Lists allow rule grants write members every field
- or with REST PUT /api/boards/:boardId/lists/:listId. A WIP limit is a
board-wide workflow rule, so the methods' rule now holds everywhere:
- a Lists deny rule refuses an update touching wipLimit unless the caller
is admin of the list's board. Every WeKan client path goes through the
methods, so it refuses nothing in ordinary use;
- the REST PUT asks for a board admin (checkBoardAdmin) when the body
carries a wipLimit; write access still edits title, color and starred.
tests/wipLimitAdminOnly.test.cjs runs the real deny rule, pins the REST
check before the write, and fails on any list method that changes a WIP
limit without a board admin check first.
This was in CHANGELOG TODO Later as needing a maintainer decision;
decided: board admins only.
Thanks to xet7 !
linkedWritePolicy sliced POST cards' linked-card branch up to the getCard
that #6823 removed, so the slice ran to the end of the file and found
checkBoardAccess elsewhere; it ends at the branch's author-spoof note now,
and fails if that is missing. webhookBleed (GHSA-7w2h-g83c-jqrp) pinned
copyBoard's signed-out refusal as one line; it records an AuthBleed
attempt first now, so the guard accepts the block and still requires the
refusal before the board is read.
Thanks to xet7 !
The Data health status line ("Last Run: Never") reused List Sync's
list-sync-last-synced-never, so a translator who words that one as "never
synced" would make Data health read wrong. It is data-health-never-run
now, added after data-health-repair with add-pending-keys.mjs
--all-locales (the completeness suites require every locale to carry
English's keys in order) and listed in pending-transifex.json.
Every locale already translates the identical English "Never" under
list-sync-last-synced-never; fill-translations.mjs --apply filled the new
key from that in 234 locales, writing only the English placeholders. A
real Transifex translation still replaces it on the next pull.
This was in CHANGELOG TODO Later as needing a maintainer decision.
Thanks to xet7 !
copyBoard, copyCard, copySwimlane and createCardWithDueDate - four of the
AuthBleed methods - refused with plain not-authorized errors, so an
attempt left no trace in Admin Panel / Problems. AuthBleed was on the
PENDING list of tests/hallOfFameProblemsCoverage.test.cjs.
A new catalog key, authz.copy (AuthBleed, high, CWE-862), is recorded
where no legitimate client can be:
- a signed-out caller of any of the four - no WeKan client copies while
signed out, and with no userId nobody can be blocked;
- any refusal of createCardWithDueDate, which no WeKan client calls.
The membership refusals of copyBoard, copyCard and copySwimlane are
deliberately NOT recorded: a member who is not admin of a shared or
default board template, or a stale Copy Card / Copy Swimlane dialog,
reaches them in ordinary use, and a high-severity record naming the
account disables that login (server/lib/blockOnSecurityEvent.js). Each
record is wrapped so logging cannot break the guard.
tests/authBleedCopyMethods.test.cjs runs the real method bodies and pins
both: what is recorded, and that the ordinary-use refusals are not.
AuthBleed leaves the PENDING list.
This was in CHANGELOG TODO Later as needing a maintainer decision.
Thanks to xet7 !
The JSON branches of REST /api/attachment/upload, upload-background and
copy, their Meteor-method twins in server/attachmentApi.js, and Admin
Panel's site logo upload created the file with Attachments.insertAsync.
Meteor-Files (ostrio:files 3) has insertAsync only on the client; on the
server it is not a function, so every one of them failed - a REST 500
"Attachments.insertAsync is not a function". Only the multipart branches,
which use addAttachmentFromStream, worked.
All seven store with writeAsync(buffer, { fileName, type, userId, meta },
true) now, as email-to-card and the importers already do. Its
after-upload hook validates the file - type, size and the external
scanner, which these paths skipped - and moves it to the default storage,
or to meta.copyStorage for a copy, so the second deferred moveToStorage
each branch made is removed. The file records who stored it.
tests/attachmentApiServerWrite.test.cjs pins the seven calls and fails on
any server-side Attachments.insertAsync or Avatars.insertAsync.
This was in CHANGELOG TODO Later as needing a maintainer decision; the
site logo upload was found by the new test's tree-wide check.
Thanks to xet7 !
After validating, the method moved the file from Meteor.defer by calling
the moveAttachmentToStorage method. A deferred call has no method
invocation and so no userId, and that method's first check is "You must be
logged in.": every move was refused, the error went nowhere, and the file
stayed where it was.
Every check moveAttachmentToStorage makes - a site admin, the board
visible, the destination on the allowlist - is made by this method before
the defer, so the deferred step now calls moveToStorage itself, as the
upload path already does, and logs a failure instead of dropping it.
tests/moveStorageBleed.test.cjs pins it; its existing guard still requires
the admin check and the allowlist before every caller-named move, and a
new one fails on any Meteor.defer or Meteor.setTimeout in server/ or
models/ that calls a Meteor method.
This was in CHANGELOG TODO Later as needing a maintainer decision.
Thanks to xet7 !
POST /api/boards/:boardId/lists/:listId/cards and its bulk sibling wrote the
URL's listId and the body's swimlaneId onto the new card without checking
either against the board. A list or swimlane id of ANOTHER board gave a
card that pointed at a list and a swimlane its own board does not have -
the #6572 shape, a card that shows on neither board - and the list
permission check was evaluated against the wrong board's rules. The PUT
route has refused this since #6572; the create routes now do the same with
a 400 that names the field, and the bulk route reports it per entry. An id
that is not a string (such as { $ne: null }) is refused rather than looked
up. The linked-card branch was already checked by createLinkedCardFor.
tests/restCardPlacement.test.cjs pins both routes and fails on any REST
handler in server/ that inserts a card without the check.
This was in CHANGELOG TODO Later as needing a maintainer decision; the PUT
route's #6572 rule already decided it.
Thanks to xet7 !
The six fixes from Raymond-Voogt's reports #6821-#6826. CHANGELOG.md went
over its 450,000-byte budget with them, so v12.40 is moved to
old-CHANGELOG/2026/10.md by releases/changelog-archive.mjs.
Thanks to Raymond-Voogt and xet7 !
The database health probe (server/lib/databaseHealth.js) saw restarts, slow
storage and a full disk, but not what made one instance slow: a 10 GB
collection scanned three times per search, and an hourly job reading all
1.1 million cards (#6824, #6825). Both were visible only in MongoDB's own
log, as "Slow query" lines with COLLSCAN, and in serverStatus: 1.6 billion
documents read in two hours.
Two more checks, every 5 minutes with the others:
- db.collection-scan: the "Slow query" lines MongoDB keeps (getLog
'global'), newer than the last probe, where a query read a whole
collection of at least 10,000 documents. Grouped by collection and the
field names filtered on - never values - with count, documents read and
time. Small tables read whole by design (settings, roles) and internal
namespaces are left out. Needs the getLog privilege; without it, and on
FerretDB, the check finds nothing and is skipped.
- db.scan-rate: serverStatus.metrics.queryExecutor.scannedObjects between
two probes above 50,000 documents per second. A database restart, which
resets the counter, is not counted.
Both are rows in Admin Panel / Problems / Database with what to do;
docs/Databases/MongoDB/Storage-Requirements.md lists them.
tests/databaseHealthScans.test.cjs drives the log parsing and the rate,
including that a filter's values never reach the row. From the reporter's
patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6826.
Both were Meteor.setInterval jobs, so every WeKan process behind one
database ran them. On a 24-pod installation (54,234 History rows, 148,660
board memberships, 1,760 position-history entries):
- the change history integrity audit read the whole History 24 times an
hour, and
- UserPositionHistory.cleanup ran 24 times a day, each run one query per
board membership of every user, each fetching up to 1000 whole
documents, to trim nothing - outside the CPU governor.
Both are SyncedCron jobs now, the way the other periodic jobs already
are: synced-cron's { intendedAt, name } lock runs each scheduled time on
one pod only, and its running-job check (indexed in #6769) skips a run
while the previous one is still going. No new collection is needed for
it. The audit stays hourly; the cleanup runs at 4:15 am.
The cleanup asks the database which user/board pairs hold more than 1000
non-checkpoint entries (aggregate) and trims only those: the 1000th
newest entry's date with one indexed query, everything older in one
remove. The result is the same as before - the newest 1000 per user and
board are kept, checkpoints never - also for pairs whose user has since
left the board. It waits for a quiet CPU and pauses between pairs.
models/lib/positionHistoryCleanup.js holds the plan with the database
calls passed in; tests/positionHistoryCleanup.test.cjs runs it on an
in-memory history against the old algorithm's result, counts the queries,
and fails if anything in server/ or models/ drives either job from a
per-process timer again. From the reporter's patch, with the claim moved
onto the existing SyncedCron.
Thanks to Raymond-Voogt and xet7 !
Fixes#6821.
The sidebar card search, the link-card popup and the list, swimlane and
board pickers (Board.searchCards / searchLists / searchSwimlanes /
searchBoards, models/lib/cardSearch.js) and the import member search
(UserSearchIndex) compiled the typed term AS a regular expression:
- "C++", "(2026)", "[x" or a case number like "PL0900-2026(1)" threw
"Invalid regular expression" and the search showed nothing;
- "." matched any character and "*" or "?" changed what was searched for.
Every server-side search (global search, publications, boardTextSearch)
already escapes the term and matches it literally. These now do the same,
still case-insensitive, through literalSearchRegex() in cardSearch.js,
which the user search reuses rather than carrying its own escape. The
Advanced Filter's /regex/ syntax is a separate path and is unchanged.
tests/noUnescapedDynamicRegExp.test.cjs no longer needs its reviewed
exceptions for models/boards.js, models/lib/cardSearch.js and
models/users.js; tests/searchLiteralTerm.test.cjs drives the matching and
fails on any model, client or imports file that compiles a raw term into
a RegExp. From the reporter's patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6822.
A card inserted through the Cards collection gets its "created" activity
from Cards.after.insert. Two paths inserted through the collection AND
called cardCreation() themselves:
- Board View / Version Control, New issue (vcsCreateIssue), and
- POST /api/boards/:boardId/lists/:listId/cards with linkedId
(createLinkedCardFor).
Each such card got two "created" activities, and every watcher two
notifications and two emails. The other explicit callers - REST create,
bulk create, email view, email to card - insert with Cards.direct, where
no hook runs, and are right to record it themselves.
Both extra calls are removed. Outside a method (a REST route, a server
job) the hook has no user, so the REST linked card's activity would have
lost its author: the hook now falls back to the card's own userId, which
createLinkedCardFor sets to the session user. Activities never exclude
their actor from notifications, so the fallback only names an author
where there was none, such as a recurring card's next copy.
tests/noDoubleCreateActivity.test.cjs walks server/ and models/ and fails
on any explicit cardCreation that follows a hooked insert. The
GHSA-6jr3-42jf-vhm5 guard in restApiIdorBatch now pins the linked card's
attribution through createLinkedCardFor and the hook. From the reporter's
patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6823.
Every global search and card report (server/publications/cards.js) upserts
its search session by { userId, sessionId }, reads it back by the same two
fields, and removed the user's sessions older than a day by
{ userId, modifiedAt }. The sessiondata collection had only its _id index,
so each search scanned every stored session three times.
And only the searching user's OWN old sessions were removed: a user who
never searched again kept theirs forever. Each session holds the pickled
selector of the search, which lists every board the user can see - large
for an administrator. One instance had 4,751 sessions taking 10 GB, the
biggest collection in its database.
- Indexes { userId: 1, sessionId: 1 } and { modifiedAt: 1 }.
- Sessions older than a day are removed for everybody on each search, as
one indexed delete. Paging (next/previous) works within the day as before.
Test: tests/searchSessionIndexes.test.cjs. From the reporter's patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6824.
server/cardRecurrenceSchedule.js runs every hour and asks for the cards
with a recurrenceInterval ($exists: true, not null or 'none'). There was no
index on the field, so the query read every card in the database to find
the few that recur. One instance logged it as a slow query: COLLSCAN,
1,108,017 documents examined, 1,155 ms.
A partial index on recurrenceInterval holds only the cards that have one,
the same way activities indexes commentId and attachmentId. The job's
$exists: true lets MongoDB use it; tests/recurrenceIndex.test.cjs pins both.
From the reporter's patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6825.
Card Settings draws each row once per list, and its minicard list head is
empty; the Date section's card list starts with the fixed Mark as complete
row; the SMTP host field is shown only while email settings are enabled and
SMTP is chosen.
Thanks to xet7 !
Files are served private, no-cache, so every later view of an attachment,
avatar or thumbnail revalidates and gets a 304, and a browser updates the
stored response's headers with the 304's. The app-wide frame-ancestors 'self'
that FrameBleed's restore puts on every response therefore replaced the
file's own policy - an SVG's default-src 'none' and sandbox - from the second
view on. The SVG body is still sanitized on every serve, so this lost a layer
of defence rather than opening script execution. The app-wide framing headers
are now left off a 304, so the stored 200 keeps the policy its route chose; a
header a route set on the 304 itself is kept. Not recorded in Admin Panel /
Problems: it fires on ordinary revalidation, not on an attempt.
Thanks to xet7 !
The theme's quiet text, #6b7280, was 4.51:1 on #f7f7f7 and 4.44:1 on the
tinted card header, at or under the 4.5:1 it needs; #4b5563 is about 7:1.
The opened card and sidebar contrast tests measured right after a reload,
before the board's colour had reached the page, and so measured WeKan's stock
colours; they now wait for the theme class as the header test does.
Thanks to xet7 !
The S3 pane has had two Save buttons since #6465, one under the Enabled and
Read switches and one after the connection fields; the spec matched one.
Thanks to xet7 !
forms.css gives every input the 9px 14px padding of a text field. The
Draggable table brought its native checkboxes back without removing it, so a
16px box left the browser about 2px to draw in and a ticked one was a small
blue dot beside an unticked square. The same was true of the WIP limit groups
popup and of task-list checkboxes in a description. All three have no padding
now, and a test fails on any stylesheet that brings back a native checkbox
with it.
Thanks to mimZD and xet7 !
Fixes#6820.
LinkedWriteBleed over REST is refused and recorded but no longer disables the
account (#6798); notification intents are seeded recent, past the expiry of
#6768; quoted custom field values; the Login and Windows SSO forms each have
a Save; the Bots view under Rules; the popup stub has onCreated and helpers;
the board view panel fills the window first. An invite mail goes to a running
SMTP sink, a sink waits for a busy port, and the allowed AssignedBleed read
retries on a socket reset only. The first checklist is added with the title
line's +.
Thanks to xet7 !
A new drawing was fitted to the popup before it was maximized and kept that
size. It is refitted whenever its room changes, until it is zoomed or resized
by hand.
Thanks to xet7 !
50 ms after an inlined form opens it focuses the field and selects what it
holds, so the first key replaces a title being edited. Text typed or pasted in
those 50 ms was selected too, and the next key - Enter for a new line - left
only a line break. The selection is skipped when the field already changed.
Thanks to xet7 !
The Gregorian option's value is gregorian; the date-changed triggers are on
the card triggers tab; the shared templates and security panes have their own
addresses; Shortcuts opens as a modal; the roles pane has two descriptions;
saved rule descriptions are lowercased; the feature list is FEATURE_KEYS long;
a plain member is not shown the Rules editor at all (#2217), and the server
still refuses its rule writes.
Thanks to xet7 !
A leftover copy of gcs-credentials-description, from before the English and
translated pairs, showed the same sentence twice under the key field.
Thanks to xet7 !
The helper handed TAPi18n.__ over unbound; __ reads this, so it threw and both
descriptions of the visibility popup were an empty line in every language
since the custom descriptions of Admin Panel / Settings / Visibility. It is
passed bound, and a test fails on any TAPi18n.__ passed as a bare value.
Thanks to xet7 !
The popup opens on its Card section and draws only the open section's rows,
each once per list (Show on Card, Show on Minicard). The specs looked for rows
of other sections and matched a row twice. The linked timer spec reloads after
its database writes, so the board's spent time has reached the page.
Thanks to xet7 !
The class that keeps the window unpainted until it is placed beside its
minicard was a static class of the template, removed by hand once placed.
Blaze writes a tag's static classes again whenever its class attribute
changes, so maximizing and minimizing, or collapsing, brought it back and left
the card open but invisible. It is now a reactive class, off for good once the
window is placed.
Thanks to xet7 !
Since #6796 a card with no checklist has only the + of the Checklists title
line (a.add-checklist-top); the bottom a.add-checklist appears once there is
a checklist. The specs looked for the bottom one only, so every spec that adds
a card's first checklist failed, and 12-checklists skipped its checks silently.
Thanks to xet7 !
The scan counts what points at nothing: cards on a missing or another board's
list or swimlane, ghost and duplicate board members, boards with no active
admin, custom field values and boards that no longer exist, checklist items
without a checklist, and subtasks or linked cards whose card is gone. It runs
nightly when the CPU is low, claimed so that only one pod scans or repairs.
A repair that only moves data reuses the upgrade steps; one that deletes asks
twice, and the server refuses it without that confirmation. Every repair edits
with $pull or a guarded update, so a concurrent edit is not overwritten, and a
member dedupe keeps the admin entry. Legacy scalar boardId and string boardIds
of custom fields are understood.
Translations done with low confidence: ay, csb, lld, kok, wa-RR, ve-CC, bi, tpi.
Thanks to Raymond-Voogt and xet7 !
Fixes#6818.
The Corsican and Southern Sotho specs looked for .templates-description and
.shared-templates-hint inside ul#templates-setting, which holds only the three
scope checkboxes; both paragraphs are its siblings in .templates-settings.
Thanks to xet7 !
Found by the Haitian attachment-search browser test. Every attachment
lookup of the global search read the attachment's card from a top-level
cardId, which attachments do not have - they name it in meta.cardId - so
has:attachment, a free-text match on a filename and attachment:<name>
found no card at all; tests/databaseQueryBounds.test.cjs had pinned that
projection. The negated predicates (has:-attachment, has:-checklist)
were ignored and returned the cards WITH one. Soft-deleted attachments
do not count for has:attachment.
Thanks to xet7 !
Stepping to the next result with Enter highlighted it while the last
one stayed lit for the rest of its three seconds, so two cards were
highlighted at once and it was not clear which was current - found by
the #2171 browser test. Revealing a result removes the highlight from
any other.
Thanks to xet7 !
The specs predate an opened card showing only the fields it has data
in: a checklist spec found no Add checklist on an empty card (and five
others skipped their assertions the same way). The seeded board turns
Card Settings / Card's Show empty fields on - what an opened card did
before - and the specs of the empty-field rules (card-add-fields) turn
it off.
Thanks to xet7 !
An opened card shows the fields it has data in, but a linked card keeps
its data on its source card - members, labels, dates, custom fields,
checklists - and the decision read the linked card's own, empty
document: a linked card hid every field of its source. Found by the
#1946/#6613 browser test, whose source member's avatar was missing.
shownFieldsOf() takes the data, and the counts of checklists, subtasks,
text notes, attachments and comments, from the source card, and the
card's own choices (On this card) from the card opened. The opened
card, its sections and Card Settings' On this card all decide through
it. tests/linkedCardShownFields.test.cjs runs it.
Thanks to xet7 !
Found by the #6808 browser test: when an opened card really is deleted,
its window is destroyed with its data - usually before the server has
answered whether the card is gone - and the confirmation was dropped
for a destroyed window, so the window closed but the address stayed
the card's. The question is asked outside the window now
(confirmGoneCard, waiting for a settled connection and login), and the
window's end asks it too when the card is missing; the close
(closeGoneCard) clears the window, the popup and the address. A card
that only left for a reconnect still answers available and stays.
Thanks to brlin-tw and xet7 !
The Retention help text came with Tigrinya's bare ካርድ for card; Tigre
says ወረቀት ካርድ, which tests/tigreAllBoardCardContexts.test.cjs holds.
Thanks to xet7 !
Every Hall of Fame vulnerability without a test naming it (24 names, 30
advisories) was checked against the current source. No fix had been
reverted. Looking for the same mistake elsewhere found siblings:
- FloppyBleed: the fs-path-heal upgrade step joined an attachment's
stored name into candidate paths as-is; a record a client inserted
named ../../../etc/passwd made the next upgrade copy that file into
storage - an arbitrary file read. Only the name's last component is
used now; the bulk move limits a legacy name's extension the same way.
- FilePathBleed (GHSA-g6vm-7757-pr88): the insert guard looked only
inside versions; with versions left out ostrio:files falls back to a
top-level path, which removing the record deletes and validation
reads. A client's top-level path is refused for attachments and
avatars, recorded by the existing canaries.
- MoveStorageBleed: validateAttachment, which deletes a file failing the
current upload rules, was open to anybody who could see the board, a
public one included. Only who may change the file, or a site admin,
validates now; a refusal is recorded (authz.attachment-validate).
- HookUrlBleed / IntegrationBleed: the REST reads of a board's
integrations gave the webhook URL - whose path is its secret - to
every member reading the board; non-admins get what the publication
gives them.
- AttachmentMigrationBleed: four migration methods answered any
logged-in user about any board, deleteDuplicateEmptyLists.getStatus
with a private board's list titles; they require a visible board and
record refusals (authz.migration-board).
- LegacyAttachBleed (GHSA-xcxp-hx9w-q5q9) and MimeStorageBleed
(GHSA-rv5g-5p4g-3v89): the legacy route judged a name dangerous only
for .svg, the response policy missed x-javascript, ecmascript, xsl and
+xml types, and the sniffers missed <tag/onx= handlers.
OIDCBleed refusals are now recorded in Admin Panel / Problems too. New
suites name the vulnerabilities they guard, existing ones name the
advisories they already covered, and tests/securityRegressionCoverage
counts 128 of 137 published vulnerabilities with a named test (was 125).
Thanks to xet7 !
The Retention page (#6789) showed only the variable names
(ATTACHMENTS_RETENTION_DAYS, ...), the raw choices uploaded and
card-inactive, and Default () with nothing between the brackets
whenever the variable was set but empty - which is what a Helm chart or
a docker-compose file listing the variable does.
Catalog fields (models/lib/authConfigCatalog.js) can name a labelKey, a
helpKey and choiceLabelKeys: the form shows the translated label with
the variable name beside it, a help line, and the choices by name.
Fields without them look as before. An empty variable is unset for the
value shown, as the retention code itself reads it, so the default is
shown again; yes/no defaults are translated. The five retention fields
use them; seven new strings in every language (low confidence for the
rarest and constructed ones). From the reporter's patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6819.
#6817: on v12.65 the reporter ticked Due in Board Settings / Card's
Show on Card and an opened card without a due date showed no Due field.
Show on Card says what a card can show; since v12.65 an opened card
shows a field when it has data. Showing an empty field is done since
#6806 (Upcoming) by Card Settings / Card's Show empty fields, the Show
empty column, or + Add / On this card. The test pins the reporter's
board through each, and that Show on Card off still wins.
Thanks to mimZD and xet7 !
Fixes#6817.
StampBleed (found reviewing the patch for #6813): checklists, checklist
items and text notes carry a denormalized boardId, by which the board
publication publishes them, and items a checklistId, by which a
checklist draws them. The insert allow rules check write access on the
document's card only, and the server's insert hooks kept a boardId the
client sent. So a member of any board could insert, on their own card,
a document stamped with a private board's id - published to that
board's members - and an item with that board's checklist id, drawn in
it. 4bd6a7f088 made the server take boardId from the card; now the
forged insert is refused outright and recorded, for those three and for
a direct attachment insert with a foreign meta.boardId. WeKan's own
client never sends a mismatch.
UploadBleed: Meteor-Files' upload pipeline (_FilesCollectionStart_
attachments / Write and its HTTP twin) inserts the stored attachment
SERVER-side, so the allow rules were never asked, and the attachments'
onBeforeUpload only cleaned the file name: any DDP client, signed in or
not, could put a file on any card of any board - published to its
members with an addAttachment activity and its notifications - and the
admin's uploads-blocked switch was skipped too. The upload is
authorized on every chunk now: signed in, allowed to edit the card (or
write the board, for a background or map image), uploads not blocked,
and a card attachment's board, list and swimlane are its card's.
Both are recorded in Admin Panel / Problems (authz.card-child-stamp,
authz.attachment-upload), once per upload. tests/stampBleed.test.cjs and
tests/uploadBleed.test.cjs run the real decisions, and fail on a card
child with no insert board check or a FilesCollection without a server
upload check; upload-stamp-bleed.e2e.js attacks the running server.
Thanks to xet7 !
The new texts of f89c8f8030 took Tigrinya's word for name (ስም) in Tigre,
which has its own (ስሜት), and repeated Tsonga's nhloko-mhaka (title)
three times in one sentence - the shape the guards against generated
filler catch. tests/tigreAllEstablishedNounContexts.test.cjs and
tests/wrongLanguageCorrections20261014.test.cjs pass again.
Thanks to xet7 !
#5874 fixed new cross-board moves (server/lib/cardBoardConsistency.js),
but a card moved before that fix can still point at a list of the board
it LEFT. Every view of its own board selects cards by that board's
lists, so the card is shown nowhere, and swimlane-structure's
dangling-listId rescue does not see it because the list exists. One
production database (1.1 million cards) had 706 such cards on 383
boards, 391 not archived.
A startup upgrade step, card-list-other-board, gives each such card its
own board's first unarchived list (and that list's swimlane when it is
bound to one), or a Rescued Data list when the board has none. Cards are
streamed with two fields, one updateMany per (list, board) pair,
idempotent. From the reporter's patch, with one change: the step runs
BEFORE swimlane-structure, so a rescued card whose new list is not bound
to a swimlane - it kept the swimlane of the board it left - is put on a
swimlane of its board in the same pass, not hidden in the Swimlanes view
until the next release re-runs the checks.
Thanks to Raymond-Voogt and xet7 !
Fixes#6814.
#5813 / #4743 made server-side card numbers atomic with a per-board
counter, but a card added in the browser - the add-card form, a card
from a template, a link, a checklist item turned into a card - still
brings the number the browser computed: the highest among the cards it
has, plus one. With lazy card loading the browser has only the cards in
view, so it reissued numbers other cards already carried, and the
counter never saw them, so the server reissued them as well. One
production database had 842 numbers used by two or more open cards.
Cards.before.insert on the server: a number another card on the board
already has is replaced from the counter, after raising the counter to
the board's highest number; a free number the counter did not issue
raises the counter to it. A board with no counter yet is seeded from its
highest number first, as getNextCardNumber's lazy seed does - the
reporter's patch created it from the browser's number alone, which can
be below numbers outside that browser's view, and the seed would then
never run. 0 / missing stays no number. Existing duplicates are not
renumbered: a number may be written down elsewhere.
Thanks to Raymond-Voogt and xet7 !
Fixes#6815.
Every way to delete a checklist - the card's checklist menu, DELETE
/api/boards/:boardId/cards/:cardId/checklists/:checklistId, the
removeChecklist rule action and the durable rule plans - removed only the
checklist document; Checklists.before.remove writes the removeChecklist
activity and nothing else. Every item stayed in the database with a
checklistId pointing nowhere: invisible on the card and never cleaned
up. One production database had 2335 of them from 690 deleted
checklists.
Checklists.after.remove now removes the checklist's items with
ChecklistItems.direct.removeAsync, as deleting a card already removes
its children: no activity per item, the checklist's own removeChecklist
activity records the deletion. Items orphaned before this are left for
the administrator to decide. From the reporter's patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6816.
Since #3986 a new card's title starting with [Text] followed by more
text lost the prefix and got the label Text, created on the board when
it had none - for everybody, without a hint. Titles pasted from ticket
systems, mails and monitoring tools ([Follower] #123456 - ...,
[EXTERNAL] ...) were changed and filled the board with unwanted labels.
It is a Member Settings switch now, Turn [label] at the start of a new
card title into a label (profile.titleBracketLabel), off by default: a
title is kept as typed. Who wants #3986's behaviour turns it on. Both
texts are translated in every language; low confidence for the
constructed and rarest ones (tlh, vo and some 35 others).
Thanks to jullbo and xet7 !
Fixes#6810.
A date popup of a card without that date opens the calendar on today,
marks today (#6751) and names it in the calendar's heading - so today
is what the form shows. But the form's date field was empty, and Save
without clicking a day answered Invalid date.
The form starts from today now (draftDate in
imports/lib/datePickerTime.js): the date field, the calendar's selected
day and its heading agree, and Save saves today at the popup's default
time (17:00 for a due date, #1502). A card's own date is kept as before,
and an emptied date field is still refused.
Thanks to brlin-tw and xet7 !
Fixes#6809.
Dragging a checklist item within its card sets cardId and checklistId
to where the item already is. The ChecklistBleed deny rule
(GHSA-gv8h-5p3p-6hx7) checked only that the destination board was
writable, so for a comment-only member or a Worker - whose own board is
one they cannot write to - an ordinary drag tripped the high-severity
canary checklist-item.cross-board-move and named them in Admin Panel /
Problems / Security as if they had attacked another board.
The board the document is already on is no destination now. That board
is the one of its SOURCE CARD, which the allow rule decides on - not
the document's own denormalized boardId, as the reporter's patch read
it: the insert hooks kept a boardId the client sent, so an item on the
attacker's card could carry a victim board's id and would have passed
as staying while moved onto a victim card. Those hooks (checklists,
checklist items, and now text notes on the server) set boardId from the
card always. A move to another unwritable board, and an unknown
destination, are still denied and still reported.
Thanks to Raymond-Voogt and xet7 !
Fixes#6813.
The fixture's user has an id, not an _id: setHandles(user._id, ...) of
8224852de1 matched no user, so the handle half of the spec never had
drag handles on.
Thanks to xet7 !
Custom fields on minicards became a Board Settings / Card switch,
allowsCustomFieldsOnMinicard (1d4ffd4080), opt-in, with false written
into every board. Before it, a custom field marked Show on card was
always drawn on the minicard, so after the upgrade those fields
disappeared from every minicard until a board admin found the switch -
reported as custom fields being visible only after opening the card.
A startup upgrade step, custom-fields-minicard-on, turns the switch on
for each board that has at least one custom field with showOnCard: that
board's own earlier choice. Boards without one keep the opt-in default.
Once ever, like cover-on-card-on: it records itself in _wekan_migration,
so a board turned off afterwards stays off on later upgrades. The test
db's distinct() returns array elements one by one, as MongoDB does.
From the reporter's patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6812.
Until the minicard's sections were rewritten (1d4ffd4080), a minicard
drew a custom field marked Show on card only when it had a value - the
2019 check of e2a374f0aa. The rewrite dropped it, so every field a card
carries was drawn, also the ones added empty by Automatically on card /
Always on card: boards with several such fields got a stack of empty
rows on every minicard.
hasCustomFieldValue() in models/lib/customFieldsWD.js: null, undefined,
an empty or blank string and an empty multi-select are empty; 0 and an
explicitly unticked checkbox are values (the old check hid 0). The
minicard draws a field only when it has one; the opened card is
unchanged. From the reporter's patch.
Thanks to Raymond-Voogt and xet7 !
Fixes#6811.
Behind a reverse proxy the DDP connection can drop and come back while a
card's link is still loading (a WebSocket upgrade the proxy refuses,
SockJS falling back). Every subscription re-runs on the way back, one
answers before the resumed login with nothing, and the card leaves
Minimongo for a moment. #3114's close-on-removal took that moment for a
deletion: it closed the card and went to the board's address.
The window now waits while the subscription, the connection or the login
is settling, and when the card looks gone with everything settled, asks
the server (cards.openCardAvailable, the 'card' publication's own rule,
now one function in server/lib/openCardAccess.js) and closes only on its
no, if Minimongo still agrees. A card really deleted, archived or moved
elsewhere still closes. Not reproduced here: no proxy in this
environment; the browser test drops and restores the connection.
Thanks to brlin-tw and xet7 !
Fixes#6808.
On 2026-10-25 each row became one line with both sides' cells and order
arrows. But the lines could follow only one side's order, and the
number beside an arrow was the field's place among ALL of that side's
fields: an arrow often changed the number and nothing visibly moved,
the minicard's arrows never moved a line, and an arrow that did nothing
was not disabled. Drag and drop, which the arrows had replaced, had been
there since 2026-10-02.
Each section has the two lists again, each in its own order and
reordered by drag and drop: Show on Card - with On this card and Show
empty beside each row - and Show on Minicard. A row is dragged by its
handle (drag handles on) or its icon or name; Up and Down on a focused
one move it one row in the list. A dropped row goes right after the row
now above it in the side's whole order, through placeKey, so a pinned
header stays first and a section moves as one. The arrows and their
numbers are gone.
Thanks to xet7 !
Ask for a reason when moving cards was a Font Awesome square a few
pixels off Show empty fields above it, its classes toggled by hand. It
is the same animated checkbox now, in the same place, read reactively
from the board and set by a board admin. Select all and Select none
under the columns' headings were links; they are the Draggable table's
buttons - white text on the theme's colour - in its container.
Thanks to xet7 !
Under each column heading of every pane - On this card, Show on
Minicard, Show on Card, Show empty - Select all and Select none set
that column for the open section's rows at once, each the way its own
checkbox would: On this card in one write of the card, Show empty in
one write of the board's list, the Scrum rows in one Scrum write (one
by one, each would carry the same revision), the others through their
own checkbox's handler. Who may change the column gets the buttons; a
personal row (Labels text, List title) is left as it is.
The headings drifted left of their cells, further each column, and the
labels were cut: the heading line had the smaller font, and the columns
are in em, so its columns were narrower than the rows'. The font is on
the headings now, every heading and cell starts at its column's start,
and the popup is up to 1200px wide instead of 900px, so a row's whole
label fits where the window has the room.
Thanks to xet7 !
Card Settings opens on its topmost entry, Card - also from + Add,
which opened on the first section of fields. Under the Card pane's
title, Show empty fields (the board's showEmptyCardFields, off by
default): ticked, every card of the board shows all its fields, the
empty ones too, and the Show empty columns are hidden - by CSS only, so
their ticks stay saved and come back as they were when it is unticked.
On this card still hides a field from one card, and Show on Card off
still hides it from all.
The Always show column is called Show empty; it is stored as before, in
cardFieldsAlwaysShown. Both headings are translated in every language.
Thanks to jullbo and xet7 !
Fixes#6806.
Show when empty became Always show and covers every per-card field,
the description, attachments and comments included: those were always
shown by a fixed list, and are now the default ticks of the board's
cardFieldsAlwaysShown. A board that never set it shows them as before;
unticked, they are shown when the card has a description, an
attachment or a comment, like any other field. The board's list is
exactly what is ticked once set, an empty list too. On this card still
hides an always-shown field from one card.
The first name, cardFieldsShownEmpty, was never pushed, so there is
nothing to migrate. tests/cardFieldsAlwaysShown6806.test.cjs pins the
default, unticking the four, the storage and the column; the browser
test unticks Comments.
Thanks to jullbo and xet7 !
Fixes#6806.
Since an opened card shows only the fields it has data in, a board where
nearly every card gets labels, a due date and a checklist needed + Add,
the section and On this card for each new card before a field could be
filled in. The new Show when empty column of Board Settings / Card (and
of + Add, the same popup) is the board's list, cardFieldsShownEmpty: a
ticked field counts like data and is on every card from the start. On
this card still hides it from one card, Show on Card off still hides it
from all, and the four always-shown fields have no such checkbox.
It is a board admin's setting, stored normalised by
setCardFieldShownEmpty, and translated in every language.
tests/cardFieldsShownEmpty6806.test.cjs pins the rule, its storage, the
column, and fails on any caller of isShown or cardFieldsAfter that does
not pass the board; card-add-fields.e2e.js ticks it in the browser.
Thanks to jullbo and xet7 !
Fixes#6806.
It read from the LAST comment in minicard.css and cardDetails.css to the
end of the file, so it passed only while the heading rules' neighbours
happened to set no colour - and failed once the Card kind check mark,
appended at the end of cardDetails.css with its own colour, came after
them. It reads the heading block, from its comment to the blank line
after it, and still fails on a colour there.
Thanks to xet7 !
A check mark at the end of its line, bold, and aria-checked in a radiogroup.
Before, the selected kind only had an is-active class that nothing styled.
Thanks to xet7 !
The comment form keeps 38px free for the writer's avatar, which is drawn
at the reading start (inset-inline-start: -38px) - but the room was a
physical LEFT margin, so on a right-to-left page (Persian in the report)
the avatar was drawn on the right, outside the card. The room is
margin-inline now, and the other margins of the comments' layout are
logical too, so all of it mirrors with the page.
tests/commentFormRtl6805.test.cjs pins the avatar to the room kept for it
and fails on any left/right-only margin or padding in comments.css.
Thanks to mimZD and xet7 !
Fixes#6805.
Under Edit custom fields, the Custom Fields pane has the two forms its
buttons opened: Create Field (also from Board Settings, for a board
admin) and Link fields to another card. In the pane the list's own two
buttons are not repeated; a new field saved there empties the form for
the next one, and Card Settings stays open. Opened as their own popup -
the card's Custom Fields hamburger - they step back when saved, as
before (client/lib/popupBack.js, now for a form drawn by more than one
popup, and telling whether it stepped back).
Thanks to xet7 !
Each line of a section pane is its own grid, and its side columns were
sized by their content, so no two lines - nor the heading line - agreed.
They have fixed widths now (On this card 7em, Show on Minicard and Show
on Card 9em each), a longer heading wraps in its column. The inline forms
float their Save left and Delete right (Change spent time, ...); the form
keeps those floats inside it (flow-root), where they had pushed the
heading and the first row aside.
Thanks to xet7 !
- The first entry is Card, with the card icon: Ask for a reason when
moving cards, the Draggable table, and the card's own rows that were
the last entry (Card number, Collapse, Parent card, ...).
- Subtasks is its own section under Checklists, Planning Poker its own
under Voting.
- Each section's settings are the form itself under the pane's title,
not a link to a popup: Subtask settings, Edit custom fields, Change
spent time, Card kind, Edit voting, Edit Planning Poker. Saved in the
pane Card Settings stays open; the section hamburgers of the opened card
still open the same forms as their own popup, which step back when saved
(client/lib/popupBack.js).
Thanks to xet7 !
- The opened card's actions menu is one list, in this order: Move Card,
Copy Card, Save as Template, Copy Template to Many Cards, Card
recurrence, Move to Top, Move to Bottom, Watch, Star | Set color,
Drawing | Copy link to clipboard, Link to board, QR code, History,
Export, Import, Move Card to Archive, More. Each item keeps the
permission it had; the two copies of the menu for the two kinds of
member are one list (cardMenuWrites). tests/cardActionsOrder.test.cjs.
- Card Settings: Time is under Date in the left menu.
- Card Settings / Voting: Edit voting and Edit Planning Poker are the forms
themselves, under the pane's title; saved there, Card Settings stays
open, saved in their own popup (the section hamburgers) they step back.
- Select all / Unselect all are centred under their Draggable heading.
Thanks to xet7 !
- The five leave the card's actions menu. On the opened card each is in
the hamburger of its section: Subtasks (Filter: Subtasks, and the
subtask settings), Voting, Planning Poker, Spent time, and a new Scrum
settings heading over the Scrum fields the card shows (Card kind).
Voting, Planning Poker and Spent time show their heading when ticked
"On this card" before there is anything in them, so the hamburger can
fill them in.
- Card Settings: everything in a section's hamburger is also at the top
of that section's pane, under its title - the card's actions when it
is opened from a card, Subtask settings also from Board Settings.
tests/cardSectionActions.test.cjs fails for a hamburger that is not.
- Filter: Subtasks is one function, client/lib/filterSubtasks.js.
- Card Settings: no select-all rows for Show on Minicard and Show on Card
in its first entry, where there is nothing under them; the popup is
high enough for every entry of its menu.
Docs: docs/Features/Cards/Card-Fields.md.
Thanks to xet7 !
- Board Settings / Card is the Admin Panel's left menu and pane. The menu
lists the sections (models/lib/cardSettingsSections.js): Card Settings
first (Ask for a reason when moving cards, the select-all of each side,
Draggable), then Date, Members, Labels, Description, Checklists,
Attachments, Time, Custom Fields, Voting, Scrum settings, Comments and
Card. Every row of the table is in exactly one section.
- The pane shows the open section's rows, one line each, in the reading
order On this card, Show on Minicard, Show on Card, the field: each side
cell the board-wide checkbox, the field's position on that side and its
up and down arrows (the Up and Down keys on a focused arrow too; the
maintainer's choice, replacing the drag and drop of the two long lists).
Every checkbox is the same animated one, and only the one just clicked
animates.
- The opened card's "+ Add" opens this same popup for the card, with the
"On this card" column; the separate Add popup is gone. A reader who may
not change the board sees its checkboxes disabled.
- A row's name leaves out what its section says: under Scrum settings the
rows are Sprint, Release, ..., not "Scrum settings: Sprint".
- The popup moves by its title bar, maximizes, is 900px wide (popupOffset
and popup.css agree) and high enough for its menu.
- A maximized card's comments, at the top of the right column, have no
separator line above them.
- New string "On this card" in every language. Low confidence: ace, ak, ay,
bi, bm, bua, chr, csb, dz, ff, fj, gn, gv, iu, kl, ks, kw, lld, nah, nap,
nso, om, pap, rn, rup, rw, sc, scn, se, sm, ss, st, tig, tlh, to, tpi, ts,
ve, ve-PP, vo, wal, wo, wa-RR, zgh, nd, xh, zu, ja-HI.
Docs: docs/Features/Cards/Card-Fields.md and
docs/Features/Board-Sidebar/Board-Settings/Card.md. The Playwright specs of
the old two-list layout are rewritten for the sections and arrows.
Thanks to xet7 !
The comments are their own template, cardCommentsSection, in the left
column of the opened card and, on a maximized card, at the top of the
right one beside the fields; the right column is as wide as the left.
Thanks to xet7 !
- The cover image on the opened card is on by default. The schema default
is true, and the once-ever upgrade step cover-on-card-on turns it on for
the boards created while it was opt-in; a board turned off later stays
off, also on an install that had no board yet.
- A new drawing becomes the card's cover; saving an edit leaves the cover.
- One separator line under "+ Add": the Sort group's gate read the board
itself, not the card's view, and drew its rule over fields the card does
not show.
- Similar cards: asked when the card opens, and the section is there only
when there are some, with how many.
- Custom Fields: only on a card that has a custom field value or ticked
Custom Fields in "+ Add" - which is now how a card with none gets the
section and its menu.
- The "+ Add" popup moves by its title bar (and by the drag handle, shown
only while drag handles are on, for every movable popup), has maximize /
minimize beside its close button, is wide enough for the pane's labels
and high enough for every menu entry, and a pane opened shows its ticks
without animating them - only the clicked one animates.
Thanks to xet7 !
An opened card shows only the fields it has data in, plus its
description, attachments and comments, empty or not, and its cover when
it has one. "+ Add", under the cover, opens a popup with the Admin
Panel's own left menu and pane title: the sections (Date, Members,
Labels, Description, Checklists, Attachments, Time, Custom Fields,
Voting, Scrum settings, Comments, Card) on the left, the open section's
fields on the right - the items of Board Settings / Card - each with a
checkbox. Ticking an empty field shows it on this card; unticking a field
hides it from this card, also when it has data. The card keeps its
choices in shownFields and hiddenFields, which accept only field keys.
Board Settings / Card still decides what a card CAN show: a field turned
off there is on no card and not offered. The opened card and its section
templates get their own currentBoard, the card's view of the board with
the flags of the fields it does not show reading false, so the existing
template checks apply without being edited; the minicard is unchanged.
The design is docs/Features/Cards/Card-Fields.md. Seeded e2e cards show
every field, as the specs written before expect.
Thanks to xet7 !
The custom colors added to the Drawing popup's palette are stored in the
user's profile (profile.drawingColors, through the new setDrawingColors
method), so they follow the user to every browser. The method takes only
#rrggbb codes, each once, at most 16, and refuses a caller who is not
signed in; the schema holds only #rrggbb. Someone drawing on a public board
without signing in keeps them in this browser, as before.
Thanks to xet7 !
The drawing area takes all the room the popup has: a new drawing is as
wide and high as that room, instead of a fixed 800 x 500 in the middle.
A handle at its bottom-right corner (bottom-left right to left) makes it
larger, or smaller without cutting off a line, and the magnifier buttons
zoom it, scrolling when it no longer fits. A drawing keeps its size when
saved; older ones are 800 x 500. Save is above the drawing, at the end of
the tools.
Colors: clicking a color opens a color wheel, a brightness slider and the
HTML color code; custom colors are added to the palette, kept in this
browser; the eyedropper picks from the screen where the browser can
(EyeDropper API) and from the drawing elsewhere. Any #rrggbb is a color,
nothing else, so a color never becomes anything else in the SVG.
Add Card: Drawing is in the row Search / Template / Drawing / More
options, for one card, and opens the new card's drawing on the whole
window, saved as an SVG attachment.
New strings in every language. Low confidence: tlh, vo, la, chr, iu, kl,
nah, ay, qu, gn, zgh, tig, wal, om, bo, dz, bua, sah, cv, csb, szl, hsb,
rup, lld, fur, nap, scn, sc, co, ve-CC, ve-PP, wa, gv, kw, rm, ak, bm, ee,
ff, lg, rn, rw, ss, ts, ve, nso, tn, st, ny, sn, nd, wo, fj, sm, to, bi,
tpi, haw, pap, ks, uz-AR, ace, wa-RR, ary, yi, wuu-Hans.
Thanks to xet7 !
Romanian (ro 158 values, ro-RO 179): about 160 values each were Italian
("Sposta in cima", "rosso", "ti ha inviato un invito"), with some Spanish
("disparador", "carril") and French ("Connexion", "Erreur"); also cedilla
ş ţ replaced with comma-below ș ț.
Standard Moroccan Tamazight (zgh, 344 values): about 100 values were
Arabic and about 230 Kabyle or French in Latin letters; all now in
Tifinagh. Values already in Tifinagh, including reviewed ones with a
Latin product name, are kept as they were.
Urdu (ur, 2389 values): most of the file was English spelled letter by
letter in Urdu script ("منتقل کو توپ" for Move to Top - توپ is a cannon,
"سیزے" for Size) or English word order word for word; rewritten in
natural Urdu, with the stray "اردو:" prefixes removed.
Search keywords in these four locales are one word of letters, as the
query parser reads them; the underscore, space and zero-width non-joiner
forms could not be typed as operators.
Every placeholder matches English. tests/wrongLanguageCorrections20261025
pins each language, the placeholders and the search keywords; the guards
that pinned the old Arabic and Kabyle values say why they changed.
Low confidence: much of zgh (technical and statistics terms), Urdu
technical and Blockly terms, Romanian search keywords (culoar, termen,
verificare, câmppersonalizat).
Thanks to xet7 !
A loop drawn with the Lasso selects every line wholly inside it, and a
grouped line brings its whole group. The selection moves together from
inside its box, stopping at the edge; resizes from the handle at its corner,
line widths to the nearest allowed one; groups and ungroups, the group kept
with the saved drawing; and goes to the front, the back, or one layer up or
down. Undo now steps back through every change, a move or a resize being one
step.
New strings in every language. Low confidence: ace, ak, ay, bm, bo, dz, br,
bua, chr, csb, cv, ee, ff, fj, fur, gn, gv, haw, hsb, ig, iu, kl, ks, kw, lg,
lld, nah, nap, nd, ss, ts, ve, ve-CC, ve-PP, qu, rm, rup, sah, sc, scn, se,
szl, tig, tlh, vo, wa, wa-RR, wal, wo, yi, zgh, uz-AR, ja-HI, om, sm, to, tpi,
bi, mi.
Thanks to xet7 !
A streaming tokenizer (models/lib/svgSanitizer.js) replaces the regular
expressions that read an SVG whole: it removes script, foreignObject,
iframe/object/embed, SMIL set/animate, event handlers, javascript:/vbscript:
URIs after decoding character references, dangerous CSS, DOCTYPE/ENTITY XML
loops and processing instructions, wherever they are and however the file is
split into chunks, with bounded memory. UTF-16 is decoded and checked.
Upload sanitizing streams to a temporary file and renames it; validation
checks the whole SVG instead of rejecting any over its 1 MB scan; serving
pipes through the sanitizer with no 8 MB fallback to an unsanitized
download.
Thanks to xet7 !
#6802 asks for handwriting with a pen, saved as a card attachment, and
started while the card is created:
- Add attachment / Drawing, and Add Card's Drawing button (shown while
the composer adds ONE card: the card is added, opened, and the drawing
starts on it), open a NEW drawing on the whole window - the Drawing
popup maximized, without the card's earlier drawings - saved as an SVG
attachment of the card, its lines kept on the card for editing.
- The eraser takes away every line it touches (measured to the line's
segments, its width included); Clear now has the trash icon.
- Palm rejection: once a pen has drawn, a touch does not, and while one
pointer draws no other starts a line. A failed pointer capture no
longer stops a line from starting.
- A Drawing popup opened from the card menu, which replaces the menu in
the same popup, now opens maximized when it was left maximized.
The openers live in client/lib/newDrawing.js, which touches no template:
importing the popup's own module from attachments.js ran it before
cardDetails.jade had defined the template, and the client did not start.
Eraser is in every language. docs/Features/Cards/Drawing.md describes
it all. tests/cardDrawingPen.test.cjs tests the eraser and palm rejection
as pure functions and pins the new flows;
tests/playwright/specs/card-drawing-pen.e2e.js draws and saves both new
drawings to SVG attachments, erases a line and rejects a palm in a
browser.
Thanks to mimZD and xet7 !
Fixes#6802.
Since JVN#74210258 (stored XSS) an SVG upload was refused and any stored
SVG was served as a download, so an SVG could not be a card's picture.
Every uploaded SVG is already sanitized on the server before it is
stored - no script, event handler, javascript: URI, foreignObject or
DOCTYPE/ENTITY XML loop (models/lib/sanitizeUploadedFile.js) - so the
refusal goes, for attachments and avatars.
Serving it inline is made safe in one place, server/lib/svgResponse.js,
used by every route that sends file bytes (universalFileServer.js for
attachments, avatars and legacy files, avatarServer.js,
legacyAttachments.js and httpStream.js): the WHOLE file is sanitized
again before it is sent, whatever is stored, and sent as image/svg+xml
under a Content-Security-Policy with default-src 'none' and sandbox, no
script, X-Frame-Options DENY and nosniff, so even opened directly as a
page it runs nothing. A download is sanitized too; a range request gets
the whole file; an SVG over 8 MB stays a sandboxed download. A file whose
active markup is removed on the way out is logged to Admin Panel /
Problems like the stream sanitizer's, and one removed at upload trips
the existing sanitize.dangerous-content canary.
tests/svgServing.test.cjs runs the real sanitizer on a crafted SVG
(script, onload, javascript:, DOCTYPE/ENTITY, foreignObject/iframe) and
checks the body and headers, the download, the oversized case, and that
no file-serving route in server/routes or httpStream.js sends bytes
without the SVG path, and that nothing else sends image/svg+xml;
tests/playwright/specs/svg-attachment.e2e.js uploads one, checks what is
served, that it shows in the card without running anything, and makes
it the cover and the board background.
Thanks to xet7 !
The row shows or hides the Drawing popup's Open as whiteboard button, and
is now named after the card menu's Drawing it belongs to, with that
entry's translations (cardDrawingPopup-title) and its pencil icon.
Thanks to mimZD and xet7 !
The card's Drawing popup stayed where it opened. Like the opened card it
is now dragged by its title bar or the drag handle beside the title, and
has the opened card's maximize / minimize button: maximized it fills the
window, and minimizing puts it back where it was dragged or resized to; a
maximized popup is not dragged; the drawing keeps its 800 x 500 shape so
the pen lands under the pointer; a popup left maximized opens maximized
again. The shared popup offers both by name (MOVABLE_POPUPS,
MAXIMIZABLE_POPUPS in popup.js), Board View settings staying movable.
The three new strings, Drag to move, Maximize and Minimize, are in every
language. tests/popupMoveMaximize.test.cjs pins the allow-lists, the
header controls, the restored place, the drawing's shape and the strings
in every locale; tests/playwright/specs/popup-drawing-window.e2e.js drags,
maximizes and minimizes it in a browser.
Thanks to mimZD and xet7 !
CodeQL js/incomplete-sanitization, alerts #593, #594 and #595:
docs/Databases/FerretDB/1/SpeedTest/report.cjs escaped `|` as `\|` in
Markdown table cells but left a backslash alone, so a value ending in a
backslash turned the added one into a literal backslash and its pipe
split the cell. One mdCell() helper escapes the backslash first, then the
pipe, and turns a line break into a space; it is also used for the
database's name and the query's title, which were not escaped at all.
tests/speedTestReportCells.test.cjs checks the escaping, that no value
can add a column to its row, and that nothing in the tree escapes a pipe
without the backslash. The report is generated from local speed test
results at build time, so there is no attempt to record in Admin Panel /
Problems.
Thanks to GitHub CodeQL and xet7 !
The shapes FerretDB's PostgreSQL and MySQL backends now answer in the
database - the visible boards and the due cards of the dueCards
publication, and an $in longer than the 32 values MySQL compares with
JSON functions - with negatives that must stay in Go (an operator in an
$elemMatch, a regex branch, a missing field, a long list of numbers).
SQLite, PostgreSQL, MySQL and MariaDB answer all 115 cases as MongoDB 8.
Thanks to xet7 !
npm audit reported two high severity issues: @azure/msal-node
>= 5.0.0-beta.0, < 7.1.0 may disclose authorization code flow parameters
to an attacker-controlled endpoint, and @azure/identity depends on it.
It reaches WeKan through @tweedegolf/sab-adapter-azure-blob, whose
@azure/identity (4.14.0, the newest, and 4.15.0-beta.1) asks for
msal-node ^6.0.0, so `npm audit fix --force` reported "up to date" and
changed nothing. package.json overrides it to ^7.1.1. Its only breaking
change since 6 removed responseMode from acquireTokenInteractive, which
@azure/identity never passes; DefaultAzureCredential, ManagedIdentity and
ClientSecretCredential construct, and a token request reaches Microsoft
Entra and fails as an authentication error for a made-up tenant. WeKan's
Azure Blob storage uses DefaultAzureCredential, not the authorization
code flow. The lock file also catches up with the installed
@azure/identity 4.14.0. npm audit: 0 vulnerabilities.
tests/msalNodeAdvisory.test.cjs pins the override and that no locked copy
is in the vulnerable range.
Thanks to xet7 !
"Activity notification delivery incomplete; pending intent retained" was
logged for nearly every activity - 1,080 times in one test-server run,
and on a production server one line after another - and never said why:
the .catch() dropped the error. It and the recovery and both cleanup
lines now carry the failure's code (activity-notification-intent-invalid,
sync-busy, ...). Only a code is logged as it is; any other error gives its
name and numeric or short code, never its message, which may carry an
address or a card title. tests/notificationFailureReason.test.cjs pins
that, and fails when a notification failure line in server/ drops its
reason again.
Thanks to xet7 !
Rerun of the four FerretDB v1 backends at twice the production data,
with the MySQL/MariaDB index reads and VIRTUAL index columns, the
multikey side tables for MySQL/MariaDB, the PostgreSQL GIN membership
index and SQLite sorting in the database. MongoDB 6-9 and FerretDB 2
keep their rows from the same directory. Every database returned the
same data as MongoDB.
All Boards count went from 8-9 s to 159 ms on PostgreSQL and from
9.4 s to 1.1 s on MySQL; adding the 44 indexes took 172 s on MySQL and
901 s on MariaDB instead of 20 and 40 minutes. This build is before
the fixes for SQLite's People page (the database sort read its key
three times per row), MySQL/MariaDB All Boards with a starred board, and
Due Cards' $and on PostgreSQL, MySQL and MariaDB, which a rerun now in
progress measures.
Thanks to xet7 !
WeKan's due cards query wraps its board ids in an $and, which FerretDB's
PostgreSQL, MySQL and MariaDB backends now push down branch by branch;
both shapes answer as on MongoDB 8 on every backend.
Thanks to xet7 !
At start it removed every wekan-conformance-db-* container and network as
left behind by an interrupted run, including those of a run still in
progress: a speed test beside a conformance run lost its MySQL in the
middle of Due Cards ("connection refused") and its MariaDB while
loading, and both results were lost. Containers and networks now carry
the process id of their run as a label, and one whose run is alive (a
db-conformance.sh process) is kept; one without the label, of a run that
ended, or whose pid now belongs to something else is removed as before.
tests/dbConformanceStaleContainers.test.cjs runs the script's functions
against a fake docker.
Thanks to xet7 !
Three cases for what FerretDB now answers from indexes or in the
database: an equality or $in on an indexed field (inside an array, a
value differing only by case, special characters, numbers, a long
string), membership in an indexed array of documents in every shape the
array can take and after writes, and a sort over every simple type with
ties, null and missing fields, with and without a limit, then with an
array and a document among the values. SQLite, PostgreSQL, MySQL and
MariaDB answer all 114 cases as MongoDB 8 does.
Thanks to xet7 !
import-too-large used the provisional ፈይላት, which
tests/tigreCorpusAttestedPlurals.test.cjs rejects in favour of the
corpus-attested ፋይላት used everywhere else in the Tigre file.
Thanks to xet7 !
tests/importPage.test.cjs still required the checked box's 17px label gap
to be margin-inline-end and no margin-right anywhere, which #6786 changed
on purpose: the tick is placed with left/margin-right so it stays on its
square right-to-left, and a [dir="rtl"] rule moves the label gap to the
left. The guard now pins that, and the unchecked box's logical gap; the
comments in import.css name the tick's physical offsets.
Thanks to mimZD and xet7 !
The resize handle is on the list's inline end, its left edge in a
right-to-left language, but the width was the start width plus the
pointer's movement: dragging the handle out of the list narrowed it,
and dragging it in widened it. The movement is now counted with the
list's own direction, as the board sidebar and the left menus already
do. tests/rtlListResize.test.cjs pins it and requires every width
resizer to flip right-to-left; a Playwright spec drags the handle out
and back in, in both directions.
Thanks to mimZD and xet7 !
Fixes#6801.
#6786's first fix drew the tick with physical borders, so it is a check mark
and not "<" right-to-left. But where it sits was still logical: the tick is a
box narrowed from 13px to 7px and rotated about its bottom-right corner, placed
with inset-inline-start: -3px and margin-inline-end: 6px. A right-to-left page
started the narrowed box at the square's RIGHT edge and pushed it further
right, so the tick sat beside its box - "out of box" in the issue's Admin Panel
screenshots. Measured in Chromium, the right-to-left tick spanned 303-323px
beside a square at 291-308px.
The shared tick, the Admin Panel's, the sidebar's and the Clean themes' are
placed with left and margin-right now: 291-311px, on the square, at the same
place as left-to-right, and 7 + 4 + 6 = 17px keeps the label where it was. The
import page, whose rows add a gap before the label, keeps that gap on the
reading side with a right-to-left rule. Toggle switches and the board list's
corner box, which are not this tick, still mirror.
tests/rtlCheckMark.test.cjs fails if any rule that draws a tick places it with
a logical offset or margin; tests/rtl.test.js allows physical margins and a
left offset only inside checked-state rules; the Playwright spec measures that
the tick is on its square in both directions and the label does not move.
Thanks to mimZD and xet7 !
Fixes#6786.
docs/Databases/FerretDB/1/SpeedTest/speedtest.sh (build.sh and build.bat ->
Tests -> Database speed test) is releases/db-conformance.sh with
WEKAN_DB_SUITE=speedtest: the same FerretDB built from source and the same
databases started the same way - SQLite, PostgreSQL, MySQL and MariaDB through
FerretDB v1, MongoDB 6, 7, 8 and 9, and now FerretDB 2 with PostgreSQL and
DocumentDB.
data.cjs generates, deterministically, twice the users, boards, lists,
swimlanes and cards of a production instance (615,070 cards), skewed the way
real ones are; indexes.cjs creates the indexes WeKan creates, read from its
ensureIndex calls; queries.cjs asks 18 common WeKan queries as WeKan's own code
builds them; report.cjs writes Results.md - a row per database, fastest at the
top, a column per query - and fails when a database answered or stored
anything differently from MongoDB. README.md describes it, what it found, what
was improved and what could still be.
db-conformance.sh: WEKAN_DB_BACKENDS runs only the named databases (to repeat
one into an earlier run's WEKAN_LOGDIR), containers are removed with their
volumes, SQLite's data is under .tools/tmp, and FerretDB 2 is a backend of the
speed test, and of the conformance run with WEKAN_CONFORMANCE_FERRETDB2=1. The
conformance catalogue gains a case of writes by string _id and _ids differing
only by case, which found that FerretDB on MariaDB 12.3 lost them.
tests/dbSpeedTest.test.cjs checks the data, the index list, the queries, the
report's order and that a difference fails it, the wiring and the Due Cards
board scope.
Thanks to xet7 !
ghcr.io/ferretdb/postgres-documentdb:17 installs pg_cron, which may only be
created in the database cron.database_name names - postgres. With POSTGRES_DB
ferretdb the DocumentDB extension failed to install and the server never
started. POSTGRES_DB and FerretDB's URL use postgres now.
Thanks to xet7 !
The publication fetched every board the user may see - every public board of
the instance among them, whole - to read its _id and members. It asks for those
two fields only. And with no assigned-only board, the usual case, its board
scope is { boardId: { $in } } instead of an $or with an empty second branch,
which MongoDB and FerretDB both answer from the { boardId, archived, type,
dueAt } index. A board where the user is assigned-only still shows only the
user's assigned cards. On the database speed test (615,070 cards) Due Cards on
FerretDB + SQLite went from 34 s to 12.8 s, with FerretDB's own changes.
Thanks to xet7 !
tests/incompleteEscaping.test.cjs refuses a RegExp built from a value that only some metacharacters were escaped in; the guard escaped only '-'.
Thanks to xet7 !
wekan/FerretDB now releases ferretdb-sqlite-<arch> beside ferretdb-<arch>: the
same FerretDB with only the SQLite handler, about 5 MB smaller, and SQLite is
all a WeKan bundle, image, snap or .spk runs. releases/ferretdb-asset.sh is the
one place that chooses: the newest release that has ferretdb-sqlite-<arch>,
and, until one does, the full ferretdb-<arch> of the newest release, which
has the SQLite handler too. It says in the log which one it took and why,
downloads it, verifies it against its .sha256sum, and returns FERRET_ASSET,
FERRET_TAG, FERRET_URL and FERRET_SHA for the provenance table (also through
$GITHUB_ENV, cached per job so the check and embed steps agree).
Every FerretDB download goes through it: the amd64, arm64, win64, win-arm64,
win32, mac-arm64, mac-x64 and extra-architecture jobs of release-all.yml (the
Docker images, snap, AppImage, Flatpak, single-file and macOS/Windows
packages are made from those bundles), repack-bundle-for-arch.sh for
release-all-missing.yml, bsd.yml, check-arch-binaries.sh,
build-release-bundle.sh and test-download-urls.sh. require-binaries.sh checks
the resume-login floor against the release the helper chose. The provenance
rows record that release and URL instead of /latest/.
No release workflow builds FerretDB: sandstorm-src/build-deps.sh takes the
prebuilt ferretdb-sqlite-amd64 by default (FERRETDB_SOURCE=download), and
sandstorm.yml and release-all.yml's build-sandstorm no longer set
FERRETDB_SOURCE=build; building from source stays a local option. The default
docker-compose.yml downloads ferretdb-sqlite-<arch> (FERRETDB_BINARY, falling
back to ferretdb-<arch> for a release without it); the PostgreSQL, MySQL,
MariaDB and SAP HANA compose files keep the full binary.
tests/ferretdbSqliteAsset.test.cjs drives the helper against a fake GitHub
(newest, older and no release with the SQLite-only binary, .exe names, a
pinned tag, FERRETDB_VARIANT=full, checksum match and mismatch, a missing
platform, bad names) and checks that every download site uses it, that no
workflow builds FerretDB and that only the SQLite compose file takes the
SQLite-only binary. The tests that pinned the old URLs follow the helper.
Thanks to xet7 !
A grain has one login (Sandstorm's), one database (FerretDB on SQLite) and one
mailbox (the grain's own address), but the .spk carried every login package
WeKan has and a FerretDB with the PostgreSQL, MySQL and SAP HANA handlers.
releases/sandstorm-slim-spk.sh, used by sandstorm.yml, release-all.yml's
build-sandstorm job and build.sh's "Make the .spk package", builds with the
package profile of releases/sandstorm-slim.mjs - accounts-password, 2FA,
passwordless, lockout, OAuth2/OIDC, CAS, LDAP, SAML and the seven social
logins removed from a copy of .meteor/packages for that one build, then
restored - trims the bundle for a linux/x64 grain, verifies none of those
packages got in and packs with spk pack (meteor-spk pack rebuilds and would
undo the trim). sandstorm-src/build-deps.sh builds FerretDB from source with
ferretdb_no_postgresql,ferretdb_no_mysql.
Under Sandstorm the Admin Panel hides the E-mail, Login, Locked users, SAML,
LDAP, OAuth2, CAS, Header login, OAuth providers and Passwordless panes,
Attachments / Database migration, the Email-to-card IMAP and webhook settings,
the New user button and the password fields; a hidden pane opened by URL lands
on the first visible one. POST /users/login and /users/register answer 404
sandstorm-sso-only, database migration is refused and the IMAP/webhook
settings are not stored. Without accounts-password the server creates
Accounts.emailTemplates with the package's defaults and marks useraccounts
initialised, which otherwise stopped the first grain.
Against wekan-12.63-sandstorm.spk, built from the same source: 181,307,364
instead of 185,271,476 bytes (-3.8 MiB, -2.1 %), unpacked 26.7 MiB smaller.
Docker, Snap and the bundles build from the full package list, and a test fails
if that list is slimmed. Tested on a local Sandstorm 0.308: a grain starts, a
board, a list and a card are created, and the removed options are not shown.
tests/sandstormSlim.test.cjs and tests/playwright/specs/sandstorm-slim.e2e.js
pin it. Design: docs/Platforms/FOSS/Container/Sandstorm/Smaller-wekan-spk.md.
Thanks to xet7 !
Collection2's attachSchema lives in the package's lazy main module, which only
aldeed:schema-index loads, through an asynchronous Collection2.load(). Nothing
waited for it: the models attached their schemas with whichever attachSchema
existed first - collection2's, or the bare shim in imports/collectionHelpers.js,
which stores the schema and never cleans a write. The full build happened to
load collection2 first. A build with fewer packages (the Sandstorm .spk) reached
the models sooner, so a new board's swimlane was stored without archived, sort
and type, and the board opened empty. server/main.js now loads
meteor/aldeed:collection2/main before the models in every build.
Thanks to xet7 !
A card made from a card template, linked from another board, or copied - and
a subtask copied with it - took its whole customFields array along: values of
another board's fields, of deleted fields, and entries with no field id. The
admin-only field guard could not match those to a field of the new card's
board, refused the whole card and recorded AdminFieldBleed against the user.
copy(), its subtask copies and link() now keep only the values of fields
defined on the destination board (models/lib/customFieldsForBoard.cjs), read
from the collection rather than the cache, just before the insert. An
admin-only value of the destination board is kept, so the guard still decides
it. tests/copyForeignCustomFields.test.cjs fails on the code before the fix,
and fails on any card cloned from another and inserted without the filter.
Thanks to Raymond-Voogt and xet7 !
Fixes#6800,
models/lib/databaseErrors.js builds the connection-lost rule's pattern from
CONNECTION_LOST.source (#6799), a constant regex of the same file, so no
caller value is spliced into it. Listed with that reason, as CARD_URL_RE.source
already is.
Thanks to xet7 !
In Kubernetes a restarting MongoDB pod's DNS name does not resolve for a
few seconds, and the driver throws "getaddrinfo ENOTFOUND
wekan-mongodb-0...". No rule in models/lib/databaseErrors.js knew it, so
it was not transient, and server/lib/uptimeWatch.js recorded every
unhandled rejection as a critical CrashBleed although 00processErrors.js
kept WeKan running: nine "crashes" while WeKan reconnected by itself.
connection-lost now matches getaddrinfo ENOTFOUND and EAI_AGAIN, but only
for the DATABASE's own host - from the caller, or from MONGO_URL and
MONGO_OPLOG_URL (every host of a replica set, mongodb+srv too) - so a
webhook or mail host that does not resolve is still not a database
problem. The crash recorder skips what isTransientDatabaseError already
handles, for both uncaught exceptions and unhandled rejections.
tests/databaseDnsRestart.test.cjs parses connection strings, runs both
guards' decision on the database host and on other hosts, and runs the
crash recorder's own listeners: a database coming back records nothing,
a real crash and a foreign DNS failure still do. It fails on the code
before this commit.
Thanks to Raymond-Voogt and xet7 !
Fixes#6799,
Accounts were disabled for members working on their own board; one
instance lost four in three days, each user then refused at login 81
times.
- A Worker may move a card (#3189) and tick a checklist item (#3307),
but canUpdateCard and the checklist item rule asked
canEditCardOrLinkedCard first, which recorded authz.linked-write (high,
blocked) before the Worker carve-out allowed the change, and that
record disables the account. Both now ask without recording first, and
record only a change that is still refused after the carve-outs.
- A read-only or comment-only member whose screen still offered an edit
(a role changed while the board was open) was refused with the same
record. authz.linked-write keeps being recorded and the write keeps
being refused, but it no longer disables the account (blocksAccount:
false, as ssrf.webhook since #6782).
tests/workerNoSelfBlock.test.cjs runs canUpdateCard and the checklist
item rule from their own source: a Worker's move and tick are allowed
with nothing recorded, other refused edits are still recorded, the
catalog entry never blocks through blockOnSecurityEvent's own decision,
and no rule with a Worker carve-out records before it. It fails on the
code before this commit. boardRoleViews follows the two-step check.
Thanks to Raymond-Voogt and xet7 !
Fixes#6798,
Admin Panel / Problems / Security showed HistoryIntegrity (critical)
81,833 times. A list bound to no one swimlane has swimlaneId '', and the
legacy history append hashed the row with '' and then inserted it
through collection2's default clean, which removes empty strings, after
which the schema's defaultValue stored null: every such list move failed
its own checksum at every audit and was reported as tampering. The
stored-chain path already inserted with { removeEmptyStrings: false,
trimStrings: false }; the legacy path now does too.
Rows already stored that way verify: a null where '' was hashed is
accepted in the id and label fields (boardId, swimlaneId, listId, cardId,
group, batchId, restoredFromId, restoredByUserId) and nowhere else, so a
value replaced by null, a different value, or any change to content, user
or entity still fails.
tests/historyEmptyStringChecksum.test.cjs appends through a collection
that cleans like collection2, verifies already-cleaned rows, fails every
real change, and fails on any ChangeHistory insert in the tree that would
clean or trim; it fails on the code before this commit.
Thanks to Raymond-Voogt and xet7 !
Fixes#6797,
#6796: an opened card gave most of its height to controls with nothing in
them. Stickers, Location, Dependencies and List already have Show on Card
rows, and Date Format is in Member Settings; what was left:
- A field's add button sits on its title's line (Labels, Stickers,
Location, the dates, Members, Assignee, Creator, Requested and Assigned
By, Dependencies); what a field holds follows and wraps. Requested and
Assigned By put their two buttons side by side.
- Checklists: the controls under the list share a line, and the bottom
"+" is drawn once there is a checklist; before that it is the title
line's.
- Attachments: the upload rules ("If filename is invalid, ...", size,
types) are in the upload popup, not body text above every list. "+" is
a small button. A file with nothing to preview gets a small file button
that still opens the preview, instead of a 144x96 box with "txt" in it,
and the name has a line of its own, so a long one is not hidden behind
the buttons.
- Two new Board Settings / Card / Show on Card rows, Attachments: Preview
and Attachments: Details (uploader and date), both on by default, built
from existing translations.
Board Settings / Card is a centred panel as wide (up to 1800px) and tall
as the window, and each list spreads into as many 10em columns as fit,
read top to bottom: on 1920x1080 nothing is scrolled, on 1366x768 32px.
Its rows are dragged by the handle, the icon or the label when drag
handles are on, and by the icon or the label, with no handle drawn, when
they are off. With handles on only the handle dragged, and the rows were
locked to vertical moves, which the columns made unusable.
tests/declutterCard6796.test.cjs runs the tile decision and the popup
geometry, and checks the gates, the CSS and the drag wiring;
tests/playwright/specs/declutter-card-6796.e2e.js checks the add buttons
on their title's line, the compact attachment, the rules in the upload
popup, Attachments: Details, the new rows saving, no scroll at 1920x1080,
and a drag by label and handle with handles on and by label with them
off. cardSettingsCoverage and narrowWindowLayout follow the new rules.
Thanks to mueschel and xet7 !
Fixes#6796,
It escaped only . and $ when building a pattern from an identifier, which
tests/incompleteEscaping.test.cjs reports anywhere in the tree.
Thanks to xet7 !
While MongoDB restarted, Admin Panel / Problems showed
"Exception while invoking method 'usersHeartbeat' ValidationError:
Failed validation Socket 'connect' timed out" as a schema bug, telling
the admin to look for an empty required field and report a WeKan bug.
collection2 wraps whatever failed during a write's validation in
"ValidationError: Failed validation", an unreachable database included;
the schema rule came first, and the driver's connect timeout matched no
rule at all. The same classification decides in 00startupResilience.js
and 00processErrors.js whether an error is transient, so it was fatal at
startup too.
schema-validation now yields when the same message carries a lost
connection, a timeout, a lock or too many connections. connection-lost
also knows the MongoDB driver's own errors: Socket '...' timed out,
MongoNetworkTimeoutError, MongoNetworkError, Server selection timed out,
MongoServerSelectionError, PoolClearedError, NotWritablePrimary and
"not primary" (not SQL's "not primary key").
tests/databaseErrorsWrappedCause.test.cjs runs both guards'
isTransientDatabaseError from their own source on the reported error,
puts every transient cause behind three wrappers and requires its own
rule each time, and keeps a real schema failure a fatal schema failure.
Thanks to Raymond-Voogt and xet7 !
Fixes#6795,
Admin Panel / Problems showed "Created the missing index "-modifiedAt" on
lists" at every start, from every pod. server/models/users.js passed the
list sort options ('-modifiedAt', 'title', ...) to ensureIndex as
strings: the driver read each as a field name, so lists got indexes on
fields named "-modifiedAt", "-title" and "-sort" (on no document, kept up
to date on every list write), and ensureIndex compared a string's JSON
with an index key object's, which never matched, so all six were
re-created and reported every time.
models/lib/indexKeys.cjs turns the sort options into one single-field
index per field ({ modifiedAt: 1 }, { title: 1 }, { sort: 1 }; one serves
both directions) and finds the stray single-field "-x" indexes, which
startup now drops; a compound index containing such a field is left
alone. ensureIndex turns a string key into the key it means, with a
warning, instead of indexing a field named after it.
tests/listSortIndexes.test.cjs uses the reporter's real index list, runs
ensureIndex itself against a fake collection (a string key creates the
real index once and reports it once), and fails on any ensureIndex call
in the tree whose key is not an index key object.
Thanks to Raymond-Voogt and xet7 !
Fixes#6794,
The Valencian file is ca@valencia.i18n.json, but its registry tag is
ca-valencia, and resolveTag and the browser-language matcher only treated
'_' as '-'. A profile saved as the file's name - which is what
tests/playwright/specs/rules-blocks.e2e.js does - resolved to nothing and
the page stayed in English; that case failed on the commit before the
npm updates too. Both now compare through one normalizeLanguageTag
('_' and '@' as '-'), exported from imports/i18n/browserLanguage.js.
tests/browserLanguageFallback.test.cjs uses that function rather than its
own copy of the old rule, checks ca@valencia, and requires every locale
FILE name to resolve to a registry language.
Thanks to xet7 !
imapflow 2.1.2 -> 2.8.0 and mailparser 3.9.31 -> 3.12.2 (email to card):
bug fixes, and mailparser no longer turns a decoded display name into an
address. pdfjs-dist 6.2.108 -> 6.4.299 (attachment text search),
isomorphic-git 1.42.4 -> 1.44.3 (GitHub wiki import), pretty-ms 9 -> 10
(upload time estimate; its breaking changes are in colonNotation, which
WeKan does not use, and the output it shows is unchanged).
Each now has a test that RUNS it the way WeKan calls it, so the next
update that moves an API fails in seconds:
- imapflowMailparserRuntime: the poller's connect, mailbox lock, unseen
search, fetchOne, simpleParser and \Seen flag against
server/lib/tests/fakeImapServer.js; a wrong password is refused, and an
encoded address in a display name stays a name.
- pdfjsTextRuntime: documentGif.js's legacy build, worker, fonts, CMaps
and getTextContent on a PDF with known text; a non-PDF is refused.
- isomorphicGitRuntime: githubWiki.js's log, recursive readTree and
readBlob on a two-commit repository; a missing object is an error.
npm audit reports nothing. The e2e run against a build with these:
rules-blocks (147 languages), attachments, both email specs, and the
security specs pass, except two rules-blocks cases that fail the same way
on a build of the commit before this one.
Thanks to developers of dependencies and xet7 !
Within their ranges or pins: @aws-sdk/client-s3 and lib-storage 3.1155.0,
@fastify/busboy 3.2.4, the three @tweedegolf/sab-adapter-* 3.0.5/3.0.3,
blockly 13.4.0, dompurify 3.4.17, file-type 22.2.0, filesize 11.0.28,
i18next 26.5.4, meteor-node-stubs 1.2.32 (pbkdf2 is still 3.1.7 after
the postinstall patch), wasmagic 1.0.12, and for development
@rspack/core 2.2.9, @typescript-eslint/* 8.72.0 and puppeteer 25.15.0.
The lockfile is written by npm 12.2.1, the Dockerfile's. npm audit
reports nothing.
Blockly 13.4 adds a search box to the toolbox, with five new messages.
releases/translations/import-blockly.cjs added them to every locale, and
they are translated directly into all 230 locale files, from each file's
own words for "block" and "search"; %1 is kept in every count. The
importer also replaced Telugu's literal blockly-LOGIC_NULL "null" with a
word meaning "invalid"; it is "null" again, as
tests/vietnameseBulgarianCompletion.test.cjs requires. Corrected while
there: Polish "Szukaj blokad" (search for blockades) from Blockly's own
catalog is "Szukaj bloków", Arabic's singular count drops a stray "(1)",
and Odia's "no-results" had English mixed into it.
Low confidence, for a speaker to correct: ace, ak, an, ary, ay, bi, bm,
bo, bua, chr, co, csb, cv, dz, ee, ff, fj, gn, gv, ha, haw, hsb, ig, iu,
kl, kok, ks, kw, la, lg, lld, mg, mi, nah, nap, nd, nso, ny, om, pap, qu,
rn, rup, rw, sah, sc, se, sm, sn, so, ss, st, szl, tig, tlh, to, tpi,
ts, uz-AR, ve, ve-CC (Venetian), ve-PP (Veps), vo, wa, wa-RR (Waray),
wal, wo, xh, zgh and zu.
All 1988 node suites pass except tigreCorpusAttestedPlurals, which
fails on the commit before this one too.
Thanks to developers of dependencies, translators and xet7 !
openbsd-vm 1.4.9 adds OpenBSD 8.0 as the VM's default release and fixes a
non-root user's writes to the NFS share; the BSD bundles keep release 7.8
from releases/bsd/targets.json, so they are still built for 7.8. The three
setup-node@v6 steps in the disabled Playwright workflow are pinned to
v7.1.0 by commit, like the fifteen in the active workflows.
Thanks to xet7 !
snapcraft-core26.yaml still had the caddy part snapcraft.yaml had before
v10.71: the version from api.github.com, which answers 403 to a busy CI
runner and, under snapcraft's pipefail, ended the part before its 2.8.4
fallback; a plain curl with no retry and no fallback for a CPU the newest
Caddy does not publish; and a default Caddyfile that proxied to 3000,
where WeKan does not listen when Caddy is on (it listens on
CADDY_BIND_PORT, 3001). Both snaps build from snap-src, so core26 now has
snapcraft.yaml's part unchanged, and both pin 2.11.7 as the fallback.
tests/releaseSnapArches.test.cjs read snapcraft.yaml only, which is how
the core26 copy was missed; it now checks every snapcraft*.yaml, and the
default Caddyfile's port. With the old core26 file it fails.
Thanks to xet7 !
GitHub CodeQL alert 591 (js/insecure-randomness, CWE-338), in the
dynamic-import fork: the key that lets a request read the SERVER's
dynamic modules (?key= on /__meteor__/dynamic-import/fetch) came from
Math.random(), whose xorshift128+ state can be recovered from earlier
outputs, and was compared with ===. meteor shell's connection key, which
runs code in the server process, was made and compared the same way.
Meteor 3.5.3 and 3.6-rc.0 both have this.
Both forks now use crypto.randomBytes (160 and 128 bits) and compare with
crypto.timingSafeEqual. tests/meteorForkRandomKeys.test.cjs runs both, and
fails on any Math.random() in the forks and on a key, secret, token,
nonce, salt, password or code made from Math.random() anywhere in the
tree. A wrong key is not recorded in Admin Panel / Problems: another
WeKan instance behind the same load balancer legitimately sends its own.
Thanks to GitHub CodeQL and xet7 !
secureTransfer recorded every throw as a high "blocked" event naming the
user, and that disables the account. sanitize-html 2.18.0 threw
RangeError on nested <iframe>, so a card planted with the payload locked
out the next member who exported the board; any library fault would do
the same. The transfer boundary now marks its own refusals
(TransferBoundaryError: a cycle, a non-plain object, a size limit), and
models/lib/transferFailure.cjs records only those as blocked - high, and
medium for a size limit as before. Anything else is ImportExportFailure:
detected, still naming whose import or export it was, and never blocking
an account.
tests/transferFailure.test.cjs drives real boundary refusals and a
sanitizer that throws through blockOnSecurityEvent's own decision; with
the old secureTransfer it fails. It also fails if the boundary throws a
plain Error or anything but secureTransfer calls it.
Thanks to xet7 !
sanitize-html 2.18.0 re-sanitized the fallback of a discarded <iframe>
with no recursion limit (GHSA-c9rx-x947-fp3h, CWE-674). WeKan's server
sanitizer discards every tag, so a few kilobytes of nested <iframe> threw
RangeError in secureTransfer, on every import and export - and
secureTransfer records a throw as a high blocked event naming the user,
which disables that account. A card planted with the payload locked out
the next member who exported the board. 96ed9ad202 moved to 2.18.1.
tests/sanitizeHtmlNestedIframe.test.cjs runs WeKan's own sanitizeInput
options on three nested-iframe payloads, checks the installed and locked
versions, and fails if anything else imports sanitize-html; with 2.18.0
it fails with RangeError. The Playwright spec exports and imports a board
holding the payload and checks that nobody is locked out.
Thanks to xet7 !
Meteor published the same six fixes as 3.3.3, 3.4.2 and 3.5.3 on
2026-10-16. 3.6-rc.0, which WeKan runs, does not have them: its tag is
behind 3.5.3 by exactly the 15 security commits, and neither it nor
Meteor's devel branch has the fixed code. Going back to 3.5.3 would also
mean Node.js 24 and Rspack 1, so WeKan carries the fixes in packages/,
where a package overrides the release's own: 3.6-rc.0's allow-deny,
ddp-server, dynamic-import, facebook-oauth, google-oauth and shell-server
with Meteor's 3.5.3 patch applied unchanged, each marked with a _1 wrap
number. ddp-server leaves out uWebSockets.js, as Meteor's published
package does; it is only for the opt-in uws transport and came from a git
URL.
- DDP: a message named __proto__, toString or not a string, and an async
handler that rejected, crashed the server.
- allow/deny: a top-level __proto__ in an update was missing from the field
list the validators saw.
- dynamic import(): requests are bounded in size (413) and complexity
(400).
- Google and Facebook direct-token login: a token issued to another
application was accepted; identity now comes from the provider, and a
Facebook verification error no longer carries the app secret.
- meteor shell: its history and compile cache are private.
- Deploy discovery is in meteor-tool, which an app cannot replace; WeKan is
never deployed with meteor deploy, and a test keeps it so.
Refused attempts are in Admin Panel / Problems as Meteor DDP, Meteor
allow-deny, Meteor dynamic-import and Meteor OAuth, through a hook the
packages call (server/lib/meteorSecurityHook.js); none blocks an account.
An oversized import() body, an unknown ordinary DDP name and a network
failure are refused without a row, because ordinary use can reach them.
tests/meteor353SecurityFixes.test.cjs runs each fix's code cut out of the
fork and searches the tree for the shape of each fault; all of them fail on
the unfixed 3.6-rc.0 packages. It also fails when .meteor/release moves
on, because a fork would silently keep 3.6-rc.0's code.
tests/playwright/specs/meteor-353-security.e2e.js sends each attack to a
running WeKan built with the forks. The forked files are recorded in the
source audit baseline, and the suites that check WeKan's own methods and
subscriptions skip Meteor's package tests.
Thanks to Meteor developers, Vext Labs and xet7 !
Cancel workflow does not cancel a job whose if: is still true, and always()
is true in a cancelled run. tests/releaseCancelSafeJobs.test.cjs checked
only release-all.yml; it now fails on a job on always() in any workflow that
is a reusable-workflow call or has no timeout of 60 minutes or less. Every
such job today (release-notes, done, and the AppImage, Flatpak and Mac
summaries) is bounded. node-patches had eleven five-hour resume stages
called this way, and Cancel workflow did not stop them.
Thanks to xet7 !
The Recover job of "Release All missing" died after one HTTP 502 from the
GitHub API while `gh run watch --exit-status` listed the rerun's jobs, so
plan and every build after it were skipped. releases/retry-failed-release.py
now polls `gh run view`, retries up to ten API errors in a row, waits for
the new attempt rather than reading the old attempt's failure, and stops
only on the rerun's own conclusion. tests/retryFailedRelease.test.py pins
the 502 case, a failed rerun, a lasting outage and the stale attempt, and
that no `gh run watch` is left.
Thanks to xet7 !
The board publication finds a board's comments, comment reactions, text
notes, checklists, checklist items and attachments by the board id each
row carries (#6480), but a card that changed board re-homed only its
checklists and checklist items. Its comments stayed published to the
board it left, and came back when the card was moved back. Attachments
followed only when Card.move() ran on the server, and the REST card
move, a hook-less write, re-homed nothing at all.
One list (models/lib/cardChildrenBoard.js) now names every such
collection, and one helper (server/lib/cardChildrenBoardSync.js)
re-homes them from the Cards.after.update hook, the REST move and the
durable rule move. The startup schema upgrade step card-children-boardid
moves rows that a move already left behind to their card's board.
Thanks to fabiosalles and xet7 !
Fixes#6793.
From IRC: a Jira import of 25 issues worked and one of 858 failed. The
import boundary refused any document over 250,000 values, and a Jira
search export carries some 250 per issue even without comments - mostly
null custom fields, avatar URLs and status categories - so it stopped at
under 1,000 issues, about 6 MB. The refusal was a plain Error, which the
import page showed as "Internal server error". The cap is now four
million values; a file over it is refused as import-too-large, which the
page translates, with the limit as the reason. The import deadline was a
flat two minutes whatever the file held; it is now WEKAN_IMPORT_TIMEOUT_MS
plus half a second per record (models/lib/importDeadline.js), on the
server and in the import page's watchdog alike. The Jira creator also
collected the file's issue keys once per issue, which was quadratic.
"Is there a way to convert an existing board into a template?" There was
not: a board template could only be built inside the Templates board.
Board menu / Save as Template (saveBoardAsTemplate) copies the board as a
template board, private with the creator as its one member, and adds the
linked card in the user's Templates / Board Templates swimlane that makes
it a template. Board admins only, as Copy Board, and not offered on a
board that already is a template.
The new import-too-large string is translated into every language; the
low-confidence ones are ace, ak, an, ay, bm, bo, bua, chr, csb, cv, dz, ee,
ff, fj, fo, fur, gn, gv, haw, hsb, iu, kl, kok, ks, kw, lg, lld, nah, nap,
nd, rm, rup, sah, sc, scn, se, ss, tig, tlh, to, ve, ve-PP, ve-CC, vo, wa,
wa-RR, wal, wo, wuu-Hans and zgh.
Thanks to xet7 !
Fixes#6792.
CodeQL alert 590 (js/incomplete-sanitization): the #6788 e2e put the
stored address into a $regex with only "." escaped, so a backslash in the
address could cancel the escape. It now uses escape-string-regexp, the
same module the server matches addresses with.
tests/incompleteEscaping.test.cjs only knew single-character patterns
and so missed `.replace(/[.]/g, '\\.')`. It now also reports a character
class without a backslash replaced by a backslash escape, and found this
line before it was fixed.
Thanks to GitHub CodeQL and xet7 !
tests/adminPanelDocsMatchMenu.test.cjs requires docs/Features/Admin-Panel/Validation.md
to inventory every live pane; Attachments / Retention (#6789) was missing
from it. It also crashed on the commit before this one, whose test run was
read by its last line only.
Thanks to xet7 !
The full node suite found three breakages in this round's own work:
- adminPanelDocsMatchMenu: Admin Panel / Attachments / Retention was in the
product and not in docs/Features/Admin-Panel/Attachments/README.md. It has
its section and its row in the URL table now.
- incompleteEscaping: the test from the #6788 patch hand-wrote a regex escape.
It now uses the same escape-string-regexp package the server imports.
- releaseSnapArches: two guards read the Launchpad step's text. infra_failure()
(the v12.56 Launchpad-outage retries) also reads snapcraft-wekan-*.txt
before the loop, and the fixed `sleep 60` became `sleep "$pause"`. The
guards now look for the log printing after the no-snap message, and for the
pause variable, and say why. These two had been failing since that change.
An earlier run's report that this suite was only "load-related" was wrong:
the FAIL lines had been filtered out of the output that was read.
Thanks to xet7 !
An audit of every environment variable the code reads found 30 that are new
since v12.00. Eleven were already Admin Panel settings and on every platform
the release workflows build. Of the rest:
Now Admin Panel settings, through models/lib/authConfigCatalog.js (a value
there wins, an empty field falls back to the variable):
- Email to card limits, beside its own Admin Panel settings:
INBOUND_IMAP_POLL_SECONDS, INBOUND_EMAIL_PER_ADDRESS_PER_HOUR,
INBOUND_EMAIL_MAX_BYTES, INBOUND_EMAIL_MAX_ATTACHMENT_BYTES and
EMAIL_VIEW_SENDS_PER_HOUR. They were module-level constants, read before
the Admin Panel values loaded; they are read when used now.
createRateLimiter takes a limit function, and a changed poll interval
restarts the IMAP poller.
- ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT in People / Login, like the login
expiry beside it, applied from the next start.
- Windows SSO (WINDOWS_SSO_ENABLED, _DOMAINS, _ACTIVE_DIRECTORY,
_MERGE_EXISTING_USERS) in People / Login. It was already read through
authEnv but had no form. Being Windows-only, its catalog section names
start-wekan.bat as its one platform.
Listed on every platform (Dockerfile, the docker-compose files, start-wekan.sh
and .bat, the snap config and help), where none of these had been: the
variables above, INBOUND_EMAIL_WEBHOOK_SECRET (its own Admin Panel page
already has it), and the per-process switches that stay environment only -
INBOUND_IMAP_DISABLED (one pod of a multi-pod deployment), WEKAN_DISK_MONITOR,
WEKAN_DISK_WATCH_PATHS, WEKAN_RAM_MONITOR and WEKAN_IMPORT_RUN_STALE_MS.
Left unlisted on purpose: NEXTCLOUD_EXAPP, NEXTCLOUD_URL and
WEKAN_NEXTCLOUD_PROXY_KEY (set by Nextcloud's AppAPI), SANDSTORM_MAILDIR (set
by Sandstorm). DEFAULT_AVATAR_URL keeps no Admin Panel UI, as decided in #824.
tests/envVarCoverage.test.cjs keeps it so. It fails for a variable that is in
no Admin Panel catalog, OWN_PANE or ENV_ONLY with its reason; the variables
read before v12.00 are a frozen LEGACY list that can only shrink. An
environment-only or own-page setting a user sets must be on every platform,
and stale entries fail. tests/authConfigCatalog.test.cjs honours a section's
platform list. tests/adminPanelNewSettings.test.cjs pins the reads and the
forms. tests/cookieRefreshRateLimit.test.cjs's guard now expects the Admin
Panel value, and says why. tests/playwright/specs/admin-new-env-settings.e2e.js
opens the forms.
Thanks to xet7 !
The result of an Admin Panel backup lived only in the memory of the server
process that ran it. After a restart, or on another pod of a multi-pod
deployment, the Backup pane said "idle", so nobody could see whether last
night's backup had worked. There was no history, no warning when a scheduled
backup failed or did not run, and local backups were never cleaned up.
- Every run, scheduled or "Backup now", is recorded in backupRuns: start and
end, who or the schedule, scope, storage, status, size, duration and error.
Records are kept 400 days. A run still "running" after 24 hours counts as
failed, and a scheduled run skipped for another backup is recorded as failed.
- Admin Panel / Problems / Backup shows the last success (overdue when its
period has passed), the last failure with its error, the next run and the
last 30 runs. The same status is above the schedule in Attachments / Backup.
- Problems / Summary lists "Backup failed" and "Backup overdue". /metrics adds
wekan_backup_last_success_timestamp_seconds,
wekan_backup_last_run_timestamp_seconds, wekan_backup_last_run_success and
wekan_backup_overdue for alerting.
- BACKUP_KEEP_DAYS: after a successful backup, local backups of the same scope
older than N days are deleted. The newest is always kept, and only a
directory inside the backup root holding a backup.zip is removed.
From the patch by Raymond-Voogt, and in Admin Panel as well:
- BACKUP_KEEP_DAYS is the catalog's backup section
(models/lib/authConfigCatalog.js), overridable beside the schedule in
Admin Panel / Attachments / Backup and resolved through authEnv at every
backup.
- It is listed on every platform: the compose files, start-wekan.sh and .bat,
the snap config and help, and the Dockerfile, which the patch's version
had missed. Its platform hunks, written before #6789, were re-applied by
hand.
tests/backupRuns.test.cjs (21): the run records, overdue and pruning against a
real directory, and the Admin Panel override, including that nothing reads the
variable around it. tests/authConfigCatalog.test.cjs checks every platform.
admin-attachment-retention.e2e.js checks the Backup pane shows the field.
Thanks to Raymond-Voogt and xet7 !
Fixes#6790.
Organisations that must not keep files forever (storage limits, GDPR data
minimisation) had only scripts working on MongoDB directly, which leave card
references behind, do not know which storage holds a file, and break on
upgrades. Soft-deleted attachments were also kept forever.
A nightly job (server/attachmentRetention.js, rules in
models/lib/attachmentRetention.js), off unless configured:
- ATTACHMENTS_RETENTION_DAYS soft-deletes card attachments older than N days
through the card's own Delete (cover unset, activity, card history Restore).
- ATTACHMENTS_RETENTION_MODE: uploaded (default), or card-inactive, which also
requires the card to have had no activity for as long.
- ATTACHMENTS_PURGE_DELETED_AFTER_DAYS removes attachments soft-deleted at
least M days ago for good, file included, through Attachments.removeAsync
so every storage backend is cleaned. The write re-checks deletedAt, so one
restored meanwhile stays.
- ATTACHMENTS_RETENTION_DRY_RUN only logs; ATTACHMENTS_RETENTION_MAX_PER_RUN
caps each step per night.
Never touched: attachments without a card, template boards and cards, and
attachments with an unknown upload date.
From the patch by Raymond-Voogt, and in Admin Panel as well:
- The five settings are a section of models/lib/authConfigCatalog.js.
Admin Panel / Attachments / Retention (/admin/attachments/retention) draws
the shared override form on it: a value there wins, an empty field falls
back to the variable, and the source in effect is shown.
- The job resolves them through authEnv on every run, so a change needs no
restart.
- The new menu label attachment-retention is translated in all 246 locales.
- The catalog's platform test then found that the patch had missed the
Dockerfile and the snap help; both list all five now, beside
docker-compose, start-wekan and the snap config.
tests/attachmentRetention.test.cjs (14) covers the rules and the Admin Panel
wiring; negative: the job never reads the environment around the Admin Panel.
tests/authConfigCatalog.test.cjs checks every platform lists each variable.
tests/playwright/specs/admin-attachment-retention.e2e.js opens the pane, and
checks that an ordinary user cannot.
Thanks to Raymond-Voogt and xet7 !
Fixes#6789.
A board member who was not a board admin could not add a colleague from
Board / Members / +.
- inviteUserToBoard matched the typed email address exactly. LDAP and OIDC
store an address as the directory spells it ("Jan.Jansen@Example.com"), so
"jan.jansen@example.com" found nobody, and WeKan tried to create a new
account instead: "This user is not created" with registration off,
otherwise a raw 403 "Email already exists". The match is now
case-insensitive, anchored and escaped.
- searchUsers read five users and filtered afterwards: disabled accounts
(which the invite then refuses, #1894) and, for non-admins, people outside
the user's organization or team (#6116). Five non-matching users ahead of
the colleague hid them. It reads 50, filters, then returns 5.
From the patch by Raymond-Voogt. tests/inviteMemberEmailCase.test.cjs pins
both, including that the pattern is anchored and its dot literal.
tests/playwright/specs/invite-member-email-case.e2e.js covers:
- an invite with a lower-cased address adds the stored colleague, and no
second account is made;
- negative: a similar but different address is not taken for them;
- the search returns the colleague past six disabled matches, offering none
of them.
Thanks to Raymond-Voogt and xet7 !
Fixes#6788.
The Security report in Finnish read "Sijainti" beside the English "IPv6
location", and the menu row and title bar of the Instrumentation report were
English in every language.
- The IPv6 location column is the translated 'location' with the fixed
technical suffix " (IPv6)" - "Sijainti (IPv6)" - through a new optional
labelSuffix on table headers, so no new key is needed.
- instrumentationReportTitle names the report in the menu row and in its
title bar, which tests/adminUrls.test.cjs requires to say the same words.
It is translated into all 246 locale files, after instrumentation-other
in en.i18n.json's key order. French uses "Instrumentation logicielle",
because the bare word is spelled exactly like the English one.
Low-confidence translations, written from the language's general
vocabulary for "measuring tools" where the technical term has no
established form: ak, ay, bm, bua, chr, cv, ee, ff, fj, gn, gv, ha, haw, ig,
iu, kl, kw, lg, mi, nah, nd, ny, om, qu, rn, rw, sah, se, sm, sn, ss, st,
tig, tlh, to, tpi, ts, ve, vo, wal, wo, zgh.
tests/addressReportColumns.test.cjs checks that every address column header
is translated. The admin-office-location UI spec expects "Location (IPv6)".
Thanks to xet7 !
Admin Panel / Problems / Security showed a sign-in from "Dinkelsbühl, DE".
Cloudflare sends cf-ipcity as raw UTF-8 bytes, and Node hands HTTP header
values over as Latin-1, one character per byte, so every city with a letter
outside ASCII was stored garbled.
geoHeaders reads a header value made only of byte-sized characters as UTF-8
when its bytes are valid UTF-8, before the existing percent-decoding. Real
Latin-1 that is not valid UTF-8, plain ASCII and percent-encoded names are
left as they were. Rows already stored keep the old text until their place is
seen again.
tests/geoHeadersUtf8.test.cjs: Dinkelsbühl, Zürich, Kraków, Москва, 東京, and
an end-to-end HTTP request carrying the UTF-8 bytes. Negatives: ASCII, a
percent-encoded city and genuine Latin-1 are unchanged. It fails without the
fix.
Thanks to xet7 !
Admin Panel / Problems / Security showed StorageBleed, "checked 12144 files in
900s; 0 changed, 0 with no record saying why; stopped early: this run has
used its time", 41 times: the background scan reported its own summary on
every run. A clean scan is the scan working, and the Security report is for
attempts. A summary that has nothing to sum up hides the row that matters.
The summary is recorded only when the scan found a changed or missing file,
beside those findings, which are still recorded one by one. A clean run,
including one that ran out of time and continues next time, is written to
the server log as "[file-integrity] ...".
tests/fileIntegrity.test.cjs pins the condition. Negatives: no unconditional
summary record remains, and changed and missing files are still recorded.
Thanks to xet7 !
Admin Panel / Problems / Security showed FileNameBleed, "uploaded a filename
carrying an exploit pattern; URL-encoded name", for a user who had only
opened a board of 2019 photos with Cyrillic names. Reading each file
repaired its stored percent-encoded name (the FileBleed "fileRead" rows,
correct and recorded once per file). The repair's reasons were then passed to
the upload canary, where "URL-encoded name" counted as dangerous. Browsers and
older WeKan percent-encode every non-ASCII name, so every such name tripped it.
- "URL-encoded name" is no longer a dangerous reason.
- What an encoding could hide is named from the decoded name instead:
sanitizationReasons() now reports "path traversal" and "null byte". Before,
"URL-encoded name" was the only thing an encoded "../../etc/passwd" tripped;
it now trips the path-traversal canary under its own name, which
DANGEROUS_REASON already listed but no reason ever produced.
- A name repaired while a file is read (source fileRead) never trips the upload
canary: the repair is still recorded, but it is not an attempt.
tests/filenameCanaryReasons.test.cjs loads the real module, with its server
dependencies stubbed:
- the Cyrillic name trips nothing;
- negatives: an encoded traversal and an encoded null byte still trip, and
markup in a name uploaded now still trips;
- a read-time repair is recorded without a canary.
Thanks to xet7 !
Admin Panel / Problems / Security reported HistoryIntegrity checksum-mismatch,
severity critical, 89472 times, on a board's history row nobody had touched.
Meteor connects to MongoDB/FerretDB with ignoreUndefined, so a content
property that is undefined is dropped when the row is stored. Writers record
such content routinely, for example `deletedAt: list.deletedAt` for a list
that was never deleted. The row's hash covered `"deletedAt":{"$undefined":true}`,
the stored row has no deletedAt, and every background audit found the row
failing its own checksum and reported it again.
- hashHistoryRow() hashes previousContent and newContent as stored: undefined
properties dropped, undefined array elements as null, as the driver does.
New rows verify as the database returns them.
- Rows written before this were hashed with the undefined keys. If the normal
check fails, the keys present in the other side of the change and absent
here are re-added as undefined, which reproduces exactly what was hashed;
nothing else is accepted.
tests/changeHistoryIntegrity.test.cjs stores rows through BSON with
ignoreUndefined, exactly as the driver does: a new row and a pre-fix row both
verify, and a changed value, a removed real value, a change on the other side
and an added key are still caught. The test fails without the fix.
A row that still reports checksum-mismatch after this release changed in a
way an unset value cannot explain, and is worth looking at.
Thanks to xet7 !
tests/releaseDownloads.test.cjs flags every workflow line that names curl
as a download that must go through releases/fetch.sh; infra_failure()'s grep
pattern named it only as text in git's error. 'RPC failed;' identifies that
error on its own. tests/snapLaunchpadInfraRetry.test.cjs still runs the
function against v12.56's 'RPC failed; curl 56' log.
Thanks to xet7 !
v12.56's ppc64el snap failed after 20 minutes of its five-hour budget. Attempt
1's Launchpad builder lost its TLS connection while cloning our source ("RPC
failed; curl 56 GnuTLS recv error ... fatal: early EOF"). Attempts 2 and 3
followed a minute apart each, and both met Launchpad's own "HTTP Error 503:
Service Unavailable" / "Error: Timeout". s390x, riscv64 and armhf each lost an
attempt the same night and recovered.
infra_failure() recognises an attempt that failed on Launchpad rather than on
WeKan: an HTTP 5xx or timeout from its API, or, in that attempt's own build
log, a dropped git/TLS transfer or the build farm's package proxy failing.
Such an attempt earns another one, up to six, after a pause of 5, 10, 15...
minutes, never running past the shared deadline. Every other failure keeps
three attempts and the 60s pause; a missing stage-package is not retried
longer.
tests/snapLaunchpadInfraRetry.test.cjs runs the workflow's own infra_failure()
against logs shaped like v12.56's, and against the negatives: a missing
stage-package, an earlier attempt's log, a 4xx.
Thanks to xet7 !
v12.56's Bun linux-x64 bundle failed its live smoke test: WeKan stopped with
"Topology is closed", because nothing listened on 127.0.0.1:27019. The
smoke-test MongoDB had been started with `docker run -d --rm` and never
checked, so a container that had died left no log behind, and the job could
not say why. linux-arm64 passed in the same run, and linux-x64 in v12.53, so
this happens only sometimes.
- bun.yml starts the container without --rm, and waits until it answers
a ping. If it does not answer within 60s, its state and log are printed.
- build-target.sh checks the port again right before it starts WeKan, with
the new releases/bun/wait-mongo.mjs (a plain TCP check, nothing to install).
The database holds only this test's data, so if it is gone, its log is
printed and a new one is started once. A second failure fails the job.
tests/bunSmokeMongo.test.cjs: URL parsing, the wait succeeding and timing
out, the workflow step and the single replacement.
buildScriptParity lists wait-mongo.mjs with the other Bun target-build
internals.
Thanks to xet7 !
The UI test of #6783 (inactive-users-last-active.e2e.js) still found "-" in
another user's row after the people publication started sending
lastConnectionDate. The table builds its rows from a client-side Users.find
with its own field list (peopleDocs), which left the date out. The row's
lastActiveAt read that copy before the full user document, so the date never
reached the cell. The projection keeps the field now. The two presence
helpers read the whole cached user, as userData() already does, so a field
missing from the projection cannot hide them again.
Verified with Playwright on Chromium against the dev server: the spec failed
before this change and passes with it. tests/lastActive.test.cjs pins both
halves and fails without this commit.
Thanks to Raymond-Voogt and xet7 !
Fixes#6783.
A check mark is not mirrored in a right-to-left language (#6786), so the
tick's rule uses border-right. The guard allows border-left/-right only inside
a rule whose selector is a checked state, the same definition
tests/rtlCheckMark.test.cjs uses. A border anywhere else, and any margin,
padding or float inside such a rule, is still refused.
Thanks to mimZD and xet7 !
Its wekan service must match the other compose files line for line
(tests/dockerComposeBackends.test.cjs): the setting moves from beside
ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS to after LOGOUT_ON_MINUTES, with the
Admin Panel note the others carry.
Thanks to Raymond-Voogt and xet7 !
Admin Panel / Problems / "Lists missing their swimlane" -> Restore binds each
list back to the swimlane positionHistory records it was created in. After
every new WeKan release, the startup schema upgrade re-checks old data, and
its merge-per-swimlane-lists step - written for the v7.98 era, which stamped
lists to the default swimlane and duplicated them per swimlane - took those
lists for that era's damage. It ran when a board had two lists of one title
or one list with cards in another swimlane, and then un-bound every list on
the board, the restored ones included. So after each upgrade the count came
back to exactly the same number.
A list bound to the very swimlane it was created in, with none of its cards
in another swimlane, is per-swimlane by design: it is what Restore puts back,
and not a v7.98 stamp, which was applied after the list existed. The step now
leaves those lists out of its check, its merge and its un-binding, so a board
of only such lists does not trigger it. Stamped lists, lists whose cards are
in other swimlanes, and lists bound anywhere but their record are handled as
before. Lists already un-bound by an earlier upgrade are restored by pressing
Restore once more, and now stay.
tests/schemaUpgradeSteps.test.cjs: the issue's board (restored lists kept, a
stamp on the same board still un-bound), a by-design board not triggering the
step, and the two negatives. The first fails without the fix.
Thanks to mimZD and xet7 !
Fixes#6787.
The tick is a box rotated 40 degrees, drawn by its bottom and side borders,
and the side was border-inline-end. A right-to-left page puts that on the
left, so the rotated corner opened the other way and every checked checkbox
showed "<" - the Admin Panel's bounced-email table in Persian, in the issue.
A check mark is not mirrored in a right-to-left language, so all 25 rules
that draw one - the shared materialCheckBox, checklists, subtasks, the
sidebar, the Admin Panel and every board theme's colour - use border-right
and border-left now. Where the box sits stays logical.
tests/rtlCheckMark.test.cjs fails if any checked state anywhere in client/
draws its tick with a logical border. tests/playwright/specs/rtl-check-mark.e2e.js
compares the computed borders in ltr and rtl. customFieldsSectionMenu's guard
now expects border-right, and its comment says why.
Thanks to mimZD and xet7 !
Fixes#6786.
Admin Panel / People showed "Last active" as "-" for every user but the
administrator: the people publication did not carry lastConnectionDate.
USERS_DISABLE_INACTIVE_AFTER_DAYS disables, once a night, accounts that have
not used WeKan for that many days, and revokes their logins. Admins are
never disabled. An account with no recorded activity starts its count on the
first run rather than from createdAt, and re-enabling an account restarts it.
The setting is in Admin Panel / People / Login as well as in the
environment, and the job resolves it every night, so a change there needs no
restart. Every platform's settings file lists it.
LDAP background sync looked a user up by id without LDAP_USER_SEARCH_FILTER,
so an account the filter excludes - one disabled in Active Directory - could
not log in but was still "found". It was never disabled, and a manual
disable was undone on the next run. The filter is now ANDed into the lookup.
An account disabled for inactivity is not re-enabled by the sync.
From the patch by Raymond-Voogt, with the setting moved into the Admin
Panel's login settings. Tests: tests/inactiveUsers.test.cjs,
tests/ldapBackgroundSync.test.cjs, tests/ldapUserIdFilter.test.cjs,
tests/authConfigCatalog.test.cjs and
tests/playwright/specs/inactive-users-last-active.e2e.js.
Thanks to Raymond-Voogt and xet7 !
Fixes#6783,
Fixes#6784,
Fixes#6785.
release-all's glibc "AppImages" call passed no `only`, so it built the musl
rows too, and both groups had an "AppImage x86_64" and an "AppImage aarch64".
Two jobs of one name write to one directory of the run's log archive, whose
files then ask to be overwritten or renamed when it is unpacked.
- The glibc call builds x86_64, aarch64, i686 and armhf only. The musl pair
stays with the "musl AppImages" call, which waits for the musl bundles.
- The job is named by its file's architecture, so it is "AppImage
x86_64-musl", which the publish step's "see the AppImage <arch> build job's
log" names too.
- The publish step checks only the architectures its own run builds. The musl
run warned that the four glibc AppImages were missing.
tests/muslBundles.test.cjs checks that no two matrix rows share a name, and
that each row is built by exactly one call.
Thanks to xet7 !
v12.54's armv7 single file failed with std::bad_alloc on all three attempts
of the retry added for armhf in v12.53, so the failure is not intermittent.
--build-sea injects with LIEF inside the Node.js that runs it, and a 32-bit
target's blob must be written by a 32-bit Node.js. The executable, the
180 MiB archive and LIEF's copies of both do not fit that process's address
space.
For a 32-bit ELF target the i386 Node.js now writes only the blob
(--experimental-sea-config: the same blob, no LIEF), and the new
releases/single-file/sea-inject-elf.py injects it with LIEF 1.0.0 from PyPI,
the version Node.js vendors. It ports InjectIntoELF() and MarkSentinel()
from src/node_sea_bin.cc step for step. Its output is byte-identical to
--build-sea's, for a non-PIE x64 Node.js and for the PIE node-armv7. win32
(PE) and 64-bit targets keep --build-sea. The retry is removed.
tests/singleFileSeaInject.test.cjs checks the split and the workflow's LIEF.
Where a Python with LIEF 1.0.0 is available it builds both ways, compares
them byte for byte, runs the result, and checks that an executable that
already carries a blob is refused.
Thanks to xet7 !
Every x86_64 musl AppImage of v12.53 failed to start in a bare Alpine:
"Error loading shared library libatomic.so.1". node-runtime held only
libstdc++ and libgcc_s; the build container had libatomic through g++, so the
bundle's own smoke test passed.
build-bundle.sh now copies every NEEDED library of bundle/node except musl's
libc, and AppImage.yml checks each is in node-runtime before packing.
Thanks to xet7 !
The v12.53 armhf single file failed with std::bad_alloc in --build-sea. A
32-bit target is injected by the 32-bit i386 Node.js, and the executable,
the 180 MiB archive and LIEF's copies of both come near its 4 GiB address
space. armv7 and armv6, same archive and host, built in the same run, and
armhf built in v12.52, so the failure is intermittent.
buildSea() runs it up to three times when, and only when, it fails with
std::bad_alloc, removing the partial output between attempts. Any other
failure stops at once.
Thanks to xet7 !
Every Android bundle of v12.53 stopped in npm-rebuild.js: "sh: 1:
node-gyp-build: not found". Termux has no /usr/bin/env, so a
"#!/usr/bin/env node" script runs only through termux-exec, an LD_PRELOAD
library that Termux's login exports. The workflow starts bash directly,
without login.
build-bundle.sh exports termux-exec's library the way login does, newest
generation first, and keeps it only if a program still starts with it.
Thanks to xet7 !
The activity hook delivered webhooks through Meteor.call('outgoingWebhooks'),
and that method trusted a call without this.connection as the server's own.
Meteor gives a server-side Meteor.call the userId AND connection of the method
it runs in (ddp-server applyAsync), and a card moved from a browser runs in
that browser's method. So the server's own act-moveCard delivery arrived as a
client forging one: it was recorded as ssrf.webhook-forge (high) with the
mover's userId, and blockOnSecurityEvent set loginDisabled.
- deliverActivityWebhook() in server/notifications/outgoing.js is the server's
delivery: a function, not a method, so no client reaches it and no inherited
context changes it. It reads the integration again (enabled) and names the
activity's actor. server/models/activities.js calls it through safeDeliver.
- The outgoingWebhooks method treats every call as a client's: only the
card-opened notification, rebuilt from the card, as before for clients.
- Server deliveries no longer need the actor to be a member of the hook's
board, which also skipped a global webhook ('_global' is no board) and an
activity with no method behind it (REST, timers).
- securityLog.record() now passes the catalog key and blocksAccount to the
block decision. The stored row carries neither, so every 'high' blocked row
disabled whoever it named: a hook refused for its own internal address
disabled the mover too, and ssrf.redirect/ssrf.attachment's
blocksAccount: false never applied. ssrf.webhook is now blocksAccount:
false - the person whose move sent it did not write the hook's URL.
tests/hookBleedServerDelivery.test.cjs: the move delivered with nothing
logged, in an inherited context too; a forged call still refused, logged and
blocking; the card-opened notification; failing and internal hooks blocking
nobody, through record() itself; and a whole-tree scan that no server code
calls a this.connection-gated method from inside a client's method without
clearing the invocation. tests/playwright/specs/hook-bleed.e2e.js moves a
card through the Move dialog with a webhook enabled.
Thanks to do4me and xet7 !
Fixes#6782.
bsdBundles pinned bsd.yml's FreeBSD VM to the old commit; it now reads the
pin and requires node-patches to use the same one, which it now does.
sqrl required qrcode-generator 1.4.4 exactly; it now requires an exact pin,
and 2.0.4 was checked to give sqrlQrSvg's call the same SVG.
Thanks to dependabot and xet7 !
v12.51's i386 single file stopped with std::bad_alloc and freebsd-x64's with
"Failed to relocate ELF program headers": the i386 Node.js is a PIE with
R_386_32 relocations LIEF does not adjust, and the FreeBSD one a non-PIE with
two bss-like segments. releases/single-file/sea-inject.mjs reads that from
the ELF before anything is built, build.mjs exits 3 with the reason, and
single-file.yml turns it into a notice. wekan/node-patches now builds both
the way the injection needs.
A target that was not built leaves a one-line artifact saying why, so its
Start job no longer logs "Artifact not found" errors and publish does not
warn about it as unstarted.
Thanks to xet7 !
Every musl AppImage of v12.51 died at once in Alpine: "Error relocating
.../bundle/node: _ZTVN10__cxxabiv117__class_type_infoE: symbol not found".
The musl Node.js is linked against GCC's C++ runtime, which musl.yml's own
Alpine had installed for building, and a user's Alpine does not. The bundle's
node-runtime now holds that Alpine's libstdc++.so.6 and libgcc_s.so.1 with a
license notice, start-wekan.sh puts it on the library path as for libatomic,
and the AppImage workflow requires both files of a musl bundle.
Thanks to xet7 !
Every Android bundle of v12.51 stopped with EPERM: npm chmods each package's
bin when it installs (uuid/dist/bin/uuid), and only a file's owner may chmod
it - a+rwX on the bind mount was not enough. android.yml reads the uid of
Termux's user from the image, chowns the checkout to it before the rebuild,
and takes it back before packaging. An unreadable uid stops the job.
Thanks to xet7 !
js/incomplete-multi-character-sanitization in
tests/templatesAreRendered.test.cjs: the test removed template declarations
and Template.<name>.helpers/events/onCreated/onRendered/onDestroyed from the
source it scans with a single replace each, so removing one could splice its
neighbours into another (and CodeQL read the remains as a possible on...
attribute). Both removals now repeat until nothing changes, the fix used for
alerts #545 and #570-#582.
tests/tagStrippingFixedPoint.test.cjs keeps the shape out of the whole tree:
it now also finds a multi-character removal of an on<Capital> name outside a
fixed-point loop, and proves it catches alert #588's code and passes the
loop. The code is a test's source scan, never run on user input, so nothing
reaches Admin Panel -> Problems.
Thanks to GitHub CodeQL and xet7 !
The theme follows Apple's Liquid Glass: the two header bars, swimlane
headers, lists, minicards, the opened card, the sidebar and popups are
frosted glass over the pastel mesh - a translucent fill,
blur(24px) saturate(180%), a rim of light along the edges (inset highlights,
brightest on top), a diagonal sheen and larger rounded corners. The header
bars are glass now instead of solid blue, with dark text; blue is kept for
the primary action, glossy, and for what is active. Reduce transparency, or
a browser without backdrop-filter, gets near-opaque surfaces.
A new UI test, theme-appleglasspastel-contrast.e2e.js, measures every text
and icon against what is really painted behind it - it hides the text,
screenshots, and reads the pixels under each box - to WCAG AA (4.5:1 text,
3:1 large text and icons), on the board, the opened card, the sidebar, the
board menu and All Boards, at laptop and phone size. It found and the theme
now fixes: white header buttons, icons, username and the stock logo on the
glass; the sidebar hamburger forced white by boardBody.js's accessibility
style; grey #808080 sidebar headings (3.8:1); #a6a6a6 icons (2.4:1); faint
Add Card; white text on the pale-blue hovered menu row; and the list
headers list.css pins grey with !important.
The header guards headerBars and themeAccents now compare a bar's whole
background, so a glass gradient counts, and list appleglasspastel as a glass
header whose accent is its primary blue.
Thanks to xet7 !
Card menu -> Drawing -> Open as whiteboard opens the drawing under the header
bar, over the opened card, with the drawing's and Red Strings' own tools -
the seven colours and four widths, Undo, Clear and Save picture. The 800 x
500 drawing is scaled to the screen, so a line lands in the same place on a
phone and on a 55" screen; Escape or x closes it.
Several people draw at the same time: each line is sent when the pen lifts
as one atomic $push into that drawing (cards.whiteboardAddStroke), with its
own id and its author, and the card's publication brings it to everyone who
has the drawing open; the line stays drawn locally until it comes back.
Undo and Clear take away only the caller's own lines, Save picture writes
only the drawing's PNG, so nothing anybody else is drawing is overwritten.
Who may draw is who may edit the card; the others watch. A Board Settings /
Card row, Whiteboard, hides it on a board, and the Admin Panel's Card fields
everywhere. The drawing popup's PNG upload is shared with Save picture.
Translated in every language.
Thanks to xet7 !
The last three of the features other kanban apps call AI, done with plain
code (docs/Features/General/Assistants/Assistants.md):
- Checklists -> From description: the list lines of a card's description
("- ", "* ", "1. ", task boxes; never inside code blocks) previewed, then
made into a checklist - ticked where the line was [x] - or into subtasks
through addSubtaskCard.
- Create cards from action items, on a comment and in the card menu for its
description: "TODO: ...", "- [ ] ..." and "@user ..." lines become cards
at the top of the card's list, linking back to it, with the mentioned
user as member when they are an active board member.
- Global search understands plain phrases in the reader's language - "my
overdue cards", "due this week", "unassigned cards" and seven more - and
runs them as its operators, saying which; a query with an operator in it
is never rewritten.
Checklist from description and Action items are Show on Card rows of Board
Settings / Card and of the Admin Panel's Card fields; Search phrases is an
Admin Panel / Settings / Visibility / Features tick. Translated in every
language.
Thanks to xet7 !
Five more of the features other kanban apps call AI, done with plain code
(docs/Features/General/Assistants/Assistants.md):
- Board menu -> Summary: what each person did in the last day or week -
done, moved, added, commented - and what they have overdue, from the
activities and History; Copy as text gives Markdown with card links.
- Board menu -> Since your last visit (N): what others changed since the
visit before this one, by card. The visit is kept in profile.boardVisits,
at most 500 boards.
- At risk: a weighted score of overdue, due soon with little done, blocked,
idle in a middle list and sent back; a triangle on the minicard and the
reasons in the opened card.
- Suggested members in the Members and Assignees popups, from who handles
the same labels, list and swimlane.
- Forecast done date: the 50th and 85th percentile of the board's cycle
times, counting only the cards that took at least as long as this one
has been open. The server sends the times once per board, numbers only.
Summary and Since your last visit are features of Admin Panel / Settings /
Visibility / Features; At risk, Suggested members and Forecast are rows of
Board Settings / Card and of the Admin Panel's Card fields. Every server
answer applies the board's read rules and the assigned-only role.
Translated in every language.
The guards of the earlier helpers are brought up to date as well: the date
words of models/lib/titleDueDate.js are a reviewed RegExp site,
server/methods/ruleSuggestions.js is a board-admin-only path, the Rules
page's list branch carries the suggestions, and Tigre's new strings use its
own word for a board.
Thanks to xet7 !
Board menu -> Rules shows Suggested rules above the rule list: when the
same person does one thing to a card and, within two minutes, another, that
pair is counted once per card, and a pair seen on three cards in the last 30
days is offered as a rule (moved to a list -> label, member or archive;
added to a list -> label or member; label added -> member). A pair a rule
already does is not offered. Create goes through rules.createRule with the
same trigger and action the wizard builds; Dismiss hides one suggestion for
that admin on that board (profile.dismissedRuleSuggestions).
Only board admins get suggestions, and Admin Panel / Settings / Visibility /
Features has a Rule suggestions tick that turns them off, on the server too.
Translated in every language.
Thanks to xet7 !
Two of the features other kanban apps call AI, done with plain code
(docs/Features/General/Assistants/Assistants.md):
- A due date typed at the end of a new card's title ("... tomorrow 14:00",
"huomenna klo 14", "friday 9:30", "in 3 days", "23.10.") becomes the card's
due date, read with the browser's own Intl tables so every language works.
A hint under the field shows the date, and its x keeps the words. The
opened card's title reads it too, but only when the title changed.
- Similar cards: letter triples and the Dice coefficient (letter pairs for
scripts without spaces). The add-card form lists up to three close cards,
marking a possible duplicate, and the opened card has a Similar cards
section. The server method applies the board's read rules and the
assigned-only role.
Both are rows of Board Settings / Card and of Admin Panel / Settings /
Visibility / Features / Card fields, so a board admin or a site admin can
hide them. Translated in every language.
Thanks to xet7 !
The page listed up to 200 methods and publications on 11 pages. Above the
table there is now one bar per area - Settings, Login, People, Boards,
Cards, Lists, Notifications, Attachments, Problems and the rest - its length
the area's calls against the busiest area's, its red end the share that
failed, with the calls, the average duration and the errors beside it.
Clicking an area shows only its operations in the table; clicking it again
shows all.
models/lib/instrumentationAreas.js groups an operation by the first area
whose pattern matches its name, and weights an area's average duration by
completed calls. tests/instrumentationAreas.test.cjs checks the grouping
against all of WeKan's 614 methods and publications - "Other" holds three -
and the summary arithmetic. The labels are existing translation keys, apart
from the new instrumentation-other ("Other"), translated into every
language. The Finnish "cards" heading read "Korttia" (the form after a
number) in every place it is used as a heading or label; it is "Kortit".
The bars are HTML and CSS, one grid with subgrid rows so names, bars and
numbers line up; the viewport matrix checks the page at every device size.
Thanks to xet7 !
Admin Panel / Settings / Shared labels chose a colour from a dropdown of
colour names. The board label popup's picker - the palette swatches and the
custom colour wheel - is its own template now, labelColorPicker, and the
popup and every Shared labels row use it; a custom colour is saved as its
hex, which the server already accepted. A pick reaches the row through an
object with set(), because Spacebars calls a function argument instead of
passing it.
The swatches grow to fill their row, so on the wide admin page their width
followed the window. There they have the size they have in an opened card's
label popup, 54 x 33px, at every window width.
tests/sharedLabelsColorPicker.test.cjs pins the shared picker and the size;
tests/playwright/specs/shared-labels-color-picker.e2e.js picks a swatch and a
custom colour, saves both, and measures the swatches at 1366, 1920 and
2560px.
Thanks to xet7 !
The add-list form's alternatives are one span.quiet each in .edit-controls,
a flex row; a flex item drops the space its text begins with, so it read
"or Templateor link a list from another board". Adjacent .quiet spans get a
margin between them instead.
Every dev-server start also warned "missing space before text for line 26"
of editor.jade: inlineViewer had a bare {{> UI.contentBlock }} line under
+viewer. It is +Template.contentBlock, as elsewhere.
tests/jadeCompilesClean.test.cjs compiles every client template with the
build's own Jade compiler and fails on any warning or error.
Thanks to xet7 !
The foldable in the screen-size test was a Galaxy Z Fold 7 standing in for
the iPhone Duo. Apple's specs (apple.com/iphone-duo/specs) give its inner
7.6" display as 1878 x 2670 px at 430 ppi and its outer 5.4" display as
1398 x 2034 px at 460 ppi; at the 3x of every current iPhone that is
626 x 890 and 466 x 678 CSS pixels, and the screenshots come out at exactly
Apple's pixel sizes. Both displays are tested upright and on their side with
the iPhone user agent and touch; all 40 checks pass.
Thanks to xet7 !
tests/playwright/specs/viewport-matrix.e2e.js opens WeKan as an iPhone 15,
an unfolded Galaxy Z Fold 7, an iPad Pro 11, a 1366x768 laptop and a 55"
4K touch panel, each upright and on its side, and checks the board header,
board menu -> Original positions, Problems -> Memory Usage and Disk usage,
the Table, Calendar Mode, Time, Timeline and Map views, and dragscroll by
mouse or by finger. It measures that icons and texts are on screen and not
drawn in the colour behind them, that the page never scrolls sideways, that
every column can be reached and stays readable; screenshots of each step go
to .tools/log/viewports/. What it found, fixed:
- iPhone: the header bar was width: 100% plus its side padding as a content
box, 24px wider than the screen, and the sidebar hamburger sat past the
right edge. It measures its padding inside now.
- Admin Panel left menu on a phone: the list's disc bullets showed as a dot
after every entry, and a rule between groups shrank to a dash beside an
entry. No bullets, and each group starts a row of its own.
- Admin tables: 13 equal columns were 25px each on a phone and 42px on an
upright iPad, every header one letter per line. Up to 1024px a column keeps
a readable floor and the table scrolls sideways in its wrapper.
- Table view: the title-wrap and swimlane-group toggles were white icons on
white - two empty squares - stretched to 72px by the global button padding.
And on an upright iPad or foldable, Members, Labels and the date columns lay
past the edge of an overflow-hidden board with nothing to scroll; the view
scrolls sideways itself now.
A swipe that starts beside a list's resize handle resizes the list, as it
should, so the dragscroll check starts where a person pans. The file runs in
Chromium only: device emulation and the touch swipe exist only there.
Thanks to xet7 !
fixedVulnerabilityClasses reads entry.path as an archive entry and asks for
a containment check; the disk monitor's loop variable was only named that.
Thanks to xet7 !
Where each swimlane, list and card was put when it was made has been
recorded on creation for a long time, and shown by nothing: the two
templates for it were drawn nowhere, every string was English and they
printed raw ids, and the client helpers beside them were never called.
Board menu → Original positions (after Archive, open to everyone who sees
the board) opens originalPositionsSidebar: Swimlanes, Lists and Cards, each
by the name it has now, Moved when it is no longer where it was put, where
it was put by the names those have now, the title it was made with when that
changed, and when. The server already narrows the history to what the
reader may see, assigned-only roles included.
The text is existing translation keys plus one new one, original-positions,
translated into every language. models/lib/originalPositions.js builds the
groups and is tested without Meteor; the old templates, the per-item
component and the uncalled helpers are removed, and the design page is now
the feature's guide.
Thanks to xet7 !
The RAM and Disk usage pages were designs that no code carried out. Both
monitors now run beside the CPU one and, like it, record only the start and
the end of a sustained high-usage period:
- Memory: RAM from /proc/meminfo's MemAvailable - os.freemem() is MemFree,
which counts the page cache as used and shows a healthy server as full -
and swap, which alone also starts a period. Without /proc/meminfo it uses
what Node reports. Settings WEKAN_RAM_* and WEKAN_SWAP_HIGH_PERCENT.
- Disk: each filesystem WeKan writes to - the files root, its temp directory
for uploads and the snap's data directory - measured once per device, with
an episode of its own. WEKAN_DISK_WATCH_PATHS replaces the paths.
- Each report has a live line above its rows and a URL
(/admin/problems/ram, /admin/problems/disk). The menu and titles use the
existing memory-usage and sandstorm-disk-usage keys, which every language
translates, and the Summary names the cpu, ram and disk streams.
Observe and report only, as designed. The three monitors share one event
recorder (server/lib/resourceLog.js) and one intEnv (models/lib/intEnv.js),
which three files had each defined. The pure halves are tested without
Meteor, and resourceMonitorsWiring checks the wiring and that no copy of
either shared piece returns.
Thanks to xet7 !
Each was described only in Board Settings / Board View. Their guides are
written from the templates and the server code: what each shows, every
control, what can be changed and who may change it, where its settings
live, and the files and tests behind it. Board-Header/README.md links them,
boardViewSettings fails when a Board View entry has no guide of its own, and
TODO Later loses the gap and the code-to-combine item that is done.
Thanks to xet7 !
- Calendar, Calendar Mode and Multi Board Calendar showed archived cards
once the Archive sidebar had loaded them; every calendar selector leaves
them out now.
- Timeline offered "Restore to this state" to every viewer, and a refused
restore vanished, since nothing awaited it. The button is shown to those
who may change the card, and a refusal is reported.
- Table: a swimlane header row spanned a fixed 11 columns, one short with
all four date columns and too wide on a phone; it spans the columns the
table has. Its add-card error was an English sentence.
- Map showed the raw "upload-failed" for a failed upload; it is translated.
- client/lib/errorMessage.js turns a failed call into a message in the
reader's language: the translation when the error code is a translation
key, otherwise the translated "Something went wrong" with the server's
reason after it. 25 alert() calls with their own English fallback use it.
tests/errorMessageI18n.test.cjs runs the helper and fails on an alert()
that falls back to English again; calendarFilter tests the archived cards
for all four selectors.
Thanks to xet7 !
fileIntegrityScan.js asked cpuMonitor for currentCpuPercent, which it never
exported, so cpuPercent() was always NaN: the hourly scan never skipped a
busy hour and every finding recorded cpuPercent NaN. It reads
getCurrentCpu().percent now.
Five files imported names their modules do not export - UserAvatar,
AttachmentStorage and Settings as a named import - none used; they are
removed. tests/namedImportsExist.test.cjs checks every named import and
destructured require of an app module against what that module exports.
Thanks to xet7 !
Both views wrote out the same FullCalendar options - first day of the week
and the week numbers that follow it, time formats, the one-row toolbar,
translated button labels, height, locale and direction - about fifty lines
each. models/lib/calendarBaseOptions.js builds them once, given the
translation, the user's first day and the display options, and each view
adds only what differs: dragging and selecting, navLinks, business hours
and its events.
The tests that read the toolbar or the direction from boardBody.js read the
shared module, and the Multi Board Calendar runtime test runs it for real.
Thanks to xet7 !
Template.swimlane and Template.listsGroup each built the same jQuery UI
sortable for their row of lists - options, placeholder sizing, dragscroll
pause and the autorun that follows the drag-handle and permission changes -
two copies of about fifty lines. initListsSortable builds it once and, as
listsGroup already did, replaces a sortable already on the element.
The guards that counted three list sortables count the shared one and check
that both templates call it; each is still gated by canModifyBoard().
Thanks to xet7 !
Received, Start, Due and End were each written twice in cardDate.js, once
for the opened card (card*Date) and once for the minicard (minicard*Date):
the same field, the same colouring, the same title and the same editor,
eight copies of about 40 lines. CARD_DATE_KINDS describes each date once
and both templates are built from it; only the due date counts down, as
before. cardDate.js goes from 596 to 410 lines.
The tests that matched each template's own helpers block read the
CARD_DATE_KINDS entry instead, and still fail if Received, Start or End
gains the countdown.
Thanks to xet7 !
The members widget and the add/remove organization and team popups of the
Right sidebar each built the same onCreated state by hand - error and
loading flags, a paged subscription and setError/setLoading/isLoading - five
copies of about 25 lines. initGroupPickerState builds it once; each picker
keeps the publications it subscribed to before.
Thanks to xet7 !
#5729's fixed (same) width for all lists is read by list.js and turned on
from the list header menu in listHeader.js, and each carried the same five
localStorage/profile helpers. They are client/lib/fixedListWidth.js now,
with the same storage keys, so a viewer's saved choice still applies.
tests/fixedListWidthShared.test.cjs fails if a client file grows its own
copy again.
Thanks to xet7 !
Without an account the browser keeps the board view, and client/lib/utils.js
had two hand-written copies of the view list for it: setBoardView stored
any of them, but storedBoardView's copy lacked Product Backlog, Sprints,
Sprint Report and Velocity, so those opened as Swimlanes after the reload.
Both now ask isKnownBoardView, i.e. BOARD_VIEWS, which removes the two
lists (about a hundred lines) and the drift with them.
The guards that counted view names in utils.js check the isKnownBoardView
calls instead, and boardViewMenu fails if a hand-written list returns.
Thanks to xet7 !
- models/cards.js defined assignMember ... toggleAssigner twice in one
Cards.helpers({}); in an object literal the last key wins, so the first
twelve methods (about a hundred lines, with their own linked-board
branches) never ran. models/users.js had two copies of the swimlane-height
storage helpers, and the header's event map an empty
'click .js-open-bookmarks' the real handler replaced. Each first copy is
removed; what runs is unchanged.
- An Admin Panel attachment settings pane: attachmentSettings.jade (four
templates) and about 300 lines of settingBody.js for S3, transfer limits
and storage paths. No menu opened it and no template drew it; Admin Panel /
Attachments (attachments.js) is the one in use.
- Templates drawn by nothing: dateBadge, dateCustomField and
cardCustomFieldDate with its JS, orgAvatar and teamAvatar, the three
*ModalTitle templates of My Cards, Due Cards and Global Search, boardLists,
boardCreateRulePopup, addMemberPopupTest, and subtasksItems with the two
templates only it used.
- CSS repeated word for word: accessibility.css opened with a copy of
myCards.css's first 74 lines; list.css repeated its 768px collapsed-list
block at 1024px and 1200px, which 768px already covers; boardHeader.css
repeated its .mobile-mode rules inside a 801px media query. The later
copies decided nothing, so the result is the same.
tests/noDuplicateObjectKeys.test.cjs parses every app and package file and
fails on an object literal that defines a key twice, and
tests/templatesAreRendered.test.cjs fails on a template nothing draws,
apart from runtime-built names and three listed exceptions. Tests that read
the removed copies now read the code that runs.
Thanks to xet7 !
getMembersToMap (models/wekanmapper.js) is async, and cloneBoard kept its
Promise and called membersMapping.forEach on it, so every clone through
that method stopped with "membersMapping.forEach is not a function". The
board menu clones with copyBoard, so this was the cloneBoard method only.
WekanCreator carried an identical getMembersToMap that nothing called; it
is removed, leaving the one in wekanmapper.js.
tests/asyncResultAwaited.test.cjs resolves, file by file, every variable
assigned from an async function - declared there or imported async - and
fails when it is then used as an array or object without await.
Thanks to xet7 !
- Three snap set lines named keys the snap does not have, which snapd
stores without a word: MONGO_OPLOG_URL (the key is mongo-oplog-url),
oauth-enabled (oauth2-enabled) and "snap set wekan set disable-mongodb".
tests/docsSnapKeysExist.test.cjs checks every snap set in the docs
against the KEY_ names in snap-src/bin/config.
- Adding-new-Snap-settings-to-code.md used setting names that do not
exist (LDAP_ENABLED, LDAP_SEARCH_FILTER, a wrong KEY_ line), the edge
branch and Travis CI. It now follows the real config and wekan-help
entries, says that a login setting goes through the Admin Panel catalog
and authEnv(), and lists the other platform files a setting belongs in.
- The LDAP and Traefik Docker examples ran MongoDB 3.2/4.0 with
--smallfiles, which MongoDB 4.2 removed, and WeKan images from 2018. They
use mongo:7 and ghcr.io/wekan/wekan:latest; Traefik stays at v1.7, since
that guide's labels and traefik.toml are v1 syntax.
- The Windows page no longer sets RICHER_CARD_EDITOR, which WeKan does not
read, and points to build.bat for building from source.
Thanks to xet7 !
The notifications drawer subscribed to 'notificationsAttachments', while the
server publishes 'notificationAttachments'. Meteor reports nothing for an
unknown subscription, so it never became ready and an attachment named in a
notification was never sent to the drawer.
Six template keys did not exist in en.i18n.json, so the page showed the key
itself: the Due group of the sidebar filter ("dueAt"), the Scrum sprint form
("end", "no-cards", "custom-field"), the Jira estimate field on import, the
passkey trash icon ("remove") and two webhook URL fields ("URL"). Each now
uses the existing key with that wording, so every language that already
translates it shows it translated.
tests/subscriptionsArePublished.test.cjs checks every subscribe() in the
tree against every publication, and tests/templateI18nKeysExist.test.cjs
every literal key of every template against en.i18n.json.
Thanks to xet7 !
A feature's guide now sits under the menu it is used from, read from the
templates rather than from where somebody once put it: Header-Bar,
All-Boards, Pages, Board-Header (search and every Board View), Board-Sidebar
(Board Settings, Filter, Members, Labels, Archive), Rules, Swimlanes, Lists,
Cards, Member-Settings, Admin-Panel and Login-Page. Topics used from several
menus (editor, history, theme, translations, email, troubleshooting) are in
General.
- Each area has a README mapping its menu entries to their guides and to the
template or server module that implements them. Board-Header/README.md
lists all 40 Board View entries with the template boardBody.jade renders;
five views (Table, Calendar Mode, Time, Timeline, Map) have no guide of
their own yet and say so.
- Board-View.md listed 25 views while BOARD_VIEWS has 40; it now lists all
of them with their English labels.
- Pages keep their file names. Where a released changelog links an old path,
a "# Moved" page stays there and points to the new one; test-menu.sh skips
folders holding only those.
- Undo was filed under Login; it is General/Undo now.
- Every link in docs, code comments, scripts and tests follows the move;
docsLinksResolve checks them all.
Tests that read a doc follow it to its new place. boardViewSettings now fails
when Board-View.md or Board-Header/README.md differs from BOARD_VIEWS, or
names a template boardBody.jade does not render.
Thanks to xet7 !
Found by following every import, re-export and require from client/main.js
and server/main.js (meteor.mainModule: only what that reaches is loaded) and
each local package's package.js:
- packages/wekan-fullcalendar/fullcalendar/ (88 files) and update.sh: the
vendored FullCalendar v3 and the script that updated it as a git
submodule; the package takes FullCalendar 5 from npm (Npm.depends).
- packages/wekan-fontawesome/fontawesome-free: js/, sprites/, metadata/,
attribution.js and the .min.css copies; package.js adds only the plain CSS
and the webfonts. Its package.json no longer names the removed files.
- models/lib/propagateMembers.js and models/lib/teamBoardMemberSync.js:
replaced on 2026-10-14 by models/lib/groupBoardMembership.js (memberships
that record their team or org, #4178), which the server uses. Their tests
exercised the old modules; the same scenarios now run against planGain /
groupChanges, and the wiring checks are kept.
- models/lib/recoveryPlan.js and its test: a model of the SQLite recovery
policy that nothing ran; releases/ferretdb/sqlite-recovery.mjs carries it
out and tests/sqliteVerifiedRecovery.test.cjs tests that. The Recovery
design page says so.
- packages/wekan-ldap/server/configResolver.js: a vendored copy nothing
imported - the LDAP package reads its settings through the app's
accessor. Its sync test is now a check that no package carries such a
copy; three comments that sent readers to it explain the reason instead.
docs/Design/TeamsOrganizations.md also said losing a team removes nothing;
since #4178 a team takes back what it gave.
Thanks to xet7 !
package.json sets meteor.mainModule (since 2026-03-22), so the server runs
only what an import chain from server/main.js reaches. Three modules added
after that were never imported, so they never ran, while their tests - which
read the file - passed:
- server/loginTimingNormalization.js: the DDP `login` half of the LockoutBleed
timing fix (GHSA-2g94-9x3m-hv37). Only the REST login was equalized, so the
web login's response time still told whether a username exists.
- server/cardRecurrenceSchedule.js: the hourly job behind a card's
Recurrence setting; the setting was saved and nothing ever recurred.
- server/productNameCache.js: the Admin Panel product name for the snap's
pages shown while the database is down.
They are imported in server/imports.js beside their related modules. The
Meteor internals the login handler uses (Accounts._loginHandlers,
_checkPasswordAsync, _findUserByQuery) exist in this Meteor release.
tests/serverModulesLoaded.test.cjs follows the import chain from
server/main.js and fails when any server module that registers something at
load time - a startup hook, methods, publications, a cron job, a login
handler or a route - is not reached; it fails on the old imports.js.
Thanks to xet7 !
A custom role from Admin Panel -> People -> Roles reaches every board view
through the same two questions as a built-in role: what the member may do is
asked of the capability table, which answers from the custom role, and which
cards they see is asked of the member's flags, which the custom role writes.
fallbackRoleFor() picks only among built-in roles that see no more cards, so
a role whose "Sees all cards" is off always mirrors an assigned-only role and
one with it on never does. The flags are written when a member gets the
role, rewritten on every board when the role is saved, replaced with the
custom role by setMemberPermission, and kept when the role is deleted; no
other code writes them.
tests/boardRoleViews.test.cjs builds a member for all 32 capability
combinations as the server writes it and checks that the card scope, the
card rule, REST reads and writes, button rules and the real Email View
selector narrow them exactly when the role does not see all cards, and that
nothing sets a role flag without the custom role following.
server/lib/tests/customBoardRoles.tests.js turns "Sees all cards" off and on
for a role in use and checks its member becomes assigned-only and back
(meteor test; not run here). docs/Features/Members/Roles.md explains it in
"Custom roles in every board view".
Thanks to xet7 !
docs/Features/Members/Roles.md gains "Roles in every board view": a role is
the member's on the board, not the view's, so every view, the API and every
write ask the same code. A table names each of the 40 board views and the
server source it reads - the board publication, the table page, Scrum, board
status, activities, the Email and Chat views - and what an assigned-only
member gets from it; the board report charts are refused to them, as exports
are, because they are computed from every card. Then search, All Boards,
notifications, position and change history, exports, REST and writes, what
is recorded in Admin Panel -> Problems, and the tests that keep a new view
from skipping the rule. The old "Which cards they see" paragraph, which
named only the board publications, points to it.
Thanks to xet7 !
AssignedBleed follow-up, GHSA-r4gm-mjj9-g3x8. An assigned-only member
(isNormalAssignedOnly, isCommentAssignedOnly, isReadAssignedOnly, and custom
roles through those flags) sees only the cards assigned to them. The Board
Email View checked board.isVisibleBy() alone, so it published the title,
description and email metadata of every card in a list or label, counted
them, and searched them. It now merges assignedOnlyCardScope into its folder
and search selector for the page and the count, and a reply on another card
is refused.
An audit of every path that returns or changes a card found the same shape -
"a member of the board, so every card of it" - elsewhere, all fixed here:
- reads: the board publication's ancestor cards, linked source cards with
their subtasks and dependency targets, and comment reactions; All Boards
tile counts; a board's activities from linked boards; the Chat view and
the All Boards feed, which also let card MEMBERS through (assignees is the
rule); My Attachments' card; GET /api/user/cards; position history of a
card; the cross-board subtask picker; Scrum rollover counts; and the
notification publications, which kept sending the full documents of cards
named in old notifications - also to members removed from the board;
- writes on a card the member cannot see: the canonical
canEditCardOrLinkedCard / editableCardIds (every Cards.allow update,
checklists, items, attachments, text notes, custom fields, the shared
description, card methods) now ask the card - the role's `write` is a
board answer, and the card is read when a caller passed it without
assignees; DDP and REST comments, button rules on a card, checklist moves,
issue state, watching, the card-opened webhook, moveBoardObjects,
moveSwimlane and attachment moves;
- REST writes: checkBoardWriteAccess refuses assigned-only members, as
checkBoardAccess already does for reads - those routes act on any card,
list or swimlane by id. The GHSA-f396 canary still fires for a role
without the write capability.
A refusal no view would produce is recorded under AssignedBleed in Admin
Panel -> Problems (authz.assigned, medium: never disables); opening a view,
searching and REST calls are narrowed or refused without a record.
tests/boardRoleViews.test.cjs runs the Email View selector, pins every path
above, and fails when any server file that serves card data has no role
rule and no stated exemption; the "assignee or card member" rule is
rejected anywhere in server/ and models/. server/lib/tests/editableCardIds
adds an assigned-only case for both edit checks (meteor test; not run here).
Seven guards that pinned the old lines now pin the new ones.
Thanks to crypto-nidh, binary-lover and xet7 !
- B324 docs/Features/Login/ldap-sync/ldap-sync.py: the MD5 of an LDAP photo
only notices a changed photo, so it says usedforsecurity=False.
- B202 tests/nextcloud/bootstrap.py: the downloaded WeKan release zip is
extracted only after every member is checked to land inside the target
(zipfile also refuses '..' and absolute names; now it is explicit).
- B102 tests/backfill-charts-pagination.py: exec of this repository's own
backfill-charts.sh planner under test, in an empty namespace with the
network patched out - kept, and marked with its reason.
- B108 tests/release-telemetry.py: '/tmp/check-telemetry.py' is a fake
__file__ for the path logic; nothing is written there - marked.
- B106 tests/ucsRelease.test.py: the fake portal's expected value is a test
fixture, passed through a variable rather than as a password literal.
bandit reports none of the five now; the three tests pass.
Thanks to Qlty and xet7 !
Qlty (zizmor) security findings in the workflows that build and publish
every release:
- template-injection (128): ${{ ... }} pasted into a run: script is expanded
before the shell sees it, so a crafted workflow_dispatch input, tag or step
output becomes shell code. 251 expressions in 13 workflows now reach their
scripts through the step's env: and are used as quoted shell variables
($env:NAME in the PowerShell steps); ${{ env.X }} is plain $X. Where a
value sat in single quotes it is double-quoted now, and six unquoted ones
are quoted.
- unpinned-uses (20 in Qlty, 160 with current zizmor): every action is
pinned to a commit, with its version as a comment for Dependabot.
actions/dependency-review-action@v5 was a branch; it is v5.0.0.
- excessive-permissions (8): AppImage, Flatpak, mac, windows,
release-all and release-all-missing grant contents: read at the workflow
level, and each job that writes (a release asset, a git push, the docker
push, gh run rerun) is granted that on the job. Nothing used actions:
write except recover, which keeps it.
- artipacked (47 -> 13): actions/checkout gets persist-credentials: false,
except in the jobs that push with the checkout's credentials, directly or
through releases/version.sh, release-website.sh, release-charts.sh and
backfill-charts.sh.
actionlint with shellcheck reports 50 notes, the 56 before minus the six
quoted. Every PowerShell step parses (pwsh 7.6.7). Not run on GitHub.
tests/workflowHardening.test.cjs fails on an expression in a run script,
an unpinned action, a workflow-level write grant in a multi-job workflow,
or a checkout keeping credentials outside the pushing jobs, and runs
zizmor when it is installed. Eleven guards that pinned the old text, or ran
the extracted scripts with the expressions substituted, now pin the env
form and pass the values as the step's environment.
Thanks to Qlty and xet7 !
AssignedBleed follow-up, GHSA-3cgr-47wm-9cc9. An assigned-only member
(isNormalAssignedOnly, isCommentAssignedOnly, isReadAssignedOnly) sees only
the cards assigned to them. 1a218ead02 applied that to the attachment API,
but six other paths asked only for board membership, which such a member
has:
- the /cdn/storage/attachments and /cfs/files/attachments downloads
(universalFileServer isAuthorizedForBoard) served any card's file;
- Attachments.protected, ostrio:files' own download check, likewise;
- the legacy /cfs/files/attachments route likewise;
- searchAttachmentDocumentText matched the extracted text of every card's
PDF/DOCX/XLSX/PPTX on the board and returned snippets with their
attachment and card ids - no id needed, and it supplied the ids for the
downloads;
- legacyBoardAttachments without a cardId published every legacy
attachment record of the board;
- linkedListCards published every card of the source list.
The downloads now also ask mayReadBoardAttachment(), which names the
refusing path in Admin Panel -> Problems (authz.assigned, medium: never
disables). The document search and the legacy publication are narrowed to
the member's cards (assignedOnlyCardIds); asking the publication for a card
not assigned to them is refused and recorded, as card details always pass
the open card. Linked-list cards take the source board's
assignedOnlyCardScope; searching and viewing a linked list are ordinary
use, so those are not recorded.
The board's own files - background (sidebar or API upload) and map image -
carry no card and are part of the board every member sees; they stay
readable, where the attachment API refused them to an assigned-only
member. Any other card-less file is still refused.
tests/assignedOnlyReads.test.cjs pins each path, the board-file rule and
the refusal source, and fails when any file in server/ or models/ that
serves attachment or document data lacks the rule without a stated
exemption. The Playwright spec checks both downloads refuse the hidden
card's file but not the member's own, that the search finds only the
member's card, and that the owner is unaffected. Four source guards that
pinned the old lines now pin the new ones.
Thanks to crypto-nidh and xet7 !
The snap runs Caddy 2, and migrate-caddyfile-v1-to-v2.sh treats a Caddyfile
that `caddy adapt` rejects as Caddy v1: it moves it to Caddyfile.v1.bak-<n>
and, when it cannot convert it, writes the default in its place - on every
start. 19 Caddyfile examples in the docs were Caddy v1 (`proxy / localhost:3001
{ websocket transparent }`, `browse`, `fastcgi`, `tls self_signed`, `ext`,
v1 `log`/`errors`, `root /path`), so a file copied from the snap install page
was renamed each time it was put back. All are now Caddy 2 (reverse_proxy,
file_server browse, php_fastcgi, tls internal, try_files, log output) and pass
`caddy adapt` with Caddy 2.11.7. Also:
- `http://Xhttps://X { tls ... }` became `X {`: Caddy 2 refuses TLS on the
http address and redirects to https by itself;
- the Windows examples `load` the certs folder - Caddy 2's load takes folders;
- the Docker Meteor3 Caddyfile gave the Let's Encrypt and CloudFlare variants
of one site the same host, which Caddy 2 refuses as ambiguous; each has its
own host now;
- Caddy.md's logs example and its systemd unit, installer and setcap are
Caddy 2 (`caddy run --config`, no getcaddy.com, no -conf/-agree/-email).
The fallback template the migration writes proxied to localhost:3000. With
Caddy enabled the snap runs WeKan on caddy-bind-port (default 3001), so a
migrated site pointed at nothing. Both templates now read the snap settings
from caddy-control's environment - `:{$CADDY_PORT:8080}` and `reverse_proxy
localhost:{$CADDY_BIND_PORT:3001}` - so `snap set wekan port=...` reaches
Caddy on the restart the configure hook already does; that hook's sed lines
only ever matched Caddy v1 lines. The commented TLS example in the template
had `protocols h1` inside a site and a stray `}`, so uncommenting it failed;
it uses `alpn http/1.1` now.
tests/caddyfileExamplesV2.test.cjs finds every Caddyfile in the docs and the
snap, fails on Caddy v1 syntax and on a Caddy 1 command line, checks the
templates' ports, and with a Caddy 2 binary runs `caddy adapt` on all 30.
snapStagePackages.test.cjs pinned the wrong port 3000 and now pins 3001.
Thanks to Group-Deed and xet7 !
After the 12.47 fix, #6771 comment 6197931378 showed the background sync
running and importing nobody: "filter": "(&(&(objectclass=person))(uid=\2a))",
"Search result count 0". importNewUsers() asked for every user with the string
'*', and the RFC 4515 escaping added for login names on 2026-09-27
(679a8b3499) turned the wildcard into a literal asterisk. The wildcard is now
reachable only through ALL_LDAP_USERS (userSearchValue.js), a Symbol that a
login request cannot carry, so a typed '*' is still escaped.
The sync also ran far more often, or less often, than set: later.js is a
calendar, and every(n).minute() is "minutes 0, n, 2n ... of each hour", an
interval only when n divides 60. 2 hours and 1 day both became hourly, 90 s
became every minute, and 3600 (seconds, typed as milliseconds) every 4
seconds. Milliseconds now become an interval later keeps exactly - seconds
and minutes dividing 60, hours dividing 24, whole days - pinned to the start
of the unit; anything else is rounded to the nearest one with a warning, and
an interval under a minute is warned about as probably seconds.
tests/ldapImportAllUsers.test.cjs reproduces the reported filter and checks
the wildcard, the still-escaped typed '*', and that no code searches the
string '*'. tests/ldapSyncSchedule.test.cjs checks every interval up to 36
hours reaches later only as an every(n) it keeps, and with the real later.js
that 1 min ... 1 week keep their spacing.
Thanks to tromlet and xet7 !
The NetBSD x64 bundle of v12.47 stopped in npm install: argon2's
native build ran node-gyp, which looks for `python3` or `python`, and
pkgsrc's python313 installs only /usr/pkg/bin/python3.13 - "You need to
install the latest version of Python". OpenBSD's package provides
python3, so only NetBSD failed.
releases/bsd/build-bundle.sh now, when neither is on PATH and PYTHON is
not set, hands node-gyp the versioned interpreter it finds
(/usr/pkg/bin/python3.N, skipping python3.N-config) through PYTHON and
npm_config_python, before the npm install; with no Python at all it
stops with an ::error:: naming the package. Simulated locally with a
pkgsrc-shaped directory and no python3 on PATH; with python3 present
nothing changes. tests/releaseScriptsUtf8.test.cjs pins the lookup and
its place before the install.
Thanks to xet7 !
All three Windows bundle builds of v12.47 stopped at the risk audit:
"Automated risk indicators found: server/lib/localizeAvatar.js: new URL
origin http://127.0.0.1". The file had not changed. risk-audit.py read
its baseline with a bare read_text(), which on a Windows runner decodes
cp1252, so the baseline's "http://127.0.0.1/…" (a comment in that file)
became "http://127.0.0.1/…" and no longer matched the source. With a
non-UTF-8 default on Linux (LC_ALL=C, -X utf8=0) the old script misread
the baseline the same way and counted all 16688 files as changed; the
fixed one reads it as the build does.
Every text read and write in releases/*.py now names UTF-8: the risk
audit, the telemetry check, remote-release.py (which also reads and
rewrites CHANGELOG.md, with its ®), the dependency, UCS, Nextcloud, Bun,
Mac and Snap scripts, and the GITHUB_ENV/GITHUB_OUTPUT writes.
tests/releaseScriptsUtf8.test.cjs fails on any read_text(), write_text()
or text-mode open() in releases/ without an encoding, multi-line calls
included; tests/bun-release.py follows the checksum write's new
argument. Every Python and node test of these scripts passes.
Thanks to xet7 !
- sidebarArchives.js imports its own template: cardDetails.js now
imports it for restoreArchivedCard, and a file that registers on a
template it does not import may run before the template exists
(clientBundleImports).
- The 6.09 restore spec makes its test ObjectIds with crypto.randomBytes,
not Math.random (codeqlInsecureRandomness).
- Tigre's new restore strings say ወረቀት ካርድ for card and ምዱድ for board,
the file's own words, not the bare Tigrinya ካርድ and ሰሌዳ.
Thanks to xet7 !
Restoring an archived card whose list had reached a hard WIP limit did
nothing at all: the Restore handlers checked canBeRestored() and, when it
said no, returned without a word or a method call, and Restore all
skipped such cards just as quietly.
- Restore, in the Archive sidebar and in an open archived card, now goes
through one function (restoreArchivedCard): a list that is full - or
gone - opens the restore-to-list popup, which says the list has reached
its WIP limit and offers only lists with room; with none left it says
so instead of offering a list that would fail again.
- Restore all restores every card that has room and then says how many
it left out and why. Its popup opens against the link kept before the
loop: after the awaits the browser has cleared evt.currentTarget.
- canBeRestored() decides with models/lib/wipRestore.js, which also
blocks a list that is OVER its hard limit: the old `===` let a card
into a list whose limit had been lowered below its count. A soft limit
still only warns.
Tests: tests/wipRestore.test.cjs (the rule, over-limit and soft/disabled
negatives, both Restore paths, Restore all's count, and a scan that no
client code skips a blocked restore without a word);
restore-wip-limit.e2e.js against the production bundle (restore into
another list with the full one not offered, Restore all restoring what
has room and naming the rest, a soft limit restoring at once), 12 of 12
over three repeats with the existing archive restore test. The four new
strings are translated in every locale.
Thanks to jullbo and xet7 !
Fixes#6772.
"[uncaughtException] WeKan is stopping: TypeError: string.toLowerCase is
not a function" from later.parse.text, called by wekan-ldap's sync
schedule, with the snap restarting in a loop - the report on Alma Linux
8.10 with LDAP sign-in. A numeric LDAP_BACKGROUND_SYNC_INTERVAL reached
later's text parser as a Number; 7dfd942ff6 reads milliseconds or
later.js text and never throws, and tests/ldapSyncSchedule.test.cjs
reproduces this exact error with the real later.js.
Thanks to tromlet and xet7 !
Fixes#6771.
The upgrade report (one board with attachments loading forever after a
6.09 to 10.85 dump and restore) came without the board's data. The
fixture tests/fixtures/restored/wekan-6.09-board.json is that board's
SHAPE instead, derived from `git show v6.09:models/...`: CollectionFS
attachments (cfs.attachments.filerecord with its GridFS file and chunk),
a card cover pointing at a filerecord, lists with swimlaneId '', members
without the newer role flags, customFields by boardIds, checklists,
comments and activities as 6.09 wrote them.
restored-609-board.e2e.js restores it into the test database as it is
and requires the board to load: the board publication becomes ready with
the board and its cards, and the page shows its lists and cards, not the
spinner or the "could not be loaded" message. It passes against the
production bundle - and also against a bundle built without the client
cover fix, so neither the 6.09 data shape nor that fault is what hung the
reported board; what did is particular to that board's data, which the
board's page now names through the server log.
Thanks to xet7 !
Found running the Email view's browser test against the production
bundle: once in eight runs, searching for text that matches nothing still
listed the previous search's card. Both views subscribe in an autorun, so
a new search's subscription starts before the old one stops, and both
published their page's ids into ONE shared index document; DDP's merge
box shows the older subscription's value while both exist, so whenever
the old one stopped late the new search showed the old rows.
Each request now has its own index, keyed by its arguments
(models/lib/reportPageIndex.js reportPageKey), built the same way on the
server and the client (emailViewPageArgs normalizes the Email view's
folder, page and search), and each view reads only the index of the
request it made. Admin Panel / Problems stops its subscription before the
next one, so its requests never overlap and keep a fixed id.
Tests: tests/reportPageKey.test.cjs (one id per request, server and
client agree, no autorun view reads a shared id); emailView and
publicBoardsPage pin the keyed ids. Against a rebuilt bundle the Email
view test passed 8 of 8, and with the Public Boards, Chat, Version
Control and import specs 30 of 30.
Thanks to xet7 !
Run against a freshly built bundle, as build.sh's browser run does, two
faults in the spec itself showed:
- Email view: Compose sends real mail, but the spec started no mail sink,
so Send answered "The email could not be sent" in any run without an
SMTP server. It catches the mail locally now, as the other mail specs do
(helpers/smtpSink.js on WEKAN_TEST_SMTP_PORT), and checks that the
message reached the recipient under its subject.
- Chat view: after page.reload() the new connection signs in again from
the login cookie, and openView() called setBoardView before that, so on
a fast server it failed with "Must be logged in". It waits for the
sign-in, and a refused call names its code and reason instead of the
minified "r".
Against the bundle: the Email, Chat, Version Control attachments and
import Attachment files specs pass (Chat 3 of 3 repeated, Email 5 of 5).
Thanks to xet7 !
Running the new browser tests showed it: the rename popup appended
this.extensionWithDot, which a migrated attachment can lack, so the file
became "architectureundefined". It falls back to the extension now.
The browser tests were run against a local source-mode server: the
Version Control attachments spec (which now asks for the storage paths
as an administrator, for that call only) and the import Attachment files
spec pass; the Chat channels spec expects no unread message once the card
was opened in the middle, which reads it.
Thanks to xet7 !
"[uncaughtException] WeKan is stopping: TypeError: string.toLowerCase is
not a function at later.parse.text ... at Object.schedule
(wekan-ldap/server/sync.js)", in a snap restart loop. The docs give
LDAP_BACKGROUND_SYNC_INTERVAL in milliseconds, settings_get() turns a
numeric value into a Number, and the schedule handed it straight to
later's text parser, which threw from a timer. Text later could not read
did not throw, but made a schedule that never ran - as a quoted
'every 1 mins' from a compose file did, the second report in #2354.
packages/wekan-ldap/server/syncSchedule.js reads the setting and never
throws: milliseconds (a Number or digits) become that interval, later.js
text is read as before, one pair of surrounding quotes is removed, unset
keeps the original default (recur().on(0).minute()), and anything
unreadable logs why and uses the default. The docs, the snap description
and the compose files say both forms work, instead of "leave this unset
so it does not crash".
Tests: tests/ldapSyncSchedule.test.cjs reproduces the crash with the real
later.js from the build, schedules 3600000 ms an hour apart and 10000 ms
ten seconds apart, reads quoted text, keeps the default, never throws on
any value a setting can hold, and fails if any server file hands a setting
to parser.text directly.
Thanks to B2RN and xet7 !
Fixes#2354.
The guards that failed before this release's translation work, each
decided by which side is right:
- The locale was wrong: Bislama's email recovery strings say sanem, the
word the guard pins; Arabic-script Uzbek writes "e" as ې (26 words);
Romansh says "chaschuna ina perdita da datas", names its own Menu and
uses one word for the template container; Tigre's card is ወረቀት ካርድ,
never the bare Tigrinya ካርድ (six strings); Wolaytta's permanent-delete
label still held English words, now in the file's own Wolaytta; and
Tamazight's operator-assignee is the portable search keyword again -
the 2026-10-13 label sweep had translated a parser keyword, so that
correction is removed and the earlier one stands.
- The guard was stale: Acehnese settled on kad for card on 2026-10-14,
so the example cards use the file's own word; Uzbek key names may be
translated as long as the printed label stays beside them; the README's
coverage count is 234 now; the Transifex pull test hands its own node to
the script it runs.
- The last English values of nine locales are their own words or settled
terms (Neapolitan and Volapük "No", Frisian and Flemish "is", Breton
"Me", Walloon "Pause", Venetian "Sprint", Veps "minus"), recorded as
reviewed shared words, so the completeness guards and --missing agree:
0 languages with untranslated strings.
Thanks to xet7 !
Keyboard key names, Blockly's math names, Scrum roles and the S3 and
webhook labels, which the earlier passes had kept in English: the
established locales translate them (Finnish Välilyönti, German
Leertaste), so these do too. Breton keeps the reviewed "Me", Walloon the
reviewed "Pause", Venetian its "Sprint", and Veps writes minus without
the Finnish long vowel. Low confidence for the key names of Nahuatl,
Buryat, Cherokee, Klingon, Tibetan, Dzongkha, Wolaytta and Tigre.
What stays equal to English is the language's own word (Neapolitan
"No", Frisian "is", Volapük "if"), or in Blockly an operating system,
sin/cos/tan, and key labels the language's keyboards print.
Thanks to xet7 !
Greenlandic, Kashmiri, Nahuatl, Tigre, Tibetan, Dzongkha, Oromo,
Wolaytta, Northern Sami, Yakut, Inuktitut and Cherokee: every value still
equal to English, translated directly from each language's existing
wording, placeholders checked against English, only English placeholders
filled. Low confidence for Nahuatl, Wolaytta, Yakut, Inuktitut and
Cherokee; a speaker's Transifex translation replaces any of them.
Thanks to xet7 !
Translated directly from each language's existing wording, placeholders
checked against English, only English placeholders filled: Tamazight,
Volapük, Acehnese, Wolof, Fijian, Guarani, Veps, Quechua, Chichewa,
Northern Ndebele, Tigrinya, Samoan, Aymara (its last string, the S3
bucket, too), Fula, Bambara, Tswana, Kirundi, Swati, Chuvash and Buryat.
Low confidence for Volapük, Veps, Buryat and Tamazight; a speaker's
Transifex translation replaces any of them. The Veps guard records "ei
%1" for Blockly's "not": Veps negates with ei, as Finnish does.
Thanks to xet7 !
Every value still equal to English in these locales, translated directly
from each language's existing wording and kanban terms, Blockly's
editor messages included; placeholders checked against English before
anything was written, and only English placeholders filled, so no human
translation is replaced.
All of Klingon, Ewe, Walloon, Luganda, Tongan, Tsonga, Venda, Kinyarwanda,
and the remaining strings of Bashkir, Pashto, Cantonese, Igbo, Xhosa,
Bhojpuri, Romansh, Maori, Breton, Sorani, Faroese, Northern Sotho,
Asturian, Amharic, Akan, Kyrgyz, Sicilian, Burmese, Hausa, Yoruba,
Frisian, Kurdish, Cornish, Uyghur, Aromanian, Sinhala, Sindhi, Manx,
Neapolitan, Assamese and their regional variants. Low confidence for
the constructed and smallest of them (Klingon, Venda, Tongan, Manx,
Cornish, Aromanian); a speaker's Transifex translation replaces any of
them. Walloon writes tangent as tandjinte, not the Waray-shared French.
Thanks to xet7 !
customBoardRoles pinned Chat's comment check on the open board; the Chat
view opens a card of any board now, so it asks the card's board, and
the guard says so. liveTestsNoSecretLogs built a RegExp escaping only
`$`; it escapes every metacharacter (incompleteEscaping).
Thanks to xet7 !
The five strings in every locale, translated directly from each
language's existing wording; English variants keep English. Bosnian
uses tabla for board and Tigre its established word for name, as their
guards require.
Thanks to xet7 !
An upgrade report: after a 6.09 to 10.85 dump and restore, one board with
attachments showed only the loading animation. The data is not
available, but the code had three faults on that path:
- The board page waited for its publication to be ready and had no
onStop, so a publication that stopped with an error left the spinner
up forever. It now shows "This board could not be loaded", pointing at
the server log, which names the cause.
- The client cache fell back to the legacy (CollectionFS) attachment
lookup, an async stub on the client: its Promise was taken for an
attachment, so a 6.09 card's coverId became a cover whose link()
threw, and the plural lookup handed callers a Promise for an array.
The client no longer calls it; the server cache awaits the real one.
- The legacy attachments publication called startsWith() on a record's
type, which throws when a 6.09 record holds something other than a
string; it is read as a string.
Tests: boardRefreshReadiness drives the error path (shown, cleared on
another board, ignored from a board left behind); legacyBoardLoad pins
that no client cache calls an async lookup and that the server awaits
every one. The board itself is not reproduced: that needs the data.
Thanks to xet7 !
Their exports name attachments without carrying the files, so the files
were reported as a loss. Each service documents where a file is
downloaded, behind the same sign-in as its API:
- Jira: fields.attachment[].content (/rest/api/3/attachment/content/<id>),
Basic email:API token; Jira's redirect to its media store is followed
without the sign-in.
- Deck: /index.php/apps/deck/api/v1.0|v1.1/boards/../stacks/../cards/..
/attachments/<id>, Basic user:app password, OCS-APIRequest: true.
- OpenProject: _links.downloadLocation, relative to the instance, Basic
apikey:<key>.
- Asana: GET /attachments/<gid>?opt_fields=download_url with a personal
access token, then the signed download_url without it; a file the
export embeds (export_boards.pl) is taken as it is; one kept on Google
Drive and the like is a link, reported.
- GitLab: a private project's /uploads/ link through
/api/v4/projects/<id>/uploads/<secret>/<file> (17.4+), Bearer token.
The import page asks for the address, user and token under "Attachment
files" for these five (the REST import takes the same as attachmentAuth).
They go with that one import: held beside the creator in a WeakMap, never
stored or logged, the token field emptied on Import, and sent ONLY to
the origin the member typed - an export names any URL it likes. Every
download is the import's SSRF-guarded fetch, which validates each hop
and drops Authorization on a cross-origin redirect. A file that cannot
be fetched is on the loss report with its reason. Unticking Attachments
leaves them out (Jira's per-issue field is pruned too).
Zenkit is left out: it publishes no way to download a file.
Tests: importAttachmentAuth.test.cjs (each service's request, the
sign-in only to its origin, malformed sign-ins, never stored or
logged), the parser tests pin the attachment lists, a Meteor test
imports an embedded Asana file onto its card and shows a Jira file is
reported without a sign-in and that the sign-in never reaches an address
the guard refuses, and import-attachment-auth.e2e.js the page (not run
here). Not run against the live services.
Thanks to xet7 !
The Attachments tab listed each file as a link to a new browser tab. A
file the attachment viewer can show now opens there on a click on its
thumbnail or name, with next and previous walking the tab's files, and
every file has the controls of an opened card's attachments: view,
download, rename, delete (the soft delete, behind the same confirmation)
and the cover / background menu, the writes for the same members as the
card's gallery.
Thanks to xet7 !
Jira's sprint report has no documented API, so a closed sprint was
reported and skipped. It is now imported as closed, with its start and
close snapshots rebuilt from documented issue data: the Sprint field,
status and resolution at the sprint's start and completion dates, from
each issue's change history (expand=changelog), or from the issues as
they are now when there is none. The snapshots are marked partial. A
closed sprint with no start or completion date is still reported.
Thanks to xet7 !
- Clicking a card in the channel tree took the member to that card's
board. It now opens the card in the middle pane with its conversation
beside it, whatever board it is on, and the page stays where it is. The
card's conversation comes from a publication of its own
(chatViewCardComments) with the tree's limits - a board the member sees,
a role that reads comments, only their cards on an assigned-only board -
and its writers' names; the comment box follows the card's own board.
- Folding the Channels or Comments pane left only an icon: the double
caret stays now, pointing the way the pane opens, mirrored with the
others right to left.
Tests: chatView.test.cjs (no navigation, the subscription, the card's
board for commenting, the publication's limits, the carets),
email-chat-views.e2e.js (another board's card in the middle without
leaving the page, carets visible on folded panes).
Thanks to xet7 !
It was recorded as impossible: Jira signs in only with an Authorization
header, and the bridge proxy takes that header for the grain's grant. But
Sandstorm's HTTP driver can keep the sign-in in the grant itself
(shell/imports/server/drivers/external-ui-view.js in the Sandstorm
source): the member connects the Powerbox to "any address" and enters the
Jira address with the credentials in it - https://EMAIL:API-TOKEN@site
(the e-mail's @ as %40), or https://jira.example.org#TOKEN for a Server /
Data Center token - and Sandstorm moves them into the grant and adds
Authorization: Basic (or Bearer) to every request the grain sends through
it. WeKan never sees them.
- egress.mjs syncApiRoot grants a Jira list at its own address, and the
Powerbox request asks for Basic authentication
(ApiSession.PowerboxTag.authentication; apiSessionDescriptor takes it).
- In a grain the Jira fetcher sends no Authorization of its own, and a
Jira source needs no WeKan token there: a marker credential says the
grant holds the sign-in. Only for Jira - GitLab sends its token in the
query, where a marker would reach GitLab.
- The List Sync popup tells a Jira list in a grain what to enter in the
Powerbox, translated in all locales; the Sandstorm docs say how, and
that the same #token form may let a private GitHub, Gitea or Forgejo
through (not tried yet).
- TODO Later drops "Not possible from a Sandstorm grain", its last
category naming an issue; changelogFormat no longer needs one.
Not run in a real grain here. Tests: sandstormSyncEgress.test.mjs (the
root and the Basic descriptor, and an address with credentials in it
still refused), sandstormJiraGrant.test.cjs (the server, the fetcher,
the marker only for Jira, the popup and the docs).
Thanks to xet7 !
GitHub CodeQL js/clear-text-logging: releases/live-tests/basecamp-import.mjs
logged the Basecamp account id read from WEKAN_LIVE_BASECAMP_ACCOUNT. The
live tests run with the maintainer's own logins and keep a log under
.tools/log/, so nothing from a login or its configuration belongs in it.
The same shape was in two more tests and is gone there too: Planka logged
its configured address, and the GitLab write-back test its GitLab address
and scratch project path, also in the message that says it is skipped.
Each now logs what it does in fixed words.
These are human-run scripts, not part of the WeKan server, so there is no
attempt for Admin Panel -> Problems to record.
tests/liveTestsNoSecretLogs.test.cjs follows every value read from the
environment, a login or the credentials into the names it lands in, and
fails on any log line of any live test that interpolates one; a negative
case pins the reported shape.
Thanks to GitHub CodeQL and xet7 !
Maintainer decision 2026-10-15:
- Translating from dictionaries and each language's own wording is
enough; speakers review it later if they have the time. The category
listing terminology for a speaker to check is removed.
- Formats with no published documentation are not taken on: Restyaboard,
YouTrack, Airtable, Leantime, Things 3, and Taskcafe (an archived
project whose GraphQL API has no documentation beyond its source).
Attachment contents from Jira, Deck, OpenProject, Asana, Zenkit and
GitHub/GitLab stay: each documents its attachment API.
Thanks to xet7 !
#4790 was a collection of ideas ("I don't know what use cases it would
cover"), and a split into six new feature requests was prepared on
2026-09-29. Checked against the code, they describe what WeKan already
does under other names, so nothing needs filing:
- labels on organizations, teams, people and boards: organizations and
teams are the groups of people; boards are grouped into All Boards
workspaces and have their colours;
- a label from an LDAP group: LDAP groups sync as organizations and teams
(#4737), with LDAP_SYNC_ADMIN_GROUPS and LDAP_SYNC_GROUP_ROLES;
- adding or keeping users out of boards by label: a board is shared with
an organization or a team, and a private board not shared with one
keeps it out;
- a board role for an LDAP group: the group syncs as a team, and the team
is shared to the board with its role;
- finer roles: custom board roles (#3022, closed);
- users by e-mail domain: done (orgAutoAddByDomain.js, #5850, #4178);
- rules by label, meteor-roles and multitenancy were thoughts in the
comments, not requests.
The prepared split (docs/Features/User-Filter-4790-Split.md) is removed,
TODO Later no longer waits on it, and docs/Design/TeamsOrganizations.md
says how its rows are covered - also that custom roles exist now.
Thanks to xet7 !
Fixes#4790.
What is built leaves the backlog, also where it is not yet tested against a
live service:
- #5758 Windows SSO: built in a594a58117 (v12.46), for a Windows host in a
domain; the handshake was not run here.
- #2698 GitLab integration: GitLab sync and import (2026-09-30), and the
write-back of edits, comments, closing and reopening in d6c1d6fce1
(v12.46), with a live test in build.sh / build.bat -> Tests -> Live
tests; GitLab login to WeKan through OAuth2 is documented, and card
numbers with board keys give the #number references.
- #337 accessibility: move buttons, focus trap, landmarks, labels and
every icon-only control named and guarded; a screen-reader pass is
testing, not a missing part.
- #2208 Sandstorm: everything that can work from a grain is built (email
sending, outgoing webhooks, list sync, the REST API through Sandstorm);
Jira sync from a grain cannot, and stays recorded as such.
Also out: the continuous backup's live-account tests, the SMTP, browser
and identity-provider test matrix, the UCS / Nextcloud ExApp variable
check, the History switch (decided on 2026-10-08), Zenkit's unverified
export, the translation batch history, and the importers built on
2026-10-14 (Planka, Microsoft To Do, KanbanFlow, Basecamp). Left: Jira
closed sprints, the #4790 split to file, translations and their
terminology review, the attachment-board report, the formats not read
yet, and the Sandstorm limits.
changelogFormat's count of categories that link issues follows the
smaller backlog; it still fails on an issue named without its link.
Thanks to nikalasmd, ndarilek and xet7 !
Fixes#5758,
Fixes#2698,
Fixes#337,
Fixes#2208.
- The activity feed's new stylesheet was not imported, so it would not
have been in the client bundle (clientBundleImports); client/features/
main.js imports it beside the feed's template.
- The Basecamp and Microsoft To Do importers stripped HTML tags in one
pass, which a crafted body survives ("<<b>b>" leaves "<b>"); each
removal now repeats until nothing changes (tagStrippingFixedPoint).
- renderedTitles escaped only the first "." of a field name; it escapes
every special character now (noIncompleteRegExpEscaping).
Thanks to xet7 !
The Chat view's tree listed the open board's swimlanes, lists and cards,
and every other board as a link that left for that board. Now:
- The tree is workspaces > boards > swimlanes > lists > cards, holding
the cards that have a conversation on every board the member sees
(server/chatView.js chatViewChannels). Every board without one is under
Other boards; its first message moves it up to its place.
- Each level has a caret before its icon - after it, mirrored, in a
right-to-left language - and folds open and shut with a slide (none
for a member who asked for reduced motion). Clicking a board folds it;
it no longer leaves the Chat view. The board the member is on, its
workspaces, swimlanes and lists start open; what they open or close is
kept in their browser.
- The board the member is on shows all its cards, from the board's own
data, so a conversation can start on any card and a dragged card moves
in the tree at once; its button shows only the cards with messages.
Another board opened from Other boards shows all its cards
(chatViewBoardChannels) for the same reason.
- Every level shows the messages this member has not read: others'
messages after they last opened the card, all of them on a card never
opened; opening the card - or a message arriving while it is open -
reads it.
- Every name, and the chat's header, renders as Markdown (inlineViewer).
- Only what the member may read: boards they see in All Boards, only
their own cards on an assigned-only board, no conversation where their
role reads no comments.
Tests: tests/chatView.test.cjs (the tree, Other boards, a first message
moving a board up, unread sums, the full board, carets, folding rows,
no navigation), server/lib/tests/chatViewChannels.tests.js (unread
counts, never my own, the role and assigned-only limits, a board I do
not see refused), email-chat-views.e2e.js (folding without leaving the
view, the move up, unread badges, Markdown names). New strings
translated in all locales.
Thanks to xet7 !
Titles, names and labels are Markdown in WeKan - links, emphasis, emoji -
but Board View / Version Control showed "Azure [issues](https://...)"
and the like as text, the all-boards activity feed did the same with the
cards and boards it names, and the email view's sidebar showed its lists
and labels raw ("Demo + Wishes 🌈").
inlineViewer (client/components/main/editor.jade) is the viewer itself -
Markdown, emoji, mentions, and the Admin Panel's security settings for
links and code - laid out inline at the size of the line it is in. These
views use it for every issue, milestone, label, release, wiki page and
board title, the activity sentence and its card and board, and the email
folders and row labels. An attachment's file name in its download link
stays a file name.
A rendered title can hold a link, and a link inside a link is not one:
the titles and labels that open or filter are spans with role=link now,
which Enter and Space open too, and a click on a link inside a title
opens that link instead.
tests/renderedTitles.test.cjs fails on any title-like value interpolated
as text in these views and pins the role=link spans.
Thanks to xet7 !
The all-boards activity feed showed "checked __checklistItem__ of
checklist __checklist__", "from list __oldList__ at swimlane
__oldSwimlane__", "added attachment __attachment__", an empty "at
swimlane", and raw names such as "removedChecklistItem": it filled only
the card, list and board of the notification sentence.
- server/activityFeed.js reads the ids the sentence needs and looks the
names up a batch at a time: swimlanes, old list and swimlane, checklist
and item, attachment, label, member and assignee, comment, old board.
Never a field's value (an admin-only custom field stays out), a
comment's text only for a member who may read comments, and another
board only when the member sees it too.
- A rename or a restore names its new title itself, and a swimlane's
activity keeps the swimlane's id in listId; activityTitleParams fills
those for the feed and the notifications alike.
- A placeholder nothing could fill - a deleted checklist item - is left
out instead of shown as __name__.
- Ten kinds of activity had no sentence at all, in the feed or in
notifications: removedChecklistItem, moveCardBoard, deleteBoard, the
board, list and swimlane renames and restores, joinAssignee and
unjoinAssignee. They have one now, translated in all locales; the
restores, moves and checklist ones join their notification groups.
tests/activityFeed.test.cjs fills every name, refuses comments and
hidden boards, and fails on any stored activity type without a
sentence; activity-feed-sentences.e2e.js checks the feed shows the names
and no __placeholder__.
Thanks to xet7 !
Decided on 2026-10-14. On the import page each of the six asks for what
its service needs - a self-hosted Planka its address, username and
password; the others an access token (Basecamp also its account id) -
lists what that account can import, and fetches the chosen board, list
or project. The credentials go with each call and are used for that
call's requests only; they are never stored or logged, and the page
clears secret fields once a fetch has used them. The fetched JSON fills
the import text box and the import goes on as for a pasted export: the
service's parser (models/lib/<key>ApiFormat.js) into the generalized
importer, with the members step and the loss report. The same JSON can
be pasted, or posted to POST /api/boards/import/<key>.
- server/apiImport.js: apiImportList and apiImportFetch, signed in only,
off with the Admin Panel's import switch, not in Sandstorm, rate
limited; credentials checked against the service's own fields
(models/lib/apiImportServices.js).
- server/lib/apiImportRequest.js: every request through the SSRF guard -
pinned address, no redirects, bounded in time and size - so a Planka
address cannot point the server at its own network; an administrator
can allow such a host with API_IMPORT_ALLOWED_PRIVATE_HOSTS. An error
names only the origin and the status.
- models/lib/apiImport/<key>.js: each service's client, plain Node with
the request injected, paging bounded and the token only in a header.
- Each has a docs page under docs/Features/ImportExport/, listed in the
coverage index and External-Tools.md.
Tests: tests/<key>ApiImport.test.cjs (client with a fake request, every
parsed field, wrong shapes), tests/apiImport.test.cjs (credentials, the
gate, the wiring, the shapes refused), api-import.e2e.js (the form for
every service, fetched JSON imported through the page, refusals incl. a
private address). Live tests, read only, run from build.sh / build.bat ->
Tests -> Live tests with your own accounts (releases/live-tests/README.md);
they were not run here. New strings translated in all locales.
Also: the release risk baseline allows the services' API addresses, and
the guards that count import creators, list the import sources and pin
the platform fetch() calls know the new ones.
Thanks to xet7 !
- syncHistoryAdmission pinned the line that walked successors to the
chain's tip inside appendSyncHistoryRow; 66dd9b0938 moved that walk to
historyChainTip and made the append take turns, so it pins those.
- The write-back's injectable GitLab read was a parameter named fetch,
which syncBleed's "no new platform fetch()" guard rightly could not
tell from the real one; it is readIssues now.
- syncClosedByWeKan, the card field the write-back added, is in the card
e-mail field inventory as internal provenance, excluded like the other
sync fields.
Thanks to xet7 !
Admin Panel -> Problems showed HistoryIntegrity, critical, "history-fork",
89,062 times. Each History row names the row before it, and the legacy
append (every board not migrated to the coordinated chain) read "the
newest row" and inserted after it as two separate steps: two changes
saved at the same moment on one board - two members, or one action whose
hooks record twice at once - both named the same row. Nothing was
tampered with, but the audit called it tampering, and undo, redo and
restore were refused for both rows. The writer gate around the legacy
append counts its writers for a migration; it does not make them take
turns.
- models/lib/historyLegacyAppend.js: a board's appends take turns in
this server, and each links after the chain's tip - the newest row,
then its successors, as Sync History already did - so a createdAt tie
does not fork either. The ordinary recorder, the Scrum restore writer
and Sync's legacy append all use it. Several servers writing one board
at the same moment can still race; the coordinated chain is the answer
to that.
- The hourly audit reported every broken row again every hour, which is
where 89,062 came from; each finding is now reported once
(historyIntegrityReported). It reads the History board by board instead
of all at once, and a fork of two intact rows saved within a minute of
each other is reported as what it is - integrity.historyConcurrentFork,
medium, "a History writer race, not tampering" - while anything else
stays critical.
Existing forks stay as they are (a row's hash cannot be changed), and
undo of their two rows is still refused.
tests/historyLegacyAppend.test.cjs: the old append forks under
concurrency (negative control), twenty appends at once on two boards
make two straight chains, a createdAt tie follows the chain, a failed
append does not stop the next, the audit tells a race from a changed or
late row, and no append in models/ or server/ links by "newest" without
taking turns.
Thanks to xet7 !
Board View / Email showed a card's title and description as text: "# Demo
card 👍", "**Markdown**", raw <font> tags and links, where every
other view renders them. The row's subject and preview now go through
the viewer like every card title and description in WeKan, so the Admin
Panel's settings for links and code apply to them as everywhere.
The preview was the description squeezed to one line and cut at 120
characters, which cut inside a link or a tag; it is now the start of the
message, the From line left out, cut at a line end (previewMarkdown),
and the row shows two lines of it. Headings and paragraphs in a row read
at the row's size.
tests/emailView.test.cjs pins previewMarkdown and that neither cell is
interpolated raw; email-chat-views.e2e.js checks the bold, the link and
that no ** or ]( is left in the row.
Thanks to xet7 !
#2698. A list synced from GitLab gets a Sync option of its own, off by
default: Write changes back to GitLab. With it, every Sync run first
sends what members did on the list's cards, then reads GitLab, so the
read finds both sides agreeing:
- a title or description edited in WeKan, when the issue still has the
text both sides last agreed on - the local-only edit the reconcile
already keeps. The Source footer Sync adds is not sent; when both sides
changed, nothing is written and it stays a conflict to resolve;
- a card archived in WeKan closes its open issue, and restoring a card
WeKan closed reopens it (syncClosedByWeKan); an issue GitLab closed is
never reopened by WeKan;
- a comment written in WeKan becomes a note, and keeps the note's id
(syncCommentId) so the comments sync does not bring it back twice.
Only what happens after it was switched on is sent (writeBackSince), at
most 100 writes a run. Every write is fenced by the list's Sync
reservation, goes through the same address checks as the reads (no
redirects, PUT or POST to an issue or its notes only), and records on
the WeKan side only while the card or comment is still as planned. A
refused write is shown in the Sync popup (syncWriteBackError, beside
syncSource because the run's list writes match syncSource whole) and the
read sync still runs. Not in Sandstorm, whose bridge only reads.
Tests: tests/listSyncWriteBack.test.cjs (the plan with GitLab's shapes,
the parser's footer, every negative - conflict, legacy card, old
archive or comment, foreign card, issue GitLab closed - and the wiring),
server/lib/tests/listSyncWriteBack.tests.js (end to end through
syncOneList against a fake GitLab). The live test,
releases/live-tests/gitlab-write-back.mjs, runs from build.sh / build.bat
-> Tests -> Live tests with the glab login releases/mirror.sh uses, on one
scratch issue in a private project of that account; it is human-run and
was not run here. releases/live-tests/run.mjs runs every live test and
skips a service with no login.
Also: the English variants get the SQRL and Windows sign-in strings
(their key order follows en.i18n.json); buildScriptParity accounts for
the scripts CI runs inside their own environments; new strings
translated in all locales.
Thanks to xet7 !
a539429fce made the sign-in page translate SQRL's sqrl-only and
sqrl-hardlock refusals the way it already translated
oauth-account-conflict, by one list of codes, so the guard's pin on the
old single comparison failed. It now pins the list - the conflict among
the codes, matched on err.error or the reason, shown as text - so the
behaviour it protects is the same.
Thanks to xet7 !
The Upcoming section opens with them and the Bosnian and Tsonga
terminology; TODO Later keeps only the two decided items still to build
(GitLab write-back, the API importers) and drops the finished batch
undo/redo entry.
Thanks to xet7 !
#5758. On a WeKan running on Windows in a domain, members already signed
in to Windows can sign in with "Sign in with Windows", without a
password: /sso/windows runs the browser's Negotiate handshake with
node-expose-sspi, WeKan finds or creates the member, and the browser
comes back to /sign-in with a one-time token (random, kept as its
SHA-256, one minute, used once) that the page signs in with through a
login handler - so every login check applies, deactivated accounts and
SQRL's sqrlonly included.
- WINDOWS_SSO_ENABLED=true turns it on, on Windows only.
- WINDOWS_SSO_DOMAINS lists the domains allowed; empty means nobody, and
machine accounts never.
- WINDOWS_SSO_ACTIVE_DIRECTORY=true takes name and e-mail from AD.
- WINDOWS_SSO_MERGE_EXISTING_USERS=true signs in to the account with the
same username or e-mail; otherwise a new account is made beside a
local one of the same name, since a local alice is not necessarily the
domain's alice. A Windows account signs in to the account it linked to
before.
node-expose-sspi is Windows-only and not a dependency every platform
downloads: the admin installs it into the bundle, and WeKan looks for it
there (docs/Features/Login/WindowsSSO.md; start-wekan.bat has the
variables).
Built without a Windows domain to test against, as decided: the
decisions - names, domains, profile, which member - are tested in plain
Node in tests/windowsSso.test.cjs, with negatives for every malformed or
foreign name, an empty allowlist and a same-named local account; the
handshake and the server wiring are pinned from source. New strings
translated in all locales.
Thanks to nikalasmd and xet7 !
Undoing a 10,500-card sprint close took 282 s and redoing it 578 s, about
27 ms a card: each record of a History row cost some thirty database
round trips - a read per record in the preflight, two ownership checks
(two reads each) around every read, the same again around a readback
after every write, and the whole row read back record by record twice
more at the end.
Now a row's records are read in one query per type (readTargets), and
inspectScrumHistoryWrites takes that as readMany, bracketed by one
ownership check before and one after: the worker's claim and the source
row only ever go from current to displaced, so current before and after
the read means current throughout it. Every write keeps its ownership
check right before it, after the read it is computed from; the readback
after a write confirms the value landed and leaves ownership to the next
write's fence and the batch's final readback. A sprint or release that
thousands of cards name is looked up once, not once a card. The
permission check stays per card.
The 10,500-card start / close / undo / redo test went from 14 min 27 s
to 6 min 7 s on the same machine; all 18 Scrum tests pass.
tests/scrumHistoryWriteState.test.cjs pins one read and three checks
for a bracketed read, ownership lost during it, a short answer, a missing
record and identities checked before any read (negative), and that every
write in the path is still fenced after its read.
Thanks to xet7 !
WeKan -> Rocket.Chat (OAuth2) -> Google (SAML) is three sign-ins in a row,
and with the popup login style the chain broke whenever Rocket.Chat was
not signed in yet: its SAML login left the authorize page the popup was
waiting on, so WeKan never got its code, although Google and Rocket.Chat
both logged a successful login. Logging in to Rocket.Chat first only
avoided the detour.
docs/Features/Login/OAuth2.md now says how to configure the chain: the
redirect login style (the default now; oauth2-login-style /
OAUTH2_LOGIN_STYLE / Admin Panel), Rocket.Chat's SAML entry point and
issuer, Google's NameID as the e-mail address, the exact
/_oauth/oidc redirect URI, https everywhere, how to read the logs, and the
direct alternatives (Google OIDC, WeKan's own SAML).
tests/oauth2RocketChatSamlChainDocs.test.cjs pins that redirect stays the
default in the server and the snap, and that the documented section names
the settings - and never recommends popup.
Thanks to timmy-mac and xet7 !
Fixes#6549.
The member's SQRL client sends both options with every sign-in, and WeKan
now follows them (it used to say they were not supported):
- sqrlonly: every other way of signing in is refused - password, OIDC,
LDAP, SAML, CAS, passkey, Nextcloud (validateLoginAttempt), the REST
/users/login and header login, which mint their tokens without it. A
resume token stays valid; a session already open stays open.
- hardlock: no password-reset e-mail is sent (the answer is the same as
for a sent one), a reset link sent before does not sign in, and the
member cannot change their e-mail address.
An ident records the options only once it succeeds; a flag the client
leaves out is switched off. Neither applies while the identity is disabled
from the SQRL client (the emergency stop), nor while the admin has SQRL
off, and an admin can still change the e-mail, set a password and create
a token: those are the ways back. Member Settings / SQRL shows which locks
are on; the sign-in page and the e-mail change say why they refused.
tests/sqrl.test.cjs drives both options through the protocol with a real
Ed25519 client (set, cleared, never by a query, a refused or a forged
ident), the refusal decision for every login type, and pins every path
that signs a member in - and lists every file that mints a login token,
so a new one cannot skip the check. New strings translated in all
locales.
Thanks to xet7 !
Bosnian used both ploča and tabla for a board. Every board string now uses
tabla and its cases (genitive plural tabli); ploča stays only where it
means the dashboard (kontrolna ploča) or the Admin Panel. The board
search operator abbreviation is tb, because t is already traka
(swimlane).
Tsonga used vuhlayiselo for both the Archive and storage. The Archive is
now "vuhlayiselo bya swa khale", while storage stays "vuhlayiselo" and the
database "vuhlayiselo bya data". The archive popups ask their question.
Bosnian and Croatian s3-port translated (S3 port).
The audited-corrections rows, the Bosnian audit test and the archive
filter guard follow the decision. wrongLanguageCorrections20261014 pins
Tabla, the tb abbreviation, the dashboard and Admin Panel exceptions, and
the Tsonga archive word wherever English says archive.
Thanks to xet7 !
GitLab write-back with live tests in the build menus (#2698), Windows SSO
(#5758), documenting the Rocket.Chat SAML chain (#6549), SQRL's sqrlonly
and hardlock (#2460), faster batch undo/redo, API importers for Planka,
Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep, and
the Bosnian and Tsonga terms.
Thanks to xet7 !
It timed out in every full Meteor run. Profiled at full size it passes, in
15 min 25 s: start and close 2 s, the rollover 36 s, the undo batch 282 s
and the redo 578 s - past the 15 minutes it had. The next test, which
interrupts a rollover, then met this one's unfinished writes and failed
too. The test has 30 minutes now, with the measurements beside the
limit, and the Scrum snapshot rows group passes (3 passing, 14 min).
TODO Later now records the real follow-up: batch undo/redo writes about
27 ms a card.
Thanks to xet7 !
musl, Android, FreeBSD, the Windows single files, Bun and the Quay copy,
grouped as Release builds under the bug fixes, with In short updated.
Thanks to xet7 !
v12.44's copy to Quay failed on "stream error: ... PROTOCOL_ERROR;
received from peer" - an HTTP/2 reset on the way, not a refusal. A
transport error is retried up to four times; a refusal still fails at
once. tests/releaseDockerRegistryOutage.test.cjs runs the step with a
docker that resets twice, one that refuses, and one that never recovers.
Thanks to xet7 !
- FreeBSD: sharp 0.35.5's source refuses libvips older than 8.18.7, and
FreeBSD packages 8.18.6 (latest and quarterly alike), so both FreeBSD
Bun builds stopped at that #error. A user's FreeBSD runs the packaged
libvips through the same soname whatever was compiled against, so a
patch-release gap is accepted with a notice; a larger one still stops.
- windows-x64: one HTTP 500 from the CDN failed the asset download; a
server error is now retried, a 4xx is not.
- The .sha256sum files were written in Windows text mode, CRLF, and the
windows-arm64 Bun single file then looked for "<zip>\r". They are LF on
every platform now, and the reader strips a CR from the ones already
published.
Thanks to xet7 !
The win64, win-arm64 and win32 single files stopped at once since v12.41,
for two reasons:
- win64 and win-arm64: Node.js mounts the archive at \\.\NUL\vfs\<n>, and
Meteor's mini-files.js turns a path beginning with a backslash into
C:\... - so Npm.require looked in the wrong place and the server
stopped with "Cannot find module 'denque'". The single file now carries
mini-files.js patched to keep a UNC or device path (two leading
separators) as it is; drive paths are unchanged, and the build stops if
Meteor's code is not the code the patch was written for. It also makes
a bundle runnable from a \\server\share.
- win32: the SEA blob stores its lengths as size_t, so a blob written by
the x64 Node.js on the build host is unreadable to a 32-bit node.exe
(createZipProvider got no archive). build.mjs now refuses a target whose
pointer width differs from its builder's, and single-file.yml builds
win32, i386 and 32-bit ARM with the release's i386 Node.js, checksum
verified - the i386 and ARM ones had the same fault but no runner starts
them.
tests/singleFile.test.cjs runs Meteor's path functions on Windows path
semantics before and after the patch, refuses win32 from x64, and builds
and starts a real single executable with the patched file.
Thanks to xet7 !
start-wekan.sh ran every binary through cpu-exec, a #!/bin/bash script for
Linux's /proc/cpuinfo and qemu-user. FreeBSD has no /bin/bash, so it
failed "cpu-exec: not found" and WeKan never answered (the FreeBSD
bundles since v12.41). It is now used only on Linux with a /bin/bash -
the same holds for Alpine without bash and for Termux - and the BSD
bundles drop it, as the Windows and macOS ones already do.
Thanks to xet7 !
Both builds failed every release since v12.41. sharp is an application
package (programs/server/npm/node_modules), but the scripts removed its
glibc platform packages from programs/server/node_modules, where they are
not, and the npm install there never touches the application's packages.
- musl: releases/platform-native-packages.mjs and check-addon-arch.mjs
take --libc musl: the glibc packages go and sharp's
@img/sharp-linuxmusl-<arch> and canvas's -musl package arrive,
sha512-checked. "Cannot find module 'sharp'" ended the job, from a
require() run in programs/server; it runs in programs/server/npm now.
- Android: the glibc packages go from the right directory, and sharp is
built from source against Termux's libvips in its own directory; should
that fail it runs as WebAssembly, with a warning. Termux's user does not
own the bind mount, and "chmod: ... Operation not permitted" stopped
v12.43 and v12.44 - only what is not already executable is chmodded.
tests/platformNativePackages.test.cjs installs the musl packages through
the real script; muslBundles and androidBundles pin the paths, the
--libc musl call and that nothing chmods unconditionally.
Thanks to xet7 !
It times out in every full Meteor run, before this round as well; the
profile at 3,000 cards and why it cannot simply run smaller are recorded
so the next step - profiling the board data read and the rollover at full
size - starts from there.
Thanks to xet7 !
It failed in every full Meteor run, before this round too, at Mocha's two
seconds. Timing the handler showed it refuses in 2 ms; the time was its
console.error of the refusal - the first error stack of the run, whose
printing loads the server bundle's source map. The test now captures that
log (and checks it was written) instead of printing it, and the group runs
in under half a second.
Thanks to xet7 !
- Tsonga: 618 values were the filler "Hi Xitsonga: mhaka", and 831 more
were Xitsonga words padded with a repeated "mhaka" wherever the
generator had no word ("engetela bodo swirho mhaka ku suka mhaka mhaka
nhlangano"). All are translated from the English, in the file's own
words (bodo, khadi, nxaxamelo, ndlela, xirho, nhlangano, ntlawa); the
planning-poker numbers and search symbols are literal again.
- Bosnian: the 748 values that were Serbian, transliterated in v12.44, are
ijekavian Bosnian now (premjestio, Neraspoređene, Historija, sedmica),
with the board, card and list words of the rest of the file instead of
the court-file metaphor they came with (spisi, predmet, postupak).
Several mistranslations went with it (Export card said convert, Edit WIP
limit said remove it).
- Aromanian "calendar" replaces the Italian "Calendario"; it is spelled as
in English, so it joins Aromanian's list of such words.
Low confidence, for a speaker to correct: Tsonga throughout, especially
colour names, migration (ku rhurhisa), backup, lock/unlock, "Xiluva" for
the letter greeting Dear, and Vuhlayiselo used for both storage and
archive; Bosnian ploča where the board title itself says Tabla.
tests/wrongLanguageCorrections20261014.test.cjs fails on any Tsonga filler
or padding, any ekavian form in the Bosnian file, and a lost placeholder
in either.
Thanks to xet7 !
v12.44 made the clear HTML layout the default for notification e-mail
(#4434), and with it every e-mail job carries `text`, its plain-text part.
The Sync notification plan validator accepted exactly seven job fields, so
it refused every plan: a rule or Sync run's notifications failed with
sync-notification-plan-invalid. groupKey and deliverAt, from non-default
delivery settings, were refused the same way before that.
The validator now takes what emailOutbox.enqueue takes - the seven fields
and the three optional ones, checked as enqueue checks them - so a plan
never holds a job its replay would refuse. tests/syncNotificationPlan
.test.cjs plans a job with all three and refuses bad ones, and pins that
the optional list is exactly enqueue's parameters; the full Meteor run
found it (Shared notification preparation, Stored Sync notification
delivery).
Thanks to xet7 !
The one image in the templates without alt was the attachment viewer's:
it is "Preview" until a picture opens, and then the file's name.
tests/iconOnlyControlLabels.test.cjs now also fails on any img without
alt. Part of #337.
Thanks to ndarilek and xet7 !
v12.44 shipped while they were in progress; the rest of the wrong-language
replacements and the two guard updates after it go in a new Upcoming
section, as the release rules say.
Thanks to xet7 !
Both failed before this round, on changes that were deliberate:
- The activity notification recovery list (#6768) has Retry all and Cancel
older as toolbar buttons, written `actions: [{ id, labelKey }]` like the
menu's panes; the guard now leaves toolbar actions out and still
requires every menu pane to render.
- Webhooks may reach internal hosts a site admin lists (b4d2604e61):
off Sandstorm, webhookFetch is fetchSafe except for those hosts, which
internalWebhookHosts.test.cjs pins; the guard now matches that branch
and still requires fetchSafe for everything else.
Thanks to xet7 !
The first half shipped in v12.44 with "Updated translations"
(b7346d2429): Spanish Save is Guardar, the Bosnian file is in Latin
script, Romanian's Italian words are Romanian, and single values in a
dozen locales. This finishes it:
- Latvian: 225 values were Lithuanian; they are Latvian now, in the
file's own words (dēlis, kartiņa, darbvieta, migrācija). Low confidence:
fuksīns, the Monte Carlo note's statistics wording, Teksta sagatave.
- The same wrong words under other keys: Macedonian Настройки in the All
Boards menu, the Persian settings typo there too, Cantonese 依戀 in the
attachment search operator, and Occitan "mot de Santa-Clara" for
password in six values (senhal).
tests/wrongLanguageCorrections20261014.test.cjs now also fails on any
Lithuanian left in the Latvian file and checks its placeholders. Left for
later, with a speaker: the Tsonga file's 596 "Hi Xitsonga: mhaka" filler
values, Aromanian "Calendario", and Bosnian ekavian forms.
Thanks to xet7 !
The full node suite run found them; each guard keeps its assertion and
says why it changed:
- boardPermission lists ActivityPub's public-only check (#4198): only a
public board is a fediverse actor, never an instance board.
- cardSectionCollapse reads the End date item to the next template, and
cardTitleEditClose lets the close anchor carry attributes: the #337
titles moved the icon past a fixed window and a bare-anchor pattern.
- oidcAutoRedirectLoop's harness provides FlowRouter, which the sign-in
page's onCreated now reads for SQRL's one-time sign-in (#2460).
- sharedDescription's own whole-tree check skips every _build* directory,
rspack's bundled copy of every file.
Thanks to xet7 !
Each was checked for which side was wrong:
- The LibreJS labels page sent Cache-Control: public; it is private now,
as fileCacheHeaders requires of every response.
- Closing a card marks it seen (#2111): that code moved below the #6686
popup handling, which labelsPopupStaleCardContext reads from the top of
onDestroyed; unreadChanges now finds it anywhere in onDestroyed.
- The shared header helper (#2805) moved below the swimlane's currentUser
helper, where largeBoardDataLoading pins it.
- The Story/Task kind, column set places and drawing strokes (#2012, #211,
#1178) get their rule e-mail dispositions: none is e-mail content.
- Guards updated for deliberate changes, each saying why: the Rules group
in Admin Panel Visibility (#2217), the rule under the team tabs in All
Boards (#802, the two around Workspaces still pinned where they are),
and a linked list's card clearing the title draft only after it was
added (#2809, every clear checked against the add before it).
Thanks to xet7 !
Each came with a group of its own, with an untranslated title and two more
rules in Admin Panel -> Settings -> Visibility. Both are optional features
this WeKan offers, which is what the Features group lists, so they are
there now, each still off by default and saved when switched.
tests/boardsVisibilitySettings.test.cjs counts the groups and their rules
again. The SQRL page and the Upcoming entries name the new place.
Thanks to xet7 !
Upcoming gets the work since the last update: the CodeQL alerts first, as
security fixes; SQRL under Sign-in; browser push, the activity feed and the
webhook activity picker under Notifications; the linked list, live shared
descriptions, drawing, unread changes, column sets and the team tabs in
their groups; a new Nextcloud and the fediverse group for CalDAV, WebDAV
and ActivityPub; bug fixes for the subtask index, the cardKinds startup
schema and the icon-only controls; and the translations. In short is
rewritten to cover them.
TODO Later: the "decided, waiting to be implemented" category is gone -
everything in it is built - and #337 keeps a category of its own as
ongoing work. #2460 leaves "needs a maintainer decision". #4790 is linked
where it was named bare.
tests/changelogFormat.test.cjs asked at least half of the TODO Later
categories to link issues. That was a proxy, and it stopped holding once
the decided issues were built: the rest are mostly status records no
single issue tracks. It now checks the thing itself - the triage
categories exist, and no category names an issue without linking it.
Thanks to xet7 !
The 15 strings of SQRL sign-in - the Admin Panel switch, the sign-in
button and its QR code, and Member Settings -> SQRL - in all 234 locales,
from each locale's own words for sign in, password, add, remove and
Member Settings. "Rescue code" is SQRL's printed recovery code and
"identity" the member's SQRL key, not an ID card. ja-HI is written in
hiragana, as its tag says.
Low confidence: chr, tlh, wal, ay, ace, rn, sm, st, csb, kw, fur, uz-AR,
iu, nah, gn, zgh, wo, sn, tn, rup, se, cv, kl, to, bua, bi, nap, la, ak,
bm, ff, mg, ny, ve, xh, tig, tpi, sah, vo, gv, dz, ee, ig, ha, lg, nd, qu,
mi, wa, yi, ks, fj, haw, ve-PP, wa-RR, ss, ts, om, lld, scn, bo, yo and
ku; "identity", "client" and "rescue code" were coined where the language
has no settled word.
Thanks to xet7 !
SQRL (https://www.grc.com/sqrl/sqrl.htm) signs in with a SQRL app or client
instead of a password. A site admin turns it on in Admin Panel -> Settings,
off by default; WeKan must be at an https:// ROOT_URL. A member adds their
identity once in Member Settings -> SQRL, by scanning the QR code or
opening their SQRL client; the sign-in page then offers Sign in with SQRL,
shows the sqrl:// link and its QR code, and signs in by itself once the
client has answered. With the client on the same computer (cps), the
client opens WeKan with a one-time token instead.
The protocol is GRC's SQRL Semantics: the client posts signed requests to
/sqrl, each verified with Ed25519 by Node.js's own crypto, no new
dependency for it. Every nut is random and used once, taken atomically;
each request must carry the server's previous reply unchanged; a request
from another address than the sign-in page's is refused unless the client
says noiptest; disable needs the identity's signature, and enable, remove
and rekeying need the rescue code's unlock key. An identity WeKan does not
know can neither make an account nor sign in. The page learns of success
by polling with a secret only it holds, and signing in uses that once.
The identity's public keys are a user field never published and not
writable from the client. Not offered on Sandstorm. sqrlonly and hardlock
are not supported. The QR code is qrcode-generator 1.4.4 (MIT, pinned).
models/lib/sqrl.js is the protocol with storage and signature check passed
in; tests/sqrl.test.cjs drives it with a software SQRL client using real
Ed25519 keys - adding an identity, the waiting page, cps, another network,
forged signatures, replayed nuts, altered replies, unknown identities,
another member's identity, disable/enable, rekey and remove - and pins the
server's single-use and visibility rules and the UI.
server/lib/tests/sqrl.tests.js runs in Meteor (2 passing): off by
default, then an identity added and signed in with once, through the real
/sqrl route and MongoDB. Documented in docs/Features/Login/SQRL.md. The
new strings are English placeholders until the translations that follow.
Thanks to xet7 !
Fixes#2460.
21 controls showed only an icon and had no title, so a screen reader
announced them as an unnamed link: the swimlane and list drag handles, the
close buttons of the inline forms, the received, start, due and end date
buttons of a card, the add-attachment and edit-custom-field buttons, the
notification drawer's menu and close, the avatar's edit button, the list
open and back carets on a phone, the import's add-member and History's
previous and next. Each now has a translated title, which
client/lib/accessibility.js also makes its aria-label; the existing
translations are used, so no new strings.
tests/iconOnlyControlLabels.test.cjs scans every template for a link or
button whose only content is an icon and fails on one without a name.
This is part of #337, which stays open for the rest.
Thanks to ndarilek and xet7 !
Everybody who has a card's description open now edits one shared Yjs
document, so two people typing at once both keep what they typed; before,
the later Save replaced the earlier one. The editor stays the Markdown
textarea: each change in it becomes the smallest Y.Text edit, and the
others' changes are written into it with the caret kept where it was.
Save writes card.description exactly as before.
The server keeps the document in a server-only collection and publishes it
only to people who may edit the card. Updates are merged with a write that
is conditional on the state merged into, so two editors at once cannot lose
each other's typing; each update is limited to 256 KB and the document to
1 MB, and rate limited. A description changed some other way (the API, a
rule, an import) starts the document again from the new text, under a new
generation, so an editor never merges the old document into the new one.
A document nobody has touched for a day is started again from the saved
description the next time it is opened.
yjs 13.6.33 (MIT) is pinned. tests/sharedDescription.test.cjs runs the
real Yjs: concurrent edits merge, a repeated state is harmless, the caret
follows remote edits, an emoji is never split; it pins the server's checks
and that nothing else touches the document.
Thanks to dalareo and xet7 !
Fixes#140.
A test run with METEOR_LOCAL_DIR writes rspack's output to
_build-local-test/, a bundled second copy of every source file. The guard
walked into it and reported a replacement the source had already fixed.
Thanks to xet7 !
Admin Panel -> Attachments has a WebDAV (Nextcloud Files) pane beside S3,
Azure and Google Cloud Storage: a folder address, a user and an app
password, with the same read and write switches, connection test, default
storage choice and Move Attachment target as the others. Files are stored
with PUT, read with GET and removed with DELETE; the folders are made with
MKCOL as needed, and the connection test is a PROPFIND of the folder.
The password is a secret field like the other backends' keys: never
published, and kept when the form is saved without it. The address is the
site admin's own setting, so a Nextcloud on WeKan's own network can be
used; redirects are refused so it cannot be pointed somewhere else.
With the CalDAV sync of the previous commit this completes #687. The
Nextcloud ExApp is built by .github/workflows/nextcloud.yml; publishing it
to the Nextcloud app store is the maintainer's own step.
Thanks to scriptPilot and xet7 !
Fixes#687.
Board Settings -> Date has Calendar sync. A board admin gives a calendar
collection's address, a user and an app password made for WeKan, and turns
it on. Each card with a due date is one event, <cardId>.ics, UID
<cardId>@wekan, an hour long, with the card's title and link; a card that
loses its due date or is archived has its event removed. Every 15 minutes
the events are read back, and a due date moved in the calendar comes back
to its card. Sync all now pushes every card at once.
The link and its password are in a server-only collection that is never
published, and only a board admin can read or change it. Requests go
through webhookFetch: the SSRF guard, so a calendar on WeKan's own network
is reached only when a site admin lists it under Internal destinations.
Text values are escaped as RFC 5545 requires - a semicolon included, which
the first version of the test did not catch.
Thanks to scriptPilot and xet7 !
Admin Panel -> Settings has a switch, off by default. With it on, every
public board is an ActivityPub actor, @board-<id> at this WeKan's address:
webfinger finds it, its actor document carries its public key, and its
outbox and followers collections can be read. New card activity on the
board is sent to its followers as signed Notes.
It is read-only. The inbox acts only on Follow and Undo Follow, and only
with a valid HTTP signature from the actor that sent it; nothing a
fediverse server sends changes a board. Private boards are never actors:
every board route goes through one helper that serves only a public,
unarchived board while the feature is on, and
tests/restBoardDomainsAccess.test.cjs now knows that helper. The keys are
in a server-only collection, and every outgoing request goes through the
SSRF guard.
Thanks to ASLLR and xet7 !
Fixes#4198.
The 16 strings of the next three commits: the Admin Panel switch that lets
public boards publish to the fediverse, Board Settings' calendar sync, and
the WebDAV attachment storage pane - in English, pending on Transifex, and
in all 234 other locales from each locale's own words for board, card,
due date, storage, folder and password.
Low confidence: tlh, chr, wal, ay, ace, rn, sm, st, kw, csb, uz-AR, iu, zgh,
nah, gn, wo, rup, se, sn, tn, kl, bua, bi, to, ti, nso, la, tig, ak, bm, ff,
gv, vo, sah, ve, tpi, dz, qu, ee, lg, ks, wa, ve-CC, bo, fj, haw, lld, om,
ss, ts, ve-PP and wa-RR; "sync", "folder", "server" and "app password" were
coined where the language has no settled word. "WebDAV (Nextcloud Files)"
names the storage in each language, so it is not left in English.
Thanks to xet7 !
Since a card can be a subtask of several parents (v12.10), its children are
found with { $or: [{ parentId }, { parentIds }] }. Only parentId had an
index, and a $or uses indexes only when every branch has one, so the query
was a collection scan - in the card remove hook for every removed card, in
card copy and in the Excel and PDF exporters. parentIds now has its own
index beside parentId's.
tests/cardQueryIndexes.test.cjs reads the branches of every $or in
models/lib/cardParents.js and requires an index for each field, so a new
branch cannot arrive without one.
Thanks to Raymond-Voogt and xet7 !
Fixes#6770.
#584 (bad HTML filtering regexp): tests/accountEmailHtml.test.cjs checked
that the e-mail layout escapes markup with /<img|<script|<b>/, which a
<SCRIPT> passes. It now lists every tag in the output, in any letter case,
and allows only the layout's own div, p, a and br; an upper- and mixed-case
input is tried as well. The renderer was already escaping them.
#585 (incomplete regular expression for hostnames): the same test made the
reset address into a RegExp; it compares the text instead.
Both are pinned as shapes in tests/securityAlerts20261012.test.cjs, which
found more of them: a case-sensitive <script> pattern in jsWebLabels.test.cjs,
a path spliced into generated code in singleFile.test.cjs (now passed through
the child's environment), and twelve test patterns with a host name's dot
unescaped. No regex literal in the tree leaves one unescaped now.
These are in tests, so there is no attempt at runtime to record in Admin
Panel -> Problems.
Thanks to GitHub CodeQL and xet7 !
It shipped in v12.43 (a6b2938e1c): Member Settings -> "Keep #label and
@member in new card titles". This pins the issue's own example: with the
switch on, "fix menu for #PROJECT by @member" stays whole; off, the default,
it still becomes "fix menu for by".
Thanks to biji and xet7 !
Fixes#1273.
The 39 strings of browser push notifications, the webhook activity picker,
the activity feed, linked whole lists, column sets, card drawing and the
organization/team tabs, in all 234 non-English locales, from each locale's
own board, card, list and member terms.
Low confidence: ace, ay, chr, csb, kw, rn, sm, st, tlh, wal, zgh, iu, nah,
gn, wo, tn, sn, se, rup, cv, bo, fj, haw, lld, om, ss, ts, ve-PP and wa-RR;
"column", "browser", "device" and "drawing" were coined where the language
has no settled word.
Wrong-language values corrected: Macedonian had the Russian "Уведомления"
and the Bulgarian "Сваляне" (now Известувања, Преземи); Catalan, its Spain
variant and Valencian had "Membres d'Afegeix" for Add members; Klingon had
s3-bucket in English. Catalan "No" is the Catalan word and is now accepted
as complete, as Aragonese "no" already was.
Thanks to xet7 !
The left menu of All Boards gets a tab for each organization and team
the member is in. A tab shows the boards shared with that group (through
the facet filter of #4791) and who is in it; the group's admins -
orgs.$.isAdmin, and now teams.$.isAdmin for teams - and site admins add
members by user name and remove them there. A group whose membership
comes from the sign-in provider (LDAP and other directory sync) is shown
read-only, even to a site admin: WeKan reads directory groups and never
writes them back. A member sees only their own groups; organization and
team memberships stay out of what a client may write.
models/lib/groupMembers.js decides access and builds the membership
changes; tests/groupMembers.test.cjs covers admins, site admins, members,
strangers, a directory-synced group, double membership and the server's
checks. The new strings are English placeholders until the next
translation pass.
Thanks to xet7 !
Fixes#802.
Card menu / Drawing opens a drawing surface: pick a colour and a pen
width and draw with a mouse, pen or finger; undo the last stroke or clear.
Saving keeps the strokes on the card (drawings), so the drawing opens
again for editing from the same popup, and uploads a PNG of it as a
card attachment through the normal upload - so it shows wherever a
picture does. "Download as SVG" builds the SVG from the strokes. The
drawing code is the dependency overlay's ("Red Strings", #3392): strokes
are SVG paths.
Only numbers, the allowed colours and pen widths ever reach the SVG -
a point or colour carrying text is dropped - so nothing typed becomes
markup, and the SVG is not uploaded as a file at all (uploads treat SVG
as dangerous content). models/lib/cardDrawing.js cleans strokes, builds
the SVG and replaces an edited drawing; tests/cardDrawing.test.cjs
covers paths, dots, edits, injected colours, widths and points, clamping
and the bound. A Meteor run started with the new card field. The new
strings are English placeholders until the next translation pass.
Thanks to aleroot and xet7 !
Fixes#1178.
A new board view, Column sets. A board keeps named column sets - say
Completion, Priority, Milestone - each with its own coloured columns, and
every card is in one column of each set, or "Not placed". Picking a set
shows its columns; dragging a card to another column changes only where
it is in that set - its list, swimlane, labels and members stay - and
each card shows, as coloured labels, its column in the other sets, as the
issue asked. Board admins make and delete sets and columns; moving cards
needs the right to edit a card. Clicking a title opens the card.
Registered like every view: the Board View menu (appended after Version
Control), the default order and VIEWS_ADDED_LATER, the user's boardView
values and the API description, and an instance feature group so the
Admin Panel can turn it off. models/lib/columnSets.js holds the logic;
tests/columnSets.test.cjs covers places, removed columns, the other
sets' badges, foreign columns, dotted keys and the bounds, and
boardViewMenu / boardViewSettings now expect the view last. A Meteor run
started with the new fields. Documented in
docs/Features/Board/Column-Sets.md. The new strings are English
placeholders until the next translation pass.
Thanks to kentonv and xet7 !
Fixes#211.
The add-list form gets "or link a list from another board": pick a board
you can see and one of its lists, and this board gets a list that shows
that list's cards as they are, live. They stay the source board's cards,
under its rules - opened, edited, moved by whoever may write the source
board - and a card typed into the mirror is added to the source list by
addCardToLinkedList, which checks the right to write in that list. In
the Swimlanes view the mirror shows its cards once, in the first
swimlane. The source cards come through linkedListCards, published only
to a subscriber who may see both boards, so the board publication is not
widened. A list cannot mirror its own board, an archived or foreign list,
or another mirror.
models/lib/linkedList.js decides; tests/linkedList.test.cjs covers the
selector, the swimlane rule, the refused links, both visibility checks
and the source board's write rule. A Meteor runtime run started with the
new list fields. The new strings are English placeholders until the next
translation pass.
Thanks to javen9881 and xet7 !
Fixes#2809.
Member Settings / Notification Settings / "Browser notifications on this
device": the browser asks for permission and gives a push subscription,
and from then on every notification the member gets in WeKan - the same
recipients, watching and muted kinds as the tray and e-mail - also pops
up from that browser even with WeKan closed; a click opens the card. Turn
it on per browser and device, up to ten per account.
web-push 3.6.7 (pinned) sends it with this WeKan's own VAPID key pair,
made once and kept in a server-only collection; only the public key
leaves the server. A subscription's endpoint is chosen by the browser and
POSTed to by the server, so it is accepted only over https and only at
the push services browsers use - an internal address or another site is
refused when saved and again before every send. Gone subscriptions are
forgotten. The service worker opens only paths of this WeKan. Not
offered on Sandstorm.
models/lib/webPush.js decides; tests/webPush.test.cjs covers the push
services, internal and look-alike hosts, foreign click targets and the
bound; server/lib/tests/webPush.tests.js runs in Meteor (passing): one
key pair, only the public key out, an internal endpoint refused. With
the webhook activity picker (c3321926ab) and the all-boards activity
feed (656af74b2c), this completes both issues. The new strings are
English placeholders until the next translation pass.
Thanks to saurabharch, hingerl and xet7 !
Fixes#2026,
Fixes#1377.
The Story and Task commit (0d77882c3b) declared cardKinds as
`type: [String]`, which the schema library rejects at startup ("Invalid
definition for cardKinds field: type may not be an array"), so WeKan
stopped. It is `type: Array` with a 'cardKinds.$' entry of the two kinds
now. Found by a Meteor runtime test run; tests/cardKinds.test.cjs now
pins the form and checks that no array shorthand type is left in the
schemas these changes touched.
Thanks to xet7 !
Member menu / "Activity on all my boards" (/activity) lists what
happened on every board the member sees in All Boards, newest first, a
page of 50 at a time: who, what - in the same sentence the notifications
use - on which card and board, and when, with the card linked. It never
carries a field's value, so an admin-only custom field cannot leak
through it; on a board where the member sees only cards assigned to
them, only those cards' activity is listed; and it is empty when the
Admin Panel hides activities or turns them off.
models/lib/activityFeed.js shapes and filters the entries;
tests/activityFeed.test.cjs covers the entry, an unseen board, the
assigned-only rule, the bound and the server's switches. Part of #2026
and #1377, with the webhook activity picker and browser push. The new
strings are English placeholders until the next translation pass.
Thanks to xet7 !
An outgoing webhook was sent every activity, or whatever its activities
list said with no way to change it in the interface. Its form now has
"Send this webhook:" with "Every activity" and a tick per kind of
activity - the same groups a member mutes notifications by (#572):
labels, members, assignees, comments, moves, dates, checklists,
attachments, custom field values, archive and created. Ticks are saved as
the act-<type> descriptions the activity hook matches webhooks by;
nothing ticked, or Every activity, stays "all", the default.
models/lib/webhookActivityPicker.js maps both ways;
tests/webhookActivityPicker.test.cjs checks that a picked group selects
exactly its activities through webhookActivitySelection, the form state,
and that a webhook never silently gets nothing. Part of #2026 and #1377,
with the activity feed and browser push. The new strings are English
placeholders until the next translation pass.
Thanks to xet7 !
Member Settings / "Mark cards changed since I last opened them", off by
default. With it on, a minicard gets a blue edge when anything of the
card changed after the member last opened it - its own fields (title,
description, dates, labels, members), its checklists and their items,
attachments and comments - until they open it. Turning it on records
when, so the cards a member never opened are not all marked at once, and
closing a card counts as having seen it, so their own edits made while
it was open do not mark it.
models/lib/unreadChanges.js takes the latest change across those
documents and compares it; tests/unreadChanges.test.cjs covers each kind
of change, seen since, off, older than the switch and the wiring. The
new strings are English placeholders until the next translation pass.
Thanks to Lacour20, martinpospech and xet7 !
Fixes#2111,
Fixes#1604.
The 16 strings added as English placeholders by the #1931, #1618, #2805,
#4791 and #2012 commits are translated in all 234 locales, each with that
locale's own words for board, card, list, swimlane and label, and its
usual agile terms for Story and Task (where that is the English word, a
still-correct variant such as "User-Story").
Low confidence, for a native speaker to check: ace, ak, am, as, ay, ba,
bi, bm, bo, bua, chr, co, csb, cy-GB, dz, ee, ff, fj, fo, fur, ga, gd, gn,
gv, ha, haw, hsb, ht, ig, iu, kl, km, km-KH, km_KH, kok, ks, kw, la, lg,
lld, mai, mg, mi, nah, nap, nd, nso, ny, oc, om, or_IN, ps, qu, rm, rn,
rup, rw, sah, sc, scn, sd, se, sm, sn, so, ss, st, szl, tg, ti, tig,
tk_TM, tlh, tn, to, tpi, ts, tt, uz-AR, ve, ve-CC, ve-PP, vo, wa, wa-RR,
wal, wo, wuu-Hans, xh, yi, yo, zgh.
Thanks to xet7 !
The commits since: story and task cards, an existing card from another
board as a subtask, a person responsible for each checklist item with
dated items in the calendar and Gantt, adding and dragging cards in the
Table view, one shared list header row, All Boards facets, and a board
admin adding only their own organizations and teams. #5141, #864, #1931,
#1618, #2805, #4791 and #2012 leave TODO Later.
Thanks to xet7 !
A card can be a Story or a Task: card menu / Card kind (or an ordinary
card again), with a book or a checked-box badge on the minicard. A custom
field can be limited to card kinds - "Only on these card kinds", none
ticked being every card as before. A kind's own fields are added to a
card when it gets that kind, and shown only on cards of it; a field of
no kind shows on every card. The one choke point every render uses,
customFieldsWD, leaves out fields of other kinds, so the card details and
minicard agree.
models/lib/cardKinds.js decides; tests/cardKinds.test.cjs covers the
fields a kind brings, not twice, other kinds' fields staying off, unknown
kinds, and the card menu, badge and the field's ticks. The new strings
are English placeholders until the next translation pass.
Thanks to nightwind27 and xet7 !
Fixes#2012.
A facet bar above All Boards shows the first characters of the board
names (one emoji or letter, any case), the organizations and teams the
boards are shared with, and the member's own board labels - each with
its count - and a click shows only that group, in the server-paged
sorted views and the drag-ordered one alike; again, or "Show all boards",
clears it. Board labels are the member's own (profile.boardLabels):
"apply label X to the boards whose name includes Y" files many at once,
and a label can be removed. Counts are over the boards the member sees
in All Boards - the same visibility selector as getAllBoardsPage, hidden
boards left out - never more.
models/lib/allBoardsFacets.js counts, builds each group's selector and
applies labels; tests/allBoardsFacets.test.cjs covers characters, an
inactive organization link, labels of boards no longer visible, escaped
and injected facet values, empty labels and the server's visibility. The
new strings are English placeholders until the next translation pass.
Thanks to xet7 !
Fixes#4791.
Board Settings / Swimlane gets "One shared list header row", off by
default. With it on, the Swimlanes view shows the list headers once - the
first swimlane's - and the other swimlanes no longer repeat them; that
row stays at the top while the board scrolls, through the existing
sticky list header rule of #3847, which the setting turns on, rather than
a second sticky mechanism (tests/stickyListHeadersSwimlanesView keeps
that so). The only new CSS rule is scoped to boards with the setting.
tests/sharedListHeaders.test.cjs checks the board field, the toggle, the
first-swimlane class, the reuse of the sticky rule and the scoping. The
new strings are English placeholders until the next translation pass.
Thanks to mikesutton and xet7 !
Fixes#2805.
Each checklist item gets a "who is responsible" button: the board's
active members to pick from, or nobody; the avatar then shows on the
item. A deny rule keeps the responsible person an active member of the
item's board. Checklist items with a due date (#4755) now appear in the
calendar and in the Frappe and dhtmlx Gantt views as "card: item", with
their own `ci:` ids: opening one opens its card, a calendar drag of one is
refused, and moving one in a Gantt moves only the item's own due date -
never the card's dates.
models/lib/checklistItemSchedule.js collects dated items (not of archived
or missing cards) and decides who may be responsible;
tests/checklistItemSchedule.test.cjs covers both and the wiring of the
three views. tests/checklistItemDueDate.test.cjs, which pinned #4755 as
"due dates only", now says the assignee is #1618's own field. The new
strings are English placeholders until the next translation pass.
Thanks to martinbruno90 and xet7 !
Fixes#1618.
The "add existing card as subtask" picker offered only cards of the same
board. It now has a board picker: the card's own board first, then the
other boards the member may write. Another board's cards come from the
server (crossBoardSubtaskCandidates), and picking one attaches it through
addCrossBoardSubtask, which checks on the server, with server data, that
the member may write both the parent's and the child's board, that the
child is an ordinary, not archived card, and that no loop forms through
any parent. The card keeps the parents it has. Same-board picks work as
before.
tests/crossBoardSubtasks.test.cjs runs the loop check across boards and
checks both write rights, the card types, the escaped search and the
popup. The new string is an English placeholder until the next
translation pass.
Thanks to TiibCD and xet7 !
Fixes#1931.
The 27 strings added as English placeholders by the #1297, #1293, #5847
and #4265 commits are translated in all 234 locales, each with that
locale's own words for board, card, members and its Member Settings menu
name; WeKan, Mattermost and https:// are kept as they are. Where a
language's word for passkey is the English one, the popup title is
"Your passkeys", so it is not left equal to the English.
Low confidence, for a native speaker to check: ace, ak, am, as, ay, ba,
bi, bm, bo, bua, chr, csb, cv, dz, ee, ff, fj, fo, gd, gn, gv, ha, haw,
hsb, ig, iu, kl, km_KH, kok, ks, kw, la, lg, lld, mai, mg, mi, nah, nap,
nd, nso, ny, om, qu, rn, rup, sah, sc, se, si, sm, sn, ss, st, szl, ti,
tig, tk_TM, tlh, tn, to, tpi, ts, tt, ug, uz-AR, ve, ve-CC, ve-PP, vo, wa,
wal, wo, wuu-Hans, xh, yi, zgh.
Thanks to xet7 !
The Table view only listed cards. Now a member who may write gets an add
row under the table - a title, a list and a swimlane - and can drag a row
onto another: the dragged card goes just before the target card, in the
target's list and swimlane, through the same card.move the board uses.
Adding goes through tableViewAddCard, which checks that list and swimlane
are on that board and not archived and that the member may write in that
list, as for any card added. Rows are not draggable without the right.
models/lib/tableViewDrop.js places the card; tests/tableViewDrop.test.cjs
covers between, first and same-list drops, a drop onto itself, the
server's checks and that only writers get the controls.
Thanks to guakamole and xet7 !
Fixes#864.
setBoardOrgs and setBoardTeams refused nothing but non-admins: a board
admin could link any organization or team of the instance to a board,
and with it give every one of its members the board. Now an organization
or team that is new to the board must be one the board admin belongs to;
a site administrator may add any. Links already on the board stay -
somebody else may have added them - and removing or switching one off is
always allowed. The pickers offer only the admin's own groups, and the
org and team publications, which gave non-admins nothing (so the pickers
were empty for them), now give a signed-in user their own groups' names.
models/lib/boardGroupLinks.js decides; tests/boardGroupLinks.test.cjs
covers own groups, existing links, removals, site admins, a foreign group
refused and not offered, and that both methods check before writing.
Thanks to chrisi51 and xet7 !
Fixes#5141.
v12.43 was cut before these commits, so they go into a new Upcoming above
it: passkey login and Log out everywhere, the login webhook, ntfy, the
clear HTML e-mail default, Mattermost direct messages, read-only Rules
for members, the rule e-mail member picker, the subtask landing swimlane,
hidden team boards, Share to WeKan on Android, Sandstorm card sharing and
the LibreJS labels page. #1953, #2217, #2290, #2435, #4434, #5148, #1040,
#1188, #1297, #1293, #5847 and #4265 leave TODO Later.
Thanks to xet7 !
A board a member reaches through one of their teams or organizations, or
their e-mail domain, could not be left: without a member entry quitBoard
refused it, and with one the board stayed in All Boards through the team.
Now leaving such a board puts it in the member's own hidden list
(profile.hiddenBoards): All Boards leaves it out, in the paged sorted
views and the drag-ordered one, and Member Settings / Hidden boards
brings it back with Restore. The team or organization membership is not
touched, and access stays the board's own. An All Boards tile of a board
the member is not on gets an eye-slash "leave" button; a member who also
has the board through a team is both removed and hidden. A board reached
only by membership leaves as before.
models/lib/boardInvites.js decides (planQuitBoard's hide,
reachesBoardOtherwise, hiddenBoardsAfter); tests/hiddenBoards.test.cjs
covers team, organization and domain reach, an inactive link, the bound,
that the team is not touched and the All Boards filters.
tests/boardInvites.test.cjs expects the plan's hide: false where nothing
else reaches the board. The new strings are English placeholders until
the next translation pass.
Thanks to LaureHades and xet7 !
Fixes#4265.
Member Settings gets Passkeys: add a passkey on this device under a name,
see the account's passkeys and remove one. The sign-in page gets "Sign in
with a passkey": the browser offers this WeKan's passkeys, no user name
needed. Verification is @simplewebauthn/server 14.0.3 (MIT, pinned)
against ROOT_URL's host and origin, so a passkey cannot sign in to another
site or through another address; each sign-in signs a fresh challenge
that is used once and expires in five minutes, and the signature counter
must move forward, so a copied passkey is refused. A disabled account
cannot sign in with one (the existing validateLoginAttempt hooks apply).
Passkeys are a top-level user field, never published and not writable
from the client; up to 20 per account. Not offered on Sandstorm.
Member Settings also gets Log out everywhere: after a confirmation every
login token of the account goes, so Meteor ends every session - other
browsers, phones, the desktop app - and this one. Nothing else changes.
models/lib/passkeys.js holds the relying party, base64url and the
browser conversions; client/lib/passkeys.js uses navigator.credentials
directly. tests/passkeys.test.cjs signs assertions with a software ES256
authenticator: a real signature verifies, and another key, another
origin, another challenge or a counter that went back are refused; it
also checks single-use challenges, the unpublished field and the pin.
server/lib/tests/passkeys.tests.js runs in Meteor (2 passing): the module
bundles, login options name no account, and registration needs a user.
Documented in docs/Features/Login/Passkeys.md. The new strings are
English placeholders until the next translation pass.
Thanks to xet7 !
Fixes#5847.
models/lib/sandstormShare.js (#1188) parses a page path against
http://grain.invalid, a reserved name that is never contacted, and cites
Sandstorm's documentation of startSharing.
Thanks to xet7 !
The web app manifest declares a share_target, so on a phone where WeKan
is installed as an app it appears in Android's Share menu. Sharing a web
page, a note or a message opens /share-target, "Add to WeKan": pick a
board and a list, and what was shared becomes a card there - the page's
title or the text's first line as the title, the text and the address in
its description, the address once - and the card opens. Only boards the
member may add cards to are offered, and the server checks the right to
write in that list, on that board, as for any card added.
models/lib/shareTarget.js turns a share into a card and holds the
manifest's declaration; tests/shareTarget.test.cjs covers what browsers,
notes and chat apps share, an empty share, javascript: addresses, the
manifest, the route and the server's checks. Documented in
docs/Platforms/FOSS/OS/Android.md. The four new strings are English
placeholders until the next translation pass.
Thanks to memeplex and xet7 !
Fixes#1293.
A saved outgoing webhook gets "Also send a Mattermost direct message to
the card's members and assignees". With it ticked, every message about a
card also goes to each of its members and assignees as the webhook's own
message with channel "@username" - Mattermost's direct-message channel -
so they hear about their cards without following the channel. The person
who made the change is not messaged, nobody twice, a name that is not a
valid Mattermost user name is skipped, and a card stops at 50. A board
webhook does this only for its own board's cards. The direct messages go
at once, best effort, through webhookFetch; the channel message keeps its
grouping and schedule. Two-way webhooks are left as they are.
models/lib/mattermostDirectMessages.js picks the people and builds the
messages; tests/mattermostDirectMessages.test.cjs covers them, the actor,
bad names, the bound, and that it is off unless ticked and sent through
the SSRF guard. docs/Features/Webhooks/Chat/Mattermost.md says what
Mattermost needs. The two new strings are English placeholders until the
next translation pass.
Thanks to xet7 !
Fixes#1297.
The 24 strings added as English placeholders by the #1953, #2217, #2290,
#2435 and #5148 commits are translated in all 234 locales, with each
locale's own words for rules, members, board, swimlane and subtasks;
@username and the ntfy.sh example addresses are kept as they are, and the
quoted label in the Rules option's description is that locale's own
translation of the board admin's tick.
The Acehnese "keep #label" strings from the earlier pass used Malay
"simpan"; they say "keubah", the file's own word, now
(tests/wrongLanguageLocales). The Maori, Northern Sotho, Somali and Tok
Pisin recovery suites count 50 recovery keys since the four bulk actions
of #6768.
Low confidence, for a native speaker to check: ace, ak, am, ay, ba, bi,
bm, bo, bua, chr, co, csb, cv, dz, ee, ff, fj, fo, fur, fy-NL, gd, gn, gv,
ha, haw, hsb, ig, iu, kl, kok, ks, kw, la, lb, lg, lld, mai, mg, mi, my,
nah, nap, nd, nso, ny, oc, om, or_IN, pap, ps, qu, rn, rup, rw, sah, sc,
scn, sd, se, sm, sn, so, ss, st, szl, tg, ti, tig, tk_TM, tlh, tn, to,
tpi, ts, tt, ug, uz-AR, ve, ve-CC, ve-PP, vo, wa, wa-RR, wal, wo,
wuu-Hans, xh, yi, yo, zgh.
Thanks to xet7 !
Inside a grain WeKan's own address reaches nobody, so the copied card link
was useless to anybody else. On Sandstorm, Copy card URL - in the card
menu and in the card's link popup - now sends the shell
{ startSharing: { pathname } }, which opens Sandstorm's Share Access
dialog; its sharing link opens the grain at that card. The shell accepts
only a path starting with "/", so only the card's path is sent. Outside
Sandstorm both buttons copy as before.
models/lib/sandstormShare.js builds the message;
tests/sandstormShare.test.cjs checks it, that nothing else reaches the
shell, and that both buttons share only inside a grain.
Thanks to AlexanderZobkov and xet7 !
Fixes#1188.
LibreJS runs a page's JavaScript only when it can tell the code is free.
A Meteor bundle is generated, minified and named by hash, so it cannot
carry per-file @license comments; LibreJS's other way is a JS Web Labels
table, linked with rel="jslicense". WeKan now serves /jslicense.html,
built from the client bundle it is actually serving (web.browser and
web.browser.legacy, under ROOT_URL's path), labelling each script with
the free licenses the bundle combines - Expat (MIT), Apache-2.0, Modified
BSD, FreeBSD and ISC, under LibreJS's own names and addresses - and with
WeKan's source at the running version. Every page links it from <head>,
whether or not the custom head is on.
models/lib/jsWebLabels.js builds the table and the link;
tests/jsWebLabels.test.cjs checks the scripts chosen from a manifest, the
table LibreJS reads, escaping and the wiring. releases/risk-baseline.json
allows the license addresses, and ntfy.sh, which the ntfy channel
(d873af70e8) names in a placeholder and comments.
Thanks to alexgleason and xet7 !
Fixes#1040.
Member Settings / Notification Settings gets "ntfy phone notifications":
a member pastes their ntfy topic's address, and an access token if the
topic needs one, and each notification they get in WeKan - the same
recipients, watching and muted activity kinds - also arrives in the ntfy
app, with the board and card as the title, what happened as the message
and a tap opening the card.
It uses ntfy's JSON publishing, so a title in any language needs no
header encoding, and goes through webhookFetch: the SSRF guard, Internal
destinations for a self-hosted ntfy, the Powerbox on Sandstorm. An
admin-only custom field value still reaches only board admins. One read
per activity finds the recipients who turned it on; sending is deferred
and best effort, so ntfy being down never touches e-mail or the tray.
The address and token are a top-level user field, saved and read only
through the member's own methods, not client-writable and never
published.
models/lib/ntfy.js parses topic addresses and builds the request;
tests/ntfy.test.cjs covers the request, bad addresses, tokens with header
injection, javascript: links, off, and that the setting is unpublished
and sent only through webhookFetch. Documented in
docs/Features/Notifications/ntfy.md. The new strings are English
placeholders until the next translation pass.
Thanks to xet7 !
Fixes#5148.
Notification e-mail now defaults to the clearly arranged layout of #5171 -
board first, board, actor and card in bold and linked, with a plain-text
alternative. One sentence (classic) is still one choice away at the
Admin Panel, board and member levels, and the tray keeps the classic line.
Account e-mails - reset password, verify e-mail, enroll account, and the
board and registration invitations - get an HTML part in the same style,
built from the same translated text, which is still sent as the text
part: no translation changes. Every piece of text is escaped first, the
link paragraph becomes a button, and only an http(s) address is linked. A
caller's own HTML and texts that are not WeKan's e-mail strings are left
as they were, and a failure to build the HTML leaves the text alone.
models/lib/accountEmailHtml.js renders it; tests/accountEmailHtml.test.cjs
lays out the real English texts and checks that markup in a name, a board
title or the site name stays text and only http(s) is linked.
notificationDelivery's default assertions now expect clear for e-mail,
and emailLocalizationPreparation's harness allows the new module, checks
the HTML part, and checks the absent-HTML case with literal text.
Thanks to Meeques and xet7 !
Fixes#4434.
The send-email action gets a member picker under To: typing filters the
board's active members by user name or full name, and a pick adds
@username to To. Addresses are still typed into To as before. When the
rule runs, each @username becomes that member's current email address,
so the rule - and whoever edits it - holds a user name, never somebody's
address, and a member who changes address is still reached. A @name of
somebody who is not an active member of the board, or has no address, is
dropped rather than sent as text, and nobody is mailed twice.
models/lib/ruleEmailMembers.js holds the parsing, the choices and the
expansion; tests/ruleEmailMembers.test.cjs covers them, non-members,
duplicates, an address with @ inside, and that the picker never reads an
email address. rulesHelper imports it, so the ruleEmailFailure harness,
which runs rulesHelper without require, is given it as it is given
ruleParts. The new strings are English placeholders until the next
translation pass.
Thanks to chenghongxi and xet7 !
Fixes#2435.
Admin Panel / Settings / Global Webhooks gets one address WeKan tells
when somebody logs in, when a new account is made, or both - nothing is
sent until an event is ticked. Each message is a JSON POST with the
event, the user name and the time; the email, the login's IP address,
the full name and the sign-in method are added only when ticked. A token
goes in X-Wekan-Token, as for board webhooks.
It is sent after the login, through webhookFetch - the SSRF guard,
Internal destinations and, on Sandstorm, the Powerbox - and a receiver
that is down only leaves a log line. The setting is read and saved
through site-admin methods and never published.
models/lib/accountWebhook.js cleans the setting and builds the message;
tests/accountWebhook.test.cjs checks the default carries name and time
only, each extra field only when ticked, the events separately, bad
addresses refused, and that no hash, services or user id is sent.
Documented in docs/Features/Webhooks/Login-and-Registration-Webhook.md.
The new strings are English placeholders until the next translation pass.
Thanks to KrunalDholakiya and xet7 !
Fixes#2290.
Admin Panel / Settings / Visibility / Rules gets "Boards may show their
Rules to members, read-only", off by default (Settings
rulesReadOnlyForMembers, site admin only). With it on, a board admin ticks
"Show these Rules to board members, read-only" on the board's Rules page
(rulesVisibleToMembers). Members of that board then get Rules in Board
Settings and see the rules list and each rule's details, with no control
that changes a rule; the methods that change rules keep their board-admin
checks, so nothing is granted. Without both ticks only board and site
admins see the Rules page, which until now drew its list for any member
who opened the address.
models/lib/rulesReadOnly.js decides 'edit', 'read' or 'none', and
client/lib/rulesAccess.js is the one place the Rules page, Board Settings
and rule details ask. tests/rulesReadOnly.test.cjs covers both switches,
each alone, a non-member, and that a reader's page has no edit control.
boardMenuOrder now leaves the reader's alternative branch out of the
admin's sequence and pins it alone; instanceFeatures counts the fourth
site-admin method; roleHelperRegressions follows the canAdmin check to
rulesAccess.js. The new strings are English placeholders until the next
translation pass.
Thanks to justinr1234 and xet7 !
Fixes#2217.
Beside the landing list, Board Settings / Subtasks now has a landing
swimlane, stored as subtasksDefaultSwimlaneId. As with the list, the main
board's choice wins on a shared deposit board, then the deposit board's
own; a swimlane that is archived, gone or on another board is never used.
With none picked, nothing changes: the swimlane with the parent card's
swimlane title, else the default one (#2732). Changing the deposit board
clears the choice, and a copied board does not keep its template's.
models/lib/subtaskLandingSwimlane.js decides; tests/subtaskLandingSwimlane
covers it, and tests/subtaskSwimlaneInheritance2732 now runs the chooser
for the title match instead of reading the inline lookup it replaced. The
two new strings are English placeholders until the next translation pass.
Thanks to BjoernLudwig and xet7 !
Fixes#1953.
v12.42 was cut on origin while Bots, board search reveal, label order,
avatar order, internal webhook destinations, the how-tos and the
notification recovery fixes were being recorded locally, and the merge
left their entries inside the v12.42 section although that release does
not contain those commits (tests/changelogEntriesBelongToTheirRelease
caught all eleven). The v12.42 section is restored exactly as released,
and those entries move to a new Upcoming, with the keep #label / @member
setting and the FreeBSD rc.d script. Both leave TODO Later.
Thanks to biji and xet7 !
releases/bsd/rc.d/wekan runs the bundle's own start-wekan.sh (bundled
Node.js and FerretDB on SQLite) under daemon(8) as an unprivileged
wekan_user, configured from rc.conf: wekan_dir, wekan_port,
wekan_root_url, wekan_data (WRITABLE_PATH), wekan_logfile and wekan_env.
It has no -r, because start-wekan.sh already restarts WeKan, and stop
signals the whole process group so FerretDB stops with node.
releases/bsd/build-bundle.sh puts it in the FreeBSD bundle as
bundle/rc.d/wekan, and bsd.yml fails a FreeBSD zip without it. The
FreeBSD doc has the install steps, the rc.conf table and an outline of a
ports Makefile to propose to FreeBSD.
tests/freebsdRcScript.test.cjs checks the rc.subr contract with sh -n,
that it never runs as root or restarts twice, and that the bundle ships it.
Thanks to xet7 !
Fixes#2662.
The two Member Settings strings added for #1273 were committed as English
placeholders; this fills them in all 234 locales, with each locale's own
words for label, member, card and title. "#" and "@" are kept as they are.
Low confidence, for a native speaker to check: ace, ak, am, ay, ba, bi,
bm, bo, bua, chr, csb, cv, dz, ee, ff, fj, fo, fur, gd, gn, gv, ha, haw,
ig, iu, kl, km-KH, kok, ks, kw, la, lg, lld, mai, mg, mi, nah, nap, nd,
nso, ny, om, pap, qu, rn, rup, rw, sah, sc, se, sm, so, ss, st, szl, ti,
tig, tk_TM, tlh, to, tpi, ts, tt, uz-AR, ve, ve-CC, ve-PP, vl-SS, vo, wa,
wa-RR, wal, wuu-Hans, yi, zgh.
Thanks to xet7 !
#6768: the recovery scan retried every pending activity notification each
round, and one whose delivery fails for good - its activity deleted or
changed since, a recipient who lost access, a plan with nothing or too much
to send - failed the same way every round, forever, so the list only grew.
Such an error is terminal now: after a ten-minute grace (an activity being
written is never touched) the scan cancels that notification through the
same cancellation an administrator uses, as the system, which compacts it
to a cancelled receipt. A pending notification older than
ACTIVITY_NOTIFICATION_MAX_AGE_DAYS (7) is cancelled as expired instead of
being delivered a week late. Network and other transient failures are still
retried. Admin Panel -> Problems gets "Retry all" and "Cancel older..." for
the whole list at once, site administrators only.
#6769: before each run synced-cron asks whether a job of that name is still
running - { name, finishedAt: { $exists: false } } - every minute for every
job on every instance, and only { intendedAt, name } and the TTL on
startedAt were indexed, so it scanned the job history. { name, finishedAt }
is created at startup with WeKan's ensureIndex.
The new strings are translated in every locale.
Thanks to Raymond-Voogt and xet7 !
Fixes#6768,
Fixes#6769.
Admin Panel -> Settings -> Global Webhooks -> Internal destinations: the
hosts on WeKan's own network - a Node-RED, a chat server, a Matrix hookshot
- that outgoing webhooks may reach, one per line, a name or an address,
with a port to allow only that port. Empty by default. Only site
administrators read and change it, through methods, and it is never
published, so a board member still can not point a webhook inward and the
list does not describe the network to anyone else. A listed host is called
directly without following redirects; every other address stays behind the
SSRF guard, and the REST routes that save a webhook accept a listed host as
well. The Node-RED how-to (#2017) says how.
The new strings are translated in every locale.
Thanks to xet7 !
matrix-hookshot's generic webhooks post a JSON body's top-level `text` into
a Matrix room, and WeKan's outgoing webhook already sends the activity as
a sentence in `text` - so a board's (or the instance's) outgoing webhook
pointed at a hookshot address is all it takes. WeKan needs no Matrix
account, token or bot.
Thanks to killua-eu and xet7 !
Fixes#1100.
A USB or serial RFID reader and a short Python script, as a WeKan user with
write access to the board: the scanned tag finds its card through an RFID
custom field (GET .../cardsByCustomField) and moves it to another list, or
comments on it, or creates a card for an unknown tag - and a Rule can do
the rest.
Thanks to xet7 !
Fixes#1126.
Bitbucket Cloud needs no provider of its own: an OAuth consumer with the
callback /_oauth/oidc, and the OAuth2 settings pointing at bitbucket.org's
login pages and api.bitbucket.org's /2.0/user, mapping uuid, nickname and
display_name. Checked against the code: an endpoint given as a full URL is
used as it is, and the client secret goes in the token request as Bitbucket
accepts it. Bitbucket's user record has no email, which the how-to says,
with what that means for OAUTH2_ALLOWED_EMAIL_DOMAINS.
Thanks to thuanpq and xet7 !
Fixes#1324.
The page described Rancher 1 with Rancher Active Proxy and the
wekanteam/wekan:meteor-1.4 image. It now describes Rancher v2: adding the
WeKan chart repository (wekan.github.io/charts), installing with ROOT_URL,
a release tag, a persistent volume for FerretDB's files under
WRITABLE_PATH and the cluster's ingress and certificate issuer, and
upgrading - in Rancher's own screens and with helm.
Thanks to Dreampie and xet7 !
Fixes#632.
The decision for #2171 was next AND previous; only next was there. Now
Shift+Enter in the search box steps to the previous card found, the arrows
beside "2 of 7" step either way for a mouse or a touch screen, and both
wrap round - back from the first is the last.
Thanks to rlach and xet7 !
A board's labels have an order now - a board admin moves a label up or down
when editing it (the same write, and permission, as editing a label) - and
Sort cards has "Label order": each card comes where its first label comes
in that order, cards without a label last, and cards that rank the same
keep the order they were dragged into. Like "Sort by votes" it is a display
order only: no card's manual position changes, so turning it off gives the
dragged order back.
The new string is translated in every locale.
Thanks to mnantel and xet7 !
Fixes#2040.
A board search found cards and listed them in the sidebar, but finding the
card on the board was still the reader's job; a browser's own find did not
help either, as the issue shows. Now a result opened from the sidebar is
also revealed on the board - scrolled into the middle of the view and
highlighted for a moment - and pressing Enter again in the search box steps
to the next card found, wrapping round, with "2 of 7" under the box, the
way finding on a page works. A list found is revealed the same way. The
highlight does not pulse for people who ask for reduced motion.
The new string is translated in every locale.
Thanks to rlach and xet7 !
Fixes#2171.
The minicard floated every avatar to the end of its row, which drew them
in reverse: the person added first, whom a team treats as the responsible
one, came last, while the opened card showed them first. The avatars are a
wrapping row aligned to the end now, in the order they were added - still
wrapping right-aligned as #5081 asked. Each person's initials avatar has a
colour of their own, the same everywhere and every time
(models/lib/avatarColor.js), every colour keeping the initials readable at
WCAG AA, and the avatar's tooltip names the person.
Thanks to HolgerGH and xet7 !
Fixes#2110.
Board Settings -> Bots, below Workflow view, is the Rules page's view for
bots: runners on your own server - an AI agent, a CI job, a script - that
the board hands cards to. It is laid out like kanbots in the board's own
theme, Font Awesome and drag and drop: a rail of bots, live runs and
activity; the board's lists as columns, each card with its run's state
(Queued, Running, Waiting for you, Ready to review, Done, Failed, Stopped),
the step it is on and the answers to a question it asked; and a drawer with
the card's thread, Hand to bot, Stop and a reply box. Board admins only,
like the rest of the Rules page, and never a board or public view.
A bot has no rights of its own, like Rules and workflows. WeKan only sends
to it: a bot is an outgoing webhook marked as a bot, subscribed to no board
activity and no reminders, and a dispatch goes through the ordinary webhook
queue - the SSRF guard, its signing token, retries, Sandstorm's Powerbox.
The runner works on the board through WeKan's REST API with its own user's
token and board role, and reports its run at one REST route that needs
write access to the board. Handing over is a board admin's choice, in the
view or with the new Rule action "Hand the card to bot"; an answer or a
reply is the admin's own comment, under their right to comment.
The GitHub- and Gitea-compatible APIs' routes are regular expression
literals now, and an instance board is Trello's "org" level.
The new strings are translated in every locale.
Thanks to xet7 !
v12.41 gave every board without a key one at startup by re-reading every
key of the instance for each board, and counting up from 2 again for every
board that shares a title: quadratic, and on 32,500 boards hours of slow
`{ key: { $exists: true } }` queries. Now the keys in use are read once,
the new keys are planned in memory with a counter per base
(models/lib/boardKey.js planBoardKeys, linear), and written in batches of
1000, each only where the board still has no key, so a key a board admin
set meanwhile is never replaced. A single new board reads only the keys
that could collide with its suggestion (an index range on the new `key`
index), not all of them. Planning 32,500 boards takes well under a second;
600 boards are written in under one on a running server.
Thanks to Raymond-Voogt and xet7 !
Fixes#6767.
Admin Panel / Settings / Visibility / Optional APIs ticks REST APIs in the
shape of Trello's, Jira's, GitHub's and Gitea's, so apps and scripts written
for them - Trellinator, Jira and GitHub clients - can use WeKan as their
backend, each described on the page with the address a client uses.
None has rights of its own. Each is a translator: a request in the other
tracker's shape becomes the matching request to WeKan's own REST API, made
with the caller's own WeKan token on the loopback address, and the answer
becomes the other tracker's JSON. Every WeKan permission therefore applies
unchanged - read-only and comment-only roles, assigned-only members, list
permissions - and an API that is not ticked answers 404. All of them sit
under /api, so WITH_API turns them off with the rest of the REST API.
Trello: members, boards, lists, cards, labels, comments and checklists; a
deleted card is archived. Jira: projects are boards (the board key), issues
are cards (DEV-7), statuses are lists and transitions move cards, with
simple JQL. GitHub and Gitea: repositories are boards and issues are cards,
open or closed as in Board View / Version Control, with labels, milestones,
comments and Link pagination.
The new strings are translated in every locale. A runtime test over real
HTTP shows a read-only member refused and a Trello-created card readable
through Jira and GitHub.
Thanks to xet7 !
Fixes#4930.
Import -> GitHub -> Import a whole GitHub organization makes every
repository of an organization or user its own board, opening in Board View
/ Version Control. Issues go through the ordinary importBoard, as the person
who started the job, with their comments, labels and files. Releases are
cards in a Releases list, their files attached only when chosen. Each
.github/workflows file becomes Rules. The wiki is read from its git
repository with isomorphic-git (1.42.4, pinned), every request through the
SSRF guard and only to github.com: a page is a card in the Wiki list, its
[[links]] point at and are attached to the linked pages' cards, and each
commit that changed it is a dated edit in the card's history, so Restore
brings back an older version. The job shows progress, can be cancelled,
pauses on a restart and stops at a rate limit; the token is kept in memory
only.
Version Control gains Releases and Wiki tabs: the wiki as GitHub shows it,
with the page list, _Sidebar and _Footer, links that stay in the tab, and
each page's history with Restore.
GitHub Actions workflows map to Rules: issue events to triggers, label,
close, reopen, comment, assign and create steps to actions, actions/stale to
an aging rule. Code - builds, tests, scripts - is never run: such a workflow
is a disabled rule with its YAML as the description. WeKan's Rules gain what
they lacked for it: a "commented on" trigger, an "add comment" action written
as the person whose change ran the rule and only where they may comment,
cron schedules in UTC, and a rule description shown on the rule. A disabled
rule no longer fires on a schedule or from its button, which it did.
The new strings are translated in every locale.
Thanks to xet7 !
v12.41 was already released when the Android bundles were committed, so
their entry was in the wrong section: it moves to a new Upcoming, and
v12.41's In short says again what was released. Upcoming records the
Version Control view, issue files, synced issue details, the public views
of a public board and the card QR code. #2015 leaves TODO Later.
Thanks to xet7 !
Version Control shows the board as a GitHub or Gitea issue tracker in the
board's own theme: cards are issues (open, or closed when archived, in a
Closed or Done list, or closed upstream), the board's labels are labels,
labels with a due date and the importers' milestone: labels are
milestones, comments are the conversation and attachments are the files.
The issue list takes GitHub's search words (is:open, label:, milestone:,
author:, assignee:@me, no:label, sort:). New issue, Close and Reopen write
through the ordinary collections, so the History tab - the board's
history table - shows them and Restore undoes them. Import links open the
GitHub, GitLab, Gitea and Forgejo importers, and each synced list has a
Sync now button.
The GitHub, GitLab, Gitea and Forgejo importers bring each issue's files:
user-attachments and user-images links, GitLab uploads, and Gitea and
Forgejo assets, downloaded through the import's SSRF guard and stored as
card attachments in Admin Panel / Attachments / Default Storage.
List sync has a new option, Comments, labels, state and files, off by
default: comments come from one paged repository-wide list (GitHub,
Gitea) or each issue's notes (GitLab), keyed by the tracker's ids, so a
second run writes only what changed, and nothing written in WeKan is
changed. Gitea issues are fetched without pull requests, and a rate
limited answer is waited out once or ends the run with the time to retry.
A public board's Show on / Default on Public Board settings are for the
public: visitors and non-members get them, read-only, and the board's own
members get the private side, so any view - Version Control, Email, Chat
and the rest - can be the read-only public view.
The card menu has a QR code of the card's link, drawn in the browser by
WeKan's own encoder, which the tests check module for module against
qrcode-svg.
The new strings are translated in every locale.
Thanks to xet7 !
Fixes#2015.
TODO Later's design questions block is now the decisions, each to be built
as decided: organization and team tabs, team-board hiding, read-only Rules
behind an Admin Panel option, log out everywhere and passkeys, linked lists,
search scrolling, avatars, label ordering, QR codes, subtasks across boards,
checklist item owners, Table view editing, column sets, Yjs co-editing,
drawing (PNG and SVG, editable), board grouping, card types, unread marks
for every card field, push notifications and an activity feed, Mattermost,
Matrix, ntfy and ActivityPub, a Trellinator-compatible API, an Android share
target, Nextcloud, FreeBSD rc.d, LibreJS and internal webhook destinations.
Gogs beside WeKan is closed as WONTFIX.
Thanks to xet7 !
Closes#6554.
Everything requested on 2026-10-13 is now built. What stays in TODO Later is
the one thing that cannot work, Jira list sync from a Sandstorm grain, so it
is not asked again.
Thanks to xet7 !
Each release's Linux bundle of the matching CPU is rebuilt inside Termux's
own image, on a runner of that CPU, with wekan/node-patches'
node-android-<cpu> of the same version, checked against its SHA256: npm
reinstalls the server packages run by that Node.js, so every native addon is
built for it, and sharp from source against Termux's libvips. Each addon's
architecture is checked, sharp must load, and the bundle must start and
answer HTTP 200 before it is published. A CPU whose Android Node.js is not
published yet is skipped and builds by itself once it is; the single-file
workflow, which already makes Android single files from these bundles, now
waits for them.
Thanks to xet7 !
CodeQL alert #583 (js/reflected-xss): tests/httpsServer.test.cjs's server
answered `served ${req.url} ...`, sending the request back as the body. It
now names the page by comparison, as plain text.
tests/noReflectedRequest.test.cjs keeps the shape out of every file: no
res.end/res.write/res.send writes a request's url, query, params, headers or
body into the response. Test code only, so nothing for Admin Panel / Problems
to record.
Thanks to GitHub CodeQL and xet7 !
The check counted every board-wide list whose position history recorded
the swimlane it was created in, so lists made since the automatic
un-binding stopped (#6515, released in v10.31) were counted too, and the
count kept growing. Restore would have bound them back to that swimlane,
hiding the cards they hold in other swimlanes - 490 cards in 14 lists on
the reporter's instance.
Now a list created after v10.31's release is never offered, being
board-wide by design, and a list with any card (archived ones too) in a
swimlane other than the one it would be bound to is never restored. A list
that really lost its binding, with cards only in its own swimlane, is still
restored. tests/listSwimlaneRestore.test.cjs and a runtime test on a real
database cover both rules and that case.
Thanks to Raymond-Voogt and xet7 !
Fixes#6766.
AppImage.yml wraps the musl bundles too, whose Node.js needs no glibc
libraries; tests/nodeRuntimeDependency.test.cjs still requires
node-runtime/libatomic.so.1 for every glibc bundle.
Thanks to xet7 !
Upcoming gains the musl bundles and AppImages, list sync through the
Sandstorm Powerbox, and Hong Kong Chinese and Flemish in their own
languages. TODO Later's Planned block now holds only the Android bundles,
which wait for wekan/node-patches, and records that Jira list sync cannot
work from a grain, so it is not asked again.
The Sandstorm REST API works with a grain API key and is documented in
docs/Platforms/FOSS/Container/Sandstorm/Powerbox-External-APIs.md since
commit 2cc0b59a51.
Thanks to xet7 !
Fixes#2167.
zh-HK had 90 values in Simplified Chinese, found with OpenCC; they are now
Traditional with Hong Kong usage. vl-SS (Flemish) held 158 values in about a
dozen other languages - Venda, Vietnamese, Venetian, Walloon, Papiamento and
more - now in Flemish, and its 225 values still in English are filled.
Values a test pins or an audit corrected are kept, and
tests/wrongLanguageLocales.test.cjs now covers both files.
Thanks to xet7 !
Each release's Linux bundle of x64 and arm64 is rebuilt inside Alpine on a
runner of that CPU: the musl Node.js of exactly the bundle's version,
checked against its SHA256, replaces the glibc one and its node-runtime
libraries; npm reinstalls the server packages so every native addon is
compiled against musl and sharp's musl package is the one installed; then
every addon's architecture is checked, sharp must load, and the bundle must
start and answer HTTP 200 before it is published. FerretDB and the MongoDB
Database Tools are static and stay. The AppImage workflow wraps them too, as
x86_64-musl and aarch64-musl, and starts each inside Alpine to check it.
Thanks to xet7 !
A grain's only way out is the bridge proxy, so list sync never reached a
tracker. A board member who may write saves the list's source and allows
the grain to reach that tracker's API root in the Powerbox; the grant
belongs to the tracker, found by the URL being fetched, so the periodic job
needs no signed-in user. GitLab's token goes as private_token, since the
bridge drops PRIVATE-TOKEN; GitHub, Gitea and Forgejo read public
repositories, since their token headers cannot pass; Jira, which signs in
only with an Authorization header, is refused with that reason. Off
Sandstorm list sync still goes through the SSRF guard, unchanged.
New strings translated in all languages.
Thanks to xet7 !
Upcoming gains them; TODO Later's Planned block now holds only what is
left - Android bundles, Sandstorm sync and import (whose credentials the
bridge proxy cannot carry) and Node.js musl bundles, with the questions
that decide them - and the translation block names the languages that need
a native speaker.
Thanks to xet7 !
The locale tag decides the language. Found on 2026-10-14 and rewritten:
ro and ro-RO (Italian, French and Spanish blocks), rup, lld, rm and ve-CC
(Italian; ve-CC also Zulu and Venda), gl and gl-ES (Portuguese), ace
(Malay/Indonesian), ve (Zulu), sk (Czech and Polish), hsb (Czech), vo
(Esperanto), bi (Tok Pisin), uz-AR (half Latin script, Uyghur and Kazakh
forms; now Uzbek in Arabic script). Machine-fill prefixes and notes are
gone from to ("Faka-Tonga:"), qu ("Kay willaymi:"), wal ("Wolayttatto:"),
hsb ("WeKan:"), an, fur and lg, each value now in its own language. cmn
and yue_CN no longer call a board a wooden plank; List actions means the
actions of a list in pa, pt, pt-BR, ru_RU, vi-VN, hu and ko; "No" is the
word in pa, lt and te-IN; et-EE's board is a tahvel.
Values a person or an earlier audit had already reviewed are kept: every
value a regression test pins, every audited correction, and every label
another string quotes. Poker cards show their numbers everywhere.
tests/wrongLanguageLocales.test.cjs keeps the old languages and prefixes
out and checks every placeholder against English; two older tests that
expected Venda in the Venetian file, and a prefix in Quechua, now expect
the language of the tag.
Low confidence, for a native speaker: to, qu, wal, lg, bi, vo, lld, rup,
ve, ace, uz-AR (its use of ې is for a speaker to settle), hsb and rm.
Thanks to xet7 !
tests/boardPermission.test.cjs lists every public-board check in the server
and models, so none silently leaves instance boards out: #4527's "everyone
signed in" is one, and it covers public AND instance boards. The Powerbox
webhook comment in imports/sandstorm/egress.mjs gave an example address,
which the release risk audit reports as an outbound URL; it now describes
the shape without one.
Thanks to xet7 !
A grain has no network but the bridge proxy, so an outgoing webhook now
leaves only through an API a board admin approved in the Powerbox for that
webhook's address: each saved webhook offers "Allow this grain to reach this
address". The grant belongs to the destination, not to a person, is found
by the URL being sent to, and is approved as the address's parent path so
the bridge delivers to the exact address. Every sender - immediate, grouped
and stored - goes through webhookFetch, which off Sandstorm, or for an
address no grant covers, is exactly the SSRF-guarded fetchSafe.
The REST API called with a Sandstorm API key acts as the key's user: in a
grain the bridge sets X-Sandstorm-User-Id itself. Only in a grain, only
after a WeKan token, only for an existing enabled account, and a key without
participate reads only.
New strings translated in all languages.
Thanks to xet7 !
Each is the platform's published Bun bundle ZIP, unchanged, inside that
bundle's own Bun: built on the platform itself (Alpine for musl), so the
runtime is exactly the one the bundle was tested with. The first start
extracts the bundle once into a per-version cache directory, without a
second copy of Bun, and every start runs index.mjs with the executable
itself as Bun. Like the Bun bundle it needs MONGO_URL and ROOT_URL.
The launcher reads the ZIP itself (stored, deflated, ZIP64, Unix modes,
symbolic links) and refuses any entry or link that would land outside the
cache directory. Before publishing, each file is checked: it names itself,
refuses to start without a database, extracts once and reuses that, and
loads every native addon of the bundle. Linux x64/arm64 (glibc and musl),
macOS and Windows; FreeBSD and Android have no runner to build on.
Thanks to xet7 !
Upcoming gains the features, the list archive fix, the CodeQL fix and the
Node-RED and Uberspace docs. TODO Later's decided block is done and removed;
the open requests are rewritten as the design questions that decide them,
and the locale files found in another language are listed.
Thanks to xet7 !
Node-RED: the http in flow, and that an internal address is refused by the
SSRF guard, so Node-RED needs a public name. Uberspace 7: the UberLab guide,
the update script, and email settings on the one environment line.
Thanks to yeurplc, jeyca and xet7 !
Fixes#2017,
Fixes#2009.
CodeQL alerts #581 and #582: htmlToText still removed script elements and
tags with regular expressions, looped through a helper CodeQL does not
follow. A one-pass scanner drops tags whole, script/style/head elements with
their content, and unfinished tags. The tree-wide guard no longer accepts a
fixed-point helper and also catches a whole element removed by pattern.
Thanks to GitHub CodeQL and xet7 !
Only template lists archived their cards, so a normal list's cards stayed
visible in the Lists, Table and Calendar views. A server hook on the list's
archived field now archives the cards of every list, whichever way it is
archived, and restore brings back exactly those - the rule #2292 gave
swimlanes. Cards archived with the list get the list's archivedAt, so a
browser clock that differs from the server's cannot keep them archived.
Thanks to Raymond-Voogt and xet7 !
Fixes#6765.
A board can let every signed-in user edit it, when Admin Panel / Settings /
Visibility allows it: a non-member then comments, edits and moves cards like
a Normal member, and their first edit makes them one. Board-wide settings
stay members-only.
Lists can allow or refuse editing and commenting per role (list menu, board
admins): built-in roles, custom roles and, on an open board, everyone signed
in. The server applies it to card, checklist, attachment and comment writes
and to moves into the list; the REST API honours a list's refusal on every
per-list card route. A direct client write of the setting is refused and
shown in Admin Panel / Problems.
Every board has a key, unique in the instance, suggested from its title and
set for existing boards at startup; card numbers show as KEY-7 and searching
for KEY-7 finds the card.
Shared labels in Admin Panel / Labels, for every board or an organization's
or team's boards; a board uses them beside its own, and a rename or colour
change reaches every board that uses it.
New strings translated in all languages. Low confidence: chr, tlh, wal, ay,
ace, nah, gn, iu, zgh, rup, wo, se, ff, tig, vo, bm, kl, bua, nap, mai, to,
ks, qu, bo, fj, haw, om, ss, ts, ve-PP, lld, scn.
Thanks to Meeques, justinr1234, tiFabGrinch, ejlkemper and xet7 !
Fixes#4575,
Fixes#4527,
Fixes#2449,
Fixes#2450,
Fixes#2761,
Fixes#4698.
#916 (decided 2026-10-14): HTTPS_PORT with HTTPS_CERT_FILE and
HTTPS_KEY_FILE (a path or the PEM itself) makes WeKan serve HTTPS; without
them nothing changes, and a proxy stays the recommendation for
production. Meteor's HTTP server - pages, DDP, websockets - is not
replaced: a TLS listener hands each decrypted connection to it, so
everything works the same over HTTPS. A renewed certificate is loaded
within a minute without a restart (a broken one keeps the old).
HTTPS_REDIRECT=true redirects plain HTTP to ROOT_URL when that is https,
else the same host on the HTTPS port, keeping only the path. The snap
gets https-port, https-cert-file, https-key-file, https-bind-ip and
https-redirect.
tests/httpsServer.test.cjs makes a real certificate with openssl, serves
a page and a websocket upgrade through the bridge, swaps the certificate
without a restart, and refuses incomplete settings, an untrusted
certificate, an injected host and a scheme-relative redirect.
Thanks to 68040 and xet7 !
Fixes#916.
Upcoming gets the three features and the bug fixes; TODO Later's
decided-and-waiting list drops #3022, #4178 and #1455, which are done.
Thanks to xet7 !
Found while mapping every role check for custom board roles:
- canImportIntoBoard tested the role helpers as references
(`!user.isWorker`, always false), so Import was offered to nobody; it
asks the write capability now, as the server does.
- the rules list's canAdmin used `user.isBoardAdmin` without calling it,
so every member saw the rule controls.
- the role popup's isLastAdmin compared activeAdmins() - a list - with 1,
so the last admin was never stopped from giving the role away.
- the members widget's isWorker called Boards.hasWorker, which is not a
collection function.
- OIDC's DEFAULT_BOARD_ID used Array#contains, which does not exist, so
the configured role flags threw; isCommentOnly works next to the
documented isCommentsOnly spelling.
tests/roleHelperRegressions.test.cjs pins each, and fails for any role
helper tested as a bare reference anywhere in client/, models/ and
packages/, and for a list compared with a number.
Thanks to xet7 !
#3022 (decided 2026-10-14): a site admin builds named roles in Admin
Panel / People / Roles from the capability matrix - sees all cards,
comments, edits, moves cards, invites - and a board admin gives one to a
member in the same popup as the built-in roles. Board admin stays
built-in. Every permission check asks boardRoleCapabilities, which
answers a custom role from the role; the member's built-in flags carry
the strongest built-in role that grants nothing more (fallbackRoleFor,
checked for every combination), so code reading a flag never grants
more, and a deleted role leaves exactly that. Where a role is asked by
name (hasWorker, isCommentOnly, ...) a custom role reads as the built-in
role that does what it does; commenting is asked as a capability
everywhere. Invites, REST whole-board reads, imports (a foreign custom
role is dropped) and member mapping (all eight flags now, not four)
follow it. The six new strings are translated in all 234 locales.
#4178 (decided 2026-10-14): a team or organization that gives board
memberships takes them away again when the user leaves it - only those:
each records where it came from (grantedBy), a direct membership is
never touched, a board admin is kept, and a board admin's own add or
removal is final. Teams through user edits, LDAP, OIDC and the board
sidebar; organizations where they propagate members.
Also: the Roles Status table gets a Move cards column; the comment form,
reactions and chat ask the comment capability (a No comments member was
offered reactions the server refused).
Tests: customBoardRoles and groupBoardMembership node suites, and the
runtime suites (9 passing) against a real database.
Thanks to xet7 and mfnalex !
Fixes#3022,
Fixes#4178.
HTTP_PROXY, HTTPS_PROXY and NO_PROXY now work for every outgoing request
that goes through the SSRF guard: webhooks, imports, avatar downloads,
list sync. The destination is still resolved once and checked against
the blocked ranges first, and the proxy is handed that checked address,
never the name: an http:// request goes to the proxy in absolute form on
the pinned address with the real Host, an https:// one through a CONNECT
tunnel to the pinned address with TLS still verified against the real
name (and WEBHOOK_TLS_CA_CERT). A name resolving to an internal address
is refused before the proxy is asked anything. Proxy credentials in the
URL become Proxy-Authorization. The snap gets http-proxy, https-proxy and
no-proxy.
tests/outboundProxy.test.cjs runs a real proxy on loopback: the pinned
address, the Host header, the credentials, the CONNECT authority, and
that a refused destination never reaches the proxy.
Thanks to gbarre and xet7 !
Fixes#1455.
#570, #571 (incomplete multi-character sanitization): email to card
turned an HTML-only email into text with one pass of each removal, so a
script element spliced together by removing an inner one survived and its
contents reached the card ("<scr<script></script>ipt>alert(1)</script>").
Both removals now run to a fixed point.
#574 (regular expression injection): the single file's wekan.env writer
spliced the setting name into a RegExp. A setting must be an environment
variable name, is compared literally, and its value must be one line. The
kept-versions reader built a half-escaped RegExp from the file extension;
it now reads wekan-<version><exe> literally.
#572, #573 (incomplete string escaping): two runtime tests escaped only
some metacharacters; they compare literally now. #575-#580 (URL substring
and hostname patterns): translation tests matched example hostnames with
unescaped dots or substring checks; the dots are escaped and the hosts
bounded.
tests/tagStrippingFixedPoint.test.cjs missed the <[^>]+> spelling; it now
catches both, accepts a fixed-point helper only when it really loops, and
records the search-index text of server/lib/documentGif.js as never
rendered. tests/emailToCard.test.cjs fails on the old htmlToText;
tests/singleFile.test.cjs refuses regex and newline input in setting
names and values, and reads only real version files.
Nothing here is an attempt a user can make at runtime that the server
refuses, so there is no Admin Panel / Problems key to add.
Thanks to GitHub CodeQL and xet7 !
Shared labels (#2761, #4698), board keys for card numbers (#2449,
#2450), membership removal on leaving a team or organization (#4178),
webhooks through an HTTP proxy (#1455), custom roles (#3022), editing by
every signed-in user (#4575), per-list permissions (#4527) and optional
HTTPS in WeKan's own server (#916) are decided; each moves from the open
requests to a list of decisions waiting to be implemented.
Thanks to xet7 !
node-patches now builds OpenBSD's Node.js on 7.8, the first release whose
base Clang (19.1.7) builds Node 26 - 7.7's Clang 16 has no
std::atomic_ref. The bundle is built and started where that binary runs.
The BSD page says OpenBSD 7.8 or newer is needed, and that NetBSD's
bundled OpenSSL gets FreeBSD's configuration; tests/bsdBundles.test.cjs
fails for an OpenBSD target older than 7.8.
Thanks to xet7 !
Remove what is no longer open: #3318 (closed as not planned), #6692 and
#6509 (closed as completed), and email to card and the Node.js single
files from Planned (shipped in v12.40). The September translation-repair
checkpoints are cut to what is still open.
Every one of the 62 open issues was read with its comments and checked
against the code on 2026-10-14. None other than #2141 is fully done; each
is now listed under its topic with what exists and what is missing.
Record the #2141 closure in Upcoming.
Thanks to xet7 !
The issue asked for Trello's Send Emails choice per member: Never,
Periodically (about once an hour) or Instantly. All three already exist:
email off is the member's Notification Settings override (bde66a5c7d,
2026-09-10), and the member's delivery schedule is immediate, every 5
minutes to 24 hours, or daily, with quiet hours (ab785acd1e, 2026-10-10).
A member's choice wins over the board's and the Admin Panel's.
tests/notificationFrequency2141.test.cjs pins each option at member
level, that an unknown member value is ignored rather than trusted, and
that the switch and the schedule picker are in the member's settings.
Thanks to saurabharch and xet7 !
Fixes#2141.
Preserve Wrike status behavior, directory-sync identifiers and subtask permission distinctions. Add catalog and browser coverage. Technical prose is lower confidence and needs fluent review.
Thanks to xet7 !
Preserve user mapping choices, missing-column handling and single-board versus multi-board ZIP behavior. Add catalog and browser coverage. Technical prose needs fluent review.
Thanks to xet7 !
Distinguish link directions and permission limits, translate announcement controls, and repair the custom-fields label. Add regression assertions and browser coverage. Direct technical wording needs fluent review.
Thanks to xet7 !
Add positive and negative regression coverage for attachment visibility, limits, self-links and detachment. Direct technical wording needs fluent review.
Thanks to xet7 !
Restore initial date setting, Gregorian ISO-week details and destination versus card-derived board actions. Add positive and negative catalog assertions and browser coverage. Direct wording needs fluent review.
Thanks to xet7 !
Translate Todoist and Planner instructions and distinguish recurring cards from resets and move reasons from descriptions. Add catalog and browser regression coverage. Direct technical translations still need fluent review.
Thanks to xet7 !
Fill 27 English strings, preserving user choices, ZIP exceptions and workbook layout. Technical prose needs fluent review; extend regressions.
Thanks to xet7 !
Retain export prerequisites, field mapping and omission warnings. Technical prose is lower confidence and needs fluent review; extend regression coverage.
Thanks to xet7 !
Fill 26 English placeholders with direction, visibility and permission conditions intact. Add regression coverage; fluent review remains needed.
Thanks to xet7 !
Fill 41 English placeholders and add attachment and credential regressions. Technical storage wording is lower confidence and needs fluent review.
Thanks to xet7 !
Use assignee event wording and retain subjects in rule fragments. Omit the extra copula after Irish temporal clauses, with locale-boundary and assembled-rule regressions.
Thanks to xet7 !
Correct report titles and replace shorthand with methodology, uncertainty, history requirements and date fallbacks. Add regression coverage.
Thanks to xet7 !
Distinguish recurrence from reset, restore optional move reasons and permanent anonymization wording, and translate stale Todoist and Planner guides.
Thanks to xet7 !
Fill 67 English placeholders, preserving link directions, permission checks and storage key distinctions. Extend translation and browser regression coverage.
Thanks to xet7 !
Restore set-or-change date triggers, calendar labels and time attribution limits. Cover recurrence and time report wording with regression checks.
Thanks to xet7 !
Replace unrelated export text in account anonymization and expand five report methodology notes. Preserve destructive consequences and analytical limits with regression coverage.
Thanks to xet7 !
Translate old English Todoist and Planner guides, restore Jira pagination and Excel worksheet behavior, and correct CSV delimiter terminology. Extend semantic and browser coverage.
Thanks to xet7 !
Translate 29 entries preserving permanent deletion, unchanged records and rollback safeguards. Add a full-catalog placeholder gate and extend recovery browser coverage.
Thanks to xet7 !
Translate 25 entries for Wrike, LDAP, OAuth, subtask permissions and Blockly fragments. Preserve identifiers and placeholders and extend regression coverage.
Thanks to xet7 !
Translate 35 messages covering member and column mapping, bulk transfer layouts, Trello export and Sandstorm access. Preserve technical markers and add semantic and browser coverage.
Thanks to xet7 !
Translate twelve project import guides with explicit omission warnings, English column requirements and nested-task markers. Extend semantic and browser coverage.
Thanks to xet7 !
Translate ten import guides while preserving format names, data mappings, completion dates and first-board restrictions. Extend semantic and browser coverage.
Thanks to xet7 !
Fill 67 English placeholders including field-link permissions and directions, announcements, storage settings and rule connectors. Extend catalog and browser regression coverage.
Thanks to xet7 !
Distinguish destination linking from creating a board from the current card, explain version lookup failure and configured bounce thresholds, and extend regression coverage.
Thanks to xet7 !
Restore Jira pagination and Excel worksheet mapping explanations. Use Haitian preview terminology and clarify external tracking. Add semantic and browser coverage.
Thanks to xet7 !
Replace incomplete shorthand with translated methodology, missing-history rules, forecast limits and date fallbacks. Clarify movement reasons and never-synced state; add semantic and browser coverage.
Thanks to xet7 !
Distinguish groups from enabling limits, clarify swimlane selection and describe numeric value sums instead of field counts. Add catalog and browser regression coverage.
Thanks to xet7 !
Replace incorrectly duplicated export guidance with the actual permanent identity changes, avatar removal, disabled login and preserved history. Add semantic and confirmation-popup regression coverage.
Thanks to xet7 !
Correct eight labels for recurring cards, automatic unchecking, checking all items and known accounts. Add semantic and popup regression coverage.
Thanks to xet7 !
Repair nine labels and verify the production parser accepts attachment presence and absence queries while rejecting invalid predicates. Extend browser search coverage.
Thanks to xet7 !
Correct ten upload and control labels. Preserve map administrator permissions and point archive restoration to All Boards; extend semantic and map-upload browser coverage.
Thanks to xet7 !
Correct 30 entries across card controls, activity text and settings. Restore matching and template-copy wording, preserve attachment retention, and extend subtask browser assertions.
Thanks to xet7 !
Correct 81 entries: attachment terminology throughout the catalog, checkbox actions, date initialization triggers and assignee grammar. Preserve placeholders and deletion distinctions, and add rule-builder and attachment-settings UI coverage.
Thanks to xet7 !
Translate eight current placeholders and two stale-English guides. Preserve Scrum recovery permissions and data retention, add the current catalog gate and extend six browser cases. Semantic review remains separate.
Thanks to xet7 !
Translate 48 entries with retained-data, permanent-deletion and replay restrictions intact. Extend catalog and browser coverage for planning sync and interrupted operations.
Thanks to xet7 !
Translate 45 administration, workflow, Blockly and Scrum entries. Preserve permissions, completion groups, source matching and placeholders; cover subtask editing and denied access in the browser suite.
Thanks to xet7 !
Translate 30 mixed-language controls and messages, preserving deletion prerequisites, Cc syntax, window-action distinctions, ticket states and history actions. Add regression and browser coverage.
Thanks to xet7 !
Translate 25 mixed-language entries, preserving API aggregation and configuration, recovery actions and automatic continuation. Add regression and office-report browser coverage.
Thanks to xet7 !
Translate 37 mixed-language entries, preserving dependency direction, completion polarity, import formats and unmatched counts. Keep the exact shared Latin word Color and add regression and browser coverage.
Thanks to xet7 !
Translate 32 mixed-language entries, preserving query placeholders while explaining OR/AND, negation, sorting, date ranges and archive defaults. Localize user, absence and card-number examples with regression and browser coverage.
Thanks to xet7 !
Translate 40 mixed-language search entries, preserve validation constraints and placeholders, and use a localized list example. Verify parser registration and shared selector wording; add overdue-search browser coverage.
Thanks to xet7 !
Translate 48 mixed-language entries, retaining search access boundaries and placeholders. Preserve shorthand aliases and verify distinct localized operators are registered in the parser, with browser coverage for title filtering.
Thanks to xet7 !
Translate 50 action fragments and descriptions with matching movement and checklist wording. Recognize the exact shared Latin imperative Remove without exempting longer English prose. Add regression and browser coverage.
Thanks to xet7 !
Translate 33 prefixed trigger fragments and repair three unprefixed assignee/date entries. Omit the redundant linking verb for Latin finite predicates, preserving other locales and testing assembled and saved descriptions.
Thanks to xet7 !
Translate 25 mixed-language organization, membership, date and color labels. Preserve tenant configuration requirements and the limits of delegated administration, with regression and browser coverage.
Thanks to xet7 !
Correct 40 prefixed strings, restore literal size units and invitation variables, preserve separate server safety caps and extend attachment-limit browser coverage.
Thanks to xet7 !
Correct 30 prefixed strings, distinguish upload states and logo fields, preserve WIP recovery choices, and add warning browser coverage.
Thanks to xet7 !
Correct 30 prefixed strings, retain Sandstorm access revocation warning and all-card removal notification, and distinguish self-membership from assignment in shortcut coverage.
Thanks to xet7 !
Correct 30 prefixed strings, preserve public-read/member-edit and assigned-card boundaries, and extend archive-tab browser coverage to Latin.
Thanks to xet7 !
Correct 25 prefixed strings, preserve current-user fallback, four-digit years and the last-administrator restriction, and extend keyboard-shortcut browser coverage.
Thanks to xet7 !
Correct 40 prefixed strings, preserve ZIP limits, credential requirements and destructive cancellation scope, and add file and credential-label browser coverage.
Thanks to xet7 !
Correct 30 prefixed messages, update stale Jira pagination and Excel sheet guidance, preserve literal filter examples, and extend Latin import browser coverage to nine more formats.
Thanks to xet7 !
Correct 30 prefixed strings, retain distinct due periods and missing-value filters, and distinguish members, assignees and creators. Add date-filter browser coverage.
Thanks to xet7 !
Correct 50 prefixed strings, restore date-format tokens and enrollment email paragraphs, and preserve field deletion and global administrator warnings. Add form browser coverage.
Thanks to xet7 !
Translate 32 prefixed strings, including all 25 color names, and update the stale archive restoration location. Add color distinctions and skip-link coverage. Less common shade descriptions remain lower-confidence pending linguistic review.
Thanks to xet7 !
Correct 35 prefixed strings, preserve font size distinctions, idle-day fading levels and movement directions, and extend font preview browser coverage.
Thanks to xet7 !
Correct 45 prefixed strings, restore numeric poker choices, distinguish account anonymization from import, and cover positive and negative voting labels.
Thanks to xet7 !
Correct 44 prefixed mixed-language strings, preserve visibility and assignee scope, and add semantic checks and calendar menu browser coverage.
Thanks to xet7 !
Correct 55 mixed-language strings and test personal/shared scope, toggle direction, data-loss warnings and permanent attachment deletion. Add a browser toggle regression.
Thanks to xet7 !
Correct 60 mixed-language strings, retain the valid shared Latin word Color, and test argument order, opposite states and non-destructive Home removal. Add workspace navigation browser coverage.
Thanks to xet7 !
Replace 65 prefixed strings with Latin, preserving positional title arguments, move direction, checklist state and comment permissions. Add semantic regression checks and card-history browser coverage.
Thanks to xet7 !
Fill 51 pending strings and test matching precedence, retained changes, permanent deletion and recovery restrictions. Register Latin recovery browser scenarios.
Thanks to xet7 !
Fill 35 pending translations and repair preview and history labels. Preserve import restrictions, configuration names and placeholders, and extend regression and browser coverage.
Thanks to xet7 !
Fill 35 pending labels and instructions while preserving member mapping, ZIP boundaries, field placeholders and Trello round-trip behavior. Extend semantic and browser checks.
Thanks to xet7 !
Preserve attachment exclusions, source menu and column names, hierarchy markers, archive state and import format choices. Extend semantic and browser instruction checks.
Thanks to xet7 !
Translate twelve pending import guides while preserving source menus, format markers, hierarchy mappings and limits. Replace mixed English in the Trello guide and add thirteen browser cases plus semantic checks.
Thanks to xet7 !
Fill 34 pending English strings and repair two malformed card-link labels. Cover link direction, permissions and field matching in semantic tests and add Latin browser cases.
Thanks to xet7 !
Fill 40 English placeholders for sorting, actors, recipients, self-selection, counts and Somali Blockly controls. Preserve existing translations and extend alias and token checks.
Thanks to xet7 !
Fill 126 English file values, covering 140 locale entries through the Khmer alias. Keep control aliases and placeholders consistent and extend regression and browser coverage.
Thanks to xet7 !
Fill 40 English placeholders in Bengali, Nepali, Hungarian, Icelandic, Albanian and Tagalog. Use numeric separators where inflection cannot fit the count template, and correct the Tagalog sublist endpoint. Extend semantic, token and Blockly coverage.
Thanks to xet7 !
Fill 52 remaining English placeholders while preserving correct shared words and existing Chinese translations. Add token and meaning checks and extend S3 and Blockly browser coverage.
Thanks to xet7 !
Clarify message content, labels, recipient maximum and SES sender direction. Remove mixed English in email help and add semantic and settings UI regressions.
Thanks to xet7 !
Distinguish estimates from size and translate the sprint progress term. Extend backlog UI and semantic coverage for Scrum and recovery boundaries.
Thanks to xet7 !
Translate inverse tangent, use angular-degree terminology and repair vertical movement shortcuts. Extend semantic checks while preserving valid loop, list and text instructions.
Thanks to xet7 !
Replace abbreviated chart notes with methodology, missing-data rules and uncertainty caveats. Clarify time corrections, synchronization and credentials, with semantic regressions and seven browser cases. Statistical terminology remains subject to native-speaker review.
Thanks to xet7 !
Distinguish archived records from saved data and orphaned cards from ownership. Translate remaining S3 prose and extend semantic and browser coverage.
Thanks to xet7 !
Review source keys 2480–2599. Replace the unrelated export description with the account effects and irreversible-action warning. Clarify whole-instance backup scope and add semantic and browser checks.
Thanks to xet7 !
Review source keys 2135–2349. Correct recovery severity, template-copy labels, translation counts and time until due. Add semantic and browser regression coverage.
Thanks to xet7 !
Review source keys 1990–2134. Express positive and negative integer signs explicitly and identify the maximum allowed background image size. Preserve query syntax and add semantic and browser checks.
Thanks to xet7 !
Replace the blanket short-letter exemption with exact key/value symbols. Translate 20 Southern Sotho rule, Blockly and personal-filter strings. Add inventory and browser regression coverage while preserving existing Chinese values.
Thanks to xet7 !
Review source keys 1417–1589. Restore date-set triggers, auto-detection, rule states, assignee conditions and removal of labels. Translate short English fragments and add semantic and browser checks.
Thanks to xet7 !
Review source keys 1280–1416. Translate MongoDB status descriptions and correct card-field ordering terminology and movement labels. Add semantic and browser regression coverage.
Thanks to xet7 !
Review source keys 814–929. Translate older English Todoist and Planner instructions, restore Jira pagination and Excel sheet guidance, and correct Taskwarrior and Focalboard label terminology. Add semantic checks and six browser cases.
Thanks to xet7 !
Review source keys 590–813. Restore literal escape examples and plain-bullet Markdown import guidance; distinguish unused disk space from price and data fields from agricultural fields. Add semantic and browser regression coverage.
Thanks to xet7 !
Record guarded meaning corrections and validation. Archive the oldest retained release by size and repartition October archives without changing released entries.
Thanks to xet7 !
Review source keys 220 through 454 and fix nine misleading labels covering avatar limits, historical time, grouping, pulse, unread comments, due dates, account anonymization and card labels. Add guarded corrections and a read-only popup-title browser case.
Thanks to xet7 !
Review the first 220 source strings and correct four semantic errors: reversed title arguments, automatic template application, the positive-integer height constraint and matching-card search scope. Record guarded repairs and extend the activity browser case.
Thanks to xet7 !
Translate the final 72 English placeholders and promote the full-inventory no-placeholder check. Preserve cancellation, discard and rollback constraints, already-applied changes and foreign-board protection. Register six existing recovery browser cases for Southern Sotho; fluency and runtime UI review remain pending.
Thanks to xet7 !
Fill 45 source-report, retention, estimate-mapping, email-failure and planning placeholders. Preserve omitted-versus-null handling, access requirements and no-resume/no-undo warnings; extend semantic checks and the sync-planning browser case.
Thanks to xet7 !
Fill 95 math, procedure, accessibility and shortcut placeholders. Verify random bounds, degrees rather than radians, return values, disabled definitions and screen-reader toggles. Mathematical and programming terminology remains lower confidence pending native review.
Thanks to xet7 !
Fill 90 placeholders for list sorting, Boolean logic, arithmetic and statistics. Verify strict and inclusive comparisons, logical negation, copy behavior, constants and numeric bounds. Statistical and trigonometric terminology remains lower confidence pending native review.
Thanks to xet7 !
Fill 110 placeholders for input labels, keyboard navigation and list operations. Check numbered tokens, dividend/divisor, get/remove distinctions, copy semantics, index direction and not-found behavior. Programming terminology remains lower confidence pending native review.
Thanks to xet7 !
Fill 75 editor, accessibility, colour and control-flow placeholders. Preserve 18 physical keyboard legends with exact-source exemptions and check numbered placeholders, loop conditions and bounds. Variable and programming terminology uses descriptive wording with lower confidence and needs native review.
Thanks to xet7 !
Fill 46 placeholders for delivery timing and grouping, workflow states, LDAP sync, card field visibility and subtask completion. Preserve token inventories and positive and negative permission semantics; extend notification and subtask browser cases.
Thanks to xet7 !
Fill 55 placeholders for member mapping, CSV columns, batch import and export, Trello access, link rules and webhook payloads. Preserve substitution tokens, literal interchange markers and permission limits, and extend the existing CSV and member-mode browser cases.
Thanks to xet7 !
Fill 22 instructions, retaining file formats, literal menu and column names, field mappings, first-board selection and excluded content. Extend semantic checks and register the existing import-help browser cases for Southern Sotho.
Thanks to xet7 !
Fill 34 English placeholders, preserving link directions, shared-field matching, unavailable-card privacy and edit permissions. Extend translation checks and both existing card interaction browser cases.
Thanks to xet7 !
Replace five remaining Italian labels in recovery and email controls. Preserve existing translated recovery warnings and email permissions, and cover the refresh labels in the recovery browser case.
Thanks to xet7 !
Record reviewed operations, mathematical regression checks and pending Corsican Blockly browser execution in Upcoming and the translation audit.
Thanks to xet7 !
Preserve recognizable physical key names and numbered placeholder inventories, including multiplicity. Correct the map floor-plan example and add Corsican to the existing map browser suite.
Thanks to xet7 !
Record full methodology translations, lower-confidence statistical terminology, passing checks and pending browser execution in Upcoming and the translation audit.
Thanks to xet7 !
Replace abbreviated substitutes with forecast assumptions, missing-history behavior and date fallbacks. Repair WIP group and authentication wording and register five chart-help browser cases. Corsican statistical terminology is lower confidence and needs native review.
Thanks to xet7 !
One executable per platform: that platform's published bundle repackaged
as a Node.js single executable application whose ZIP Node 26.11 mounts as
a virtual file system (useVfs + vfsArchive). Only FerretDB is copied out,
once and verified, to wekan-files/bin; native addons load from the VFS.
Everything WeKan writes is in wekan-files beside the executable, which
WRITABLE_PATH points at: attachments, avatars, db, bin, backup, logs,
versions. WeKan now treats a WRITABLE_PATH named wekan-files as the files
root (models/lib/filesRoot.js, shared by every place that derived it).
Started in a terminal it shows a menu: start, stop, status, version info
as Admin Panel / Version shows it, update to the newest release or change
to any other (checksum verified, backed up first, the old executable
kept), backup to wekan-files/backup/YYYY-MM-DD_HH-MM-SS, run at boot
(systemd, launchd, Task Scheduler, cron, Termux:Boot), log, settings.
Every entry is also a command. start runs the start-wekan.sh loop:
recovery, requested restore, FerretDB, recovery page, WeKan, restart.
Meteor's main.js chdir()s into the bundle, which a VFS cannot be, so the
server role keeps a virtual working directory. Node 26.11.1 breaks
fs.writev/readv while any VFS is mounted; they are rebuilt on fs.write
and fs.read.
single-file.yml builds every target in releases/single-file/targets.json
from its verified bundle (Macs on a Mac, to re-sign), starts it where a
runner exists with browser tests on amd64, and attaches what started.
Release All and Release All Missing call it.
Thanks to xet7 !
Record passing parser and translation regressions, conditional browser coverage and preserved Chinese values in Upcoming and the translation audit.
Thanks to xet7 !
Preserve repair limitations, acknowledgement scope and scoped-import choices. Test the native card-number search keyword and register conditional report-help browser coverage.
Thanks to xet7 !
Record passing regressions, preserved Chinese values and the current filtered translation backlog in Upcoming and the translation audit.
Thanks to xet7 !
Record restore and cloud configuration repairs, passing regressions and pending browser execution in Upcoming and the translation audit.
Thanks to xet7 !
Preserve restore modes, credential alternatives, provider menu names and migration states. Extend language regressions and register cloud-help browser coverage.
Thanks to xet7 !
Restore automatic loading instructions and the actual irreversible account-anonymization confirmation. Preserve feature scopes, backup boundaries and literal markup, with regression checks and browser help coverage.
Thanks to xet7 !
Record guarded scheduling and storage repairs, passing regressions and pending browser execution in Upcoming and the translation audit.
Thanks to xet7 !
Record regression coverage, pending lockout browser execution and preservation of existing Chinese values in Upcoming and the translation audit.
Thanks to xet7 !
Distinguish card recurrence from reset and known-user password failures from nonexistent usernames. Repair upload and support messages and register lockout-settings browser coverage.
Thanks to xet7 !
Record parser regression coverage, pending browser execution and preservation of existing Chinese wording in Upcoming and the translation audit.
Thanks to xet7 !
Record parser checks, pending browser execution and preservation of existing Chinese translations in Upcoming and the translation audit.
Thanks to xet7 !
Preserve executable search syntax and the direction of recent-date filters. Verify translated predicates with the search parser and register overdue-search browser coverage.
Thanks to xet7 !
Preserve authorized-board and member-or-assignee scopes, result counts and parser abbreviations. Add guarded repairs and shared-template guidance coverage.
Preserve authentication prerequisite identifiers, old and new date values, deletion warnings and directional placement. Add guarded repairs and passwordless-settings UI coverage.
Restore set-or-changed date conditions and assignee trigger wording. Preserve checklist negations and destination direction, with guarded repairs and date-trigger UI coverage.
Preserve import limitations and unmapped-node reporting, trigger/action distinctions, scheduling direction and completion negation. Extend guarded repairs and workflow UI coverage.
Preserve distinct upload and download limits, separate API buffering safety caps, WIP recovery choices and notification scope. Restore invariant unit labels and add attachment-limit UI coverage.
Preserve member-removal notifications, unsaved-description recovery and overtime semantics. Keep the Pomodoro technique name unchanged and add guarded repairs and shortcut UI coverage.
Distinguish personal overrides from cancellation and retain assigned-only access, notification conditions and deletion warnings. Add guarded repairs and an archive-tab browser case.
Translate stale English Todoist and Planner instructions against current source. Preserve importer mappings, field names and attachment limits, and add six importer browser cases.
Keep email placeholders and account actions distinct, preserve role restrictions and explain that enabling permanent deletion does not itself delete content. Add guarded repairs and custom-field UI coverage.
docs/Platforms/FOSS/OS/BSD.md now lists the patches each BSD's packagers
keep for Node.js - FreeBSD ports www/node26, OpenBSD ports lang/node,
pkgsrc lang/nodejs (already 26.11.1), DragonFly DeltaPorts - and what WeKan
does with each, plus Bun, sharp/libvips, bcrypt and FerretDB on each BSD, and
how to install on OpenBSD (under /usr/local, wxallowed) and NetBSD (paxctl).
bsd.yml: the OpenBSD job mounts its workspace wxallowed before starting the
bundle there, and the NetBSD job compiles the native modules with pkgsrc's
GCC 14, as Node 26 needs C++20. Both build by themselves once wekan/node-
patches publishes node-openbsd-* and node-netbsd-x64.
Thanks to xet7 !
Restore directional controls, comment and worker permission limits, and the deliberately empty comment placeholder. Preserve newer translations through guarded repairs and extend the color-rule browser case.
Specialized color shade paraphrases are lower confidence and remain open to native-speaker refinement.
Preserve imported roles and permission limits, favorite toggles, automatic width and card inactivity thresholds. Add guarded repairs and regression coverage for profile and font controls.
docs/Platforms/FOSS/OS/BSD.md says where FreeBSD, OpenBSD, NetBSD and
DragonFly BSD stand - the Bun bundles FreeBSD already has, which FerretDB
and Node.js binaries exist for each, and the plan, easiest first.
.github/workflows/bsd.yml, called by Release All, builds WeKan's Node.js
bundle for a BSD: it takes the release's amd64 bundle, verifies it and adds
that BSD's Node.js (wekan/node-patches) and FerretDB, then inside a VM of
that BSD compiles the native modules, runs the same bundle steps as every
other platform, and starts the bundle with its own start-wekan.sh, which
must answer HTTP 200 before the zip is attached. FreeBSD x64 builds now,
from node-freebsd-x64 and ferretdb-freebsd-amd64. FreeBSD arm64, OpenBSD
amd64/arm64 and NetBSD amd64 are skipped, not failed, until node-patches
publishes their Node.js. The Node.js resolver, the native addon ELF check
and the platform packages step know the BSD names.
Thanks to xet7 !
Besides Amazon SES, WeKan now takes the bounce and spam-complaint
webhooks of the other common sending services, at
/api/inbound-email/bounces/<service>, each proven the way that service
signs: Mailgun's HMAC-SHA256, SendGrid's ECDSA signature over the raw body,
Mandrill's HMAC-SHA1 over the URL and fields, Resend's Svix signature; and
for Postmark, Brevo, Mailjet and SparkPost, which do not sign, a password
in the webhook address (Basic auth or ?secret=). Each service's events
become WeKan's hard, soft, automatic-reply and complaint categories, so the
same Admin Panel rules act on them. Bounces -> Other sending services
turns each on with its key or password, written only when typed and never
shown back; a forged or unsigned request is refused and logged in Problems
-> Security. These endpoints, like the SES one, work without WITH_API.
Mail systems with no webhook keep working as before: their bounce emails
reach WeKan by IMAP and are recognised as delivery status notifications.
Thanks to xet7 !
Repair 37 mixed-language labels and descriptions, including account anonymization and logged-in user access. Preserve role restrictions and archive semantics. Regional phrasing remains provisional pending fluent review.
Email that comes back is handled in WeKan instead of landing in the
administrator's own inbox. Admin Panel -> E-mail -> Bounces: hard bounces
(a mistyped invited address), soft bounces, automatic replies and spam
complaints, each with actions done after a count - list it, stop emailing
the address, tell who invited it, delete the invitation, ignore - as
listmonk and Discourse do it, and the list of addresses that bounced, which
an admin clears to email them again. Amazon SES Bounce and Complaint
notifications and mail SES receives arrive through SNS at
/api/inbound-email/ses, signature-checked against Amazon's certificate and
accepted only from the topics the Admin Panel lists. Delivery status
notifications and out-of-office replies arriving by IMAP, a provider
webhook or a Sandstorm grain are bounces too, never cards.
Admin Panel -> Problems -> Email shows what went wrong sending or
receiving: a send the mail server refused or could not reach, an IMAP
mailbox that cannot be read (never with its password), an unreadable
email, an email for a board that no longer takes email. Attempts stay in
Problems -> Security. The inbound email endpoints no longer need the whole
REST API turned on.
Runtime tests run WeKan's own transports against local SMTP and IMAP
servers over TCP, a real Sandstorm Maildir, the webhook over HTTP and
signed SNS messages; UI tests drive the Email and Chat views, the
email-to-card settings and the Bounces page. They found and this fixes:
every whole-message parse failed in the server bundle (nodemailer's
addressparser resolved to its ESM build), the Chat view's drag and drop
never started (dragscroll took the mouse) and dropped a card into the
target's previous list, and the Chat panes did not follow a change to a
right-to-left language.
Thanks to xet7 !
Fixes#794,
Fixes#3948.
Fill 30 English placeholders and cover link direction, edit permission, paused links and inaccessible cards. Regional phrasing remains provisional pending fluent review.
Fill 30 English placeholders while retaining existing translations. Verify matching fields, propagation direction, edit permission, unavailable cards and self-link refusal. Extend the existing attachment and field-link browser flows to Maltese.
Complete Khmer and its aliases, Burmese, Amharic, Yiddish, Bhojpuri, Maithili and Konkani notes. Preserve the Khmer symlink, map its browser tag, and check Yiddish RTL layout.
Technical prose in these languages is provisional pending fluent review. Preserve existing Chinese values and unrelated new feature translations.
Email shows the board as a Gmail-like mailbox in the board's own theme:
the Inbox is the list email to card puts new cards in, Sent and All mail
follow the cards' email, the board's lists are folders and its labels are
Gmail labels, coloured on every message. The messages are the shared
table page, newest first, paged on the server; a message opens as the
card popup, its comments the conversation. Compose and Reply send From
the member's own board address, so the answer returns to this board, and
by In-Reply-To to the same card as a comment.
Chat shows the board as a Slack / Rocket.Chat workspace in the current
theme: a tree of Workspaces, boards, swimlanes, lists and cards as
channels; the selected card in the middle; its comments as chat on the
other side. Tree | card | chat left to right, mirrored right to left.
Each pane folds, the two borders drag (and move with the arrow keys),
and widths and folds are saved on the member's profile. Swimlanes, lists,
cards, workspaces and boards reorder by drag and drop through the same
paths the board and All Boards use.
The new strings are translated in every locale.
Thanks to xet7 !
Use Hiragana for the Japanese Hiragana catalog and its registered browser language tag. Extend direction checks to Sorani, Pashto, Sindhi and Uyghur. Record exact before/after repairs and all four source distinctions.
Kurmanji, Sorani, Pashto, Sindhi, Uyghur, Hausa and Somali technical phrasing is provisional pending fluent review. Existing Chinese values remain unchanged.
An email to a member's personal board address, board+<token>@<domain>,
becomes a card on that board, as Trello's email-to-board does (#794,
#3948). The subject is the title; the body (quoted replies stripped, HTML
as text) is the description, with a From line; attachments are attached
(no SVG, as for uploads). The author is the address's member, never the
From address, and they must still have write access when the email
arrives. A reply whose In-Reply-To/References matches a card's thread
becomes a comment on it.
Notification Settings, at three levels: the Admin Panel turns it on and
holds the domain, the provider webhook secret and the IMAP mailboxes with
their passwords (never published, never sent back to a browser); a board
admin turns the board on and picks the list and swimlane; board and
member choose which parts of an email are used. The member sees and
replaces their own address.
It arrives by POST /api/inbound-email (Mailgun, SendGrid, Postmark, JSON,
forms, multipart with attachments, raw MIME), by IMAP polling with
imapflow and mailparser under a database lease so one replica polls, or
on Sandstorm through the grain's own address: the bridge's Maildir is
read, a member's board token in the subject routes it, and WeKan's
outgoing email goes through HackSessionContext.send, since a grain has no
network. The email and hack-session capnp schemas are generated with the
other Sandstorm bindings.
Unknown addresses, wrong webhook secrets and over-limit addresses are
logged under authn.inbound-email. Rate limit per address, size limits,
Message-ID deduplication. The new strings are translated in every locale.
Thanks to xet7 !
A rebase rewrote the commits these entries link to, so the links named commits
that no longer exist and would have 404ed on GitHub. Repointed by
releases/fix-changelog-hashes.sh, which only touches a link no ref in this clone
can reach.
Thanks to xet7 !
Repair 38 values in each of the az, az-AZ and az-LA catalogs. Use lövhə for a Kanban board rather than şura (council), distinguish the assigned person, and correct the card-to-board command. Preserve query literals, invitation tokens and visibility emphasis; keep activity predicates compatible with the actor prefix.
Record all 114 exact corrections. Terminology and correction-ledger checks pass, including newer-translation preservation. Three browser cases register but have not been executed.
Thanks to xet7 !
Translate 193 current placeholders and nine labels hidden by fill exemptions. Preserve existing non-English values. Omit the separate linking verb before already inflected Kannada action predicates; retain the helper behavior for other languages. Use numerator/denominator notation for fixed-order progress counts.
Check permissions, import exclusions, recovery consequences, source literals, locale boundaries and runtime interpolation. Register six Kannada browser cases. Longer technical wording and full rule clause grammar remain open to speaker review.
Thanks to xet7 !
Translate 193 current feature placeholders and the exempt Bytes label, preserving all existing non-English values. Check field directions, permissions, import exclusions, recovery consequences, source literals and runtime interpolation. Register five Thai browser cases for the affected feature flows.
Longer technical wording remains provisional pending speaker review.
Thanks to xet7 !
Both v12.39 Mac apps were skipped although their bundles were attached:
`gh release view ... | grep -q` let grep exit at the first match while gh
was still writing, gh got SIGPIPE, pipefail failed the pipeline, and the
job said the bundle had not been published. The Windows EXE, Docker image
and snap-launchpad checks had the same shape. Each now reads the asset
list whole before matching it.
Thanks to xet7 !
The armhf and s390x builds succeeded, then the runner's connection to the
Launchpad API dropped or a poll hung, and snapcraft ended each attempt as
"Network is unreachable" or "Timed out waiting for build". A failed
build-state poll is now retried for up to 30 minutes; other errors and the
workflow's own deadline are unchanged.
Thanks to xet7 !
Both FreeBSD jobs stopped at "native check: sharp": Sharp's only FreeBSD
prebuilt is WebAssembly with Worker threads, and under Bun on FreeBSD the
first image operation never returned, while the same build works under
Bun on Linux. Sharp is now compiled against the system libvips there, as
on Android, and the FreeBSD VM installs vips.
Thanks to xet7 !
Export to Trello: Board Settings -> Export -> Trello creates the board in
Trello through its API with the saved key and token: labels, lists, cards,
checklists, comments, attachment files, and archived lists and cards. It
runs as a server job from the board export, with the same access check.
Swimlanes: Trello has none, so each swimlane is exported as a label named
"Swimlane: <title>". The Swimlanes by Blue Cat Power-Up groups Trello cards
into rows by label, and every Trello import turns those labels back into
swimlanes.
Sandstorm: a grain has no network of its own. Allow access to Trello opens
the Sandstorm Powerbox for https://api.trello.com/1, like the Sandstorm
WordPress app reaches wordpress.org; the access token is kept per user on
the server, and Trello import and export go through the bridge proxy.
Thanks to xet7 !
Translate 193 current feature placeholders and the exempt Bytes label. Correct four existing calendar labels using the long vowel already used elsewhere in the catalog, with exact ledger entries. Cover permission direction, import exclusions, recovery consequences, Trello markers and runtime interpolation; register Tamil feature and calendar browser cases.
Longer technical wording remains provisional pending speaker review.
Thanks to xet7 !
Fill eleven new Marathi strings without changing existing values. Extend Bengali checks for the concurrently supplied translations and register Bengali and Marathi export-dialog browser cases.
Thanks to xet7 !
Translate 193 Nepali placeholders and 11 new Trello/Sandstorm strings in each of nine Chinese catalog paths. Preserve all existing non-English values, including every earlier zh translation. Check import exclusions, permissions, recovery consequences, literal swimlane markers, exact tokens and runtime interpolation. Register browser coverage without contacting Trello.
Thanks to xet7 !
Fill 200 English MongoDB and S3 values in Nepali, Kannada, Malayalam, Javanese, Kazakh, Kyrgyz, Tajik and Somali, using the existing catalogs for terminology. Preserve existing translations and verified zh wording.
Thirteen locale and supplemental-audit suites pass, including token, state and runtime checks. Fourteen storage-settings browser cases register; a running rebuilt app is still needed. Complete software compounds remain provisional pending speaker review.
Thanks to xet7 !
Fill 100 English MongoDB and S3 values in Bengali, Icelandic, Tagalog and Albanian. Repair 15 mixed English/Tagalog clauses, retaining literal AWS console labels and the one-time secret display warning. Preserve all other translations, including existing zh wording.
Locale, correction-ledger, supplemental audit and runtime checks pass. Six storage-settings browser cases register; execution needs a running rebuilt app. Complete software wording remains provisional pending speaker review.
Thanks to xet7 !
Update Upcoming and TODO Later with the filtered backlog and the additional review queue. Keep native-language review and browser execution explicitly open.
Thanks to xet7 !
Fill 212 current placeholders and 55 English labels hidden by technical-name and short-word exemptions. Keep existing Marathi translations and preserve source tokens, product names and physical keyboard legends.
Add a read-only audit for product-prefixed prose, generic labels and keyboard names. Candidates require language-specific review; existing human-verified zh wording must not be overwritten.
Marathi, supplemental audit, shared-label and Scrum recovery checks pass. Register Marathi linked-field, notification, recovery and storage-settings browser coverage. Browser execution and broader native language review remain unfinished.
Thanks to xet7 !
Update Upcoming and TODO Later after the current Bengali fill list became empty. Preserve the distinction between filled strings and completed language-quality review.
Thanks to xet7 !
Fill 182 English placeholders for linked fields, import formats and mapping, notifications, webhooks, LDAP, Wrike and recovery. Preserve existing Bengali wording. The full current fill inventory is empty; older wording and complex technical phrases still need native review.
Verify exact placeholders, permissions, import exclusions, recovery consequences and i18next interpolation. Three focused suites pass. Four Bengali browser cases register; execution needs a running application.
Thanks to xet7 !
Track remaining fills and language-quality review separately. Document preservation of human-verified Chinese wording and the unavailable browser app.
Thanks to xet7 !
Fill 3,129 English values and repair 167 seeded values across 130 locale paths. Preserve existing translations and human-verified zh catalogs. Retire 15 completed pending keys.
Record provisional terminology in Luganda, Tswana, Tongan, Tsonga, Aymara, Quechua, Wolaytta, Venda, Acehnese, Walloon, Wolof and Tamazight as low confidence pending native review.
All 307 translation/Blockly suites and 21 human-preference checks pass. Source tokens match across all 246 catalogs. Expanded browser coverage registers 125 tests; execution requires a running app.
Thanks to xet7 !
A binding stored with issuer, nameID and nameIDFormat but no nameQualifier
or spNameQualifier keys was not found by identity, because a query for ''
does not match a missing field. The user was then found by username and
refused as account-already-bound-to-saml. An empty assertion qualifier now
also matches a missing one, and the next login writes them as empty
strings. A non-empty qualifier and a missing issuer still fail closed.
Thanks to xet7 !
tests/buildScriptParity.test.cjs failed because the Bun target-build
scripts, which bun.yml runs on each target runner, and the UCS migration's
docker-exec.mjs are not build.sh menu entries. They are listed as internals
with the reason, like the other release-workflow helpers.
Thanks to xet7 !
Android: Termux's user does not own the bind-mounted bundle, which the
workflow makes writable for everyone, so chmod failed with EPERM before an
allowed write. Files are now chmodded only when not writable already.
FreeBSD: the final Bun native check was killed at its deadline with no
output, its buffered console lost with it. It now writes each step
unbuffered and exits explicitly, and the supervisor tells a hung operation
(failure, naming the step) from every check passing and Bun then hanging on
exit (oven-sh/bun#44595), which passes with a warning.
windows-arm64 built and attached its bundle but showed an error: the
expected no-prebuilt-addon probe printed Bun's raw "error:" line, which
GitHub turns into an annotation. It is now reported as one plain line.
Thanks to xet7 !
The Docker job's bundle-version check looked for "name":"wekan" in app.js,
but rspack keeps only the version field the server reads, so the check was
skipped with a warning on every release. It now also reads the one
v-prefixed version-only module, and still only warns when that is absent
or ambiguous. A cancelled snap-launchpad job no longer claims it ran out of
time: the v12.38 jobs were cancelled at 1h49m of a 360-minute cap.
Thanks to xet7 !
The Artifact Hub scan of the v12.38 image found advisories in browserslist,
baseline-browser-mapping, colord, svgo, source-map-js (minifier-css),
compression and qs (webapp, oauth) and lodash.template (simple-schema), all
fixed in the same major. bump-bundle-npm-deps.mjs now raises them, and
gives a bumped package its own copy of a dependency whose sibling is a
different version, so compression 1.8.2 runs with the bytes, negotiator and
safe-buffer it declares. nodemailer and postcss-selector-parser fixes need a
new major and are recorded as not fixable.
Thanks to xet7 !
Debian's docker-cli carries Go 1.24.4, whose standard library advisories
were most of the Quay and Artifact Hub scans of the image, and only the UCS
migration used it, for docker exec. The migration's mongo and mongoexport
wrappers now run releases/ucs-migration/docker-exec.mjs, which speaks the
Docker Engine API over the mounted socket with the same stdout, stderr and
exit status, and the image installs no Docker CLI.
Thanks to xet7 !
Every refusal to link a SAML login to an existing (e.g. LDAP) account threw
the same "SAML identity does not match this account" and logged nothing.
Each condition now has its own reason in the server log, and a missing email
or email_verified=true attribute in the assertion is named on the sign-in
page. The refusal still fails closed. With merging on, a login name that is
the assertion's email also finds the account by a verified email, instead of
trying to create a new user. email_verified, the matching rules and the
unused SAML_ATTRIBUTES are documented.
Thanks to xet7 !
Browsers end a script at </script foo="bar"> too, so an end-tag pattern
written as <\/script\s*> or <\/script> misses it. The reported test, the
server input sanitizer's style pattern and one more test now use
<\/tag\b[^>]*>, and tests/securityAlerts20261012.test.cjs fails on the
loose shape for script, noscript, style, iframe, textarea and title
anywhere in the tree.
Thanks to GitHub CodeQL and xet7 !
The starredPublicBoards publication only sent public and instance boards,
so a user whose favorites are all private boards saw an empty popup. It now
sends every starred board the user may see - public/instance, or an active
membership, organization, team or domain share - through the shared
visibility builder, so a revoked share or stale star still never brings a
private board back.
Thanks to Raymond-Voogt and xet7 !
Fixes#6764.
The list drop placeholder had no --list-width, so none of the list width
rules matched it and it kept flex-shrink: 1 with no content; in a swimlane
wider than the window flexbox shrank it to a thin shadow. It now never
shrinks, every list sortable pins its min-width to the dragged list's width,
and it is drawn as a tinted, dashed drop area.
Thanks to mimZD and xet7 !
Fixes#6763.
Preserve Android build metadata through Termux's environment reset and build Sharp against libvips. Bound native addon probes and final checks, read complete AppImage asset lists, and follow authenticated chart pagination. Keep expected negative smoke diagnostics out of CI error annotations.
Thanks to xet7 !
Include development and optional dependencies in the locked npm install and verify the Meteor Rspack config before compilation. Exercise both omitted and included dependency installs with an offline fixture.
Build one Meteor ESM application, rebuild native addons on each target, and attach verified archives and checksums. Use native hosted runners, Alpine and Termux containers, and FreeBSD VMs. Cover release planning, failed-build gates, native modules, HTTP/DDP, and Chromium signup and board creation.
Thanks to dupontbertrand and xet7 !
The jobs run compile-native-addons.mjs from programs/server with the bundle
as `../..`, and node-gyp runs with each package as its working directory.
The relative node-gyp path was resolved from there, so v12.34's build-win32
and build-win-arm64 failed with "Cannot find module ...accounts-password/
programs/server/node_modules/node-gyp/bin/node-gyp.js". The bundle path is
made absolute first. The new test calls it the way the jobs do, with a fake
node-gyp that resolves paths the way the child process does, which the old
fake did not.
Thanks to xet7 !
Alert 565 (ReDoS): the package-specifier pattern in
releases/prune-unreachable-npm.mjs allowed `/` both between and inside path
segments, so a quoted `-/-/-/...` could be split in exponentially many ways;
es-module-lexer's minified lexer alone took over two seconds. A `/` now only
separates segments. Over the 23,812 files in node_modules it finds every
package it found before, and also `require('querystring-es3/')`, the
trailing-slash form the old pattern missed.
Alert 566 (bad tag filter): the Sandstorm readiness test matched <script>
case-sensitively. It and three negative checks that said "no <script" in
sanitized output now match any case; one of those also collected tag names
with a case-sensitive pattern that an <SCRIPT> tag would have escaped.
Alerts 567 and 568 (code sanitization): a test wrote dictionary paths into
generated JavaScript with JSON.stringify. It copies the dictionaries beside
its entry so the source is constant, and four more test probes take module
paths as arguments instead. The i18n loader the test drives, which writes an
asset name into generated server code, refuses a name outside a locale
tag's characters and escapes the literal.
tests/securityAlerts20261012.test.cjs fails on any case-sensitive script,
noscript or iframe pattern and on JSON.stringify spliced into an import,
require or asset path anywhere in the tree.
Thanks to GitHub CodeQL and xet7 !
Merging #6761 left a stray "This release fixes the following bugs:" above
the security header and the Sandstorm entries ahead of the security fixes.
Security comes first again, the Sandstorm entries follow the bug fixes under
one topic line with their contributor credited, two one-word wrapped lines
are reflowed, and In short is back to four sentences.
Thanks to fvb-sb, mnutt and xet7 !
Since v12.15 the LDAP server's certificate is verified by default, and
Node.js verified it only against the Mozilla list it is built with. A
company root CA installed on the server with update-ca-certificates was
unknown to WeKan, so after upgrading from v12.14 the snap refused LDAPS
logins with UNABLE_TO_VERIFY_LEAF_SIGNATURE.
server/main.js now adds the operating system's CAs to Node's own before any
application code runs: tls.getCACertificates('system'), and the distribution
CA bundle files Go's crypto/x509 reads. The bundle file matters in the snap:
on Debian and Ubuntu snapd keeps the host's /etc/ssl, but the per-CA links
update-ca-certificates makes point into /usr/local/share/ca-certificates,
which the snap sees from its base. Verification is not relaxed - a CA the
system does not have is still refused - and --use-bundled-ca keeps Node's
list only. It covers LDAPS, mail, webhooks and OAuth2 in every launcher.
A refused LDAP certificate now says what to do, in the log and in Admin
Panel's Test connection: install the CA on the server, or set LDAP_CA_CERT.
No hint suggests turning verification off.
tests/systemCaCertificates6762.test.cjs runs a TLS server with a certificate
from a test private CA (its key is not kept) and checks the reported error
without the CA, verification with it in the system bundle, refusal without
it, --use-bundled-ca, and the hints. Two LDAP guards follow the extended
error handling; prune-unreachable-npm.mjs leaves the regex guard's reviewed
list, as it no longer builds a RegExp.
Thanks to fvb-sb and xet7 !
Fixes#6762.
Strengthen dependency analysis and expose retention reasons in an audit
report. Prune verified browser inputs, unused client polyfills and server
type declarations. Include safety regressions and packaged-runtime results.
Load SAML, LDAP and transliteration implementations when their operations
need them. Preserve registration and authentication checks, with tests
and documentation accompanying the change.
Extract inline maps during bundle trimming so startup avoids scanning
large base64 comments. Preserve mapped stacks and include packaging
regressions and measured production results.
Keep English embedded and load other server dictionaries on first use,
without changing client loading or translation contents. Include loader
regressions, build integration checks and profiling documentation.
Load archive libraries only when an import, export or restore needs them.
Keep lightweight timing enabled and make detailed Meteor profiling opt-in.
Include first-use regression checks and production measurements.
Add launcher timings and a local production-path profiling runner. Replace
the fixed database delay with listener readiness and notify the waiting
page through a held request. Include tests and profiling documentation.
fetch-mongo-tools.sh, the local build-release-bundle.sh and the
check-arch-binaries.sh preflight fell back to the eight separate
<tool>-<platform> binaries when a release had no mongo-tools-<platform>.
wekan/mongo-tools-patches now publishes only the one program, so every
bundle, image and snap gets that or no tools, and says so. The Windows and
macOS jobs also remove the inherited amd64 mongo-tools with the launchers.
tests/fetchMongoTools.test.cjs serves a release that has only the per-tool
binaries and checks that none is installed or even requested, and fails on
any script or workflow that builds a per-tool download address.
Thanks to xet7 !
Alert 564 (regex injection): releases/platform-native-packages.mjs compiled
its command-line platform and arch into a RegExp. The canvas package names
are now compared as strings. The upload naming of attachments and avatars,
the attachment rename popup and tools/mirror-menu.mjs built a RegExp from a
file extension or a name the same way; they use literal suffix and prefix
checks now. tests/noUnescapedDynamicRegExp.test.cjs parses every source file
and fails on a RegExp built from a value that is not escaped, unless the
site is listed with the reason its values are constants.
Alert 563 (incomplete escaping): name.replace('/', '%2F') replaced only the
first slash. registryPackagePath() replaces every one and refuses anything
that is not an npm package name. Seven tests escaped a regex the same
first-only way; 'g++'.replace('+', '\\+') let "- g+" pass a guard. They use
the complete escapeRegExp, and tests/noIncompleteRegExpEscaping.test.cjs
fails on any string-pattern replace that performs an escape.
Alert 562 (ReDoS): the CasaOS reverse-domain id pattern in
tests/platformTemplates.test.cjs let '.' be matched by both groups, so
'0.0.0...!' backtracked exponentially. Each separator now belongs to one
group, and the test runs CodeQL's attack string against it.
Thanks to GitHub CodeQL and xet7 !
They read every page of a GitHub list with gh api --paginate --slurp,
and --slurp exists only from gh 2.48 on: an older gh stopped the release
with "unknown flag: --slurp". --paginate alone prints the pages back to
back, and gh_pages() now reads them one after another. A truncated page
is still an error, never a shorter list.
The tests feed the scripts pages the way gh prints them, check that no
gh call asks for --slurp, and (negative) that a truncated page fails.
Thanks to xet7 !
On Univention WeKan is served at /wekan. profile.avatarUrl holds
/cdn/storage/avatars/<id> - what Change Avatar and the server's own
migrations store - and it was rendered as stored, so the browser asked
the UCS web server for a path outside WeKan, got 404, and every avatar
was an empty circle, while Change Avatar, which builds its own link,
showed the picture. models/lib/avatarDisplayUrl.js treats the stored
value as the avatar's name: whatever host or old path prefix stood
before /cdn/storage/avatars/ or /cfs/files/avatars/ is replaced with the
path WeKan is served at now, relative to the page's origin. The avatar,
the People page and the report tables draw through it; the default
avatar gets the prefix too. External pictures and data: URLs are left
alone.
The same session, opened through 127.0.0.1:8443/wekan, fetched lazily
loaded code from ROOT_URL's host ucs-2275.wekan.intranet, which the
browser could not resolve (NS_ERROR_UNKNOWN_HOST, "Cross-Origin Request
Blocked"). Meteor's dynamic-import setting useLocationOrigin is now on
by default, so that code comes from the page's own origin and ROOT_URL
path; an explicit value in METEOR_SETTINGS still wins. Links keep using
ROOT_URL as before.
tests/avatarDisplayUrl.test.cjs covers every stored shape, (negative)
leaves external, data: and query-string URLs alone, checks that no
template puts a stored avatar URL in src without avatarSrc, and pins the
dynamic-import default and its override. The Playwright spec
avatar-sub-path.e2e.js checks the drawn src and the setting in a browser;
it was not run here.
Thanks to xet7 !
The eight tools were eight Go programs, each with its own copy of the Go
runtime, the MongoDB driver and the tools' shared packages: about 105 MB
in every bundle, image and snap. wekan/mongo-tools-patches now also
publishes mongo-tools-<platform>, all eight in one program of about 15 MB.
releases/fetch-mongo-tools.sh puts it in a bundle with a launcher per
tool - a three-line shell script on Linux and macOS, a .cmd on Windows -
so mongodump keeps working from $SNAP/bin, the bundle and PATH. Launchers
rather than symlinks, because a symlink has to survive zip -r, Docker
COPY, snapcraft and every user's unzip. Until the newest
mongo-tools-patches release has mongo-tools-<platform>, it fetches the
eight per-tool assets as before. It first removes the tools a repacked
bundle inherited from amd64, so a platform without tools ships none
rather than the wrong CPU's.
Every bundle job in release-all.yml, repack-bundle-for-arch.sh and
build-release-bundle.sh use it; the snaps move mongo-tools into bin/
with its launchers; the telemetry audit scans mongo-tools as a tool; the
Windows single EXE unpacks the .cmd launchers; the preflight and the URL
check accept the one program.
tests/fetchMongoTools.test.cjs serves the release from a local HTTP
server and checks the launchers run the program with their arguments,
the Windows .cmd files, the per-tool fallback, and (negative) that
inherited amd64 tools are removed, that a checksum mismatch is refused,
and that no workflow or snap recipe downloads the tools itself.
releaseBinaryFreshness now finds the newest-release URL in the helper;
workflowFailureDiagnostics required an ::error:: beside each new exit.
Thanks to xet7 !
ed5502edfa brought server/sandstorm.js back, and with it a commented-out
v0.8 migration that sets permission: 'public'. It is a write, not a read
gate, so it cannot leave instance boards out; it is listed as reviewed.
Thanks to xet7 !
nodejs.org's node executables carry their full symbol table and DWARF debug
data, which only a debugger reads. Node 26.11.1 for linux-x64 is 150.0 MB
and 116.7 MB without them; linux-arm64 goes from 150.2 to 114.6 MB. Every
bundle, Docker image, snap, AppImage, Flatpak and the Sandstorm package
ships one.
releases/strip-node.sh runs after the download has been verified against its
source's checksum, so the file verified and recorded is the original:
- ELF: eu-strip (elfutils). GNU strip only reads the host's own CPU and
fails on an arm64 node on an x64 runner. Inside an emulated target
container the native strip is the fallback.
- Mach-O: strip -x keeps the 39006 exported symbols addons bind to and
drops the 901035 local ones. It then re-signs ad hoc, because stripping
breaks the signature and an arm64 Mac runs no unsigned binary.
- PE: nothing. node.exe has no COFF symbols, and its debug data is a
separate .pdb that is not shipped.
It refuses a result that lost .dynsym, the table native addons resolve
N-API against. The stripped linux-x64 node was run with bcrypt, argon2,
sharp and @napi-rs/canvas, and each hashed, verified or rendered correctly.
embed-verified-node.sh calls it for amd64, arm64, Windows, macOS, Sandstorm
and the local build, and install-node-for-arch.sh for the emulated
architectures. build-amd64, build-arm64 and the extra-arch containers
install elfutils.
tests/stripNode.test.cjs strips real gcc -g binaries (it checks that
.symtab and .debug_* are gone, .dynsym stays, and the binary still runs),
refuses an ELF without .dynsym and a non-binary, leaves a .exe untouched,
and pins every call site after its checksum check.
tests/buildScriptParity.test.cjs lists every releases/ script: it named
compile-native-addons.mjs, added by 34a33f7b14 and not registered, and now
strip-node.sh. Both are registered as release-workflow helpers, and the
suite passes again. Its earlier failure was reported as pre-existing; it was
not.
Thanks to xet7 !
Adds the Docker, Launchpad and history, and native-module entries to Upcoming, and notes in the released v12.33 sharp entry that its 32-bit ARM zips can crash on ARMv6 and some ARMv7 boards, and where the fix is.
Thanks to xet7 !
Inspecting the bundles to find what could be removed found a crash risk
added in v12.33 by 943bfd9197. That commit gave the armv6, armhf and armv7
bundles sharp's @img/sharp-linux-arm package. readelf shows its .node is
built for ARMv7 (Tag_CPU_arch: v7) and its libvips for ARMv8. The armv6
bundle runs on Raspberry Pi 1 and Zero, and the armhf/armv7 bundles on
ARMv7 boards. Executing an instruction the CPU lacks raises SIGILL, which
kills the whole WeKan process the first time a thumbnail is made. Before
that commit the bundles had only the linux-x64 package, which fails to load
and is handled. 32-bit ARM now downloads no native package and keeps the
WebAssembly sharp, which runs on any CPU (thumbnails and GIFs were made
with it under Node 26).
The same inspection found that @napi-rs/canvas is not dead weight. pdfjs-dist
6 builds a DOMMatrix while loading, so without canvas the import throws and
PDF attachment text is never indexed for search. This was checked: a PDF
made with pdfkit gives its text back with canvas and fails without it.
Every bundle except Linux x64 had only canvas-linux-x64-gnu, which
platform-native-packages then removed. The script now adds the glibc/MSVC
canvas package for the target as it does for sharp, verified by sha512 and
by its binary header. That covers linux x64/arm64/riscv64, darwin x64/arm64
and win32 x64/arm64. It never installs a musl package, nor anything on
32-bit ARM, where canvas is ARMv7 too. Where none is published (ppc64,
s390x, ia32, loong64), that is logged.
Checked against the npm registry: linux-arm64 and win32-x64 got sharp and
canvas, and both passed the ELF/PE check. linux-arm downloaded nothing.
tests/platformNativePackages.test.cjs covers 32-bit ARM, the canvas choice
(no musl, no ARM, none where unpublished) and the canvas download.
Thanks to xet7 !
Launchpad snap legs (95-104 minutes in v12.32): prepare-launchpad-source.sh
archived the whole tree, 237 MB of docs, tests, translations and client
code, for every architecture. The wekan part (source: .) then copied it
again on Launchpad's slowest builders, and the recipe uses none of it,
because the app comes from the release .zip. The snapshot now holds only
what snapcraft.yaml reads: snapcraft.yaml, snap/, snap-src/, and
releases/fetch.sh, check-telemetry.py, risk-baseline.json (its deny-hash
list) and migrate-mongodb-to-ferretdb.mjs. That is 1.1 MB.
tests/releaseSnapLaunchpadFlatten.test.cjs checks the snapshot holds the
listed files and nothing else, and checks against the real snapcraft.yaml
that every project path it reads is in the list.
Git history that was fetched and never read:
- snap-launchpad cloned the full history (fetch-depth: 0, 447 MB) because
remote-build rejects shallow repositories. What it uploads is the fresh
one-commit repository made from git archive, so a shallow checkout is
enough.
- bump only reads the tree and pushes one commit on top: shallow.
- prepare fetched history to see whether the release tag already existed.
It now asks GitHub with git ls-remote, which also works on a re-run.
- update-ondra-gantt-repos cloned ~160 MB of history per variant repository
to add one commit: shallow.
- release.yml (chart-releaser) ran on every push to main with a full clone,
but this repository has no charts/; the chart is published to
wekan/charts by release-all.yml. It now runs only when charts/ changes.
The wekan/charts checkouts keep fetch-depth: 0 because they need the
gh-pages branch, and that repository is 15 MB.
Thanks to xet7 !
In v12.32 "Build and push multi-arch image" took 27 of the docker job's 29
minutes. For each of seven platforms, six of them emulated, the Dockerfile
installed a compiler toolchain, resolved and downloaded Node.js, reinstalled
programs/server with npm, re-ran the prune, bump, trim and prune passes, and
purged the toolchain again. That platform's .zip leg in release-all.yml had
already done all of it, with the same scripts.
Stage 1 (FROM --platform=$BUILDPLATFORM) now runs natively on the runner for
each target. It downloads that target's .zip, checks it against the
release's own .sha256sum, re-runs the telemetry check, reads bundle/node's
ELF header to confirm the target CPU, and lays out /build and
/usr/local/bin/node. The image's node is the .zip's own node: the file the
leg resolved and verified, rather than a second download that had to match
it. Stage 2 is the only part that runs as the target CPU. It adds the WeKan
user, applies an OS update, installs file, libatomic1 and docker-cli, and
copies stage 1's result. No npm and no compiler ever enter the image.
The docker job read the base image from the first FROM; it now reads the
last one, since the first is the build-machine stage.
Stage 1 was run outside Docker against the real v12.32 s390x zip: the
checksum, the telemetry check (47979 files) and the ELF check (machine 22)
passed, and the layout was right. The ELF check rejects the same node when
expected as ppc64le, and rejects a non-ELF file. No Docker build ran here.
tests/dockerImageFromBundle.test.cjs pins the two stages, the verification,
the per-architecture ELF numbers (shared with check-addon-arch.mjs), and
that no reinstall, Node.js download or toolchain comes back. It fails on
the previous Dockerfile. Nine tests pinned the old in-image steps; each now
pins the new behaviour, with the reason recorded beside it.
Thanks to xet7 !
Adds an Upcoming section for it, and notes in the released v12.33 entries that their win32 and win-arm64 zips were not published, and where the fix is.
Thanks to xet7 !
v12.33's build-win32 and build-win-arm64 both failed their addon check:
...accounts-password/node_modules/argon2 has no arm64 Windows addon to load
The jobs relied on npm to compile the addons that have no prebuild for their
CPU (argon2 0.44 for win32-arm64; bcrypt and argon2 for win32-ia32) during
the programs/server install, through Meteor's npm-rebuild.js. The release
jobs use npm 12, which ignores npm_config_arch, npm_config_target_arch and
npm_config_nodedir ("Unknown env config", which it says will become an
error) and blocks install scripts outside allowScripts ("install scripts
blocked"). So nothing was compiled.
releases/compile-native-addons.mjs now runs node-gyp itself, using the
node-gyp that the install brings (pinned to 13.x, which finds Visual
Studio 2026), with --arch for the target CPU. win32 also passes the nodedir
that holds the fork's ia32 node.lib. It does this for every copy of each
named package that has a binding.gyp and no win32-<arch> prebuild, before
prune-build-only-modules removes node-gyp. It fails if node-gyp fails or
leaves no .node. Both jobs no longer set the npm_config_ variables.
Checked with the real node-gyp 13.0.2, argon2 0.44.0 and bcrypt 6.0.0
(with their win32 prebuilds removed, compiled for this machine): both
compiled, loaded, and hashed and verified a password.
tests/compileNativeAddons.test.cjs covers the plan, the node-gyp arguments
and every way the compile could quietly not happen.
tests/win32BundleBuild.test.cjs pins the step in both jobs and refuses
npm_config_arch/_target_arch/_nodedir in any workflow.
tests/releaseBundleCoverage.test.cjs used to require npm_config_arch: ia32,
and now requires the node-gyp cross-build, with the reason recorded in the
test.
Thanks to xet7 !
After the 12.32 UCS upgrade every LDAP login failed with "LDAP authentication
failed". The UCS compose (wekan/univention) kept the 6.09 setting
LDAP_GROUP_FILTER_ENABLE=true with no group id attribute and no group name.
6.09 read that as "in any group". WeKan now refuses an incomplete group
filter, as intended since #3700, so isUserInGroup refused everyone. The
compose is fixed in wekan/univention: the filter is off, because UCS grants
access through (wekanActivated=TRUE), and the group id attribute is cn, so
Domain Admins become admins again.
releases/ucs-release.py now applies WeKan's own group-setting rule to the
compose before it prepares a portal upload. With the group filter or admin
sync on, it needs the three group lookup settings, and an enabled filter
needs a group name. A compose that would refuse every LDAP login is not
published. It refuses the 12.32 compose and passes the fixed one.
tests/ucsRelease.test.py covers both, plus the rule.
tests/ldapGroupFilterConfig.test.cjs shows that WeKan refuses the 6.09 UCS
settings and needs nothing missing with the fixed ones.
The UCS README describes the failure and gives a workaround for installs that
already upgraded: two appcenter/env/wekan UCR values and univention-app
reinitialize. It also explains the cross-origin error seen when WeKan is
opened through a host other than ROOT_URL.
Thanks to xet7 !
Record the 40 passing real browser checks across Nextcloud 32-35 and the mutual-TLS FRP subpath run, companion and release regressions, and the remaining Docker and ARM64 validation.
Thanks to xet7.
sharp makes the attachment thumbnails. Every bundle except amd64 is made
from the amd64 Linux bundle, and npm installed only @img/sharp-linux-x64
there. Reading the published v12.32 zips showed that every other bundle
carried that one package and nothing it could load: arm64, ppc64le, s390x,
riscv64, i386, armhf, armv7, armv6, mac-arm64 and mac-x64, as well as the
Docker images and snaps built from them. Thumbnails fell back to the
full-size image, and nothing failed.
releases/windows-native-packages.mjs becomes platform-native-packages.mjs,
<bundle> <win32|linux|darwin> <arch>. It removes the packages npm would not
install on that target (os, cpu, and on Linux libc), downloads
@img/sharp-<platform>-<arch> and its own libvips at the versions pinned,
checks each against the registry's sha512, and checks every native addon's
header for the target. sharp publishes nothing native for Linux i386 or
loong64, so there it uses @img/sharp-wasm32. That package is now a root
optional dependency in package.json, at sharp's own range. It was run
under Node 26 with no native package: it made a 512 px WebP thumbnail and
a GIF.
check-addon-arch.mjs now reads ELF (with byte order) and Mach-O (including
universal binaries) as well as PE, and follows npm's libc rule on Linux.
The script now runs in build-amd64, build-arm64 (in its arm64 container),
both macOS jobs, all three Windows jobs, and build-extra-arches through
install-node-for-arch.sh. There it runs with the target node's own
process.arch, so armv6/armv7/armhf are arm, ppc64le is ppc64 and i386 is
ia32. build-release-bundle.sh runs it for the local machine.
Against the published v12.32 zips, given their native addons, it added the
right sharp and libvips for all eleven Linux and macOS bundles, kept wasm32
for i386, and passed every bcrypt, argon2 and sharp binary. Checked the
other way, the s390x bundle was refused as ppc64.
tests/platformNativePackages.test.cjs covers the script with a mocked
registry (libvips, wasm fallback, wrong CPU, tampered tarball, path
traversal). tests/sharpEveryPlatform.test.cjs requires every job that makes
a bundle zip to run it for its own target, after the prune and before the
zip, and the wasm32 dependency to stay at sharp's version.
Thanks to xet7 !
Every Windows bundle is made from the amd64 Linux bundle, so sharp, which
makes the attachment thumbnails, had only @img/sharp-linux-x64 there. It
could never load on Windows, and every thumbnail fell back to the full-size
image. sharp publishes @img/sharp-win32-ia32, -x64 and -arm64 with the
libvips DLLs included, so nothing needs compiling.
releases/windows-native-packages.mjs puts in the package at the version
sharp pins, checks it against the registry's sha512, and removes the
packages whose os/cpu name another platform (sharp-linux-x64, its libvips,
@napi-rs/canvas-linux-x64-gnu). canvas is only pdfjs-dist's optional
dependency for rendering pages; WeKan only extracts text with pdfjs, and
there is no win32-ia32 canvas.
Running the addon check on the published v12.32 zips found a worse fault:
the win-arm64 zip has no arm64 argon2. argon2 0.44 publishes no win32-arm64
prebuild, and the job set no npm_config_arch, so node-gyp-build's install
test passed in the x64 runner node with the win32-x64 prebuild and compiled
nothing. accounts-password imports argon2 with no fallback. The rebuild
step now sets npm_config_arch=arm64, so argon2 is cross-compiled with
Visual Studio's ARM64 tools, which the runner image includes.
All three Windows jobs now run windows-native-packages.mjs and then
check-addon-arch.mjs for bcrypt, argon2 and @img/sharp-win32-<arch>, before
the zip is made. check-addon-arch accepts scoped package names. Against the
published v12.32 zips, win64 passes after the script, and win-arm64 still
fails on argon2, which the npm_config_arch fix addresses at build time.
tests/windowsNativePackages.test.cjs covers the script with a mocked
registry, including a tampered tarball and a path-traversal entry.
tests/win32BundleBuild.test.cjs pins the steps in all three jobs and the
target CPU of the cross-built ones.
Thanks to xet7 !
Adds an Upcoming section for it, and notes in the released v12.32 entry that its win32 bundle was not published after all, and where the fix is.
Thanks to xet7 !
v12.32 was the first release whose build-win32 got past the Node.js lookup,
and it died at the first step it had never run:
tar: D\:\a\\_temp/node-ia32: Cannot open: No such file or directory
RUNNER_TEMP is a Windows path, and GNU tar in Git Bash reads anything before
a colon as a remote host. The step now builds the nodedir on the POSIX form
of the path (cygpath -u), unpacks the headers by relative name inside it,
checks that include/node/node.h arrived, and gives node-gyp the Windows form
(cygpath -w).
The step after that had never run either. bcrypt and argon2 publish no
win32-ia32 prebuild, so they must be compiled for ia32, and accounts-password
imports both with no fallback. A cross-build that silently did nothing would
still zip and pass 7z t, and fail only at the first sign-in.
releases/check-addon-arch.mjs reads each shipped addon's PE header and fails
the job unless bcrypt and argon2 each have one for ia32. It skips packages
whose os/cpu name another platform, as npm does. On the published v12.31
win64 zip it passes as x64 and refuses the same zip as ia32.
tests/win32BundleBuild.test.cjs pins the new step, checks that no Windows
job in any workflow gives tar a RUNNER_TEMP or GITHUB_WORKSPACE path, and
tests the checker on synthetic PE and ELF files, positive and negative.
Thanks to xet7 !
Whitespace only: the Nextcloud entry's two paragraphs are rewrapped at 80 columns, with the same words in the same order, so tests/changelogFormat.test.cjs passes again.
Thanks to xet7 !
Shorten In short to three sentences covering all four topics, remove a UCS sentence pasted into the docs reorganization entry, describe the UCS topic as a whole, and wrap its long lines at 80 columns.
Thanks to xet7 !
The drop handler must call sortable('cancel'), which puts the dragged card
back at its source until Blaze re-renders the move. The drop preview from
b687f37272 fills the target slot during that gap, but the real card stayed
visible at the source, so the card was drawn in both lists. The reporter's
newest video shows that frame: card "2" already in the target list and still
in the source list with its old count, then the source catches up.
retireCardDropPreview() now also hides the node that sortable('cancel') put
back, with an inline style, which Blaze does not manage there:
- a move to another list keeps it hidden until Blaze removes it, even when
the new card renders a flush earlier;
- a reorder within one list shows only the preview until Blaze moves the
node beside it, instead of jumping the card back to its old place first;
- a rejected move, or one that never arrives within 10 seconds, shows the
card again where it is, so no card is left invisible.
tests/cardDropPreviewSource.test.cjs drives the helper on a minimal DOM: the
video's cross-list drop, a reorder, a drop in place, a rejected move, a
timeout, and a source copy that is never removed. It also checks that every
caller passes the node to hide. It fails on the video's frame without this
fix. 37-card-drag-sort.e2e.js now checks the source while the preview is
shown, and adds a reorder within one list.
Thanks to mimZD and xet7 !
Fixes#6430,
Run the temporary migration worker from the ordinary versioned application image. Prefer the target App Center compose images, then try the same upstream version on GHCR, Docker Hub and Quay before downtime. Reject inaccessible or incomplete images before portal upload. Cover UCS-only access, fallback, failure reporting, cleanup and migration integrity with regression tests.
Thanks to xet7 !
The autoupdate design pages move from docs/Design/Autoupdate to where their
platform lives: the per-OS pages to docs/Platforms/FOSS/OS/OS-future-alternatives,
Snap-Core and Snap-Ondra-Gantt to Container/Snap, UCS and Nextcloud to
Container/Docker, and Platforms.md to docs/Platforms. docs/Platforms/FOSS/Cloud
is split into Container/Docker (Helm, OpenShift, CloudFoundry) and
FOSS/CloudFlare; Friend and UCS move under Container/Docker; Leo moves to
Features/ImportExport/Leo.
Every link to a moved page is updated: relative links in the docs, including
the moved pages' own links to the rest of the tree, full docs/ paths in the
workflows, tests and comments, and the Upcoming CHANGELOG entry. Released and
archived CHANGELOG sections are records and keep their original links.
tests/docsLinksResolve.test.cjs passes.
Thanks to xet7 !
wekan/node-patches publishes node-win32.exe with its checksum in
node-win32.sha256sum (without .exe), as the line `<hash> *node-win32.exe`.
releases/resolve-node-source.sh looked only for node-win32.exe.sha256sum and an
unmarked name, so it answered node_found=false and build-win32 skipped itself
every release, although both binaries were published. The resolver now also
tries the sidecar without .exe and accepts sha256sum's `*` binary-mode marker,
and strips CR. Verified against v26.11.1: win32 resolves, and the downloaded
node-win32.exe matches the published SHA256. tests/releaseNodeSources.test.cjs
runs the matcher on real sidecar lines, both positive and negative.
Thanks to xet7 !
docs/Design/Autoupdate/Platforms.md now lists every binary that the newest
wekan/node-patches (v26.11.1, 16 targets) and wekan/FerretDB (v1.92.0, 25
targets) releases publish. Its "what is built" table matches what v12.30 and
v12.31 shipped and ghcr.io/wekan/wekan:v12.30 contains: armv7, armv6, win64,
win-arm64, mac-x64 and mac-arm64 bundles are added, riscv64's Node.js comes from
node-patches for v26.11.1, and loong64 is skipped. The doc also explains why
win32 is not built: the resolver looks for node-win32.exe.sha256sum, but
node-patches publishes node-win32.sha256sum. FreeBSD amd64 is listed as having
both binaries now.
Thanks to xet7 !
docs/Design/Autoupdate/Platforms.md opens with the open source platforms that
WeKan is not on yet, checked in each catalog on 2026-10-11, and what is still
missing for each. ZimaOS/CasaOS, TrueNAS, Coolify, Dokploy and the AUR get
the files their catalogs take and a README with the pull request each
expects, under docs/Platforms/. Each was tested with that catalog's own tools
in .tools/ where they run without the platform: CasaOS's validator and store
builder, the TrueNAS library render, Dokploy's three validators, and Arch's
makepkg, whose package started WeKan. tests/platformTemplates.test.cjs keeps
the image tag and settings the same across them.
Thanks to xet7 !
sandstorm.js was imported only by server/imports.js since mainModule turned
eager loading off, so its browser code never ran in a grain: the grain URL and
title did not follow the board, the Powerbox picker could not open, and the
isSandstorm helper was undefined, so email, password, logout and avatar
settings that Sandstorm handles showed anyway. The server half - which loads
the Cap'n Proto bridge client and node:net - is now server/sandstorm.js, and
the client imports the shared sandstorm.js. Its shell listener ignores
messages that are not its replies instead of throwing on them.
The Powerbox button is back in the members widget, for people who may invite.
It passes the open board, and the claimed person is invited to it through
inviteUserToBoard, with the member picker's own permission checks; #2405
removed the old button because the identity it claimed was never attached to
a board.
Thanks to xet7 !
start.js killed the please-wait bridge and then loaded main.js, but
Meteor 3 awaits every Meteor.startup hook before webapp calls listen, so
nothing answered on port 4000 for all of WeKan's startup. The
sandstorm-http-bridge got connection-refused and the browser showed
NS_ERROR_NET_EMPTY_RESPONSE. The bridge now keeps the port until Meteor
binds it: the first listen on the app port waits for the bridge process
to exit and then binds, and logs "WeKan is listening on port 4000".
Thanks to xet7 !
When there is horizontal room, the source list and the parts list flow
into as many columns as fit (a column width, not a count), so WeKan,
Trello, Jira and the rest are all on screen at once instead of below
the fold. A phone keeps one column.
Thanks to xet7 !
v12.29's build-win64 failed before building anything: community.chocolatey.org
answered 504 and `choco install -y 7zip` could not resolve 7zip.install.
windows-latest already has 7-Zip, so build-win64, build-win-arm64 and
build-win32 use it, and fall back to Chocolatey with five retries only on an
image without it.
Thanks to xet7 !
Both are Cap'n Proto calls on sandstorm-http-bridge's /tmp/sandstorm-api;
the bridge's HTTP proxy has no route for either. They went through
node-capnp (capnp.node), built for Node 14, so a grain ran without them.
imports/sandstorm/bridgeClient.mjs now makes the same calls in plain
JavaScript with @wekanteam/capnp-es, using schema classes generated from
Sandstorm's .capnp files by releases/sandstorm-capnp-schemas.sh. The
activity hook reads the board from the activity instead of the removed
hard-coded 'sandstorm' board, and a notification that cannot be sent no
longer fails the change. The .spk drops the 33.6 MB capnp.node.
tests/sandstormCapnpRpc.test.cjs drives every RPC message from a
hand-built peer, and runs the same cases plus WeKan's bridge calls against
the reference C++ RPC implementation with Sandstorm's schemas.
Thanks to xet7 !
npm capnp-es 0.0.16 (upstream commit 439f564), vendored like the other
npm-packages forks with its tarball SHA256 and npm integrity recorded. Its
experimental RPC Conn could not talk to a C++ peer such as
sandstorm-http-bridge: it ignored Resolve, Release and Disembargo, never
released an import, left tail-call answers (takeFromOtherQuestion) pending
forever, released question ids instead of export ids, answered bootstrap
with a null capability, and its DeferredTransport lost a message whenever
two arrived together. The fork handles all of them, and its compiler no
longer regenerates structs declared in another file, which made generated
Sandstorm schema modules a SyntaxError on load. Every change is in
npm-packages/capnp-es/patches/wekan.patch.
Thanks to xet7 !
start-memory.js turns Node's Web Storage off with
--no-experimental-webstorage, so Node 26 no longer prints "localStorage is
not available because --localstorage-file was not provided" into every
grain log, and it keeps an administrator's heap size or Web Storage choice
while still adding what is missing. The ROOT_URL email warning is skipped
in a grain, whose ROOT_URL is always its loopback address behind the bridge
and which has no SMTP of its own.
Thanks to xet7 !
Validation.md links models/eventLog.js by its real name, the README counts
the 166 catalogs now over 90% translated, and CHANGELOG.md is wrapped at 80
columns (whitespace only). The guards follow deliberate changes: Supported.md
belongs directly in docs/Databases, build.sh's macOS branch writes
export PATH="$HOME/.meteor:$PATH" since the npx meteor change, and the
wasmagic pin is checked against the lockfile instead of a copied number.
Thanks to xet7 !
The .spk now carries the exact Node.js the Dockerfile pins (26.11.1), which
is what https://wekan.fi/version.txt advertises, downloaded and verified
with releases/embed-verified-node.sh like the zip bundles, instead of
Meteor's dev-bundle node or the newest Node 24. FerretDB is fetched by the
release tag version.txt names, and the Sandstorm and Windows workflows
install the Dockerfile's npm with releases/use-release-npm.sh instead of a
hard-coded npm 12.0.2. Comments and docs describing the current runtime
say Node 26.
Thanks to xet7 !
A grain has no shell: the meteor-spk 0.6.0 base ships only mongod, niscud
and node in bin/, so the pkgdef's #!/bin/sh start-memory.sh failed with
"execvp(argvp[0], argvp): No such file or directory" and no grain booted.
The memory-derived heap launcher is now start-memory.js, run by node.
start.js also no longer spawns the missing /bin/sleep, which had made every
wait return at once.
Thanks to xet7 !
https://docs.meteor.com/about/install.html installs Meteor on Linux, macOS
and Windows alike with `npx meteor`, as the user and never with sudo; the
global npm install is only its fallback. npx runs the meteor package's bin,
which installs into ~/.meteor (%LOCALAPPDATA%\.meteor on Windows) and puts
it on PATH, so npm 12's refusal to run install scripts does not apply, and
the documented npm fallback flags that npm 12 rejects are not needed.
build.sh's Linux branch and build.bat now run npx -y meteor unless Meteor
is installed already, as the macOS branch did. build.sh removes the global
installer package an earlier setup left, and gives ~/.npm back to the user
if an old sudo npm made it root's. releases/rebuild-release.sh does the
same instead of sudo npm on Linux and brew install meteor on macOS.
Checked with npm 12.2.0: npx -y meteor installed Meteor 3.5.2 into a
scratch HOME and added it to .bashrc and .bash_profile.
Thanks to xet7 !
npm 12 runs no package's install script unless allow-scripts names it, and
only warns when it blocks one. The meteor npm package is just an installer:
its install script is what downloads Meteor, so Setup -> Install dependencies
finished with no Meteor. build.sh, build.bat and releases/rebuild-release.sh
now pass --allow-scripts=meteor, which npm 12.2.0 matches against the
registry URL's package name, so it allows that one script and nothing else.
Checked with npm 12.2.0 on a registry package: blocked without the flag, run
with it. npx -y meteor (macOS) runs the installer as the package's bin and
needs no change.
tests/npmNoUnsafePerm.test.cjs becomes tests/npmMeteorInstall.test.cjs and
also fails on a global npm install of meteor without --allow-scripts=meteor.
Thanks to xet7 !
5c9334b76c passed --foreground-script, as Meteor's install documentation
spells it. npm 11 read that as an abbreviation; npm 12.2.0, which build.sh
installs from the Dockerfile's NPM_VERSION before installing Meteor, stops
with 'Invalid abbreviated flag'. Checked against npm 12.2.0: it accepts
--foreground-scripts and refuses both --foreground-script and --unsafe-perm.
The test now also fails on the abbreviated flag, in the scripts and in the
.agents notes it was copied from.
Thanks to xet7 !
Setup -> Install dependencies stopped with EUNKNOWNCONFIG right after n
installed the pinned Node and npm 11: npm 7 removed --unsafe-perm and npm 11
refuses an unknown cli flag. build.sh and releases/rebuild-release.sh now
pass --foreground-script, as Meteor's own install documentation does, and
tests/npmNoUnsafePerm.test.cjs fails when any script passes the old flag.
Thanks to xet7 !
Fill 196 English placeholders while preserving existing translations and exact source tokens. Verify script, import exclusions, field permissions, notification delivery and destructive versus resumable recovery actions. Longer Gujarati technical wording remains low-confidence pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Five browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 392 English placeholders across both Hindi catalogs while preserving existing translations and exact source tokens. Verify import exclusions, field permissions, notification delivery and destructive versus resumable recovery actions. Longer Hindi technical wording remains low-confidence pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Ten browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 678 English placeholders across three catalogs while preserving existing translations and exact tokens. Verify script, import exclusions, field permissions, notifications, Scrum and recovery meanings. Keep specialist wording provisional pending speaker review and broader language auditing open.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Fifteen browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 1356 English placeholders across six catalogs while preserving existing translations and exact tokens. Verify import exclusions, field permissions, notifications, Scrum and recovery meanings. Keep specialist wording provisional pending speaker review and broader language auditing open.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Thirty browser cases pass syntax and discovery, including the zh-SG runtime tag; runtime remains unverified on this host.
Thanks to xet7 !
Fill 678 English placeholders across three Arabic catalogs and replace 18 wrong-language core values. Preserve other translations and exact source tokens. Add permission, import, notification, Scrum and recovery regressions. Longer technical wording remains low-confidence pending speaker review; the broader Persian-seed audit remains open.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Fifteen browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 396 English placeholders across both Hebrew catalogs while preserving existing translations and exact source tokens. Verify import exclusions, field permissions, notification delivery and destructive versus resumable recovery actions. Longer Hebrew technical wording remains low-confidence pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Ten browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 398 English placeholders across both Persian catalogs while preserving existing translations and exact source tokens. Check import exclusions, field permissions, notification delivery and destructive versus resumable recovery actions. Longer Persian technical wording remains low-confidence pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Ten browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 110 English placeholders while preserving existing translations and exact source tokens. Verify permissions, synchronization directions, import semantics, notification timing and workflow completion states. Longer technical wording remains low-confidence pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 240 English placeholders across both Afrikaans catalogs while preserving existing translations and source tokens. Check field permissions, import exclusions, notification delivery and workflow completion states. Longer technical wording remains low-confidence pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Six browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 130 English placeholders while preserving existing translations and exact source tokens. Cover permissions, import exclusions, notification delivery and workflow states. Longer Belarusian technical wording remains low-confidence pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; runtime remains unverified on this host.
Thanks to xet7 !
Fill 130 English placeholders, including 20 import-format instructions, while preserving existing translations and exact tokens. Replace the historical completion gate with the full current catalog. Longer Icelandic technical wording remains provisional pending native-speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; runtime execution remains unverified without the app and browser system dependencies.
Thanks to xet7.
Fill 110 English placeholders while preserving existing translations, established Bosnian terminology and exact tokens. Longer technical wording remains provisional pending native-speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; runtime execution remains unverified without the app and browser system dependencies.
Thanks to xet7.
Fill 110 English placeholders while preserving existing translations and exact tokens. Replace the historical completion gate with the full current catalog and verify action meanings. Longer Albanian technical wording remains provisional pending native-speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; runtime execution remains unverified without the app and browser system dependencies.
Thanks to xet7.
Fill 110 English placeholders while preserving existing translations and exact tokens. Check link directions, permissions, import semantics, notification settings and completion states. Longer Latvian technical wording remains provisional pending native-speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; runtime execution remains unverified without the app and browser system dependencies.
Thanks to xet7.
Review 317 long values matching Bulgarian or Serbian: correct 262 wrong-language or meaning-drifted values and retain 55 valid shared terms. Preserve all other values and exact tokens. Update the existing JSON example correction record after translating its Serbian sample prose into Macedonian. Specialized Macedonian wording remains lower confidence pending native-speaker review.
The 306-suite run passed 305 suites and exposed the stale audit record in one. After correcting the record, that suite and the focused audit and Macedonian checks pass on rerun. All 246 catalog inventories and 21 preservation checks pass. Existing browser cases pass syntax and discovery; runtime remains unverified.
Thanks to xet7.
Translate 130 English placeholders and replace 154 reviewed wrong-language or mixed-language values with Macedonian. Preserve all other translations, exact placeholders, parsed constants and markup. Longer Macedonian technical descriptions and legacy corrections have lower confidence pending native-speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; runtime execution remains unverified without the app and browser system dependencies. Record 317 additional cross-locale matches for individual language review rather than treating placeholder completion as fluency.
Thanks to xet7.
Fill 110 English placeholders while preserving existing translations, established Bulgarian terminology and exact tokens. Longer technical wording remains provisional pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; runtime execution remains unverified without the app and browser system dependencies.
Thanks to xet7.
Fill 440 English placeholders across four catalogs, preserving existing translations, established terminology and exact placeholders. Longer technical wording remains provisional pending speaker review.
All 306 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Twelve browser cases pass syntax and discovery; runtime execution remains unverified without the app and browser system dependencies.
Thanks to xet7.
Fill 414 English placeholders across vi and vi-VN, preserving existing translations and exact tokens. Cover imports, linked fields, notifications, Scrum planning and recovery choices. Longer technical wording remains provisional pending speaker review.
All 305 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Six browser cases pass syntax and discovery; runtime execution remains unverified without the app and browser system dependencies. Record the full remaining placeholder inventory, including pending Transifex keys.
Thanks to xet7.
Review the 196-placeholder batch included in e595f9a83b and correct noun forms in 23 newly filled values. Preserve all pre-existing translations. Longer technical wording remains provisional pending speaker review.
All 305 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass; the focused Basque regression passes after corrections. Three browser cases pass syntax and discovery, with runtime execution unverified without the app and browser system dependencies.
Thanks to xet7.
Fill 220 English placeholders across both Galician catalogs while preserving existing translations, placeholders and parsed constants. Longer technical wording is provisional pending speaker review.
All 305 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks pass. Six browser cases pass syntax and discovery; runtime execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Fill 109 English placeholders using reviewed regional forms, preserving existing translations and exact tokens. Retain the native shared Dates label with locale- and source-specific guards. Longer technical and regional wording remains provisional pending speaker review.
Verify 305 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register three browser cases using ca-valencia; syntax and discovery pass, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Fill 218 English placeholders across ca and ca_ES, preserving existing translations and exact tokens. Retain the native shared Dates label with locale- and source-specific guards. Longer technical wording remains provisional pending speaker review.
Verify 305 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register six browser cases; syntax and discovery pass, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
docs/Databases/Supported.md is the one list: FerretDB v1 with SQLite (the
default everywhere), PostgreSQL (works), MySQL, MariaDB and SAP HANA
(experimental), FerretDB 2 (not tested), and MongoDB 6, 7, 8 and 9 - with
what checks each: the 110-query conformance catalogue answers the same on
all of them, and WeKan's own tests run on Meteor's bundled MongoDB 8 and on
FerretDB. It also says what to know about MongoDB versions: the Linux
kernel 6.19-7.0.13 refusal and its fixes, AVX, the driver, and upgrades.
The README and the Status section of CHANGELOG.md gain a Databases list,
docs/Databases/README.md links the page, the Meteor 2.14 compatibility guide
is marked historical, and the conformance page counts 110 cases and the
MongoDB backends. CLAUDE.md and AGENTS.md describe the new Status block.
Thanks to xet7 !
Fill 220 English placeholders across el and el-GR while preserving existing translations and exact tokens. Longer technical wording remains provisional pending speaker review.
Verify 305 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register six browser cases; syntax and discovery pass, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Beside MongoDB 8 and 9, the conformance run that EVERYTHING runs now also
asks the real MongoDB 6 (mongo:6.0) and MongoDB 7 - the mongo:7 image read
from docker-compose-mongodb-v7.yml, the one WeKan's own MongoDB install runs.
All eight agree on all 110 cases: MongoDB 6.0.28, 7.0.43, 8.0.32 and 9.0.2,
and FerretDB on SQLite, PostgreSQL, MySQL and MariaDB.
Thanks to xet7 !
Fill 352 English placeholders across ms and ms-MY while preserving existing translations and exact tokens. Cover current linking, import and notification features plus LDAP and recovery. Longer technical wording remains provisional pending speaker review.
Verify 305 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register six browser cases; syntax and discovery pass, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Fill 176 English placeholders while preserving existing translations and exact tokens. Cover current linking, import and notification features plus LDAP and recovery. Longer technical wording remains provisional pending speaker review.
Verify 305 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register three browser cases; syntax and discovery pass, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
The Upcoming section after v12.26 gets its bug fix and developer-facing
subsections ahead of the translations, a translations subsection header, the
closing line thanking translators, and an In short covering all of it. Long
TODO Later lines are wrapped at 80 columns (whitespace only).
Thanks to xet7 !
The menu checks already matched every entry; these labels existed but did
less than their build.sh twins:
- Mocha runs with --full-app, EMAIL_RECEIPT_SWEEP_INTERVAL_MS, WRITABLE_PATH
and its own METEOR_LOCAL_DIR, and returns its exit status instead of 0.
- `build.bat --run-everything [mode]` works, as `./build.sh --run-everything`.
- The floating-promises guard fails instead of only warning.
- Playwright browsers live in .tools\ms-playwright and a single-browser run
sets WEKAN_PLAYWRIGHT_PROJECT; .tools\.meteor is on PATH.
- CUSTOM PORT + SUBDOMAIN: a bare name is NAME.localhost, the port is
checked, a trailing slash is removed, and the WEKAN_DEV_* overrides work.
- The trace dev server uses the computed heap, not a fixed 8192 MB.
- The Docker image tag is read from the compose file; "Kill all dev
servers" also stops `rspack build --watch`.
- The build sets the same diagnostics (npm verbose, METEOR_PROFILE, module
resolution, the command-output tracer), supports
WEKAN_BUILD_HEAP_SNAPSHOT, and explains an out-of-heap failure.
- Setup installs Node.js and npm at the Dockerfile's NODE_VERSION and
NPM_VERSION. build.sh pinned npm@12.0.2 by hand while the Dockerfile says
12.2.0; it now reads NPM_VERSION too.
tests/buildScriptParity.test.cjs checks each of these in both scripts.
Thanks to xet7 !
Fill 412 English placeholders across ko and ko-KR, preserving existing translations and exact tokens. Cover current linking, import and notification features plus planning and recovery. Longer technical wording remains provisional pending speaker review.
Verify 305 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register six browser cases; syntax and discovery pass, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Fill 206 English entries with hiragana prose and preserve technical literals and tokens. Longer technical wording and spacing remain provisional pending reader review. Record 3641 older kanji or katakana values as script-review candidates, not completed conversion.
Verify 305 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register three browser cases using the ja-Hira runtime tag; syntax and discovery pass, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
releases/db-conformance.sh, which EVERYTHING runs from build.sh and, through
releases/run-everything.sh, from build.bat, now also runs the query catalogue
against the real MongoDB 8 and MongoDB 9 servers (mongo:8.0 and mongo:9.0),
queried directly with no FerretDB in between. All FerretDB backends could
agree with each other and still all be wrong; beside MongoDB they did not:
$group gave every accumulator after the first an empty group, $min/$max took
null as a value, and capped max was not enforced at once - all fixed in
wekan/FerretDB. WeKan's e-mail outbox report, one $group with several
accumulators, was affected on FerretDB.
The $text case now creates the text index MongoDB requires, and records the
score by type only, since FerretDB's score is its own by design. On a Linux
kernel MongoDB refuses (6.19 to 7.0.13), its backend is a SKIP with the
reason, not an error. The run: SQLite, MongoDB 8.0.32, MongoDB 9.0.2,
PostgreSQL, MySQL and MariaDB answer all 110 cases the same.
buildScriptParity: releases/translations/audit-short-prose.mjs is a
read-only review queue, run directly, like audit-progress.mjs.
Thanks to xet7 !
Fill 412 English placeholders across ja and ja-JP, preserving existing translations and exact tokens. Cover current linking, import and notification features plus planning and recovery. Longer technical wording remains provisional pending speaker review. The Hiragana catalog remains a separate script and translation follow-up.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Add five browser cases alongside existing Japanese notification coverage; six cases pass syntax and discovery, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Fill 330 English placeholders across three Russian catalogs while preserving existing translations and exact source tokens. Longer technical wording remains provisional pending speaker review.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Add eight browser cases alongside existing Russian notification coverage; nine cases pass syntax and discovery, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Fill 220 English placeholders across both Ukrainian catalogs while preserving existing translations and exact source tokens. Longer technical wording remains provisional pending speaker review.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Add five browser cases alongside existing Ukrainian notification coverage; six cases pass syntax and discovery, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Fill 110 English placeholders while preserving existing translations and exact source tokens. Longer technical wording remains provisional pending speaker review.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Add two browser cases alongside existing Turkish notification coverage; three cases pass syntax and discovery, but execution remains unverified without the local app and browser dependencies.
Thanks to xet7.
Translate 220 English placeholders across Romanian catalogs and correct two Italian custom-field labels. Preserve other existing translations and exact source tokens. Longer technical wording remains provisional pending speaker review.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register six browser cases, checked by syntax and discovery; execution remains unavailable without the local app and browser dependencies.
Thanks to xet7.
Fill 110 English placeholders while preserving existing translations and exact source tokens. Longer technical wording remains provisional pending speaker review.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register three browser cases, checked by syntax and discovery; execution remains unavailable without the local app and browser dependencies.
Thanks to xet7.
Translate 110 English placeholders and replace 198 Czech or mixed-language values with Slovak. Preserve other existing values and every source token. Longer technical phrasing remains provisional pending speaker review; this is not a full audit of older Slovak text.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Add three browser cases, verified by syntax and discovery only; execution remains unavailable without the local app and browser dependencies.
Thanks to xet7.
Fill 316 English placeholders across Czech catalogs, including 96 regional values reused from existing base Czech translations. Preserve existing translated values and source tokens. Longer technical wording remains provisional pending speaker review.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register and syntax-check six browser cases; browser execution remains unverified without the local app and system dependencies.
Thanks to xet7.
Fill 316 English placeholders across Polish catalogs, including 96 regional values reused from existing base Polish translations. Preserve all existing translated values and source tokens. Longer technical wording remains provisional pending speaker review.
Verify 304 translation/Blockly suites, 246 catalog inventories and 21 human-preference checks. Register and syntax-check six browser cases; browser execution remains unverified without the local app and system dependencies.
Thanks to xet7.
Fill 220 English values across nl and nl-NL. Preserve existing translations, exact source tokens and workflow literals. Extend full-current-fill checks and representative UI coverage for linked cards, imports and notifications.
All 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Six browser cases pass syntax and discovery; execution remains unverified because the local app and browser dependencies are unavailable. Longer technical wording remains provisional pending speaker review.
Thanks to xet7.
Fill 440 English values across pt, pt-BR, pt-PT and pt_PT. Preserve existing translations, exact source tokens and workflow literals. Use European and Brazilian terminology in the corresponding catalogs and extend full-current-fill and regional meaning checks.
All 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Twelve browser cases pass syntax and discovery; execution remains unverified because the local app and browser dependencies are unavailable. Longer technical and regional wording remains provisional pending speaker review.
Thanks to xet7.
Fill 990 English values across nine Spanish catalogs. Preserve existing regional translations, source tokens and parsed constants. Extend full-current-fill and meaning checks for linked cards, imports, notifications and workflows.
All 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Twenty-seven browser cases pass syntax and discovery; execution remains unverified because the local app and browser dependencies are unavailable. New wording uses neutral Spanish; regional style and longer technical wording remain provisional pending speaker review.
Thanks to xet7.
Fill 540 English values across five French catalogs. Preserve existing translations, tokens and parsed constants. Retain Dates and __count__ minutes as correct French with locale-specific exact-source exceptions, and test source changes and locale isolation.
All 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Fifteen representative browser cases pass syntax and discovery; execution remains unverified because the local app and browser dependencies are unavailable. Longer technical and regional wording remains provisional pending speaker review.
Thanks to xet7.
Fill 440 English values across de, de-AT, de-CH and de_DE. Normalize 86 older Swiss German values from ß to ss without otherwise changing their wording. Preserve all other existing translations and exact source placeholders.
All 304 translation/Blockly suites pass; 16 German/Blockly suites pass after spelling corrections. All 246 catalog inventories and 21 preservation checks pass. Twelve browser cases pass syntax and discovery; execution remains unverified because the local app and browser dependencies are unavailable. Longer technical wording remains provisional pending speaker review.
Thanks to xet7.
Fill 110 English placeholders for linked cards, imports, webhooks, notifications and workflows. Preserve existing translations, source tokens and parsed constants. Extend the full-current-fill gate and representative browser coverage.
All 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser scenarios pass syntax and discovery; execution remains unverified because the local app and browser dependencies are unavailable. Longer technical wording remains provisional pending speaker review.
Thanks to xet7.
Fill 110 English placeholders per catalog for linked cards, imports, webhooks, notifications and workflows. Preserve existing translations, exact source tokens and workflow literals; extend full-current-fill and representative UI regression coverage.
All 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Six browser cases pass syntax and discovery; execution remains unverified because the local app and browser dependencies are unavailable. Longer technical wording remains provisional pending speaker review.
Thanks to xet7.
Fill 110 English placeholders per language for linked cards, imports, webhooks, notifications and Wrike workflows. Preserve existing translations, exact source tokens and workflow literals; extend full-current-fill and UI regression coverage.
All 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Six representative browser cases pass syntax and discovery; execution remains unverified because the local app and browser dependencies are unavailable. Longer technical wording remains provisional pending speaker review.
Thanks to xet7.
Fill 227 English placeholders for imports, linked fields, notifications, Scrum planning and recovery. Preserve existing translations, source tokens, external menu names and parsed literals. Extend the full-current-fill gate and representative UI cases.
Longer technical phrasing remains provisional pending speaker review. All 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax and discovery; execution is unverified because the local app and browser dependencies are unavailable.
Thanks to xet7.
Fill 150 English values in 75 catalogs and guard both time labels in all 234 non-English locale paths. Preserve existing translations and exact source tokens. Extend representative notification UI coverage.
Minority-language wording is provisional, especially Acehnese, Aymara, Bambara, Buryat, Cherokee, Chuvash, Dzongkha, Ewe, Fulfulde, Inuktitut, Greenlandic, Konkani, Kashmiri, Ladin, Nahuatl, Aromanian, Sakha, Tigre, Klingon, Tongan, Arabic-script Uzbek, Veps, Volapük, Wolaytta and Tamazight. Record lexical sources and low-confidence wording in the audit.
Validation: 304 translation/Blockly suites, 246 catalog inventories and 21 preservation checks pass. Browser tests pass syntax/discovery only; local app unavailable.
Thanks to xet7.
Fill daily send-time and quiet-hours end labels in 149 JSON files, also covering two existing aliases. Preserve every prior translation and all English variants. Validate the labels against their time-input context and add representative localized UI coverage.
All 304 translation/Blockly suites, 246 catalog key/token inventories and 21 preservation checks pass. Eight browser cases pass syntax/discovery checks; execution remains unverified. Regional phrasing remains provisional, especially Amharic, Khmer, Burmese, Malagasy and Uyghur. Sources and the remaining 75 locale paths are recorded in the translation audit.
Thanks to xet7 !
Fill 112 English values and correct five mixed-Spanish permission and search descriptions. Preserve role limits, source placeholders and all other prior translations. Extend linking, identity mapping and delivery regression coverage.
All 303 translation/Blockly suites pass. After final wording corrections, the three targeted Papiamento/audit suites pass; all 246 catalog inventories and 21 preservation checks pass. Three browser cases pass syntax/discovery checks but remain unexecuted. Longer technical wording remains low confidence pending speaker review; sources are recorded in the audit.
Thanks to xet7 !
Fill 112 English values in each Zulu catalog and clarify one Xhosa import label. Keep existing Zulu translations, source placeholders and Wrike API literals intact. Add link, permission, privacy and identity-substitution regression coverage.
Long Zulu technical sentences remain low confidence; terminology references are recorded in the audit. Broad suites pass 302/303 with Papiamento still incomplete. All 246 catalog inventories and 21 preservation checks pass; targeted Zulu and Xhosa checks pass. Seven localized browser cases are discovered and syntax-checked; execution remains unverified.
Thanks to xet7 !
Fill 224 English values, including short delivery labels, and correct four Xhosa field and swimlane labels. Preserve all other existing values and source placeholders. Extend current-fill, meaning and localized UI coverage.
Specialist vocabulary and longer sentences in both languages remain low confidence; research sources and older terminology work are recorded in the audit. Broad suites pass 301/303 with two remaining untranslated-catalog failures. All 246 catalog inventories and 21 preservation checks pass. Four browser scenarios pass syntax/discovery checks; execution remains unverified without a local app.
Thanks to xet7 !
The v12.26 release stopped in its bump job before anything was published -
no GitHub Release and no tag - so per CLAUDE.md its heading is back to
"# Upcoming WeKan ® release" and the next run takes v12.26 again. The
translation entries written after it, under a second Upcoming section, move
into its Translations group, and the API docs fix is listed under Releases.
Thanks to xet7 !
The bump job of release-all.yml stopped in openapi/generate_openapi.py with
"AttributeError: 'NoneType' object has no attribute 'name'". Notification
delivery builds part of the Boards, Integrations, Settings and Users schemas
with `...deliverySchemaFields('notificationDelivery')`, and the generator
read the key of every schema property, which a spread does not have.
A spread is now documented as one optional object named by the helper's
first string argument - notificationDelivery on all four - and a spread with
no such name is skipped with a warning. The generated spec renders with
@redocly/cli. tests/openapiSchemaSpread.test.cjs runs the whole generator
when a Python with esprima is available, and fails on any schema spread in
models/ that would be left undocumented.
Thanks to xet7 !
Fill 224 English values and correct 12 malformed Lithuanian activity/card labels and 40 Yiddish customization mistranslations. Preserve source tokens, filter examples and correct existing translations. Include At/To in the short-prose audit.
Add current-catalog, semantic and placeholder checks and four localized UI scenarios. Broad suites pass 299/303; four existing untranslated-catalog failures remain. All 246 catalog inventories and 21 preservation checks pass. UI discovery passes; browser execution remains unverified. Yiddish technical compounds and long sentences are low confidence pending speaker review; sources are recorded in the translation audit.
Thanks to xet7 !
Translate 349 remaining values and retain 17 exact physical keyboard legends. Cover the full current catalog and short Blockly prose, and extend planning and recovery UI scenarios to Hawaiian.
Specialist programming, planning and recovery terminology is low confidence. The older malformed-text audit remains open. Translation suites pass 297/302 with five existing untranslated-catalog failures; 21 preservation checks pass. Browser scenarios were discovered and syntax-checked, not executed.
Thanks to xet7 !
Fill 171 English values for mathematics, functions, variables and accessibility controls. Retain source formulas and placeholders and distinguish bounds, return values and screen-reader states in regression coverage.
All 19 targeted suites, 21 preservation checks and 246 catalog token/order checks pass. Browser execution remains unverified. Hawaiian statistical, exponent and programming compounds remain low confidence pending fluent-speaker review.
Thanks to xet7.
Fill 186 English values, including short labels and list aliases omitted from ordinary reports. Preserve existing translations and numbered placeholders. Protect whole translated families and distinctions between getters, removals, copied lists and Boolean comparisons.
All 19 targeted suites, 21 preservation checks and 246 catalog token/order checks pass. Browser execution remains unverified. Hawaiian technical phrasing remains low confidence pending fluent-speaker review; remaining translation work stays open.
Thanks to xet7.
Fill 169 English values while preserving existing translations, source tokens, external commands and import exclusions. Cover notification timing, webhook identity, LDAP, card visibility and Blockly color, loop and editor controls.
All 19 targeted suites and 21 preservation checks pass. Browser scenarios are registered but await a running application. Hawaiian programming compounds and longer technical wording remain low confidence pending speaker review; wider translation work remains open.
Thanks to xet7.
Document the local card-link and import mapping batch, updated pending queue and five existing current-fill test failures. Keep the all-language translation work open.
Thanks to xet7.
Fill 61 English placeholders and repair eight malformed custom-field strings. Preserve source tokens and existing correct-language text. Extend positive, negative and browser regression coverage.
Hawaiian technical compounds and longer sentences remain low confidence pending fluent-speaker review. Targeted and preservation checks pass. The broad run passes 297 of 302 translation suites; five other catalog completion gates expose new untranslated keys. Browser execution awaits a running app.
Thanks to xet7.
At 2.1 MB, GitHub showed "Sorry about that, but we can't show files that
are this big right now" for CHANGELOG.md. GitHub renders Markdown up to
500 KiB, shows only plain text above that, and nothing above about 2 MB;
the July to September archives, 683 KB to 2 MB, were shown as text only.
releases/changelog-archive.mjs now cuts by size instead of by month:
CHANGELOG.md keeps Status, Upcoming and the newest releases that fit in
450,000 bytes (345 KB now, two releases), and the rest move to
old-CHANGELOG/<year>/<MM>.md, a month over the same budget continuing in
<MM>-part2.md and on, whose parts link each other. Every archive part now
renders, except v12.13, one release of 537 KB in a part of its own. No
release section is changed: all 1,225 are where they were, byte for byte.
release-all.sh runs the archive after renaming Upcoming, keeping the newest
release, which release-notes.sh reads. tests/changelogArchive.test.cjs fails
when CHANGELOG.md or a part is over the budget. CLAUDE.md and AGENTS.md
describe the size rule instead of the current month.
Thanks to xet7 !
When too many languages were updated to list - more than 20 - the
Translations group gives "**Languages updated:** 172 languages." and the
release notes say "Updated translations at 172 languages." instead of a list
of one "172 languages" item. A listed language name loses a trailing full
stop. CLAUDE.md and AGENTS.md describe the count, and that a part of the
Upcoming section with nothing to say is left out.
Thanks to xet7 !
releases/release-all.sh stopped when the Upcoming section had no entries, no
**In short:** summary, or a Translations group without its
**Languages updated:** line, and releases/release-notes.sh failed on the
same in the workflow. Now only the "# Upcoming WeKan ® release" heading is
required - it is what becomes the new version. A missing part is a warning,
and the release notes leave it out: no In short section without a summary,
no language list without one (the translators are still thanked), and an
empty section still gets the thanks and the ChangeLog link.
Thanks to xet7 !
The new interface strings of attached cards, linked custom fields, subtask
checkboxes, Calendar Mode and notification delivery are in English in every
locale until they are translated, which lowered the count from 191.
Thanks to xet7 !
One delivery model (models/lib/notificationDelivery.js) for every channel -
e-mail, the notification tray and outgoing webhooks - set in the
Notifications popup at Admin Panel, board and Member Settings scope, and in
each one-way webhook's form:
- Content. Webhooks: the text on or off, and which property groups are sent
(standard, ids, names, links, actor, people, details), with checklist,
list, swimlane and board names, before/after values, the card description
and links added as opt-in groups. E-mail and tray: the classic sentence or
a clear layout - the board as a link first, the actor and card in bold -
and which parts are shown.
- Grouping: one message per event, per card, per board, or all together.
- Scheduling: immediately, every 5 minutes to 24 hours, or once a day, with
optional quiet hours, in the time zone of whoever set it.
The most specific explicit setting wins: member, then board, then Admin
Panel for e-mail and tray; the webhook, then its board, then Admin Panel for
webhooks. A member can only leave their own name out of outgoing webhooks.
The built-in defaults keep today's behaviour. Grouped and scheduled webhooks
and e-mail go through durable queues that survive restarts; queued webhooks
use the SSRF guard and log a blocked address in Admin Panel - Problems.
Values of admin-only custom fields now reach only board admins in e-mail and
tray, and never a webhook.
The new strings are in English in every locale, pending Transifex.
Thanks to HaKePlan, Meeques and xet7 !
Fixes#3695,
Fixes#5171.
From a card's Custom Fields menu, "Link fields to another card" links it to
another card by a pasted card link or a title search, both ways or one way
(this card sends to a main card). Fields match by name and type; a dropdown
value is carried by its item name, a multi-select only when the other field
has every item, and fields on one card only (such as Remarks) stay there.
Linking fills only the other card's empty matching fields once.
A link is held on both cards and counts only when both sides match. Linking
needs read and edit rights on both cards; a card the user cannot read is "not
found". A carried value is written as the link's creator, recorded in
Activities and History, and only while that user may still read and edit both
cards; admin-only fields never take part. A loop guard stops echoes and rings,
with a depth limit and a write budget per change. A copied, imported or
restored card starts unlinked, a deleted card's links are removed from the
others, and a direct client write of the links is refused and trips a canary.
The new strings are in English in every locale, pending Transifex.
Thanks to MarcusDger and xet7 !
Fixes#5681.
Each subtask row has a checkbox that marks the subtask card complete
(dueComplete, the card's own "Mark as complete"), and the Subtasks heading
shows "Subtasks (1/3)". A subtask is done when it is marked complete or
archived, which the minicard's subtask badge and "Hide completed subtasks"
now also count.
The setSubtaskDone method checks the edit right on the subtask itself, which
may be on another board; comment-only, read-only, worker and non-members are
refused, an assigned-only member may tick only a subtask assigned to them,
and an archived subtask is refused. The change is recorded in the subtask's
History like the card details toggle.
The new strings are in English in every locale, pending Transifex.
Thanks to zhoujunhaohao and xet7 !
Fixes#4693.
The attach-card work left four node suites failing: the Attach card popup had
no attachCardPopup-title, so it rendered with no header and no close button;
its submit button was missing from the menu action inventory; the new
attachedCardIds card field had no email content disposition; and a comment
carried a full Trello URL, which the release URL audit reports as a new
origin. The title is added in English to every locale, pending Transifex.
Thanks to xet7 !
The users schema stored profile.keyboardShortcuts: false for every new user,
while isKeyboardShortcuts() treats a missing value as on (keyboard shortcuts
are on by default). So a new account had shortcuts off until it turned them
off and on again. The schema default is now true, and a test pins every
profile boolean's schema default to the default its helper reads.
With no card opened, d on a hovered or selected minicard - the card the other
card shortcuts act on - now opens that card and its Due date editor, instead
of doing nothing until the card was opened. A card the user may not edit is
not opened, and nothing happens with shortcuts off.
Thanks to mimZD and xet7 !
Fixes#6755.
What the open issues ask for, what the code does today (and the defects
found reading it), how other software manages groups and syncs them from
LDAP, SAML, OIDC and SCIM, and options for WeKan, with the decisions left
open for the maintainer.
Thanks to xet7 !
The ring drawn in the day button's own text colour was hard to see on themes
whose day buttons are already a strong colour, such as wisteria's purple.
Today now has its own fill, green with white text, forced over every theme
(the custom theme colour sets the buttons' background with !important), with
a white inset ring and the underline kept for colour-blind users. A day that
is both today and selected keeps a visible green outline.
Thanks to mimZD and xet7 !
Fixes#6751.
Calendar Mode shows each card on the day it is due - the date only, no
time - with its labels in their colours and its whole title over as many
lines as it needs, and the cards of a day in the board's own order: by
their list's place, then their place in the list. A month or a week,
starting on the user's first day of the week, with Today, Previous and
Next; the board Filter applies, as on Calendar, and a card opens beside
the calendar. The grid and the day's order are models/lib/calendarMode.js.
A board that saved its Board View order before this view existed still
has the default order, with Calendar Mode in its place and the menu's
separators: a saved order that lacks only views added later
(VIEWS_ADDED_LATER) is the default order of its time. Any other saved
order is the user's own, and the new view goes at its end, as before.
Tests: tests/calendarMode.test.cjs (the month and week grid, the first
day of the week, the day's order, cards without a due date, the wiring),
tests/boardViewSettings.test.cjs (an order saved before Calendar Mode, and
a custom one), tests/boardViewMenu.test.cjs and
tests/playwright/specs/calendar-mode.e2e.js (the menu entry below
Calendar, labels and order on today's cell, Week, opening a card).
Thanks to tripledee and xet7 !
Fixes#3194.
A card can now have other cards attached to it, beside its files. In the
card's Attachments, + offers "Attach card": type part of a card title on
this board and pick it, or paste a card link (Copy card link gives one) to a
card on any board you can read. An attached card shows its title, board and
list, opens that card, and can be removed again.
- Data: cards.attachedCardIds, the attached cards' ids, at most 100
(models/lib/attachedCards.js).
- Methods (server/models/attachedCards.js): attachCardToCard and
detachCardFromCard need the right to edit the card, and only a card the
user can read can be attached - its board's read rule and, for an
assigned-only member, a card assigned to them. Any other is refused as
"not found", the same as a card that does not exist. attachedCardsInfo
shows an attached card's title only to a viewer who can read it; anybody
else sees that one is there.
- Trello import: an attachment that links to a Trello card of the same
export becomes an attached card; a link to a card of another board stays
in the description under Links, as attached links always did.
- WeKan import: attached cards follow the cards that came in the same
export to their new ids; the rest are dropped.
Tests: tests/attachedCards.test.cjs (the module, the permission rules and
the wiring), server/lib/tests/attachedCards.tests.js (attaching across
boards, refusing unreadable and assigned-only cards, a non-editor, and
hiding what a viewer cannot read) and tests/playwright/specs/attached-cards.e2e.js
(attach by title, refuse a hidden card, open, remove; and a Trello import).
Docs: docs/Features/Cards/Attachments/Attached-Cards.md.
Thanks to ricardoboss and xet7 !
Fixes#3257.
CodeQL alert 560 (incomplete string escaping) was
tests/scrumViewHelpers.test.cjs putting a helper name into a regular
expression with only "$" escaped, leaving the backslash and every other
special character as syntax. It now escapes all of them.
tests/incompleteEscaping.test.cjs finds the shape in every WeKan source and
test file: a backslash escape of some character in an expression that does
not also escape the backslash itself, including inside a template literal's
interpolation, where this one was. It catches the old line and the earlier
Plane link title of alert 555, and passes the complete escapes of the iCal,
PDF, file-name and card-link code.
Thanks to GitHub CodeQL and xet7 !
@wekanteam/exceljs 4.7.4, with the streaming writer fix, is carried in
npm-packages/exceljs, so the card and board Excel exports stream and the
last place of #6745's list of big data held in memory is done. The list is
removed from TODO Later, and the Upcoming entry of the Excel change says the
release is installed.
Thanks to markusst1982 and xet7 !
SAML logs in by full-page redirect by default since the popup was found to
be blocked in iframes and on some phones; SAML_LOGIN_FLOW=popup still
chooses the popup. The test of the popup flow never asked for it, so
loginWithSaml navigated its own page away and the test lost its context.
It now saves loginFlow popup and waits for the client to have it;
tests/samlPopupErrors checks every spec driving the real popup does so.
Thanks to xet7 !
- A card put into a release created after the card fields had cached the
board's sprint and release names showed "Release:" with no name: saving a
sprint or release does not change the board's revision the cache is keyed
by. A shown record that names an ID the cache does not have now asks
again, at most once per 30 s per set of missing IDs (models/lib/scrum.js
unknownScrumNameIds).
- Importing Scrum planning into an existing board never showed its preview,
and the Scrum import report showed every loss line empty: their helpers
were registered on scrumReportTable instead of scrumView, which draws
them. The preview also read its counts through scrumView's own helpers of
the same names, and the import's refresh closed the panel before its
result was seen; both are fixed.
tests/scrumViewHelpers.test.cjs checks every Scrum template registers the
helpers its own markup uses.
Thanks to xet7 !
- A person seen first without a name - Taiga's story owner, given as an
e-mail address - kept the address as the placeholder's name although a
comment of theirs named them; a later name now replaces a name that is
only the key, never a real one (tests/importMembersMode).
- The import browser tests still expected a comment by a file's person to
read "name: text". Since every import asks who the people become, the
default makes a placeholder user for them, and the comment is theirs with
the text as written: the tests now check the text and that its author is
a placeholder with that name who cannot log in. The placeholder test no
longer asserts an account isActive the users schema does not store; its
board membership is the inactive part, as before.
- The ClickUp test's CSV left a cell holding a comma unquoted, which ClickUp
and WeKan's own export quote; it moved every later column. The Planner
test now matches "Task 2" exactly, not Task 20 to Task 29 too.
Thanks to xet7 !
The export boundary passed every finished export through the HTML
sanitizer. A text document of a format's own - OPML, Leo's XML, Markdown,
CSV - is that format's syntax, not HTML: OPML keeps a card's title in
<outline text="...">, so its export held only the board's name, every such
export logged its own tags as unsafe markup, and a whole board was held to
the size of one string. A JSON export is checked as before; a text one is
made again from the cards and the board's, lists' and swimlanes' titles
passed through the boundary.
Thanks to xet7 !
- Meteor-Files 3's addFile is async - addFile(path, opts, proceedAfterUpload)
returning the file - and takes no callback. addAttachmentFromStream passed
one as its third argument, which was never called, so every streamed
attachment waited forever: a WeKan or Trello .zip import, a board clone, a
REST raw upload and a storage move stopped at their first file. It now
awaits the promise, as copyFile does; tests/importAttachmentStream checks
that no code hands addFile a callback.
- TrelloCreator rebuilt each attachment from a fixed list of fields that
left out the zip entry the .zip route had matched it to, so every
attachment fell back to downloading its Trello URL, which needs Trello's
own login, and none arrived. The entry and size are kept now
(tests/zipBombBleed); a board that fails in a .zip import is also logged.
- A file record without versions made the file route throw "reading
'original'" and answer 500; it is a missing file, answered 404.
Thanks to xet7 !
- The Planner, Wrike, monday.com, Teamwork.com and Businessmap exports
answered 500. The shared renderer required each workbook writer through a
variable, require(path), which the bundler cannot resolve; each is now a
literal require. tests/exportAllBoards checks that no server or model file
requires a module by an expression, and the format tests pin the new form.
- Export all boards was a row of the All Boards sidebar's home view only,
which nothing on the page opens since All Boards lost its hamburger: it was
reachable only through Search and the back arrow. It is now a button in
the page's own header bar, beside Search, opening the same popup.
Thanks to xet7 !
The board canvas fills its wrapper from the top, so it lay over the
announcement banner above it, and its swimlane header took the clicks
meant for the banner's close button - nobody could dismiss an
announcement. While a banner shows, the wrapper is now a column: the
banner, then the canvas taking the rest; without one nothing changes.
The browser test checks that the close button is the element at its own
place and that the board starts below the banner, then dismisses it.
Thanks to xet7 !
At x=30 the label of a script with tall or wide glyphs - Bhojpuri, Tibetan,
Cherokee, Inuktitut, Kashmiri and eight more - covered the click point, and
Firefox gave the right-click to the text, so the context menu test timed out
in those 13 locales in Firefox only. The click is now inside the block, left
of where Blockly draws its label; all 13 pass in Firefox.
Thanks to xet7 !
Since the board view is remembered per board (#4906, #4256), a view chosen
on a board is saved in profile.boardViews[boardId], not in the shared
profile.boardView. The two Playwright specs still waited for the shared
value, so both timed out in every browser although the view was saved. They
now read the board's own entry.
Thanks to xet7 !
Importing Scrum planning into an existing board reported every card of the
file's own source board that had no match on the target as belonging to
another board, so "card-not-matched" was all but unreachable for the usual
board-to-board transfer and the server test of the import failed. The
lookup for cards of other boards now leaves out the file's own board; a
card of a third board named in the file is still reported as another
board's and never written.
Thanks to xet7 !
Since #1759 a card copied or moved to another board brings its labels: a
label that board lacks is created there when the actor is its admin. The
stored (durable) rule copyCard, move to another board and move-all onto
another board still matched by name only and dropped the rest, so the
durable copy or move was no longer the ordinary one - the parity three
server tests check - and the card lost a label a direct copy would keep.
The durable plans now use the same planCrossBoardLabels with the rule's
actor. The labels to create are saved in the command (copy) or move
(single move, and each move-all unit), so a replay creates nothing twice:
each is pushed only when no label with its id is on that board yet, before
the card that names it is written. In a move-all, a label created for one
card is that board's label for the next, as when Card.move moves them one
by one. Commands saved before this, without the labels, still validate.
The server tests now expect the created label, once across a replay, and
the ordinary copy or move finding it; the card-move test gains the negative
of a mover who is not the new board's admin, where the label is dropped and
its activity removed. The command tests cover the new field, its validation
and an older command without it.
Thanks to xet7 !
- Dockerfile METEOR_RELEASE and the snapcraft description named Meteor
3.6-beta.3 and 3.6-beta.1 after .meteor/release moved to 3.6-rc.0, which
tests/releaseVersionConsistency and tests/websiteVersionInfo refuse.
- package-lock.json gained eight npm funding and deprecation links with the
@wekanteam packages now in npm-packages; they are metadata nothing fetches,
allowed for that file only and exactly in releases/risk-baseline.json, as
the earlier funding links are.
- tests/titleClickToEdit read the viewer's link handler in fixed 1,000 and
1,200 character windows; the #6753 branches at its top pushed the lines
past them. It now reads the handler's own body: a card link is routed
before window.open, and the click is stopped after it.
Thanks to xet7 !
CodeQL alert 559 (incomplete string escaping) was
tests/securityAlerts20261010.test.cjs re-running the escaping fixed for
alert 555, to show it let a URL end a link early. The test now holds the
Markdown the old code wrote, written out, and still checks that it renders
as two links. The check that no code escapes links that way now reads
tests/ as well as models, server, client and imports, and finds the old
line.
Thanks to GitHub CodeQL and xet7 !
The copy button of a code block is an <a href="#"> inside the card viewer.
Its own listener copied the text and prevented the navigation, but the click
went on to the viewer's 'click a' handler, which opens every link it sees in
a new tab - here this page plus "#". The button now stops the click, and the
viewer handler leaves the copy button alone and no longer opens a link to a
place on the page ("#", "#section") in a new tab; it moves to the target in
place when there is one.
tests/copyCodeBlock.test.cjs pins both and their order before window.open;
tests/playwright/specs/viewer-copy-code.e2e.js clicks the button and checks
that no tab opens, the page stays and the block's text is copied.
Thanks to carl-unique and xet7 !
Fixes#6753.
- Markdown links from imported files (CodeQL #555): Plane escaped [ and ]
in a link title but not backslash, so a title ending in "\" ran on into
the URL, and its URL went through encodeURIComponent, which leaves ( and )
as they are, so a ")" ended the link early and the rest became a second
link. ClickUp, Super Productivity and Vikunja wrote links the same way.
All four now use models/lib/markdownLink.js, which escapes the title and
percent-encodes what ends or breaks a destination.
- A replacement of a space with itself in a test (CodeQL #554), where a
regular-expression escape was meant. tests/noIdentityReplacement.test.cjs
now also finds the regular-expression form of an identity replacement.
- The vendored @wekanteam/exceljs (CodeQL #556-#558, Dependabot #137-#142):
sheet names are read without a backtracking regular expression, the
manual test pages pin their CDN script with Subresource Integrity, and
brace-expansion is 5.0.12. Same change as the fork, .tools/exceljs
25db789. The vendored jade's dev tools also had brace-expansion 5.0.6.
tests/securityAlerts20261010.test.cjs pins each, and the shape of each
across the tree.
Thanks to GitHub CodeQL, dependabot and xet7 !
The card Excel export, and the board export drawn in the card layout, read
every picture of the card or board into memory while drawing the sheet and
wrote the whole workbook at the end. They now write through
createWorkbookWriter to the response, and the board export writes each card's
rows out once the card is drawn. With the @wekanteam/exceljs fork's streaming
writer (.tools/exceljs: archiver 8 support and pictures on a streaming sheet)
each picture is a function the writer calls when it reaches it, so one is open
at a time and a picture that cannot be read is written empty rather than
ending the download. The fork is recognised by WorkbookWriter._addDrawing;
until a release with it is installed, these exports take the buffered writer
as before. A failure after the first byte now ends the download instead of
leaving it waiting.
Thanks to markusst1982 and xet7 !
The card and board PDF exports read every picture of the card or board into
memory before making the document, then built the whole PDF in memory too.
Each picture is now a loader: the Unicode PDF writer reads it when it draws
its row and hands it to PDFKit, which embeds it and lets the bytes go, so
one picture is in memory at a time. The document is written to a temporary
file as it is made and sent from there with its length, so it is not held
in memory either, and the base-font fallback still takes over when the
Unicode PDF fails - reading the pictures only then. Removed from TODO Later;
the Excel half stays there with what blocks it.
Thanks to markusst1982 and xet7 !
The attachment REST API carried every file as base64 inside JSON: an upload
gathered the whole body into a string, decoded it and stored it, and a
download read the whole file and encoded it - the file and its base64 copy
in memory at once, up to the API limits. Beside that form, each route now
takes the file itself: an upload whose body is the file (any Content-Type
but JSON, its card or board in the query) streams into storage, and
?raw=1 on a download streams the file out, served as a download that
cannot run in WeKan's origin. Both make the same checks first - one helper
now holds the card upload checks for both forms - and the API limits are
checked against Content-Length before reading and counted as the bytes flow.
api.py uses the raw form for its four attachment and background commands,
streaming from and to disk. The DDP methods stay base64 by their nature;
docs/API/Attachments.md says to use the raw routes for large files.
Removed from TODO Later.
Thanks to markusst1982 and xet7 !
Admin Panel > Attachments > Move read each file whole into memory: out of
CollectionFS it gathered the GridFS download into one Buffer and wrote it
with writeFileSync, into CollectionFS it read the source storage whole and
then uploaded it. Both now pipe: the GridFS download stream into the new
file, and the storage's read stream into the GridFS upload, chunk by chunk.
A copy that fails leaves no half file, and a missing binary still names the
attachment. Removed from TODO Later.
Thanks to markusst1982 and xet7 !
The live Trello import, and a Trello .json import with saved credentials,
downloaded every uploaded attachment of the board first - each read whole,
up to 256 MB - and kept them all on the board as base64 until it was made.
TrelloCreator now gets a streamer: each attachment is downloaded when the
creator reaches it and streamed into storage, one at a time. The download is
the same - the URL check, the credential only for Trello's own hosts, every
redirect validated and pinned - through fetchSafe's new stream mode, which
hands the body on as a stream with the same byte limit counted as it flows.
Removed from TODO Later.
Thanks to markusst1982 and xet7 !
Cloning built the board's whole export with every attachment as base64 and
imported that. The export is now built without file data, and the importer
streams each attachment from the source board's own storage as it reaches
it, held to the upload limit like every imported attachment. Removed from
TODO Later.
Thanks to markusst1982 and xet7 !
Every board was built whole - every attachment as base64 inside it - then
serialized and added to the .zip. Each board is now written into its entry
piece by piece by the streaming exporter the single board export uses, with
attachments as base64 in aligned chunks, paced by the response's
backpressure, so memory holds a chunk at a time instead of a board. Removed
from TODO Later.
Thanks to markusst1982 and xet7 !
The route read the whole upload into memory, up to its 200 MB cap, opened the
zip from that buffer, and read each attachment whole, up to 100 MB, to put
it on the board JSON as base64. The upload is now written to a temporary
file as it arrives, under the same cap, the zip is opened from the file, and
each attachment streams from its entry into storage through TrelloCreator,
counted against the same per-file limit and the same 1 GB budget of
everything inflated (server/lib/boundedZipEntry.js boundedZipEntryStream).
Only the board JSON files are held in memory. The .zip import takes the
people choice too. Removed from TODO Later.
Thanks to markusst1982 and xet7 !
On a seeded board of 4,000 cards, 12,000 comments, 20,000 checklist items
and 32,000 activities, served from FerretDB with SQLite as the Snap is:
closing a card took about 4 s and now takes 0.1 s, the board finished
loading in 17.6 s and now in 6.2 s, a card open re-ran about 7,700
computations and now about 1,000, and FerretDB used 13 s of CPU and 724 MB
while the board opened, now 3 s and 280 MB.
- The client data cache queued one more stop callback each time a helper
re-ran, and every check asked Tracker for dependents, which on close was
710 walks of 3 ms; there is now one callback per computation and key and
one timer per key (imports/lib/dataCache.js).
- Opening a card writes the user's last-viewed card, and avatars, @mentions,
list and swimlane headers read the whole user, so everything re-ran; they
read only the fields they show. The comment, checklist and subtask indexes
were one object every minicard depended on and are now per card
(imports/lib/keyedGroupIndex.js).
- The lazy card window kept a full copy of every card of a list per window;
it keeps the id and the sort keys, runs its id query once instead of five
times, and sends comment text only when minicards show comments
(server/publications/cardsWindow.js, models/lib/cardWindowFields.js).
Comment reactions and legacy attachment lookups come with the opened card
only.
- Attachment downloads honour Range for filesystem, GridFS and cloud
storage (206, 416, If-Range); uploads to cloud storage are spooled to a
temporary file and streamed instead of gathered into one Buffer; the API
copy checks the size limit before reading; the legacy attachment
migration streams, and no longer stores "[object Promise]" as a file; the
board export no longer concatenates buffers quadratically.
The FerretDB fork pushes dotted-path filters such as meta.cardId down to
SQLite (they were each a full scan) and decodes only the fields a count
filters on. docs/Features/Admin-Panel/Problems/Large-Boards.md describes how
a large board loads and how to size a server with 8 GB of RAM.
Thanks to markusst1982 and xet7 !
Fixes#6745.
models/lib/importSources.js describes every import source once: its name,
which files its chooser accepts, whether its export can be pasted, what a
file is sent as, whether a .zip is one export of the tool, and which
importer creates the board. The import page's list of sources, its file
chooser and its text box, "Import many boards" and the test of api.py's
lists all read it.
The page had a branch per source - one each for Excel and the four other
workbook tools, Vikunja, Notion, Plane, the text formats, CSV, Trello's and
WeKan's files - each reading its file its own way, and four file choosers.
It now has one: the chosen file is read by the reader "Import many boards"
uses, or the pasted text is read, then only the steps a source really has of
its own run (the column mapping of CSV and Excel, the empty-export check of
WeKan, Jira's estimate field, Trello's workspace, Taiga's slimming), then the
people step every source shares. Kanboard's people come from the server's
parser like every generalized source's, so its own client mapper is gone.
Every source can now be chosen as a file, not only pasted.
Thanks to xet7 !
A CSV, TSV or Excel import now shows which column is which card field
before importing, pre-filled from the header names - English names and
WeKan's own export column names in every language - and asks for what is
missing: a file with no list column gets one list, named on the page,
instead of one list per row. Unused columns can be kept as text custom
fields. The choice goes to the server as csvMapping, checked before
anything is written, and the REST import and api.py take one too.
The Owner column is applied, as are swimlane, received date, parent card,
spent time, overtime and archived. A TSV value containing a comma stays one
value. A dropdown custom field value that is not one of its items is skipped
instead of failing the import.
An Excel workbook is read sheet by sheet, its header found in row 1 or where
WeKan's export puts it, in any language; formula cells are read as their
results and rich text as text. WeKan's own Excel export imports, and a
workbook with many boards - each on its own sheet, as Export all boards
writes it - imports as many boards; the Activity sheet is skipped.
Thanks to xet7 !
Kanboard task links were only reported as losses. They now become WeKan
data: "is a child of" and "is a parent of" make the parent card, and blocks,
is blocked by, duplicates, is duplicated by, fixes, is fixed by and relates
to make dependencies of the matching type; the milestone pair becomes
related-to and is reported. Kanboard stores each link from both tasks, so
the two rows of one link become one parent link or one dependency. Rows from
getAllTaskLinks, getTaskLinkById and links grouped by label are read; an
unknown label, a link to a task not in the file and a second parent are
reported. The Kanboard export writes parents and dependencies back as task
links from both ends, so the file round-trips. The docs no longer claim typed
custom fields for Kanboard, which has none.
GitHub, Gitea and Forgejo issues put their embedded comments into the card
description; each now becomes a card comment with its author and date, and
the description is left as the issue wrote it. A comment without text, and
comments counted on the issue but not embedded, are reported.
The Jira instruction's endpoint literal is the current search
(GET /rest/api/3/search/jql) in every locale too, as code literals are copied
from English; the translation suites that pinned the old one follow.
Thanks to xet7 !
Every import page now asks once what the people named in the file become
(models/lib/importMembersMode.js): existing users chosen in the map-members
step, placeholder users that keep the original username and name and cannot
log in, to be mapped to real users later, or all the person importing. All
five creators read the same mapping. The generalized importer, which used to
drop people nobody mapped, now makes placeholders for them, as Trello and
WeKan imports do, and offers its people for mapping by reading the file with
the same parser (importBoard with previewPeople, which creates nothing).
Import many boards offers placeholders or the importer. The REST import, the
WeKan .zip route and the Trello route take the mode too.
A WeKan .zip imported as a new board no longer puts its attachment files
inline in memory within a 512 MB budget: the full-board importer streams each
from the archive into storage, as the import into an existing board does.
Both, and the Trello importer when given a stream, go through one helper
(server/lib/importAttachmentStream.js) that holds every imported attachment
to the Admin Panel's upload limit and to none when none is set, skipping a
file whose stated size is over it and stopping one that grows past it.
The import page instructions name Jira's current search (GET
/rest/api/3/search/jql with fields=*all, paged by nextPageToken), Todoist's
Manage data > Export as CSV and Planner's Export as Excel.
Thanks to xet7 !
Import many boards: on the import page of every source, several export
files, or one .zip holding them, each become their own board through the
same path a single import of that file takes, and the page lists what each
file became (models/lib/importManyFiles.js). A .zip that is itself one
export (Vikunja, Notion, Plane, WeKan with attachments) stays one board.
One board per project: for the generalized importer, each swimlane the
import would make - a project, folder or list of the tool - becomes its own
board (models/lib/importSplit.js), so an export of a whole app imports as
many boards, as a Trello .zip does. Kanri's all-data export now reads every
board, not only the first, so it splits into one board per Kanri board.
Export all boards: All Boards sidebar, or Multi-Selection for the selected
boards, downloads every board the user may export in one format, each
checked as its own export is. Excel is one workbook with a sheet per board,
named after the board; every other format is a .zip with one file per board
(server/routes/exportAllBoards.js). The per-format bytes are made in one
place, server/lib/renderExternalExport.js, for the board route and this.
A WeKan .zip export imports as a new board from All Boards, unpacked on the
server with its attachments (it was refused in the browser). api.py gains
importboardsfrom and exportallboards, sends every source in the shape the
import page sends, and fetches Excel, PDF, CSV and TSV exports from their
own routes and writes them as bytes.
Fixed while documenting: a Trello Butler rule's list name kept its case,
so the rule fires; the HTML export fetches the board JSON by URL instead of
a link the export popup no longer has; Tasks.org exports time spent;
Nextcloud Deck's done flag marks the due date done.
docs/Features/ImportExport has a directory per format with the steps to
import and export it, one board and many, and its details, moved from
Format-Coverage.md, which is now the index and the shared contract.
tests/importExportDocsCoverage.test.cjs fails when a format has no page.
Thanks to xet7 !
The Wrike entry no longer says its export writes a WeKan list column, and two
entries describe Wrike's custom workflow statuses and workflows, and the page
that lists every supported format.
Thanks to xet7 !
docs/Features/ImportExport/External-Tools.md listed ten tools while WeKan
reads and writes more than fifty. It now lists every tool and file, grouped
into project and task tools, issue trackers, plain text and outlines, and
WeKan's own formats: where in each tool to get the file, what WeKan writes
back, and which tools are not supported yet and why. The README's import and
export lists link to it and name the Wrike workflow, the Board Settings
export page points to it and to the Wrike workflow, and the historical
wishes in Sync.md say which have been done since.
tests/importExportDocsCoverage.test.cjs fails when a source on the import
page or a format in the export menu is missing from the page, so it cannot
go stale again.
Thanks to xet7 !
The Wrike Excel export wrote the WeKan list as a custom column named WeKan
list, which Wrike reads as a custom field rather than a status. It now
writes the five workflow columns of Wrike's import help article: Default
task workflow on folder rows, and on task rows Workflow (named after the
board), Status (the list's status group) and Custom Status (the list).
Wrike applies a custom status only when that workflow exists, matching
case, so the board's lists are also exported as that workflow: the JSON of
Wrike's GET /workflows, one custom status per list with the nearest Wrike
color. That JSON is the only exchange format, since Wrike has no file
import or export of workflows.
A list's status group comes from the board's rules. A "moved to this list,
mark complete" rule makes it Completed (Cancelled when its name says so), a
"mark incomplete" rule makes it Active (or Deferred), otherwise the name
decides. In Rules > Import / Export, a pasted Wrike workflow adds a list for
each status the board lacks, after the previous status's list, and adds the
rules that do what Wrike's status groups do. Those rules show in the list,
Workflow and Blocks views. A server method does this as a board admin and
adds nothing twice. Wrike's own automation rules have no export, import or
API, so they cannot be carried over.
The Wrike import reads Custom Status as the list and a single Workflow as
the board title. It reports a status group the status name does not imply,
since only the workflow import's rules keep it.
tests/wrikeWorkflow.test.cjs and tests/wrikeFormat.test.cjs cover the
workflow, rules, colors, refusals and round trips. Two new Playwright cases
import a workbook with the workflow columns and apply a Wrike workflow
through the Rules popup twice, and the export audit fetches the workflow.
New text is in English, pending Transifex.
Thanks to xet7 !
Update measured README coverage to 191 and protect the full current Xhosa fill. All 333 translation-related suites pass; the new completion gate also passes separately. Remaining language-quality and translation work stays open.
Fill the final seven import instructions, preserving header requirements, hierarchy markers and exclusions. The current fill list is empty. Specialized wording remains low confidence pending speaker review. Three targeted suites and all 21 preservation checks pass.
Fill nine instructions preserving commands, first-board limits, completion dates and attachment exclusions. Specialized wording remains low confidence pending speaker review. Three targeted suites and all 21 preservation checks pass.
Fill eight instructions preserving export commands, field names, tokens and mappings. Specialized wording remains low confidence pending speaker review. Three targeted suites and all 21 preservation checks pass.
Fill 40 messages preserving variables, keyboard labels, screen-reader states and navigation distinctions. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 35 messages preserving function variables, keyboard labels, output distinctions and placement warnings. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 30 messages with regression checks for notation, rounding directions and degrees-versus-radians instructions. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 35 messages preserving variables, sign distinctions and random bounds. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 30 messages with regression checks for variables, mathematical constants, bounds and logical distinctions. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 35 messages with regression checks for sort variables, copy semantics, insertion and comparison distinctions. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 40 messages with regression checks for variables, return/remove distinctions and copy semantics. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 40 messages with regression checks for variables, coordinate names, list semantics and consistent positions. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 40 messages with regression checks for variables, keyboard help and distinct actions and positions. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 45 messages with regression checks for variables, conditions, keyboard labels and rendered coordinates. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 35 messages, preserving variables and deletion and rollback warnings. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 40 messages with regression checks for variables, cancellation, discard consequences and record limits. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 35 messages with regression checks for estimate clearing, planning restrictions, report access and retry warnings. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Fill 24 messages and retain report limits, hidden-value scope and partial-failure warnings in regression checks. Specialized wording remains low confidence pending speaker review. Both targeted suites and all 21 preservation checks pass.
Localize keyboard labels while retaining printed legends, correct the monday.com possessive and verify both fill lists are empty. The broad run found a stale README count; update it to 190 and verify the failing suite passes. Language review and broader translation work remain outstanding.
Fill seven instructions per catalog and preserve commands, columns and hierarchy markers. Test header requirements and excluded data. Specialized terminology remains low confidence pending speaker review. Three targeted suites and 21 preservation checks pass.
Fill nine instructions per catalog with exact commands and formats. Test first-board selection, archives and attachment exclusions. Specialized terminology remains low confidence pending speaker review. Three targeted suites and 21 preservation checks pass.
Fill eight import instructions per catalog, preserving commands and formats. Test completion, archive and swimlane behavior. Specialized terminology remains low confidence pending speaker review. Three targeted suites and 21 preservation checks pass.
Fill 25 messages per catalog and preserve counts and stage variables. Test replayability, applied-change preservation and deletion warnings. Specialized terminology remains low confidence pending speaker review. Targeted suites and 21 preservation checks pass.
Fill 25 messages per catalog and preserve progress variables. Test cancellation, pending work and already-applied-change guarantees. Specialized terminology remains low confidence pending speaker review. Targeted suites and 21 preservation checks pass.
Fill 30 values per catalog and test retention limits, incomplete runs, permissions and null semantics. Specialized terminology remains low confidence pending speaker review. Targeted suites and 21 preservation checks pass.
Fill 25 messages per catalog and check preservation guarantees, replacement reuse and preview limits. Specialized terminology remains low confidence pending speaker review. Both targeted suites and 21 preservation checks pass.
Fill 50 messages per catalog and preserve summary variables. Test unknown estimates, partial reports, rollover and cancellation behavior. Specialized terminology remains low confidence pending speaker review. Both targeted suites and 21 preservation checks pass.
Fill 27 values per catalog with exact variables and function symbols. Test statistical distinctions, coordinates, logarithm base and angle units. Specialized terminology remains low confidence pending speaker review. Targeted suites and 21 preservation checks pass.
Fill 26 values per catalog, preserving mathematical constants and formulas. Test parity, rounding and sign distinctions. Specialized terms remain low confidence pending speaker review; root and prime vocabulary follows the government mathematics dictionary. Targeted suites and 21 preservation checks pass.
Fill 51 labels per catalog and preserve numbered variables. Test paired input distinctions, coordinates and rendered input numbers. Specialized terminology remains low confidence pending speaker review. Both targeted suites and 21 preservation checks pass.
Fill 58 strings per catalog and preserve variables, shortcuts and joined phrase spacing. Verify rendered name conflicts, workspace counts and conditional labels. Specialized terminology remains low confidence pending speaker review. Targeted suites and 21 preservation checks pass.
Fill 24 strings per catalog and verify function output, disabled definitions and variable substitutions. Specialized terms remain low confidence pending speaker review. The preceding broad run passed 333 suites; targeted suites and 21 preservation checks pass after this batch.
Fill 59 strings per Zulu catalog and preserve variables and mathematical symbols. Verify logic distinctions, bounds and rendered substitutions. Specialized terminology remains low confidence pending speaker review. Both targeted suites and 21 preservation checks pass.
Fill 50 English values per Zulu catalog. Preserve variables and test rendered deletion and pixel labels plus true/false loop distinctions. Specialized programming terms remain low confidence pending speaker review. Targeted suites and 21 preservation checks pass.
Fill 52 English strings in each Zulu catalog and test variables, rendered substitutions and restrictions. Specialized programming terms are low confidence and need speaker review. Both targeted suites and 21 preservation checks pass.
Translate the 21 newer import instructions while preserving commands, column names and variables. Verify excluded data, first-board selection and task hierarchy. Import and placeholder suites and 21 preservation checks pass.
Preserve commands, columns and variables while translating seven instructions. Cover excluded data, English headers and task hierarchy. Import and placeholder suites and all 21 preservation checks pass; the current fill list is empty.
Preserve commands, extensions and variables while translating six instructions. Cover excluded attachments, completion dates, archives and comments. Import and placeholder suites and all 21 preservation checks pass.
Translate eight instructions while preserving commands and variables. Cover completion, archives, first-board selection and swimlanes. Import and placeholder checks pass after a successful broad run of 333 translation-related suites.
Translate 68 values across two catalogs and preserve exact variables. Cover permanent deletion, non-destructive keep, conflict blocking and rollback restrictions. Both relevant suites and all 21 preservation checks pass; current fill lists are empty.
Translate 42 values across two catalogs and preserve exact variables. Cover retained applied changes, unwritten pending changes and discard restrictions. Both relevant suites and all 21 preservation checks pass.
Translate 34 values across two catalogs, preserving counters and reference variables. Cover invalid JSON, unchanged cards, source matching and first-sync behavior. Both relevant suites and all 21 preservation checks pass.
Translate 40 values across two catalogs, preserving variables, link syntax and configuration names. Cover access restrictions, import behavior and empty domain settings. Both relevant suites and all 21 preservation checks pass.
Translate 14 values across two catalogs, preserving commands, columns, extensions and variables. Cover excluded data, English headers and task hierarchy. Three relevant suites and all 21 preservation checks pass.
Translate 12 values across two catalogs, preserving commands, extensions and variables. Cover excluded attachments, completion dates, archives and comments. Three relevant suites and all 21 preservation checks pass.
Correct 106 values across both Galician catalogs and record audited changes. Preserve placeholders, restore the single-board Home limit and remove an unsupported loading-default claim. Three relevant suites and all 21 preservation checks pass.
Replace 93 values with reviewed Galician wording and record audited corrections. Verify native terminology, exact placeholders and action distinctions. Three relevant suites and all 21 preservation checks pass.
Replace 33 labels and messages with reviewed Galician wording and record audited corrections. Verify native terminology and exact placeholder inventories. Three relevant suites and all 21 preservation checks pass.
Translate 28 values across two catalogs, preserving commands, format keywords and variables. Cover hierarchy, first-board selection, archives and completion. Three relevant suites and all 21 preservation checks pass.
Translate 84 values across three catalogs, preserving counters and reference variables. Check keep and discard warnings, foreign-board preservation and rollback restrictions. Four relevant suites and all 21 preservation checks pass; current fill lists are empty.
Translate 66 values across three catalogs. Check discard restrictions, retained applied changes and full deletion warnings for partial imports. Four relevant suites and all 21 preservation checks pass.
Translate 60 values across three catalogs, preserving counters and reference variables. Cover planning matching, unchanged cards and recovery semantics. Four relevant suites and all 21 preservation checks pass.
Translate 75 values across three catalogs, preserving variables, link syntax and LDAP identifiers. Cover access restrictions, import behavior and empty domain settings. Four relevant suites and all 21 preservation checks pass.
Translate OPML, Org mode and Todoist instructions in three catalogs. Preserve format keywords, commands and variables, and check hierarchy, completion and comment mappings. Import and placeholder suites and all 21 preservation checks pass.
Translate 13 instructions in three catalogs while preserving commands, placeholders and regional wording. Cover excluded data, English headers, hierarchy and archives. Import and placeholder suites and all 21 preservation checks pass.
Translate eight instructions in three catalogs while preserving commands, placeholders and regional wording. Cover first-board selection, completion dates, archives and swimlane mappings. Import and placeholder suites and all 21 preservation checks pass.
Translate 13 instructions across four Russian locale paths, preserving the shared catalog alias. Cover commands, placeholders, excluded data, English headers, hierarchy and archives. Import and placeholder suites and all 21 preservation checks pass.
Translate eight instructions across four Russian locale paths, preserving the shared catalog alias. Cover commands, placeholders, first-board selection, completion dates and archives. Import and placeholder suites and all 21 preservation checks pass.
Reuse reviewed Ukrainian wording for 94 English regional values while preserving existing translations and placeholders. Extend checks for recovery warnings, planning restrictions, LDAP identifiers and link examples. Four relevant suites and all 21 preservation checks pass.
Fill OPML, Org mode and Todoist instructions from reviewed Ukrainian translations. Verify literals, hierarchy, completion and comment mappings. All 333 translation-related suites and 21 preservation checks pass.
Translate 13 instructions in both Ukrainian catalogs while preserving commands, columns and placeholders. Cover excluded data, English headers, task hierarchy and archives. Import and placeholder suites and all 21 preservation checks pass.
Translate eight instructions in both Ukrainian catalogs while preserving commands and placeholders. Cover first-board selection, completion dates, archives and swimlane mappings. Import and placeholder suites and all 21 preservation checks pass.
Translate 21 instructions while preserving commands, column names and placeholders. Cover first-board selection, archive behavior, import limitations and task hierarchy. Import and placeholder suites and all 21 preservation checks pass.
Translate 21 instructions while preserving commands, column names and placeholders. Cover first-board selection, archive behavior, import limitations and task hierarchy. Import and placeholder suites and all 21 preservation checks pass.
Translate 21 instructions while preserving commands, column names and placeholders. Cover first-board selection, archive behavior, import limitations and task hierarchy. Import and placeholder suites and all 21 preservation checks pass.
Translate 13 import instructions while preserving commands, columns and placeholders. Cover import limitations, English headers and task hierarchy with regression checks. Both translation suites and all 21 preservation checks pass.
Translate 13 instructions in Cyrillic while preserving commands, columns, variables and import limitations. Cover excluded data, English headers, hierarchy and archived tasks. Translation, placeholder and preservation checks pass.
Translate 13 instructions in both Slovenian catalogs while preserving commands, columns, variables and import limitations. Cover excluded data, English headers, hierarchy and archived tasks. Translation, placeholder and preservation checks pass.
Translate eight instructions in both Slovenian catalogs while preserving commands, extensions and variables. Cover first-board selection, completion dates, archived cards and swimlane mappings. Translation, placeholder and preservation checks pass.
Translate 21 instructions while preserving commands, columns, variables and import limitations. Extend regression coverage and refresh the broader translation test selection: 333 suites pass. Record the remaining untranslated backlog without treating deferred keys as complete.
Translate 13 instructions in both Vietnamese catalogs while preserving commands, columns, variables and import limitations. Cover excluded data, English headers, hierarchy and archived tasks. Translation, placeholder, completion and preservation checks pass.
Translate eight instructions in both Vietnamese catalogs while preserving commands, extensions and variables. Cover first-board selection, completion dates, archived cards and swimlane mappings. Translation, placeholder, completion and preservation checks pass.
Translate 13 instructions in both Malay catalogs while preserving commands, columns, variables and import limitations. Cover excluded data, English headers, hierarchy and archived tasks. Translation, placeholder and preservation checks pass.
Translate eight instructions in both Malay catalogs while preserving commands, extensions and variables. Cover first-board selection, completion dates, archived cards and swimlane mappings. Translation, placeholder and preservation checks pass.
Translate 13 instructions in both Korean catalogs while preserving commands, columns, variables and import limitations. Cover excluded data, English headers, hierarchy and archived tasks. Translation, placeholder and preservation checks pass.
Translate eight instructions in both Korean catalogs while preserving commands, extensions and variables. Cover first-board selection, completion dates, archived cards and swimlane mappings. Translation, placeholder and preservation checks pass.
Translate 13 instructions in ja-HI while preserving commands, columns, variables and import limitations. Check Hiragana script, excluded data, English headers, hierarchy and archived tasks. Translation, placeholder and preservation checks pass.
Translate 13 instructions in ja and ja-JP while preserving commands, columns, variables and import limitations. Cover excluded data, English headers, hierarchy and archived tasks. Translation, placeholder and preservation checks pass.
Translate eight instructions in ja and ja-JP while preserving commands, extensions and variables. Cover first-board selection, completion dates, archived cards and swimlane mappings. Translation, placeholder and preservation checks pass.
Translate 13 instructions in both Greek catalogs while preserving commands, columns, variables and import limitations. Cover excluded data, English headers, hierarchy and archived tasks. Translation, placeholder and preservation checks pass.
Translate eight instructions in both Greek catalogs while preserving commands, extensions and variables. Cover first-board selection, completion dates, archived cards and swimlane mappings. Translation, placeholder and preservation checks pass.
Translate 21 instructions in both Romanian catalogs while preserving commands, columns, variables and import limitations. Cover first-board selection, excluded data, English headers, completion dates and archived tasks. Translation, placeholder and preservation checks pass.
Translate 21 instructions in both Czech catalogs while preserving commands, columns, variables and import limitations. Cover first-board selection, excluded data, English headers, completion dates and archived tasks. Translation, placeholder and preservation checks pass.
Translate 21 instructions in both Polish catalogs while preserving commands, columns, variables and import limitations. Cover first-board selection, excluded data, English headers, completion dates and archived tasks. Translation, placeholder and preservation checks pass.
Translate 21 instructions in both Dutch catalogs while retaining literal commands, variables and import limitations. Extend regression coverage for excluded data, first-board selection, English headers and archived tasks. Translation, placeholder and preservation checks pass.
Translate all 21 import instructions while preserving commands, columns, extensions and variables. Cover first-board selection, excluded data, English headers and archived tasks with regression checks. Translation and placeholder suites pass.
Translate 52 values with regional terms and preserved commands, columns, extensions and hierarchy markers. Verify excluded data, English headers and archived tasks. Import-instruction and placeholder suites and all 21 preservation checks pass.
Fill 32 values with regional terminology and preserved commands, extensions and variables. Check first-board selection, completion dates and archived cards. Import-instruction and placeholder suites and all 21 preservation checks pass.
Translate 117 values with preserved commands, columns, extensions and hierarchy markers. Verify excluded data, English header requirements and archived tasks. Import-instruction and placeholder suites and all 21 preservation checks pass.
Fill 72 values with preserved commands, extensions and variables. Check first-board selection, completion dates and archived cards. Import-instruction and placeholder suites and all 21 preservation checks pass.
Translate 65 values with preserved commands, columns, extensions and hierarchy markers. Verify excluded data, English header requirements and archived tasks. Import-instruction and placeholder suites and all 21 preservation checks pass.
Fill 40 values while preserving source commands, extensions and variables. Check first-board selection, archived cards and completion dates. Import-instruction and placeholder suites and all 21 preservation checks pass.
Fill 84 values while preserving source commands, extensions, columns and hierarchy markers. Test exact variables, first-board selection, archived and completed tasks, and excluded data. Import-instruction and placeholder suites and all 21 preservation checks pass.
Discover all 234 non-English catalog paths for warning regression checks, including missing values, exact tokens and repeated address roles. Warning and placeholder suites and 21 preservation checks pass. Cherokee prose has low confidence and needs native review; the wider translation backlog remains unfinished.
Preserve repeated address variables and ROOT_URL and check prose scripts. Warning and placeholder suites and 21 preservation checks pass. These translations have lower confidence and need native review.
Preserve repeated address variables and ROOT_URL. Three translation suites and 21 preservation checks pass. These direct translations have low confidence and need native review.
Preserve repeated address variables and ROOT_URL. All 333 selected translation-related suites and 21 preservation checks pass. These translations have lower confidence and need native review.
Preserve repeated address variables and ROOT_URL. Warning and placeholder suites and 21 preservation checks pass. These translations have lower confidence and need native review.
Preserve repeated address variables and ROOT_URL. Correct three Uzbek labels to the registered script. Three translation suites and 21 preservation checks pass. These translations have lower confidence and need native review.
Preserve repeated address variables and ROOT_URL, with separate Tibetan and Dzongkha prose. Warning and placeholder suites and 21 preservation checks pass. These translations have lower confidence and need native review.
Preserve repeated address variables and ROOT_URL. Warning and placeholder suites and 21 preservation checks pass. These translations have lower confidence and need native review.
Add Acehnese, Aymara, Guarani and Quechua warnings with exact variables. Correct five prefixed or untranslated labels. Three translation suites and 21 preservation checks pass. These direct translations have lower confidence and need native review.
Preserve repeated address variables and ROOT_URL. Warning and placeholder suites and 21 preservation checks pass. These translations have lower confidence and need native review.
Preserve repeated address variables and ROOT_URL. Warning and placeholder suites and 21 preservation checks pass. These translations have lower confidence and need native review.
Preserve configured and opened address variables and ROOT_URL. Warning and placeholder suites and 21 preservation checks pass. Northern Sami, Manx and Cornish prose has lower confidence and needs native review.
Add Moroccan Arabic, Hiragana, Walloon, Waray and Venetian warnings with exact address variables. Verify legacy locale identities and Hiragana script. These direct translations have lower confidence and need native review. Warning and placeholder suites and 21 preservation checks pass.
Preserve exact repeated variables and the separate Venetian and Veps catalogs. Extend warning coverage to 169 paths. The prose has lower confidence and needs native review.
Preserve exact repeated variables and extend coverage to 164 paths. Hawaiian Samoan Tongan and Fijian prose has lower confidence and needs native review.
Preserve repeated variables and extend warning coverage to 139 paths. Kinyarwanda Kirundi Chichewa Sesotho and Setswana prose has lower confidence and needs native review.
Preserve repeated variables and the Khmer regional symlink. Extend warning coverage to 119 paths. Amharic and Pacific prose has lower confidence and needs native review.
Preserve command names, hierarchy markers, omitted-data warnings and repeated origin variables. The fill tool now reports no Finnish placeholders within its scope.
Preserve source commands, column names, hierarchy markers and omitted-data warnings. Repair the three translation completion failures without weakening coverage.
The Upcoming import and export group now lists twenty-one tools, the In
short paragraph names the larger set without listing every one, and the
TODO Later formats bullet counts the twenty-one added on 2026-10-08.
Thanks to xet7 !
Plane's Workspace Settings > Exports .zip is read with its CSV, JSON or XLSX
files (one per project, as Plane's export task and IssueExportSerializer
write them), or one of those files chosen or pasted: states become lists,
projects swimlanes, and parents, labels, dates, links and comments keep
their places, with priority, estimate and cycle as custom fields. Plane has
no import of its own to export to, so this is import only.
Thanks to xet7 !
Notion's Markdown & CSV export is read as the downloaded .zip (opened on the
server under size limits) or as one database CSV: database properties map to
lists, people, dates, tags and custom fields, and page Markdown becomes the
card description. Export writes a database CSV that Notion's CSV import
reads, and which imports back.
Thanks to xet7 !
Redmine's issue list "Also available in: CSV" export is read by its English
column names: each status becomes a list, issues become cards with the
tracker as a label, assignee, author, dates, parent task and related issues,
and priority, category, target version, estimated time, % Done and custom
fields become custom fields. Export writes the same CSV, which imports back.
Thanks to xet7 !
Businessmap's Advanced Search "Configure results" Excel download is read by
its English column names: Column becomes lists and Lane swimlanes, owners,
tags, color, dates, comments and parent links keep their places, and
Priority, Size, Type and other columns become custom fields. Export writes
the same workbook, which imports back.
Thanks to xet7 !
Teamwork.com imports tasks into a project from an Excel template (List or
Table view > ... > Import Tasks) whose help article names ten columns:
Tasklist, Task, Description, Assign to, Start date, Due date, Priority,
Estimated time, Tags and Status. Teamwork documents no export in that
layout, so the template is what is read and written. Task lists become
lists and tasks cards; a "-", "#" or ">" before a task name, doubled per
level, makes it a subtask card of the nearest shallower task above, in
its parent's list. Comma-separated Assign to e-mails become the owner and
assignees, Start and Due date the start and due dates (date cells, ISO,
or the site's numeric format with day/month order decided for the whole
file), Tags labels, Priority low/medium/high and Estimated time (25,
01:30, 1h 15m, 1h, 2 hours) the custom fields Priority and Estimated time
(hours), and Status Complete the checkbox field Complete with the due
date marked done. Other columns, unknown values, unreadable dates and
estimates, nameless rows and subtasks without or skipping a parent level
are reported; an .xls file is refused with a request to save it as .xlsx.
Export writes the template with date cells, HH:MM estimates and subtasks
after their parents.
tests/teamworkFormat.test.cjs builds the template with ExcelJS and covers
the subtask levels, every estimate form, the negatives and the round
trip; a Playwright case imports a workbook through the page. New
instruction text is in English, pending Transifex.
Thanks to xet7 !
The test's stand-in sanitizer removed tags in one pass, the shape
tests/tagStrippingFixedPoint.test.cjs keeps out of the tree (CodeQL
js/incomplete-multi-character-sanitization). It now loops until
nothing changes.
Thanks to xet7 !
Wrike documents the columns of its Excel import, not of its export: the
help article's key, parent task, title, status, priority, assigned to,
start date, duration, end date, depends on, start date constraint and
description, custom fields to the right of description, and the official
sample excel_import_sample.xls, whose folders and projects are rows with
a path as their Title (/Folder 2/Subfolder 1/) above their tasks. WeKan
reads and writes that template, headers matched case-insensitively.
Folder rows become swimlanes, Status the lists (a custom workflow's
Custom Status wins over its group), Key the reference, Parent Task the
parent card (a folder's Key puts the task in that folder), Assigned To
"Name <email>" the owner and assignees, Start and End Date the start and
due dates, Depends On "13FS" an is-blocked-by dependency, and Priority,
Duration and every other column custom fields. A start date constraint,
a folder or project's own status and dates, the workflow columns, the
SS/FF/SF kind of a dependency, bad keys and dates, and the repeated rows
of a task in several folders are reported. Export writes the template on
a Tasks sheet with a folder row per swimlane, sequential Keys, date cells,
the Wrike status group as Status and the list as the custom field WeKan
list, which the import reads back.
tests/wrikeFormat.test.cjs builds the sample's structure with ExcelJS
and covers the negatives and the round trip; a Playwright case imports a
template through the page. New instruction text is in English, pending
Transifex.
Thanks to xet7 !
Quire's Import CSV reads Name, Assignee, Tag, Start, Due, Priority,
Status, Description, Parent and ID, matched by header name in any order;
its Export CSV, as the sample file its guide links and its API's
export-csv example show, also writes Started, Completed, Duration,
Estimate, Time log, Variation, Successors, Created and Created by. A
header with several values is repeated, or with merge joined by ", ".
The hierarchy is read in all three ways Quire writes it: a Parent column,
repeated ID columns by depth, and an ID path such as "#6, #8". Statuses
become lists and tasks cards with the ID as reference and the parent
task as parent card, Assignee as owner and assignees, Tag as labels,
Start (or Started), Due, Completed and Created as dates, Created by as
Requested by, and Priority (Low, High, Urgent, or the API's -1 to 2) as
a custom field; Medium is Quire's default and is left out. Dates are
read as Quire writes them, "Jun 2, 2026", or ISO 8601, and a leading '
before formula-like text is removed. Duration, Estimate, Time log,
Variation, Successors, unknown priorities and unreadable dates are
reported. Export writes the import columns with Completed, Created and
Created by, cards numbered #1... with Parent, and repeated Assignee and
Tag columns.
tests/quireCsv.test.cjs covers the sample file, the API's example, the
import shape, the negatives and the round trip; a Playwright case
imports through the page and the export audit fetches the format. New
instruction text is in English, pending Transifex.
Thanks to xet7 !
Planner, MeisterTask, Obsidian Kanban, Linear, TickTick, ClickUp,
Nullboard, Kanri, Pivotal Tracker, Tasks.org, monday.com, Super
Productivity, Taiga and Vikunja open the Upcoming section with an In
short paragraph, and the translation entries already there get their
own subsection header.
Thanks to xet7 !
Vikunja's Settings > Data Export writes, and its Vikunja Export migrator
reads, a zip with data.json (an array of projects with their tasks, views,
buckets, task_buckets and positions), filters.json, VERSION and
files/<id>. Both layouts are read: project views with buckets per view
(0.24 and newer) and bucket_id / is_done_bucket (0.21-0.23); a VERSION
older than 0.20.1 is refused, as Vikunja refuses it. The first kanban
view's buckets become lists and tasks cards in that view's order, several
projects swimlanes under their parent's name, with labels, assignees as
owner and assignees, created_by as Requested by, the dates (Go's zero time
is no date), the HTML description and comments as text, TipTap task lists
as checklists, hex color as card color, priority, percent done and done as
custom fields, subtask/parenttask as parent cards and blocking, related
and duplicate links as dependencies. Attachments, reminders, repeats,
other relation kinds, label and project colors, WIP limits, backgrounds,
reactions and saved filters are reported. The zip is uploaded, or its
data.json chosen or pasted, and opened on the server under size, entry
and inflate limits. Export writes the same zip, with a list called Done
as the done bucket and several swimlanes as child projects.
tests/vikunjaFormat.test.cjs covers both layouts, the round trip through
the zip and the negatives; Playwright cases import a zip and a pasted
data.json through the page and download the export. New instruction text
is in English, pending Transifex.
Thanks to xet7 !
Taiga's Admin > Project > Export writes, and its load_dump importer reads,
one JSON object: the whole project, with people as emails and statuses,
swimlanes, sprints and roles by name. User story statuses become lists,
Taiga swimlanes swimlanes, and user stories cards in kanban order with
their tags, assignees, owner as Requested by, watchers, dates and comments
from the history entries. Tasks become subtask cards of their story with
their own status, people, dates and comments; epics and issues get
swimlanes of their own, an epic is the parent of its first story and an
issue's type, priority and severity become labels. Custom attributes,
story points (the Scrum estimate), blocked notes and requirements become
custom fields, tag colors the nearest label colors, open milestones Scrum
sprints with the backlog order as rank. Attachments (the page leaves the
embedded files out before sending), the wiki, the timeline, votes, WIP
limits, memberships and closed sprints are reported. A .json.gz dump is
unpacked first. Export writes every key Taiga's exporter writes, with
subtasks as tasks, a story's checklist items as tasks and sprints with
both dates as milestones.
Imported labels take a board-level label_colors map as well as a tag's
own color.
tests/taigaFormat.test.cjs covers the mapping, the negatives, that every
name the dump refers to exists, and round trips both ways, on a fixture
written from taiga-back's export serializers. Playwright cases import a
dump through the page, reject a malformed one, and the export audit
fetches the new format. New instruction text is in English, pending
Transifex.
Thanks to xet7 !
Super Productivity's Export Data writes sp-backup_*.json: {timestamp,
lastUpdate, crossModelVersion, data}, with project, task, tag, note, boards
and archiveYoung/archiveOld as {ids, entities} entity states. Projects become
swimlanes, so none is dropped; the board takes the title of the only one.
Its boards are saved filters, not containers, so lists follow its default
Kanban board: done tasks in Done, the KANBAN_IN_PROGRESS tag in In Progress,
a project's backlog in Backlog, the rest in To Do. Tasks become cards and
sub-tasks sub-task cards, tags labels, notes and web link attachments the
description, the scheduled day or time the due date (the start date when a
deadline is the due date), doneOn the end date, timeSpent spent hours,
timeEstimate and priority custom fields, and archived tasks archived cards.
Repeat configurations, reminders, issue links, project notes, local
attachments, the per-day time breakdown and the saved boards are reported;
pre-v14 backups are refused.
Export writes a backup Import from File accepts at crossModelVersion 4.5:
project, task, tag, note, boards and both archives, leaving the slices the
app fills with defaults out. Swimlanes become projects, lists one board of
panels with other lists as tags, checklists markdown task lists in the
notes, and spent hours are booked on the card's end or creation day.
tests/superProductivityFormat.test.cjs checks the mapping, the negatives,
the round trip and the export against Super Productivity's own field and
cross-model validation; a Playwright case imports through the page and the
export audit fetches the format. New instruction text is in English,
pending Transifex.
Thanks to xet7 !
monday's "Export board to Excel" is documented only through its help
article's screenshots and cannot be changed: the board's name in row 1,
then per group its name, a header row starting Name with the board's
own column titles, the items and a summary row; with "+ updates" a
<board>-updates sheet of Item ID, Item Name, User, Created At and Update
Content. Column titles are the board owner's, so they are matched by
meaning: Name is the title, Status the list (groups become swimlanes;
without a Status column the groups are the lists), Person / People /
Owner / Assignee the owner and assignees, Date / Due date / Deadline the
due date, Timeline the start and due dates, Tags labels, Item ID the
reference, Long text / Description / Notes the description, and every
other column a custom field. Updates become comments on the item they
name. Subitems are undocumented; as community reports show them - a
Subitems header row after the parent, its rows indented one column -
they become subtasks. Bad dates, nameless items and updates for unknown
items are reported. Export writes the flat table monday's own Excel
import reads: the first sheet, a header row and ISO dates.
tests/mondayFormat.test.cjs builds the documented layout with ExcelJS,
including updates and subitems, and covers the negatives and the round
trip; a Playwright case imports a workbook through the page. New
instruction text is in English, pending Transifex.
Thanks to xet7 !
Tasks.org's backup (Settings > Backups > Export tasks) is JSON:
{version, timestamp, data:{tasks, tags, caldavAccounts, caldavCalendars,
...}}, written with every default left out. A task's list is its
caldavTasks[].calendar, named by caldavCalendars[].uuid; lists become
lists and tasks cards, with notes as description, tags as labels,
priority 0-2 as custom field Priority (High, Medium, Low), due and start
dates in epoch ms (a time only when ms % 60000 > 0, otherwise all-day,
kept as that day at 12:00 UTC), completion as the end date, elapsed time
as time spent, the estimate as custom field Estimate (hours), comments,
and caldavTasks[].remoteParent as subtask cards linked to their parent -
Tasks.org subtasks are full tasks with their own dates and completion,
which a checklist item could not keep. Deleted tasks are skipped and
reported; repeat rules, reminders, location reminders, a running timer,
attachments (the backup has no file contents), comment pictures and
undefined lists are reported. Export writes a backup Tasks.org's Import
backup accepts: one local account named after the board, a list per
WeKan list, tag definitions and per task its caldavTasks row, with
stable ids so a second restore skips tasks it already has; checklist
items become subtasks.
tests/tasksorgFormat.test.cjs runs a backup shaped like Tasks.org's
exporter output, the negatives, the fields its importer requires and the
round trip; a Playwright case imports through the page and the export
audit fetches the format. New instruction text is in English, pending
Transifex.
Thanks to xet7 !
Pivotal Tracker shut down on 2025-04-30; its stories CSV exports remain.
Columns are matched by name and repeated ones (Owned By, Blocker/Blocker
Status, Comment, Task/Task Status, Pull Request, Git Branch) collected in
order, so exports from before about 2018, which have no Priority, read
too. Current State becomes lists in Tracker's workflow order (unscheduled
to rejected), Type and Labels labels, Id the source reference, Owned By
the owner and assignees, Requested By Requested by, Created at / Accepted
at / Deadline the created, end and due dates ("Nov 22, 2014" or
11/22/2014), Estimate the Story points field and Scrum estimate, Priority
a custom field, each Iteration with its dates a Scrum sprint (one holding
only accepted stories is finished and reported), comments keep the author
and date of their "(Author - Mon D, YYYY)" tail, Task pairs a Tasks
checklist with done items, and an unresolved "#id" blocker an
is-blocked-by dependency. Pull requests, git branches, other blockers and
unknown states, types, priorities and dates are reported. Export writes
the columns Tracker's import reads, without Id, Iteration and URL.
Todoist's RFC 4180 reader is shared. tests/pivotalCsv.test.cjs runs a
2023 and a pre-2018 export, the Scrum planning, the negatives and the
round trip; a Playwright case imports through the page and the export
audit fetches the format. New instruction text is in English, pending
Transifex.
Thanks to xet7 !
Kanri's Import & Export page writes, and its Import from Kanri reads, one
board (Partial Export: id, title, columns of cards, background, globalTags)
or all data (Full Export: the app settings and every board). Columns
become lists, cards become cards with their description, due date and
due-date-done flag and the card id as source reference, a card's tasks a
Tasks checklist, tags labels with their colors, and Kanri's card colors
WeKan's (teal and custom colors as hex). One import makes one board, so
from all data the first board is imported and the others are reported, as
are the background image, the countdown due date display, tags no card
uses and colors that are not colors. Imported labels now keep a source's
label color, and the collected export carries the card color and due-date
done. Export writes a single-board file Kanri's Partial import accepts.
tests/kanriFormat.test.cjs covers the mapping, all-data files, the round
trip and the negatives; Playwright cases import a board and an all-data
file through the page, and the export audit fetches the new format. New
instruction text is in English, pending Transifex.
Thanks to xet7 !
Nullboard's "Export this board..." writes plain JSON despite the .nbx
extension: one board {format, id, revision, title, lists: [{title,
notes: [{text, raw, min}]}]}, or an array of them for "Export all
boards". Every board is checked as Nullboard's own checkImport checks
it - the five keys, a non-empty id and revision, a lists array and
format 20190412 - and anything else is refused. Lists become lists and
notes cards; a note is free text, so its first non-blank line is the
card title and the rest the description. A raw note, drawn as a
heading in the list, gets the label raw; collapsed notes, empty notes,
repeated list titles and every board after the first in an array are
reported. Export writes one board Nullboard imports, with the title and
description as the note text, checklists after them as [ ] / [x] lines
and a card labelled raw as a raw note; Nullboard notes are text only,
so other labels, dates, people and comments are not written.
tests/nullboardFormat.test.cjs runs a welcome-board shaped sample, the
negatives and a round trip through Nullboard's checkImport; a
Playwright case imports through the page and the export audit fetches
the format. New instruction text is in English, pending Transifex.
Thanks to xet7 !
ClickUp documents two CSV shapes, both read by header name: the
workspace export (Task ID, Task Link, Task Type, Task Custom ID, Task
Name, Task Content, Status, each date as Unix milliseconds and as text,
Parent ID, Subtask IDs, Attachments, Assignees, Tags, Priority, List
Name, Folder Name/Path, Space Name, the time columns, Checklists and
Comments) and the Spreadsheets importer's columns (Priority 1-4,
Description content, List, Task assignee, Checklist, Time Estimate).
Statuses become lists, ClickUp lists swimlanes, the Space the board
title. Tasks become cards with Parent ID or the parent's Subtask IDs as
subtasks, Task Content as description with its attachments as links,
the [A,B] assignees and tags, the created, due and start dates (the
millisecond column, or ISO 8601), Time Spent as spent hours, and
Priority, Task Type, Custom ID, Folder and Time Estimate as custom
fields; the importer's Checklist becomes a checklist. The export's
Checklists and Comments cells have no documented format and are
reported, as are other dates. Export writes the workspace export
columns, plus the importer's Checklist column, which ClickUp maps by
name.
tests/clickupCsv.test.cjs covers both shapes, ClickUp's own importer
example, the negatives and the round trip; a Playwright case imports
through the page and the export audit fetches the format. New
instruction text is in English, pending Transifex.
Thanks to xet7 !
TickTick's Generate backup writes, and Import backup reads, a CSV that
starts with a quoted Date / Version / Status preamble, then Folder Name,
List Name, Title, Kind, Tags, Content, Is Check list, the start and due
dates, Reminder, Repeat, Priority, Status, the created and completed
times, Order, Timezone, Is All Day, Is Floating, Column Name, Column
Order, View Mode, taskId and parentId, and since version 7.2 projectKind.
TickTick publishes no specification; this follows real 7.1 and 7.2
backups, as Vikunja's TickTick migrator reads them. The header is found
by its first cell and columns are read by name.
Each TickTick list becomes a swimlane and its kanban columns lists.
Tasks become cards with Content as description and its ▫ / ▪ lines as
the checklist, tags as labels, and the start, due, created and completed
dates; an all-day start or due date is the calendar day in the task's
Timezone, so it does not move. Status 1 is completed, 2 archived and -1
the label won't do; Priority 1/3/5 and Folder Name are custom fields;
taskId and parentId make subtasks. Reminders, repeat rules and unknown
codes are reported. Export writes a 7.2 backup for one TickTick list.
tests/ticktickCsv.test.cjs covers 7.1 and 7.2 backups, time zones, the
negatives and the round trip; a Playwright case imports through the page
and the export audit fetches the format. New instruction text is in
English, pending Transifex.
Thanks to xet7 !
Linear exports issues as CSV - the workspace export or a view's - with
ID, Team, Title, Description, Status, Estimate, Priority, Project,
Creator, Assignee, Labels, Cycle, the created, started, completed,
canceled and archived dates, Due Date and Parent issue, plus columns it
has added over time; they are matched by header name. Values are read as
Linear's own open-source CSV importer reads them: priority names, labels
joined by ", ", and a leading ' before text a spreadsheet could take for
a formula, which is removed. Statuses become lists and teams swimlanes;
issues become cards with the ID as reference and Parent issue as the
parent card, Assignee as owner, Creator as Requested by, the labels and
dates, Archived as an archived card, and Priority, Estimate, Project,
Cycle and Canceled as custom fields. Updated, Triaged, cycle dates,
Initiatives, milestones, SLA Status, non-ISO dates and unknown priorities
are reported. Export writes Linear's columns in its order, with the same
formula guard.
tests/linearCsv.test.cjs covers the mapping, the parent link, the
negatives and the round trip; a Playwright case imports through the page
and the export audit fetches the format. New instruction text is in
English, pending Transifex.
Thanks to xet7 !
The plugin keeps a board in one Markdown file, and the generic Markdown
import read it only partly: the frontmatter and settings footer were
reported as unknown lines, #tags and @{dates} stayed in titles, and the
Complete lanes and the Archive were lost. This follows the plugin's own
parser and writer: kanban-plugin: board frontmatter (basic accepted),
## Lane (limit) headings, **Complete** lanes, - [ ] cards with 4-space or
tab continuation lines, *** and ## Archive, and the %% kanban:settings %%
JSON footer, whose date-format, date-trigger and time-trigger are used.
Lanes become lists with the card limit as WIP limit; #tags labels;
@{date} @@{time} the due date; the Tasks plugin's dates (due, start,
created, done, scheduled) and priority emoji the dates and a Priority
custom field; its id and depends-on the reference and blocked-by links;
Dataview key:: value fields custom fields; task lines in a card's body
its checklist; [x] and Complete lanes the done label, as the Markdown
import does; the Archive archived cards. Recurrence, cancelled dates and
other frontmatter keys are reported. Export writes the plugin's layout.
Imported columns now carry a WIP limit: KanboardCreator turns a column's
wip_limit, or Kanboard's own task_limit, which it dropped until now, into
the list's limit.
tests/obsidianKanban.test.cjs covers the plugin's sample layout, custom
date formats, the negatives and the round trip; a Playwright case imports
through the page and the export audit fetches the format. New instruction
text is in English, pending Transifex.
Thanks to xet7 !
MeisterTask reads one CSV shape and writes another; both are matched by
header name. Its import shape, from MeisterTask's own sample file, is
project,section,name,notes,due_date,status,tags; its export header is
id,token,name,notes,created_at,updated_at,status,due_date,
status_updated_at,assignee,section,tags. Sections become lists and tasks
cards, with notes as description, "; "-separated tags as labels, the
assignee as owner, due and created dates in ISO 8601, status 2 as
completed with status_updated_at (or completed_at) as the end date, and
status 8 or 16 (binned, archived) as archived cards. Columns MeisterTask
documents no shape for - checklists, comments, custom fields, tracked
time - unknown status codes and non-ISO dates are reported. Export writes
the import shape, which MeisterTask reads back.
Todoist's RFC 4180 reader is shared and names the format in its errors.
tests/meistertaskCsv.test.cjs runs MeisterTask's published sample, the
export header, the negatives and the round trip; a Playwright case
imports through the page and the export audit fetches the format. New
instruction text is in English, pending Transifex.
Thanks to xet7 !
Planner's "Export plan to Excel" writes one sheet, Tasks: plan name, plan
ID and export date on rows 1-3, then Task ID, Task Name, Bucket Name,
Progress, Priority, Assigned To, Created By, the created, start, due and
completed dates, Late, Completed By, Description, Completed Checklist
Items, Checklist Items and Labels. Columns are matched by name, as newer
exports add Is Recurring. Buckets become lists and tasks cards, with the
Task ID as source reference, the ;-separated assignees as owner and
assignees, Created By as Requested by, the checklist and labels, and
Progress, Priority and Completed By as custom fields. Dates are text in
the exporting user's locale: day/month order is decided for the whole
file, and reported when every date could be read either way; date cells
keep their day. Which checklist items were done (Planner exports only a
count), a recurring task's repeat and unknown values are reported.
Export writes the same workbook as .xlsx.
The layout follows a real Planner export, the MIT-licensed test data of
the plannr package, added under tests/fixtures/planner/ with its
licence. tests/plannerFormat.test.cjs imports it, round-trips an export
through ExcelJS and covers the negatives; Playwright cases import the
file through the page and download the export. New instruction text is
in English, pending Transifex.
Thanks to xet7 !
The coordinated History chain stays switched on offline only, Blockly
translations stay paused, and Microsoft Planner is the next import and
export format.
Thanks to xet7 !
Repair 15 values, restore the single-board restriction and preserve removal warnings and positional date roles. Wu prose is lower confidence and needs native review.
Thanks to xet7.
Repair eight activity and workspace values, preserve placeholder roles and restore the Markdown format name. Wu prose is lower confidence and needs native review.
Thanks to xet7.
Replace 25 Mandarin-like summaries with Wu wording and restore positional percent arguments to their source roles. Update audit records. Wording is lower confidence and needs native review.
Thanks to xet7.
Replace 24 Mandarin-like or malformed activity values, preserve exact tokens and synchronize audit records. Wording is lower confidence and needs native review.
Thanks to xet7.
Replace 26 Mandarin-like values with Wu wording, preserve source tokens and update exact-value audit records. Wording is lower confidence and needs native review.
Thanks to xet7.
Translate 33 remaining recovery messages and verify placeholders, removal warnings and an empty full fill list. Wu wording is lower confidence and needs native review; older Mandarin-like passages still need correction.
Thanks to xet7.
Preserve placeholders and verify matching order, retained changes and replayable-operation warnings. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve placeholders and technical literals and verify permissions, import matching and unchanged foreign-board cards. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Translate 32 workspace and alias messages and verify placeholders, search directions and an empty Blockly fill list. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify replacement order, whitespace handling and variable-type conflicts. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify letter case, copied text and indexing from either end. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve key names and verify directions, navigation pairs and focus destinations. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify function outputs, scope, disabled calls and screen-reader mode transitions. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and key names and verify angle units, inverse functions and variable types. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and mathematical literals and verify random bounds, rounding directions and logarithm bases. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify inclusive bounds, number properties and statistical terms. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and mathematical literals and verify negation, comparison bounds and arithmetic results. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify sorting directions, case sensitivity and strict versus inclusive comparisons. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify removal return behavior, indexing, not-found results and copying semantics. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify copy versus cut, first versus last and retrieval versus removal. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify input positions, arithmetic operands and count versus value. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and key names and verify bitmap positions, opposite icon actions and condition ordering. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify true versus false conditions, fallback branches, deletion counts and opposite editing actions. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables, import literals, key names and numeric limits. Verify loop restrictions and break versus continue. Wu wording is lower confidence and needs native review.
Thanks to xet7.
Preserve placeholders, link templates and configuration names. Check Wu phrasing and opposite actions. Wording is lower confidence and needs native review; Mandarin-like older passages remain to audit.
Thanks to xet7.
Translate 49 remaining recovery, import and history messages. Preserve variables and check destructive-action warnings and an empty full fill list. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify recovery states, irreversible cancellation and retained changes. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and technical literals and verify missing versus null values, planning retention and retry behavior. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Preserve placeholders and verify replacement reuse, saved settings, omitted values and report limits. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Preserve placeholders and verify ambiguous matches, local versus source choices, retained content and unchanged subcards. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Preserve source variables, UTC and observation limits. Verify report scope, unknown estimates, sprint states and incomplete-import restrictions. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Preserve source placeholders, link templates, URLs and configuration names. Check permissions, movement directions and saved and failure states. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Translate 44 variable, workspace, search and alias messages. Verify exact placeholders, keyboard names, directional search and an empty Blockly fill list. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify text position, letter case, trimming direction and replacement semantics. Specialized wording is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and key names and verify opposite directions and navigation actions. Specialized terminology is lower confidence and needs native review.
Thanks to xet7.
Preserve variables and verify return values, function scope and opposite accessibility states. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and key names with checks for angle units, bases and directions. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and verify numeric endpoints, rounding directions and statistical distinctions. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and mathematical notation with boundary regression coverage. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and null with comparison and condition regression coverage. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and distinguish insertion, replacement and copying operations. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and distinguish retrieval, removal and combined operations. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and coordinate letters with regression coverage for positions and division operands. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve numbered variables and verify opposite actions, pixel states and input roles. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve numbered variables and verify loop conditions and deletion counts. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Use shared placeholder validation for numbered variables and clarify the historical test baseline. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Record 298 passing translation suites and the current 33800-value backlog across 48 languages, with 250 pending source keys tracked separately. Thanks to xet7.
Preserve counters and verify recovery outcomes and an empty current fill list. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve counters and verify retained changes, replayable operations and the oldest-50 limit. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and verify retained work, delivery permissions and permanent cancellation. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and literals with regression checks for null handling and retained planning. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and verify retention limits, hidden values and partial-run semantics. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Move translation entries absent from v12.24 back to Upcoming after the concurrent merge, and document Yiddish Sync conflict translations. Release ancestry and translation summary checks pass. Thanks to xet7.
Preserve variables and check retained data, limited review and replacement reuse. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve counters and references with import and observation regression coverage. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve counters and test estimate distinctions, sprint states and close/cancel outcomes. Specialized Scrum wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and check rule limits, conflict handling and completion policies. Specialized Scrum wording is lower confidence and needs native review. Thanks to xet7.
Preserve search variables and shortcuts and verify no Blockly fill-list entries remain. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve placeholders and joined announcement spacing with boundary regression coverage. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and position markers with coverage for navigation and text boundaries. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and verify opposite actions and accessibility state transitions. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables and key names with regression coverage for units and return values. Specialized wording is lower confidence and needs native review. Thanks to xet7.
Preserve placeholders, numeric bounds and mathematical notation. Specialized mathematical wording is lower confidence and needs native review. Thanks to xet7.
Preserve placeholders and mathematical notation with boundary regression coverage. Specialized mathematical wording is lower confidence and needs native review. Thanks to xet7.
Preserve variables, index markers and operation distinctions. Specialized programming wording is lower confidence and needs native review. Thanks to xet7.
Preserve placeholders and distinguish retrieval, removal and combined operations. Specialized programming wording is lower confidence and needs native review. Thanks to xet7.
The Caddy proxy headers entry was added after v12.24 had been prepared,
under that release's heading, although v12.24 does not contain the
commit it links. It moves to a new Upcoming section with the redirect
login default.
Thanks to xet7 !
Every login that chooses between a popup and a redirect opened a popup by
default. Google's sign-in pages, and other identity providers', can send
Cross-Origin-Opener-Policy, which makes Meteor's popup look closed at
once: the login was tried before the provider answered, and the user
was back on the sign-in page with no error. Popups are also blocked in
iframes and on some phones. The full-page redirect has no popup to lose.
- OAUTH2_LOGIN_STYLE (OAuth2/OIDC): redirect unless it says popup, in the
server, the Admin Panel catalog and the samples.
- OAUTH_PROVIDERS_LOGIN_STYLE (Google, GitHub, Facebook, X, Meteor
Developer, Weibo, Meetup): redirect by default, in the code, Dockerfile,
snap, Sandstorm package and samples.
- SAML: both identity-provider profiles log in by redirect;
SAML_LOGIN_FLOW=popup still chooses the popup, and the client no longer
falls back to a popup while the configuration loads.
- CAS: redirects unless "popup": true. Its redirect could never finish:
nothing called Meteor.initCas, which the package now does at startup.
The sign-in page also passed username and password as loginWithCas's
options and callback, so its callback never ran, and the CAS redirect
page echoed the request address into HTML unescaped.
A redirect login's error now reaches the reloaded sign-in page, from
accounts-oauth's page-load hook and the SAML and CAS events, instead of
the page coming back silently.
Verified against a freshly built and prepared bundle with the local
identity-provider suite and no login style set: OIDC, SAML, CAS and all
seven Meteor providers log in by redirect, and each refusal is shown on
the sign-in page (31 of 31 with Chromium). Its LDAP wrong-password case
expected wording that changed in 679a8b3499 and is corrected.
Thanks to xet7 !
The production Caddyfile in the Meteor 3 Docker docs left the headers to
Caddy's defaults, so behind CloudFlare WeKan saw a CloudFlare edge
address as every visitor, and with no HTTP_FORWARDED_COUNT the proxy's
own address: all users shared the login cookie refresh limit of 30 per
10 seconds, which signs users out at busy times and sends a Google login
back to the sign-in page. Examples that read CF-Connecting-IP trusted it
from anybody who connected.
The global options now trust CloudFlare's published ranges, and only
those, through client_ip_headers CF-Connecting-IP, so grey cloud sites
and direct connections use their own address. Shared snippets give every
WeKan site the same headers - X-Forwarded-Proto https and the visitor's
address as the only X-Forwarded-For and X-Real-IP - and the container
template sets HTTP_FORWARDED_COUNT=1. Sandstorm gets its own snippet that
sets X-Real-IP, which Sandstorm believes from a loopback address, and the
Sandstorm docs explain how its gateway routes by Host, takes https from
BASE_URL and finds published sites by their sandstorm-www TXT record.
Both Caddyfiles were validated with caddy adapt, and the headers checked
against a live Caddy.
Thanks to xet7 !
A rebase rewrote the commits these entries link to, so the links named commits
that no longer exist and would have 404ed on GitHub. Repointed by
releases/fix-changelog-hashes.sh, which only touches a link no ref in this clone
can reach.
Thanks to xet7 !
Fill 25 messages while preserving source variables and existing translations. Check retention, permanent deletion, recovery checkpoints and unrelated-board protection.
Thanks to xet7.
Signing in with Google brought the user back to the sign-in page every
time, with no error. Meteor's OAuth builds the provider's redirect_uri
from ROOT_URL, so the provider returns the browser to ROOT_URL's origin
and the callback leaves the login secret in that origin's storage. When
WeKan was opened at any other address - http for https, with or without
www, an IP address, another port, or the snap's 127.0.0.1 default - the
sign-in page never sees the secret and the login never completes.
The provider only accepts its registered redirect URI, so this cannot be
repaired from the page. Instead, when a provider login (OAuth2/OIDC,
SAML, CAS or an accounts-* provider such as Google) is offered and the
page's origin differs from ROOT_URL's, the sign-in page now names both
addresses and says to open WeKan at ROOT_URL or set ROOT_URL to the
address in use. The OAuth providers documentation lists it under
Troubleshooting.
Thanks to xet7 !
Fill 29 messages in each Romanian catalog while preserving existing translations and source variables. Extend checks for matching priority, unchanged cards and history recovery decisions.
Thanks to xet7.
The snap's default ROOT_URL is 127.0.0.1, and every link built in the
browser - Copy link of a card, list or swimlane, comment permalinks -
goes through Meteor.absoluteUrl(), which reads ROOT_URL, so a browser
that opened WeKan by the machine's name copied a 127.0.0.1 link nobody
else could follow. When ROOT_URL is loopback and the page is not, the
client now builds absolute links from the page's own origin, keeping
ROOT_URL's path. A real ROOT_URL still wins, and the server keeps
ROOT_URL for emails: `snap set wekan root-url=...` remains the setting
for those.
Thanks to n8willis and xet7 !
Fixes#6752.
Fill 44 messages in each Romanian catalog while preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes and server-only login settings.
Thanks to xet7.
Fill 25 messages in each Romanian catalog while preserving source variables and existing translations. Check retention, permanent deletion, recovery checkpoints and unrelated-board protection.
Thanks to xet7.
Fill 44 messages while preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes, movement directions and server-only login settings.
Thanks to xet7.
Fill 25 messages while preserving source variables and existing translations. Check retention, permanent deletion, recovery checkpoints and unrelated-board protection.
Thanks to xet7.
Fill 43 messages while preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes and movement directions.
Thanks to xet7.
Fill 25 messages while preserving source variables and existing translations. Check retention, permanent deletion, recovery checkpoints and unrelated-board protection.
Thanks to xet7.
Fill 43 messages while preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes and movement directions.
Thanks to xet7.
Fill 25 messages while preserving source variables and existing translations. Check retention, permanent deletion, recovery checkpoints and unrelated-board protection.
Thanks to xet7.
Fill 61 messages while preserving existing translations, source variables and literal examples. Extend checks for recovery choices, matching priority and unchanged cards.
Thanks to xet7.
Fill 36 messages while preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes.
Thanks to xet7.
Fill 61 messages while preserving existing translations, source variables and literal examples. Extend checks for recovery choices, matching priority and unchanged cards.
Thanks to xet7.
Fill 61 messages while preserving existing translations, source variables and literal examples. Extend checks for recovery choices, matching priority and unchanged cards.
Thanks to xet7.
Fill 36 messages while preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes.
Thanks to xet7.
Fill 61 messages while preserving existing translations, source variables and literal examples. Extend checks for recovery choices, matching priority and unchanged cards.
Thanks to xet7.
Fill 36 messages while preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes.
Thanks to xet7.
Fill 61 messages while preserving existing translations, source variables and literal examples. Extend checks for recovery choices, matching priority and unchanged cards.
Thanks to xet7.
Fill 36 messages while preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes.
Thanks to xet7.
Fill 61 messages in each Dutch catalog while preserving existing translations, source variables and literal examples. Extend checks for recovery choices, matching order and unchanged cards.
Thanks to xet7.
Fill 36 messages in each Dutch catalog, preserving existing translations, source variables and literal syntax. Extend checks for retained and discarded Sync changes.
Thanks to xet7.
Fill 36 messages in each of four Portuguese catalogs while preserving regional wording, source variables, format syntax and LDAP settings. Extend checks for retained and discarded Sync changes.
Thanks to xet7.
Fill 61 messages in each of four Portuguese catalogs, retaining existing translations and regional terminology. Extend checks for recovery decisions, matching priority and literal syntax.
Thanks to xet7.
Fill 36 messages in each of nine Spanish catalogs. Preserve source variables, import syntax, LDAP names and the distinction between retained and discarded Sync changes.
Thanks to xet7.
Fill 61 messages in each of nine Spanish catalogs while preserving existing localized values and source syntax. Extend checks for recovery decisions, import matching and permanent-deletion warnings.
Thanks to xet7.
Fill 97 current messages while preserving existing localized values, source variables and literal examples. Extend regression checks for import matching, recovery decisions, LDAP settings and retained Sync changes.
Thanks to xet7.
Fill 61 messages in each of four German catalogs, preserving existing translations and Swiss spelling. Extend regression checks for recovery decisions, source matching and literal syntax.
Thanks to xet7.
Fill 61 messages in each of five French catalogs, preserving existing localized values and source syntax. Extend translation and semantic regression checks for import, Sync and history recovery decisions.
Thanks to xet7.
All 322 translation suites and 21 human-preference checks pass. Keep the outstanding language backlog and fluent-review limitations visible.
Thanks to xet7.
Fill 20 messages and extend the Scrum inventory to 127 while retaining per-key checks. Preserve matching priority and existing planning. Full new wording remains low-confidence pending fluent review.
Thanks to xet7.
Fill 20 messages and extend the Scrum inventory to 127 while retaining per-key checks. Preserve matching priority and existing planning. Full new wording remains low-confidence pending fluent review.
Thanks to xet7.
Fill 20 messages and extend the Scrum inventory to 127 without weakening per-key checks. Preserve matching priority and existing planning. New wording remains low-confidence pending fluent review.
Thanks to xet7.
Fill 20 messages and retain per-key coverage while extending Scrum inventory to 127. Preserve matching, non-duplication and first-Sync planning protection. New wording remains low-confidence pending fluent review.
Thanks to xet7.
Preserve counters, matching priority, non-duplication and existing planning protections. Restore the Estonian regression suite without weakening coverage.
Thanks to xet7.
Translate 116 new planning messages across six catalogs and correct 34 Italian-seeded Aromanian labels. Preserve counters, source matching and existing planning protections. New Aromanian wording remains low-confidence pending fluent review. Seven targeted suites pass; ten failures from the latest broad run remain open.
Thanks to xet7.
An import that stopped halfway - a restart, a hung writer, a failure - left a
partial board nothing recorded. Each board import, copy, Trello zip and
Trello API import now writes an importRuns record first, with the id its new
board will have; every creator inserts the board with that id and the run's
id stamped on it. A heartbeat keeps the run alive; the method deadline now
stops the writer at its next step. A scan at startup and every 5 minutes
flags a stopped or failed run once and records it in Admin Panel ->
Problems -> Recovery, where an administrator keeps the partial board or
discards it: only the board carrying the run's stamp is removed, through the
board's own removal, then whatever else has its id. Discard is refused while
the import's Scrum stage is still written or recovered, and the Scrum resume
is refused while the import is discarded. Resume is deliberately not
offered: the source file is not kept, for its size, its personal data and
the anonymization it would undo; discard and import again instead.
Thanks to xet7 !
Every Scrum import used to create a new board. A board administrator can
now import a native wekan-scrum-2 transfer, or a WeKan board export, into
a board that already exists, from the Sprints view: Preview shows what
would change and writes nothing, Import writes it.
Sprints and releases are matched by ID on this board, then by
provenance, then by a name exactly one record has on each side; the rest
are created once with the source's provenance, so importing the same
file again changes nothing. Cards are matched by ID, or by card number
and title, and never created; unmatched, ambiguous and other boards'
cards are reported and left alone. Matched cards get the file's sprint,
releases, backlog rank, issue type and acceptance criteria; a move into a
finished sprint is refused. The writes go through the journaled Scrum
import stage, so an interrupted import is finished or discarded the same
way, and are recorded as one Scrum History change.
Thanks to xet7 !
Replace 35 wrong-language values and preserve overtime meaning, invitation variables and technical names. Full new wording remains low-confidence pending fluent review.
Thanks to xet7.
The popup opened with no title, so it rendered without a header and with
no close button; it now opens with the existing "Board announcement"
key as its title. Its Save is a submit button inside the form, handled
by the form's submit event, which the menu action inventory now records
and checks.
Thanks to xet7 !
List Sync from Jira or GitLab now carries an issue's sprint and fix
versions / milestones into the board's Scrum planning while Scrum is
enabled on the board. A missing sprint or release is created on this
board with the dates the source gives; an existing one is matched by its
source ID first, then by name. A local planning change stays until the
source changes that issue's planning, and a first Sync never removes
planning. The writes go through the durable Sync journal and steps, so
an interrupted Sync is finished or discarded like any other.
Thanks to xet7 !
Replace 35 wrong-language values, retain variables and import format names, and cover movement and removal scope. Full new wording remains low-confidence pending fluent review.
Thanks to xet7.
Correct 47 wrong-language values while retaining invitation variables and technical names. Add regressions against Italian and English fallback. New phrasing remains low-confidence pending fluent review.
Thanks to xet7.
Fill 23 messages while preserving applied changes, unwritten remainder and replay eligibility. New wording remains low-confidence pending fluent review; older linguistic defects remain open.
Thanks to xet7.
Fill 47 values while preserving import syntax, link-rule variables, configuration names and Sync planning semantics. New terminology and grammar remain low-confidence pending fluent review.
Thanks to xet7.
Fill 63 messages and cover conflict scope, replacement reuse, report limits and missing-versus-null values. New wording remains low-confidence pending fluent review.
Thanks to xet7.
The reporter puts a card at the bottom of the next list when it moves on and
at the top when it moves back. With only "moved to" and "moved from" a list
triggers, that needs a rule for every pair of lists. "A card is moved forward
to a later list" and "moved back to an earlier list" now fire on any move
between two lists of the board, compared by the lists' order rather than by
the screen, so they also work in right-to-left languages. They are matched
on the rule's own board, like the other trigger kinds
(models/lib/ruleMoveDirection.js).
tests/ruleMoveDirection.test.cjs covers the directions and what has none; a
Playwright case moves cards both ways through the REST API. The RepointBleed
guard counts the new matching path. New text is in English, pending
Transifex.
Thanks to rlach and xet7 !
Fixes#2076.
Fill 36 messages and cover permanent rejection, retained pending work, non-recreation of activities and irreversible cancellation. New wording remains low-confidence pending fluent review.
Thanks to xet7.
Admin Panel / Settings / Features could turn one "<prefix><number>" pattern
into links (#3069). The reporter wanted "[Task:3384]" and "[Incident:3384]"
to link to their tracker, and "[TK:1223]" with TK an abbreviation of Task.
"More link rules" now takes one "<token> = <url>" per line, with {number}
and {identifier} in both, and "Abbreviations" maps an identifier to the
word the address needs. All rules are matched in one pass, earliest first,
after the #3069 pattern, and text that is already a link is never rewritten,
so no rule relinks another's link. Only an http(s) rule with exactly one
{number} is used, and the values are URL-encoded into the address.
The markdown package carries a copy of models/lib/externalLinkRules.js;
tests/externalLinkRules.test.cjs keeps the two identical and covers the
reporter's examples and the refusals. The release risk baseline records the
example addresses in the new comments, and the default avatar's, which it
had not. New text is in English, pending Transifex.
Thanks to rzoss and xet7 !
Fixes#1463.
Preserve reporting caveats, cancellation membership and rollback eligibility. Cover all current Scrum keys and source variables. Full new wording remains low-confidence pending fluent review.
Thanks to xet7.
The site has one announcement for everybody; the reporter's teams needed a
reminder per board. A board admin writes it in the board menu, Board
announcement, and turns it on. Every member then sees it as a banner on the
board, as plain text, until they dismiss it; an edit gives it a new version,
so it shows again. Dismissing records the version the server reads, for a
board the user can see, so a client cannot dismiss a future edit in advance.
The text is trimmed and bounded, and an empty one cannot be turned on.
tests/boardAnnouncement.test.cjs covers showing, dismissing, editing and
the bounds; the board menu order guard includes the new item, admin only. A
Playwright case checks the banner and the dismissal. New text is in English,
pending Transifex.
Thanks to TiibCD and xet7 !
Fixes#1566.
Fill 73 values, preserve variables and shared labels, and use the shared token scanner in regression coverage. New terminology and phrasing remain low-confidence pending fluent review.
Thanks to xet7.
The reporter coloured lists by stage and wanted cards to follow: "by merely
dragging cards around the colors would change". The only way was a script
that rewrote every card's colour through the API, again after every move.
A list's colour popup now has "Cards without a colour of their own use this
colour". Such cards are shown in the list's colour, and nothing is written
to them: a card dragged to another list takes that list's colour, and a
card's own colour always wins. models/lib/cardDisplayColor.js decides; the
card colour helpers use it from the list the card is shown in.
tests/cardDisplayColor.test.cjs covers the rule; the guards that pinned the
old colour code now pin it through the new helper. New text is in English,
pending Transifex.
Thanks to C0rn3j and xet7 !
Fixes#4756.
Fill 36 release-selection and recovery messages in Maori, Northern Sotho, Somali and Tok Pisin. Extend the expected inventory to 111 while retaining per-key coverage and variable checks. Full new wording remains low-confidence pending fluent review.
Thanks to xet7.
The view menu sits on a board, but choosing a view there changed it for
every board, so one board could not stay on Calendar while another stayed
on Swimlanes. A view chosen on a board is now that board's own
(profile.boardViews, published to its owner beside the shared value). A
board without its own choice uses the view every board shared before, then
the board's default, so nothing changes for anybody until they choose a
view on a board. A choice made off any board still sets the shared view,
and the browser's stored view follows only that one. The server accepts only
a known view under a safe board key. Label text visibility per board, the
other half of #4256, was done earlier.
The guards that pinned the single shared view now pin both; a new test runs
the stored-view logic per board, and a Playwright case checks two boards.
Thanks to DimDz, Meeques and xet7 !
Fixes#4906,
Fixes#4256.
Fill 63 release-selection and Scrum recovery values in seven catalogs. Restore six planning suites without weakening their coverage; four other Scrum translation suites remain to repair.
Thanks to xet7.
Only the Jira importer created sprints and releases. GitLab iterations and
milestones became nothing but milestone: and iteration: labels, OpenProject
versions only a version: label, and Asana milestones and Trello produced
nothing Scrum-related, so a board moved from those tools lost its planning.
Imports now map what each export really carries, through the same journaled
Scrum import stage as Jira and WeKan JSON, so an interrupted import is
recovered the same way. GitLab iterations become sprints and milestones
releases, with their dates and state. OpenProject versions become releases
and its Sprint resources sprints; position sets the backlog rank and story
points become the board's estimate field. Asana milestone tasks become
releases for themselves and the tasks they wait for. Trello has no sprints or
releases; its Power-Up data is counted in the import loss report.
As for Jira, a started sprint is imported as planned and a finished one not
at all, because the exports have no commitment or close snapshot; both are
reported. Malformed dates, unknown states, duplicate names and cards in an
iteration that is not imported are reported, never invented. The milestone
and iteration labels stay for List Sync and existing boards. The import
page's Scrum settings part now also decides whether external imports bring
their planning in. GitLab and OpenProject exports write each card's sprint
and first release back so a board round-trips.
Thanks to xet7 !
Fill 144 values across four catalogs, preserve Swiss spelling, source variables and technical syntax, and cover recovery consequences and release selection.
Thanks to xet7.
A Scrum History undo, redo or restore keeps a checkpoint that blocks every
Scrum edit on its board until it finishes, and only its author could retry
it, with the same plan. When somebody else had changed one of its records,
its History row changed or its author lost write access, every retry failed
the same way, the checkpoint could not be discarded online or offline, and
the board's Scrum edits stayed blocked for good.
A retry that fails for a reason the next one would meet again now marks its
checkpoint. A board administrator sees such a checkpoint in the History
recovery notice and can roll it back, which restores every record it wrote
to the saved "before" value and revision and is offered only when nobody
changed those records since and none of its History was written, or keep the
board as it is, which removes the checkpoint and writes nothing while
reporting how much of the operation had been written. A checkpoint that has
not stopped on a conflict stays its author's to retry. The resolution names
the checkpoint it resolves, so a repeat is a no-op; it claims the checkpoint
by compare-and-set, fencing the author's workers, waits for an in-flight
write, and checks every record before and after its own writes. Each one is
recorded in Admin Panel / Problems / Recovery. The offline command
releases/recover-scrum-history.cjs does the same with every writer stopped.
Unit, integration (against MongoDB 7), Meteor and Playwright tests cover
rollback, discard, refusals, concurrency and the offline command. New text
is in English, pending Transifex.
Thanks to xet7 !
A custom field could be hidden from non-admins (adminOnly, #3141), but not
shown to everyone while editable only by admins, which a score or a value
computed elsewhere needs. A custom field can now be marked read-only in its
settings: every board member sees the value, and only a board admin - or the
REST API and rules acting as one - can set, change or clear it. The card
editor offers editing only to board admins, and the server refuses everyone
else through adminOnly's write guard, at the driver boundary, so no write
path is left out. Turning the flag on or off is itself an admin's change.
tests/readOnlyCustomField.test.cjs drives the rule, including setting an
empty field and clearing one. New text is in English, pending Transifex.
Thanks to CarloRampini and xet7 !
Fixes#3143.
Fill 180 values across five catalogs while retaining source variables and technical syntax. Cover recovery consequences, replay eligibility and release selection.
Thanks to xet7.
The maintainer suggested adding the users to an organization or team and
giving the board to it. Admin Panel / People adds a page of selected users
to a team in one step, organizations gain users by email domain, and
"propagate members to boards" makes the team's or organization's members
members of its boards, later members included.
Thanks to rjl9 and xet7 !
Fixes#5050.
Labels belong to a board, so a card moved or copied to another board has
its labels mapped by name, and a label the destination board did not have
was dropped. Now a missing named label is created on the destination board,
with its colour, when the person moving or copying the card is an admin of
that board. Creating labels is admin-only there, and a move must not do
what that user could not do directly, so for anybody else such a label is
still dropped. Unnamed labels are never created or matched, as they cannot
be told apart. Copy and move share the rule in
models/lib/crossBoardLabels.js.
tests/crossBoardLabels.test.cjs covers admins, members, unnamed and duplicate
labels; the cross-board move Playwright case checks a label that only the
source board had.
Thanks to d3dbit and xet7 !
Fixes#1759.
Organizations could gain new users automatically by email domain, but users
who register through one identity provider - the reporter's Nextcloud -
often share no domain, so they could not be grouped. OAUTH2_DEFAULT_ORGANIZATION,
or its field under Admin Panel / People / OAuth2, names an existing
organization (by short name, display name or id) that every account created
by an OAuth2/OIDC login joins, beside the domain rule. A name that matches no
organization creates none: the login goes on and the server log says so.
Listed on every platform, with snap help lines for it and for
DEFAULT_AVATAR_URL and OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS, which lacked
them.
Thanks to vasyugan and xet7 !
Fixes#5339.
Fill 25 pending messages while preserving release selection, applied/total variables, discard consequences and oldest-first limits. Full wording remains low-confidence pending fluent review; zero reported placeholders does not certify older translations.
Thanks to xet7 !
A user who had not uploaded an avatar was shown with initials only. The
maintainer accepted a general avatar feature configured in environment
variables only, with a URL to an intranet server or a Gravatar-style service
and the username replaced. DEFAULT_AVATAR_URL is that template: {username},
{userId}, {emailMd5} and {emailSha256} are replaced, URL-encoded, and only
an http(s) template is used. /avatar-default/<userId> redirects the browser
there; the server fetches nothing. An uploaded avatar always wins, and when
the default image does not load the initials are shown again. There is no
Admin Panel field. The variable is listed on every platform and documented in
docs/Features/Members/Default-Avatar.md.
Thanks to jLouzado and xet7 !
Fixes#824.
Fill 47 messages while preserving import syntax, environment identifiers, report limits and named placeholders. Ordinary Manx placeholders are cleared; newly added pending messages and older language quality remain under review. Complete grammar is low-confidence pending fluent review.
Thanks to xet7 !
A saved List Sync operation whose list was removed, recreated or
reconfigured, or whose actor lost full-list write access, could never be
replayed. The replay job refused it every minute with only a console line,
and because a new Sync of the list resumes the pending operation first,
that list could not Sync at all.
Such an operation is now marked once, with one Recovery event, and a
blocked manual Sync says why. Admin Panel / Problems / Recovery lists these
operations with what they applied and their live replayability. An
instance administrator can discard one only while the same checks a replay
makes still fail. The discard holds the list's Sync lease, records one
immutable decision, then removes the saved steps and the operation marker,
reading each removal back. It writes no card: changes already applied stay
and the rest are never written. A retry or a second administrator only
finishes the removal, and a replay that finds a decided discard completes it
instead of resuming. The intent stays as evidence and the discard is
audited in Recovery.
Unit, source-wiring and negative tests cover recording once, refusing
non-administrators and replayable operations, and discarding twice; an app
test and a Playwright case cover the Recovery page. New interface text is
in English, pending Transifex.
Thanks to xet7 !
A card had exactly one release, scrum.releaseId. Jira import kept only the
first fix version of an issue and reported the rest as lost, Jira export
wrote no fix versions at all, and the card UI could not show or pick more
than one release.
A card's releases are now a list, scrum.releaseIds, with releaseId kept as
its first entry so older servers, importers and REST readers still see one.
Existing cards are not migrated: every reader goes through cardReleaseIds(),
which reads the list and the old single field the same way, so cards saved
either way work side by side, and a card moves to the new form on its next
Scrum save. A save with releaseIds replaces the list; a save with only
releaseId, from an older client, replaces the first release and keeps the
others, and null clears them. Every release must belong to the board,
checked in one query; duplicates collapse and a releaseId that contradicts
the list is refused.
Copies and moves to another board link each release by name. The native
transfer writes one release exactly as before and adds releaseIds only for
cards with several, and remaps each of them on import. Jira import maps every
fix version and Jira export writes them all as fixVersions. Board View /
Sprints shows each release's cards and how many are done, counting a card in
each of its releases. Scrum History checks and guards every release, and
rule e-mails name them all. The Product Backlog and card details use a
multiple select.
tests/scrumMultipleReleases.test.cjs covers the rules and fails if any code
reads the single field directly; a Playwright spec drives the UI. New text is
in English, pending Transifex.
Thanks to xet7 !
Fill 63 messages while preserving source/local distinctions, missing/null behavior, retention limits and non-resumable report semantics. Sync terminology and full grammar remain low-confidence pending fluent review.
Thanks to xet7 !
#2906 asked how to add and archive lists by script. Lists could be added,
edited and deleted through REST, but not archived or restored: the PUT edits
only live lists and has no archived field. POST
/api/boards/:boardId/lists/:listId/archive and .../unarchive now do what the
list menu does, for a user with write access to the board, answering 404
when the list is not in the expected state. docs/API/Lists.md shows both.
Thanks to stevekiss and xet7 !
Fixes#2906.
OAuth2/OIDC logins could be limited to email domains with
OAUTH2_ALLOWED_EMAIL_DOMAINS, but the Meteor login providers (Google,
GitHub, Facebook, X, Meteor Developer, Weibo, Meetup) let anyone with an
account there sign in. OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS, or the new
field under Admin Panel / People / OAuth login providers, restricts them
with the same rule and the same policy code. It is checked before an account
is created or merged, and on every later login, so narrowing the list also
applies to existing accounts. A provider that sends no email is refused while
a restriction is set, and a list that is not domain names is refused when
saved instead of locking everyone out.
Listed on every platform. New text is in English, pending Transifex.
Thanks to jakubgs and xet7 !
Fixes#1904.
An outgoing webhook carried mostly ids: the card title and the acting user,
but not the list, board or swimlane names, not the link, and nothing about
the person a join or an assignment was about. For an assignment the payload
said who assigned, but not who was assigned, which is what a chat
integration needs in order to tell that person.
The default payload now also has list, board, swimlane and url, member and
memberUsername for joining or leaving a card, and assigneeId, assignee and
assigneeUsername for joinAssignee/unjoinAssignee, which no param carried
before. The fields are additive, and WEBHOOKS_ATTRIBUTES still replaces the
default list wholesale. docs/Features/Webhooks/Webhook-data.md shows an
assignment payload.
Thanks to chrisi51 and xet7 !
Fixes#3297.
Fill 71 labels and short messages while preserving named variables, distinct sprint states and consistent navigation labels. Use the shared token scanner in the Manx regression suite. Scrum compounds and grammar remain low-confidence pending fluent review.
Thanks to xet7 !
A user added to a team becomes a normal member of the boards that team is
assigned to (#4593, addUserToTeamBoards). The Admin Panel paths did that,
but the login providers' group syncs - LDAP_SYNC_TEAMS and OIDC groups with
PROPAGATE_OIDC_DATA - pushed the team onto the user with a plain $push. Such
users could see the team's boards but not work on them. Both now run the same
board sync after adding a team: LDAP imports it, and the wekan-oidc package,
which cannot import app code, reaches it through a global as it already
reaches authEnv.
tests/teamBoardsFromLoginSync.test.cjs pins both paths and fails if any code
pushes a team onto a user without the board sync; the OIDC concurrency test
now checks each concurrent login syncs only its own team's boards.
Thanks to xet7 !
Admin Panel / Settings / Layout / Custom head meta tags was saved and
published, but the page's <head> only ever received the custom link tags and
the manifest, so description, Open Graph and other meta tags never reached a
browser or a link preview. They are written now, when custom head tags are
enabled. Only <meta> elements are taken from the text: a script, a style, a
second title or plain text is dropped, and so are http-equiv refresh and
set-cookie, which would redirect every visitor or write their cookies.
tests/customHeadMetaTags.test.cjs covers the tags kept and the ones refused;
a Playwright case fetches a served page.
Thanks to xet7 !
Board Settings / Subtasks shows the deposit board's lists since #3414 and
stores the chosen landing list on the main board, but addSubtaskCard read
only the deposit board's own setting, so the choice was ignored. When the
deposit board itself sends its subtasks to another board, that setting
names a list of a third board, and the subtask was written with the deposit
board's id and that third board's list.
models/lib/subtaskLandingList.js now decides: the main board's choice when
it is a live list of the deposit board, then the deposit board's own, and
only when the deposit board has none is its Queue list created and stored
as before. A choice that is gone, archived or on another board falls back
to the deposit board's first live list, never a foreign one. So several
boards that share one deposit board can each land their subtasks in a list
of their own, which is what the reporter wanted.
Thanks to TiibCD and xet7 !
Fixes#1781.
Repair 16 messages in 11 locale files and extend exact-literal checks to ten import formats. Accept grammatical affixes around commands and filenames without changing valid translated prose. Three relevant suites and 21 human-preference checks pass.
Thanks to xet7 !
The import/export entry lists what is left after the three new formats, and
the online History-chain switch moves to the maintainer-decision category,
with the choice it needs.
Thanks to xet7 !
Repair 73 messages in 25 locale files. Preserve case-sensitive JSON fields and Jira API paths while retaining surrounding prose and localized quotation styles. Add catalog-wide positive and negative literal checks for four import formats. All 322 translation/i18n suites pass; broader prose translation remains in progress.
Thanks to xet7 !
The 2026-09-30 retention decision compacts receipts and request IDs after 90
days "to a permanent minimal id and outcome". Stored Sync plans got a
compaction sweep because a plan carries its whole work. The five receipt
collections the decision also names (Scrum History completions and
requests, List Sync intents and completions, tray delivery receipts) were
left on the TODO list, but checked against the code they are already that
form when written: an id, the identity it proves and its outcome, with no
payload. Compacting them would save nothing and would break the exact-shape
checks their readers make.
tests/receiptRetentionShape.test.cjs builds each receipt with the real code
where it is pure, requires it to stay small and free of growing lists, and
pins the reader checks that refuse any extra field.
Thanks to xet7 !
Four blocks were dated development logs kept as history: "Carried to a
future release", "Active implementation checkpoint", "Scrum and Sync
resumed" and the #6701 snap login note. Checked against the code on
2026-10-08, almost all of what they called unfinished has since been built:
durable rule actions, Sync activation and replay, History linked at write,
Scrum worker serialization and recovery notices, the Jira Scrum import and
everything in their maintainer-decision lists. #6701 was closed on
2026-09-17 and its FerretDB fix is released.
They are replaced by one short "Carried to a future release" that lists
only the open work: nine items that can be built here, the ones that need
infrastructure or credentials, the backend properties that are not steps
left undone, and filing the #4790 split. The logs remain in git history.
Thanks to xet7 !
Correct mixed-language instructions and translate OPML and Org mode help. Restore JSON field identifiers and the Jira API path; preserve format syntax and source variables. Full prose remains provisional pending fluent review.
Thanks to xet7 !
#4294 asked for four things. Several triggers and actions, rule variables,
renaming in place and rule import/export were built earlier; two parts were
still missing.
- "I want the assignee to be the creator of the card by default": rules had
member actions only. Add and Remove assignee actions take a username, a
{creator}/{assignees}/{members} token, the user who triggered the rule, or
"*" for every assignee, and write card.assignees. They are durable through
Sync like the member actions, with the joinAssignee/unjoinAssignee
activities the assignees hook writes.
- "give a Rule a default name": Add Rule with an empty title showed an
error, and rules.createRule stored the literal "Rule". The title is now
optional; the rule is named after its trigger and action ("When ...,
then ..."), and the rules list renames it in place.
Fixing this found that "Remove all members from the card" iterated the
card's assignees while removing from its members: an earlier fix believed
assignMember wrote assignees, but both definitions in models/cards.js write
members. It removed only members who were also assignees. Remove-all now
iterates card.members, in the ordinary and the durable path, and the guards
that pinned the wrong collection now read models/cards.js to decide.
New text is added in English, pending Transifex.
Thanks to xeruf and xet7 !
Fixes#4294.
Correct 236 storage, migration, backup and report values. Preserve provider identifiers, units, simulation limits and uncertainty. The explicit wrapper queue is empty; other mixed-language values still need review. Statistical terminology and full technical prose remain low-confidence pending fluent review.
Thanks to xet7 !
server/moveBoardObjects.js reads cardFieldStates with a { cardFieldStates: 1 }
projection to drop hidden fields when objects move between boards. The guard
counted that read as a writer and failed. Projections are now excluded; the
publication is still pinned separately.
Thanks to xet7 !
The Todoist, OPML and Org mode modules cite their specifications
(todoist.com, opml.org, orgmode.org) in comments; the release preflight
reported them as new URL origins. Only these files' entries are added.
Thanks to xet7 !
Merging a login into an existing account (OIDC with
OAUTH2_MERGE_EXISTING_USERS, and the Meteor OAuth providers with their
merge setting) happens in Accounts.onCreateUser: the existing user is
removed and returned, and Meteor inserts it again under the same _id. That
removal ran Users.after.remove, which is the account-deletion cleanup: it
pulled the user out of every board's members and watchers and every card's
members and assignees, and deleted their avatars. A merged user came back
signed in with no boards. Both paths now remove through collection-hooks'
.direct, which skips the hooks.
tests/mergedUserKeepsBoards.test.cjs pins both paths and fails if any code
removes an account through the hooks and then returns it; the OIDC merge
test's stub now throws on a hooked removal.
Thanks to xet7 !
Replace 76 English wrappers and repair 12 search labels and messages. Verify localized queries with the production parser, including quoted values, absent fields, invalid limits and collision-free operators. Technical compounds remain provisional pending fluent review.
Thanks to xet7 !
Org mode files from Emacs, Orgzly, Beorg or organice import as boards:
level-1 headings become lists and level-2 headings cards. TODO keywords,
including those a #+TODO line declares, decide the done tag; [#A]
priorities become priority:A labels and :tags: labels. SCHEDULED, DEADLINE
and CLOSED become the start, due and end dates, and a :CREATED: property the
creation date. Body text becomes the description, and its - [ ] checkboxes
and childless level-3 headings the card's checklist; a level-3 heading with
children becomes a checklist of its own. #+TITLE names the board.
Timestamps carry no zone in Org and are read and written as UTC.
Repeaters, warning delays and text outside cards are reported in the loss
report. Export writes the same outline.
tests/orgMode.test.cjs covers custom keywords, localized day names, the
round trip and the negatives. A Playwright case imports a file through the
page, and the export audit fetches the new format. New instruction text is
in English, pending Transifex.
Thanks to xet7 !
Replace 76 artificial English wrappers while preserving template variables, named import counts, separators and font names. Search operators still need parser-aware review. Complete software compounds remain provisional pending fluent review.
Thanks to xet7 !
OPML is what Workflowy, Dynalist, OmniOutliner, Logseq and most other
outliners export and import. Top-level outlines become lists and their
children cards, with the outliners' _note as the description and a completed
item (Workflowy's _complete, Dynalist's complete) as the done tag. Deeper
outlines become checklists with their descendants as items, and the head
title becomes the board title. A list's note and url/htmlUrl/xmlUrl links are
reported in the loss report. Export writes the same with Workflowy's
attribute names; line breaks and tabs in notes are written as character
references so that they survive the XML parser.
Like the Leo outline, the XML is parsed on the server only, with htmlparser2
in XML mode: DTDs and external entities are never resolved, and size and node
counts are bounded. tests/opmlOutline.test.cjs covers a Workflowy/Dynalist
file, the round trip and the negatives (an external entity, a node bomb). A
Playwright case imports an outline through the page, and the export audit
fetches the new format. New instruction text is in English, pending
Transifex.
Thanks to xet7 !
Replace 145 artificial English wrappers and translate the new Todoist import guidance. Preserve runtime identifiers, protocol names, time directions, check states and source variables. Complete software compounds remain provisional pending fluent review.
Thanks to xet7 !
Todoist's Export as a template writes, and Import from template reads, a
CSV with TYPE, CONTENT, DESCRIPTION, PRIORITY, INDENT, AUTHOR, RESPONSIBLE,
DATE ... DEADLINE_LANG columns. Sections become lists, tasks become cards,
indented sub-tasks a Sub-tasks checklist, and notes comments on the task
above. @label words become labels and leave the title, PRIORITY 1-3 become
labels p1-p3 (1 is Todoist's highest; 4 is its "no priority"), RESPONSIBLE
becomes the owner, and DATE becomes the due date, or the start date when a
DEADLINE is the due date. Dates in words such as "every monday", DURATION,
orphan notes and sub-tasks and unknown row types are reported in the loss
report. Export writes the same columns in Todoist's order, with its
view_style=board meta row. Todoist exports no completed tasks, so finished
checklist items are left out.
tests/todoistCsv.test.cjs covers quoted fields, the round trip and the
negatives. A Playwright case imports a template through the page, and the
export audit fetches the new format. New instruction text is in English,
pending Transifex.
Thanks to xet7 !
Translate board, font, color, voting and filter labels. Restore numeric poker choices, date formats and compact sort labels without artificial prose prefixes. Fine color shades and software compounds remain provisional pending fluent review.
Thanks to xet7 !
A rule's trigger and actions are edited in place (rules.updateRule), and the
send-email rule action includes the card's content and live attachments,
with SMTP delivery tested against a local server. Live external mail
providers were not tested.
Thanks to kabi178 and xet7 !
Fixes#2713.
Fill 224 workspace, Scrum, Sync and notification-recovery messages and ten short Blockly labels hidden by the fill heuristic. Preserve variable tokens, report limits, missing/null distinctions and irreversible cancellation wording. Complete software phrasing remains provisional pending fluent review; older seeded translations still need auditing.
Thanks to xet7 !
MAIL_SERVICE_PASSWORD_FILE, MONGO_PASSWORD_FILE and S3_SECRET_FILE were
listed on every platform, and nothing read them. Per the maintainer decision
of 2026-10-08:
- MONGO_URL_FILE holds the whole MongoDB URL. Meteor connects before any
WeKan code runs, so the Docker entrypoint, the snap's wekan-control,
start-wekan.sh and start-wekan.bat read it and start WeKan with MONGO_URL
set. An unreadable or empty file stops the start instead of falling back
to a default database. The snap log now masks a password in MONGO_URL.
- MAIL_URL_FILE and S3_SECRET_KEY_FILE fill MAIL_URL and S3_SECRET_KEY first
thing in server/main.js (models/lib/envSecretFiles.js). As for the login
secrets, the variable wins over its file.
- The three dead names are gone from the Dockerfile, every docker-compose
file, the snap settings and help, the start scripts and the docs. The
example secret files are renamed to match, and WeKan logs a warning naming
the replacement when a retired name is still set.
The issue itself was closed earlier, with only part of this done.
Thanks to xet7 !
The snap, Docker, docker-compose and start scripts have offered
LOGOUT_WITH_TIMER, LOGOUT_IN, LOGOUT_ON_HOURS and LOGOUT_ON_MINUTES since
2018, but the code that read them was removed with the job queue it ran on,
so they did nothing. Per the maintainer decision of 2026-10-08 they work
again. A login ends LOGOUT_IN days after it was made, or at
LOGOUT_ON_HOURS:LOGOUT_ON_MINUTES server time (the next such time, or on the
day LOGOUT_IN days later). Once a minute the server removes the expired
login tokens in one query, and Meteor signs out the browsers that used them.
The four settings are overridable in Admin Panel / People / Login like the
other login variables, with hours and minutes bounded. An unusable
combination signs nobody out and the server log says why.
tests/logoutTimer.test.cjs checks the one-query cutoff against the
per-login deadline over two years of logins in three time zones, two of them
with daylight saving time.
Thanks to xet7 !
Fill 175 messages while preserving function results, angle units, screen-reader states, text-operation scope and numbered substitutions. Mathematical loanwords and full software phrases remain provisional pending fluent technical review.
Thanks to xet7 !
`snap set wekan bind-ip=127.0.0.1` makes WeKan listen on loopback only
(snap-src/bin/config, snap-src/bin/wekan-control export BIND_IP, which
Meteor honours); the bundle and Docker take the BIND_IP environment
variable.
Thanks to galletl and xet7 !
Fixes#4403.
The checklist menu has Move Checklist and Copy Checklist with a board /
swimlane / list / card picker (client/components/cards/checklists.jade,
checklists.js).
Thanks to qiutian00 and xet7 !
Fixes#4250.
The Bigboard board view shows several boards on one page
(client/components/boards/bigboardView.*,
docs/Features/Board/Bigboard.md), and cards can be dragged between
boards in it.
Thanks to Jieiku and xet7 !
Fixes#4223.
Boards on All Boards are reordered by drag and drop into each user's
own order (client/components/boards/boardsList.js,
models/lib/boardSortReorder.js, sortBoardsForUser), boards have colours
(boardChangeColorPopup), and the All Boards table view lists boards as
rows.
Thanks to compumatter and xet7 !
Fixes#2796.
Board WIP limit groups share one limit across several lists
(wipLimitGroups in models/boards.js,
models/lib/wipLimitGroupDecision.js), set in the sidebar popup, and the
list headers highlight a group over its limit
(client/components/lists/listHeader.js).
Thanks to aviertio and xet7 !
Fixes#2489.
Auth0 signs in through the OAuth2/OIDC service, whose login style can
be `redirect` (OAUTH2_LOGIN_STYLE, also in Admin Panel / People /
OAuth2); with OIDC_REDIRECTION_ENABLED=true the login page goes
straight to the provider (client/components/main/layouts.js,
server/models/settings.js).
Thanks to xet7 !
Fixes#2211.
Admin Panel / Settings / Email Templates customizes the subject and
body of invitation and activity emails, with {board} {card} {list}
{username} {url} {comment} {action} variables escaped on the server
(client/components/settings/settingBody.jade,
server/notifications/email.js).
Thanks to hingerlanton and xet7 !
Fixes#2148.
A custom field of type date is shown on the minicard as a compact date
badge, its label can be hidden (showLabelOnMiniCard), and the date
formats include date-only variants that drop the time
(client/components/cards/cardDate.jade, client/lib/dateDisplay.js).
Thanks to gerroon and xet7 !
Fixes#2145.
Board reports have ten charts - dashboard, burndown, burnup, cumulative
flow, control chart, cycle time, flow efficiency, lead time, throughput
and WIP run (client/components/boards/charts/,
server/lib/boardChartData.js) - with PDF and Excel export
(models/server/ExporterChartPDF.js, ExporterChartExcel.js).
Thanks to xet7 !
Fixes#2043.
Subtask helper boards (titles wrapped in ^...^) are filtered out of All
Boards, the board publications, Bigboard and the multi-board calendar
by notHelperBoardTitle() (models/lib/helperBoards.js), tested by
tests/helperBoards.test.cjs.
Thanks to nmd3 and xet7 !
Fixes#1990.
An administrator can mark an email address verified in Admin Panel /
People / edit user (client/components/settings/peopleBody.jade,
setEmailVerified in server/models/users.js), and the verify-email and
resend-verification routes exist (config/accounts.js).
Thanks to lucg71 and xet7 !
Fixes#1921.
Global Search (/global-search, config/router.js) matches free text in
titles, descriptions, comments, custom fields, checklists and
attachments (server/publications/cards.js), and finds archived cards
with `status:archived` / `status:all` (config/search-const.js).
Thanks to usmcamp0811 and xet7 !
Fixes#1844.
Thumbnails and covers are rotated from EXIF on the server with sharp's
`.rotate()` (server/lib/imageThumbnail.js, server/lib/imageGif.js).
Full-size originals are shown by the browser, which applies EXIF
orientation by default, and no WeKan CSS overrides `image-orientation`.
Thanks to CWempe and xet7 !
Fixes#1758.
The list menu has Move and Copy with a board picker
(client/components/lists/listHeader.jade, listHeader.js), and the
server move checks the right to change both boards
(server/models/lists.js, requireBoardMutation for source and
destination). Multi-Selection can move or copy several lists to another
board (client/components/sidebar/sidebarFilters.jade).
Thanks to h0jeZvgoxFepBQ2C and xet7 !
Fixes#1704.
The person who made a change is never notified of it, except when they
@mention themselves: server/models/activities.js filters `user._id !==
userId` from the recipients. The requested behaviour is the fixed
default.
Thanks to gpelouze and xet7 !
Fixes#1631.
A rule does it: trigger "card moved to" a list
(client/components/rules/triggers/boardTriggers.jade) with the action
"add acting user as member"
(client/components/rules/actions/cardActions.jade,
models/lib/ruleActingUser.js, server/rulesHelper.js). The mover is
added to the card's members, shown on the minicard, and can be removed.
Thanks to xet7 !
Fixes#793.
ldap_sync_now existed in packages/wekan-ldap/server/syncUser.js, but nothing
imported that file, so the method was never defined. It also imported every
directory user regardless of the sync settings. Per the maintainer decision of
2026-10-08 it is now loaded and wired to a Sync LDAP users now button. It runs
the background sync once with the settings in effect: import new users and/or
keep existing users updated, without needing the schedule to be on. Only an
active site administrator can run it, and with neither setting on it says
there is nothing to sync. The button and the scheduled job share one run at a
time, and a failed run reports the directory's error instead of success.
New text is added in English, pending Transifex.
Thanks to xet7 !
Move misplaced translation entries out of Status, record the Bislama and login-notice batch, and guard against matching prose mentions of Upcoming. Changelog and release-summary tests pass.
Thanks to xet7 !
Translate 116 Bislama Blockly labels and 62 read-only login notices while preserving source tokens and existing human prose. Extend state, operand, argument-order and read-only semantics checks. All 321 translation/i18n suites and 21 human-preference checks pass.
Bislama software compounds remain provisional. Browser and screen-reader sessions and the broader translation audit remain open.
Thanks to xet7 !
ldapts opens its socket lazily. Test connection connected and then bound only
when LDAP_AUTHENTIFICATION was set, so without a service account no operation
ran and it reported success even for a host that does not resolve. Per the
maintainer decision of 2026-10-08 a test without credentials now does an
anonymous base-scope search of LDAP_BASEDN (no attributes, one entry at most)
and succeeds only when the directory answered; otherwise the directory's own
error is shown. Without a base DN it says nothing could be tested.
Thanks to xet7 !
With HEADER_LOGIN_ID and HEADER_LOGIN_TRUSTED_IPS set, a proxy at a trusted
address signs in as anyone it names. Since the 2026-10-05 Admin Panel work a
site administrator could switch that on from People / Header login, so a
stolen administrator session was enough to open every account. Per the
maintainer decision of 2026-10-08 the six HEADER_LOGIN_* settings now come
from the environment only: a value stored in the Admin Panel is ignored, the
pane shows the values in effect read-only with no Save button, and a save sent
by hand is refused and recorded in Admin Panel / Problems as ProxyBleed
(authn.header-login-env-only). Every other login section stays overridable.
New text is added in English only, pending Transifex.
Thanks to xet7 !
Add 74 translations, repair three Bislama color labels and preserve exact numbered placeholders. Verify card-field scripts and rendering, Blockly ranges and control flow, and source-scoped native color terms. Relevant suites and human-preference checks pass.
Minority-language software wording remains provisional, especially Bislama and Wu Chinese; fluent-speaker review and browser checks remain open.
Thanks to xet7 !
Automatic logout is implemented, header login stays environment-only, LDAP
Test connection without a service account does an anonymous base search,
ldap_sync_now gets a Sync now button, and the #5724 secret files become
MONGO_URL_FILE, MAIL_URL_FILE and S3_SECRET_KEY_FILE.
Thanks to xet7 !
Fill 119 keyboard and card-field strings in Akan, Maori, Northern Sotho, Somali, Tok Pisin and Waray. Preserve physical key identities, navigation direction and source variables. All 31 relevant suites and 21 human-preference checks pass.
Assembled software wording remains provisional, especially Akan, Northern Sotho and Waray; fluent-speaker review and browser checks remain open.
Thanks to xet7 !
Update the stale README metric to 182 of 234 locale catalogs above 90 percent non-English text. Keep the source-derived regression check and state that coverage does not establish fluency.
Thanks to xet7 !
Fill 44 values while retaining hiding scope, unchanged data and settings, restoration and board-specific field order. All 30 relevant suites pass, including full catalog token and rendering checks.
Breton, Faroese, Romansh, Sardinian, Scottish Gaelic and Sicilian wording is provisional and needs fluent-speaker review. Browser checks were not run.
Thanks to xet7 !
Add 16 missing translations in Finnish, Swedish, German, French, Spanish, Portuguese, Italian and Dutch. Preserve source order and verify unchanged-data and per-board-order semantics.
Thanks to xet7 !
Fill 44 English placeholders including keyboard names and short Blockly labels. Check cancellation scope and retained key names. Technical wording remains low confidence pending speaker review; the broader dialect audit remains open.
Thanks to xet7 !
In the verification run the second click on the Multi-Selection color
button failed: the sidebar re-renders while the cards' new colors arrive,
and the button was "not stable" and then detached for 15 s. The spec now
clicks again, up to three times, until the popup's color wheel is visible.
It passed 3 of 3 alone.
Thanks to xet7 !
Since the date templates were merged (9c288c3d4d), the minicard received,
start, due, end and custom-field date badges passed their title as
showTitle="{{_ 'card-due'}}". Spacebars does not evaluate {{...}} inside an
inclusion argument, so the badge's title - its tooltip and accessible name -
read "{{_ 'card-due'}} week 41"; the #6750 browser spec's page snapshot
showed it. The badges now pass titleKey="card-due" and dateBadgeBody
translates it; the card-details badges keep their showTitle helpers.
tests/jadeInclusionArgsNoMustache.test.cjs fails on any +template(...)
argument string containing {{...}} in client/ or packages/, pins the five
badges, and recognises the broken form.
Thanks to xet7 !
The #6750 browser spec failed on Shift+D: the due date editor opened and
closed again. client/lib/keyboard.js re-dispatches a key typed on a
non-Latin layout as its Latin key code, and decided "another language" by
comparing the key with the key code's lowercase letter - which also matched
every SHIFTED Latin key ('D' is not 'd'), symbols such as '!' and the
Shift key itself. So each Shift shortcut fired twice; for Shift+D the copy
clicked the same due date control again and closed the popup. The Shift+1-9
filters were affected the same way.
It now re-dispatches only a single non-ASCII character whose key code is a
Latin letter or digit, and copies the Shift, Ctrl, Alt and Meta state, so
Shift shortcuts keep working on non-Latin layouts too.
tests/keyboardNonLatinRedispatch.test.cjs runs the real handler: shifted
Latin keys, symbols and modifiers are not duplicated; Cyrillic letters map
with and without Shift; it fails on the previous code.
Thanks to mimZD and xet7 !
The browser suite failed "String Template help preserves literal examples"
in all 67 locales of every browser: the Custom Field String Template help
showed the raw key custom-field-stringtemplate-context-hint. Its text has
literal "%{card.title}" and "%{value|urlencode}", which the sprintf
post-processor cannot parse. __() caught that and retried with
`postProcess: false` - but i18next treats false as unset and runs the
global sprintf again, and the `sprintf` option the Blaze `_` helper always
passes triggers it as well, so the retry threw too and __() returned the
key. The retry now drops the positional sprintf option and passes an
explicit empty postProcess list, which really turns it off; real %s
formatting is unchanged.
tests/i18nLiteralPercentBraces.test.cjs runs the real __() with the
installed i18next: the help renders in English and all 246 locales when
called the Blaze way, %s still formats, and the old retry is shown to
return the raw key.
Thanks to xet7 !
GitHub CodeQL code scanning alerts #551, #552 and #553
(js/incomplete-url-substring-sanitization): tests/tatarBoardLayoutCorrections
and tests/tokPisinInterfaceTranslations checked translated text with
includes('https://trello.com/app-key') and includes('example.com'), which
also pass for https://evil.example/?x=https://trello.com/app-key or a host
such as example.com.evil.example. The Trello links are now parsed and must
have the host trello.com and the path /app-key, as a7ae58ea9f did for
#547; the example domain must be a whole word of the text.
tests/urlSubstringSanitization.test.cjs, which keeps this shape out of the
tree, flagged exactly these three lines and passes now. The other failing
tests in both files fail on the committed versions too: they list locale
keys that the new English strings are not yet translated into.
Thanks to GitHub CodeQL and xet7 !
Fill 37 placeholders and check navigation directions, text append roles and letter case. Technical Darija wording remains low confidence pending speaker review.
Thanks to xet7 !
Fill 50 placeholders and check random bounds, number properties, operand roles, statistics and constant formulas. Technical Darija wording remains low confidence pending speaker review.
Thanks to xet7 !
Fill 46 placeholders and check comparisons, negation, branch labels and list operations. Technical Darija wording remains low confidence pending speaker review.
Thanks to xet7 !
Fill 55 placeholders, including the short bitmap-on label. Check opposing actions, bitmap coordinates, deletion arguments and list positions. Technical Darija wording remains low confidence pending speaker review.
Thanks to xet7 !
Above the Features Save there is now one tick per field type of Board
Settings / Card - the same icons and names, all ticked by default. An
unticked field, for example Pomodoro, is not offered in any board's Board
Settings / Card and is not shown on any opened card or minicard, whatever
the board chose. Visibility only: no card data and no board setting is
written, so ticking it again shows every board as it was set. There is no
ordering here; the order stays each board's own.
The catalog and the decisions are models/lib/cardFieldVisibility.js. It is
stored as cardFieldStates on the settings document (missing means shown,
so existing installs are unchanged), published with the other Features
settings and saved by the site-admin-only saveInstanceFeatures method,
which refuses unknown field keys. The hiding happens at the client's one
board read (ReactiveCache.getBoard), which returns the board with the
hidden fields' flags reading false - the same object when nothing is
hidden - so every card and minicard template that reads a board flag agrees
without being edited; the per-card List title and the user's Labels text
override check the same mark. The server's reads, publications and the REST
API are unchanged. A whole-column tick in Board Settings / Card leaves the
hidden fields' board values alone.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide checks still require the new card-field-visibility keys in other locales.
Thanks to xet7 !
A rebase rewrote the commits these entries link to, so the links named commits
that no longer exist and would have 404ed on GitHub. Repointed by
releases/fix-changelog-hashes.sh, which only touches a link no ref in this clone
can reach.
Thanks to xet7 !
Remove the obsolete custom-colors-in-use translation after its source key was removed. Technical wording remains low confidence pending speaker review.
Thanks to xet7 !
One card's color popup already had a color wheel (#5514) that stores a
'#rrggbb' hex in card.color; Multi-Selection offered only the ready-made
palette, so a lighter shade that keeps card text readable had to be set card
by card. The Multi-Selection color popup now has the same color wheel and
writes the same field through the same Card.setColor and server allow rule.
Both color popups also show the custom colors already used on the board's
cards beside the palette, so a color picked once is one click away for the
next cards. No new storage and no new interface text.
Cards the user may not edit (Utils.canModifyCard, e.g. a linked card whose
source board is comment-only for them) are skipped, and one refused card no
longer stops the rest of the selection. The Cards schema validates color with
one shared rule (isAllowedCardColor: empty, a palette name or a strict
'#rrggbb'), so crafted values such as 'red;background:url(...)', '</style>'
or 'javascript:' are refused on the server and never offered as swatches.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide checks still require custom-colors-in-use in other locales.
Thanks to xet7 !
With Board Settings / Card / Comments "Show on Minicard" on, a card with
seven assignees showed its comment as "Någr…" next to the row of avatars.
The avatar rows are float: inline-end and the badges float: inline-start;
each .minicard-comment was overflow: hidden, a block formatting context,
which a float narrows to the width it leaves, and white-space: nowrap cut
the text there. The comments now clear both floats and start at full
width under them, and the text wraps, clamped to three lines with the
ellipsis at the end. Same in RTL, since clear: both is side-agnostic.
Tests: tests/minicardCommentsOnMinicard.test.cjs pins the clear, the wrap
and the clamp, and fails on any minicard comment rule that goes back to
nowrap, absolute positioning or a one-sided clear, or on avatar rows laid
out absolutely. tests/playwright/specs/minicard-comment-beside-assignees.e2e.js
reproduces the report with one comment and seven assignees and asserts no
avatar intersects the comment and the text is not clipped.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide checks still require custom-colors-in-use in other locales.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide checks still require custom-colors-in-use in other locales.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide checks still require custom-colors-in-use in other locales.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide checks still require custom-colors-in-use in other locales.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide checks still require custom-colors-in-use in other locales.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide checks still require custom-colors-in-use in other locales.
Thanks to xet7 !
Technical wording remains low confidence pending speaker review. Repository-wide catalog checks still require the new custom-colors-in-use key in other locales.
Thanks to xet7 !
Fill 29 placeholders, preserving bases, sign reversal and angle units. All 53 focused and 21 human-preference checks pass. Mathematical terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 24 placeholders, preserving aggregate distinctions, random bounds and rounding directions. All 52 focused and 21 human-preference checks pass. Statistical terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 21 English values, preserving constants, inclusive limits and remainder operands. All 51 focused and 21 human-preference checks pass. Mathematical terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 22 English values, preserving Boolean conditions, coordinates and angle bounds. All 50 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 24 placeholders, preserving delimiter behavior, comparison boundaries and negation. All 49 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 23 English values, preserving removal semantics, index markers and copies. All 47 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 24 placeholders, preserving key roles, empty-list length and retrieval actions. All 46 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 32 placeholders, preserving axes, operand roles and indexed values. All 45 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 29 placeholders, preserving indexed fields, opposite actions and list positions. All 44 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 25 English values, preserving deletion roles, dimensions and opposite actions. All 43 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 27 English values, preserving loop roles, conditions and fallback branches. All 42 focused and 21 human-preference checks pass. Technical terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 20 placeholders, preserving colour bounds and variable/function roles. All 41 focused and 21 human-preference checks pass. Technical terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill seven English-identical labels after inspecting rule and count contexts. All 73 focused and 21 human-preference checks pass. Assembled fragment wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 21 English values, preserving indexed roles and menu symbols. All 72 focused and 21 human-preference checks pass. Keyboard transliterations remain low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 29 English-identical values after verifying equality with English. Preserve providers, identifiers and endpoint examples. All 71 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 21 placeholders, preserving retention, permissions and partial-change caveats. All 67 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 20 placeholders, preserving preview limits and omitted-data caveats. All 66 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 23 placeholders, preserving local data, subcard behavior and review scope. All 65 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 21 placeholders, preserving observation limits, UTC and report caveats. All 63 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 30 placeholders, preserving units, report tokens and unknown-estimate distinctions. All 62 focused and 21 human-preference checks pass. Scrum terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 30 placeholders, preserving policy and sprint-action distinctions. All 61 focused and 21 human-preference checks pass. Scrum terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 25 English values, preserving validation, permissions and alias consistency. All 59 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 28 English values, preserving variable roles, counts and search keys. All 58 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 25 placeholders, preserving replacement roles and whitespace handling. All 57 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 24 placeholders, preserving search/count roles and missing-match tokens. All 56 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 24 placeholders, preserving append roles, character indices and letter-case distinctions. All 55 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 29 placeholders, preserving toggle tokens and navigation distinctions. All 54 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 25 English values, preserving function tokens, output distinctions and warnings. All 53 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 26 placeholders, preserving angle units, variable types and parent tokens. All 52 focused and 21 human-preference checks pass. Technical terminology remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 24 placeholders, preserving random bounds, bases and rounding directions. All 51 focused and 21 human-preference checks pass. Mathematical terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 24 placeholders, preserving remainder operands and statistical distinctions. All 50 focused and 21 human-preference checks pass. Statistical terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 28 English values, preserving constants, coordinates and inclusive limits. All 49 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 25 English values, preserving inclusive comparisons, Boolean distinctions and tokens. All 48 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 28 English values, preserving item/count tokens, copy semantics and sorting distinctions. All 47 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 26 English values, preserving index markers, return tokens and removal semantics. All 46 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 29 placeholders, preserving key roles, empty-list length and list actions. All 45 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 32 placeholders while preserving axes, operand roles and indexed tokens. All 44 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 34 English values, preserving coordinate roles and opposite actions. All 43 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 36 English values, preserving branch meanings, loop conditions and deletion tokens. All 42 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 31 placeholders, preserving limits and indexed tokens. All 41 focused and 21 human-preference checks pass. Technical terminology remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 37 English values, including 19 short labels excluded by the missing-string filter. Preserve existing translations and technical identifiers. All 74 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 36 placeholders with regression coverage for tokens, script, cancellation and retry caveats. All 73 focused and 21 human-preference checks pass. Technical wording remains low confidence pending speaker review; browser checks were not run.
Thanks to xet7 !
Fill 12 placeholders while preserving access requirements, retention, units and missing-versus-null behavior. Technical wording remains low confidence pending speaker review. All 71 focused and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 18 English placeholders while preserving report limits, hidden values and partial-change caveats. Technical wording remains low confidence pending speaker review. All 70 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 18 English placeholders while preserving replacement reuse, preview limits and parser omission caveats. Technical wording remains low confidence pending speaker review. All 69 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 16 English placeholders while preserving source-write restrictions, review scope and local data retention. Technical wording remains low confidence pending speaker review. All 68 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 25 English placeholders while preserving partial-report restrictions, UTC days, observation limits and unknown estimates. Technical wording remains low confidence pending speaker review. All 66 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 30 English placeholders while preserving report counts, minute units and unknown-estimate caveats. Technical wording remains low confidence pending speaker review. All 65 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 28 English placeholders while preserving role, policy and sprint action distinctions. Technical wording remains low confidence pending speaker review. All 64 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill nine English placeholders while preserving validation, administrator permissions and conflict recovery guidance. Technical wording remains low confidence pending speaker review. All 62 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 21 English placeholders while preserving keyboard shortcuts, match counts and shared label consistency. Technical wording remains low confidence pending speaker review. All 61 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 19 English placeholders while preserving variable references, count distinctions and comment suffix spacing. Technical wording remains low confidence pending speaker review. All 60 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 21 English placeholders while preserving replacement operand roles, all-occurrence semantics and whitespace behavior. Technical wording remains low confidence pending speaker review. All 59 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 22 English placeholders while preserving position markers, search operand roles and not-found return values. Technical wording remains low confidence pending speaker review. All 58 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 20 English placeholders while preserving letter case, copy semantics and indexed operand roles. Technical wording remains low confidence pending speaker review. All 57 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 22 English placeholders while preserving directional consistency and distinct movement and scrolling actions. Technical wording remains low confidence pending speaker review. All 56 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 21 English placeholders while preserving variable references, screen-reader states and opposite toggle actions. Technical wording remains low confidence pending speaker review. All 55 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 22 English placeholders while preserving function names, output distinctions and procedure restrictions. Technical wording remains low confidence pending speaker review. All 54 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 22 English placeholders while preserving angle units, function abbreviations and variable types. Technical wording remains low confidence pending speaker review. All 53 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 23 English placeholders while preserving inclusive bounds, rounding directions and function bases. Technical wording remains low confidence pending speaker review. All 52 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 21 English placeholders while preserving distinct statistical operations, list-valued modes and random bounds. Statistical wording remains low confidence pending speaker review. All 51 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 22 English placeholders while preserving constant examples, numeric symbols and inclusive bounds. Technical wording remains low confidence pending speaker review. All 50 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 21 English placeholders while preserving Boolean distinctions, conditional labels and numeric domains. Technical wording remains low confidence pending speaker review. All 49 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 25 English placeholders while preserving sort direction, copy semantics and inclusive comparisons. Technical wording remains low confidence pending speaker review. All 48 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 22 English placeholders while preserving not-found values, copy semantics and distinct insertion and replacement actions. Technical wording remains low confidence pending speaker review. All 47 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 20 English placeholders while preserving index markers and distinct return and removal effects. Technical wording remains low confidence pending speaker review. All 46 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 22 English placeholders while preserving shortcut tokens, index markers and distinct selection actions. Technical wording remains low confidence pending speaker review. All 45 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 29 English placeholders while preserving coordinate names, indexed tokens and operand roles. Technical wording remains low confidence pending speaker review. All 44 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 29 English placeholders while preserving indexed tokens and distinct icon and list input actions. Technical wording remains low confidence pending speaker review. All 43 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 30 English placeholders while preserving indexed references and distinct editing actions. Technical wording remains low confidence pending speaker review. All 42 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 20 English placeholders while preserving indexed tokens and condition polarity. Technical wording remains low confidence pending speaker review. All 41 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 24 English placeholders while preserving existing translations, format tokens and colour bounds. Technical wording remains low confidence pending speaker review. All 40 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Restore literal JSON field names and correct the surrounding wrong-language prose. Technical wording remains low confidence pending speaker review. All 151 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Replace nine incomplete or wrong-language values with full explanations preserving forecast limits, date fallbacks and time adjustment caveats. Statistical wording remains low confidence pending speaker review. All 150 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 37 wrong-language or incomplete values while preserving statistical distinctions, day units and WIP group meaning. Statistical terminology remains low confidence pending speaker review. All 149 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 25 wrong-language values while preserving repair placeholders, failure conditions and the acknowledgement label. Technical wording remains low confidence pending speaker review. All 147 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 31 wrong-language values while preserving technical identifiers, byte units and temporary account lockout. Technical wording remains low confidence pending speaker review. All 146 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 35 wrong-language values while preserving numeric ranges, resource identifiers, time units and background processing notices. Technical wording remains low confidence pending speaker review. All 145 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 34 wrong-language values while preserving URL and ID labels, distinct recovery targets and the continued board use notice. Technical wording remains low confidence pending speaker review. All 143 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 22 values while preserving service identifiers and distinct migration and connection outcomes. Technical wording remains low confidence pending speaker review. All 140 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 23 values while preserving provider names, credential states and pause versus stop distinctions. Technical wording remains low confidence pending speaker review. All 139 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 22 values and restore literal console labels, credential fields and file extensions from English. Technical wording remains low confidence pending speaker review. All 138 focused checks and 21 human-preference checks pass; browser checks and external console revalidation were not run.
Thanks to xet7 !
Correct 15 values while preserving time formats, monthly range and distinct restore modes. Retain existing continuous-backup translations. Technical wording remains low confidence pending speaker review. All 137 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 14 values and replace incorrect account-anonymization export text with its actual irreversible consequences. Preserve service and field identifiers. Technical wording remains low confidence pending speaker review. All 135 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 12 values, align automatic-loading guidance with English and restore configuration names and code examples. Technical wording remains low confidence pending speaker review. All 134 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 11 values while preserving archive identifiers and distinguishing card recurrence from checklist reset. Technical wording remains low confidence pending speaker review. All 127 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 18 values while preserving time categories, transfer measurements and the compaction error prefix. Technical wording remains low confidence pending speaker review. All 125 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 22 values while preserving storage names, copy modes and single, global and board-scoped attachment moves. Technical wording remains low confidence pending speaker review. All 122 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 24 values while preserving technical identifiers, distinct memory metrics and checklist line mapping. Technical wording remains low confidence pending speaker review. All 121 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 18 values while preserving member-related deletion restrictions, distinct ticket states and Cc notation. Technical wording remains low confidence pending speaker review. All 119 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 28 values while preserving protocol identifiers, login counts and API aggregation semantics. Technical wording remains low confidence pending speaker review. All 117 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 21 values and restore executable log commands while preserving detection states and sorting distinctions. Technical wording remains low confidence pending speaker review. All 116 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 18 values while preserving sort direction and opposing completion, visibility, addition and removal actions. Technical wording remains low confidence pending speaker review. All 114 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 19 values while preserving query examples, OR/AND distinctions, negation, sort syntax and the Arial font name. Technical wording remains low confidence pending speaker review. All 113 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 34 values while preserving permission scope, member-or-assignee filtering, incomplete-card criteria and result placeholders. Technical wording remains low confidence pending speaker review. All 110 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 33 values while preserving date and mention placeholders, reminder distinctions and irreversible deletion warnings. Technical wording remains low confidence pending speaker review. All 106 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 32 values while preserving protocol names, assetlinks.json, HTML boundaries and JSON markers. Technical wording remains low confidence pending speaker review. All 105 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 33 wrong-language or incomplete values while preserving defaults, WIP identifiers, transfer directions and autolink disabling behavior. Technical wording remains low confidence pending speaker review. All 99 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 18 tracking, upload, shortcut and logo settings values while preserving shortcut ranges and distinct upload states. Technical wording remains low confidence pending speaker review. All 98 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 29 values preserving source tokens, format names and export failure conditions. Technical wording remains low confidence pending speaker review. All 87 focused checks and 21 human-preference checks pass; browser and export-runtime checks were not run.
Thanks to xet7 !
Correct 22 prose values and restore three date-format labels to source notation. Preserve tokens and distinct field options. Technical wording remains low confidence pending speaker review. All 85 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 36 text values and restore the blank comment placeholder. Preserve source tokens, shade distinctions and permission limits. Specialized color wording remains low confidence pending speaker review. All 83 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 31 values preserving source tokens, movement directions, toggle states and aging tiers. Technical wording remains low confidence pending speaker review. All 82 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 27 prose values and restore ten numeric/question-mark options to source symbols. Preserve placeholders and support/opposition distinctions. Technical wording remains low confidence pending speaker review. All 79 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 31 values while preserving source placeholders, action polarity and the title-before-card argument order used by the activity template. Technical wording remains low confidence pending speaker review. All 70 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Correct 37 values preserving tokens and distinct date types, set-or-change semantics and movement directions. Technical wording and composed fragments remain low confidence pending speaker review. All 66 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Replace 46 incorrect values with Tatar rule, trigger and import/export wording while preserving correct existing translations and source tokens. Technical wording remains low confidence pending speaker review. All 64 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 28 English placeholders preserving key-cap names and permanent cancellation semantics. Default inventory retains only 11 product names and mathematical identifiers; older wrong-language text still needs correction. Technical wording remains low confidence pending speaker review. All 62 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 56 English placeholders preserving tokens, limits, null semantics and recovery distinctions. Technical terminology remains low confidence pending speaker review. All 61 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 56 English placeholders preserving tokens, observation limits and conflict-choice distinctions. Technical terminology remains low confidence pending speaker review. All 60 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 61 English placeholders with preserved tokens and distinct sprint states, completion policies and unknown estimates. Technical terminology remains low confidence pending speaker review. All 58 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 41 English placeholders while preserving tokens, keyboard shortcuts and fragment spacing. Technical wording remains low confidence pending speaker review. All 56 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 34 English placeholders with preserved source tokens and distinct text and variable operations. Technical wording remains low confidence pending speaker review. All 55 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 32 English placeholders and cover tokens, character positions, case labels and not-found results. Technical wording remains low confidence pending speaker review. All 54 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 40 English placeholders and cover tokens, directions, navigation targets and screen-reader states. Technical wording remains low confidence pending speaker review. All 53 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 27 English placeholders and cover tokens, return distinctions and invocation references. Technical wording remains low confidence pending speaker review. All 52 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 24 English placeholders and cover tokens, angle units, inverse functions and variable types. Technical wording remains low confidence pending speaker review. All 51 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 28 English placeholders and cover tokens, random bounds, logarithm bases and rounding distinctions. Technical wording remains low confidence pending speaker review. All 50 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 30 English placeholders and cover tokens, statistical distinctions, number polarity and remainder notation. Technical wording remains low confidence pending speaker review. All 49 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 25 English placeholders and cover tokens, constants, coordinates and conditional labels. Technical wording remains low confidence pending speaker review. All 48 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 32 English placeholders and cover tokens, sorting direction, inclusive comparisons and copy semantics. Technical wording remains low confidence pending speaker review. All 47 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 32 English placeholders and cover tokens, removal, copy semantics and list positions. Technical wording remains low confidence pending speaker review. All 46 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 29 English placeholders and cover tokens, move-key references and retrieval versus removal. Technical wording remains low confidence pending speaker review. All 45 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 39 English placeholders and cover tokens, arithmetic operands, coordinates and position labels. Technical wording remains low confidence pending speaker review. All 44 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 37 English placeholders and cover tokens, opposite actions, bitmap coordinates and variable references. Technical wording remains low confidence pending speaker review. All 43 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 33 English placeholders and cover tokens, loop polarity, variable references and deletion counts. Technical wording remains low confidence pending speaker review. All 42 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 24 English placeholders and correct nine mixed-language activity and comment strings. Preserve tokens and cover Tatar vocabulary, colour bounds and loop distinctions. Technical wording remains low confidence pending speaker review. All 41 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 25 English placeholders and cover tokens, delivery states and cancellation warnings. Default inventory retains 11 product names and mathematical symbols; none of 149 pending Transifex keys remain English. Technical wording remains low confidence pending speaker review. All 59 focused checks and 21 human-preference checks pass. Browser and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 37 English placeholders and cover tokens, retention limits, null handling and delivery distinctions. Technical wording remains low confidence pending speaker review. All 42 focused checks and 21 human-preference checks pass. Browser and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 37 English placeholders and cover tokens, source protection, preview limits and shared labels. Technical wording remains low confidence pending speaker review. All 41 focused checks and 21 human-preference checks pass. Browser and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 44 English placeholders and cover tokens, UTC references, observation limits and unknown estimates. Technical wording remains low confidence pending speaker review. All 42 focused checks and 21 human-preference checks pass. Browser and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 49 English placeholders and cover tokens, shared labels, sprint actions and rule restrictions. Technical wording remains low confidence pending speaker review. All 41 focused checks and 21 human-preference checks pass. Browser and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 69 English placeholders and cover tokens, keyboard shortcuts, count fragments and trim directions. Technical wording remains low confidence pending speaker review. All 52 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 47 English placeholders and cover tokens, positions, whitespace and replacement arguments. Technical wording remains low confidence pending speaker review. All 51 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 39 English placeholders and cover tokens, physical directions, navigation targets and action distinctions. Technical wording remains low confidence pending speaker review. All 50 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 37 English placeholders and cover tokens, return distinctions and invocation restrictions. Technical wording remains low confidence pending speaker review. All 49 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 34 English placeholders and cover tokens, logarithm bases, inverse functions and degree units. Technical wording remains low confidence pending speaker review. All 48 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 35 English placeholders and cover tokens, statistical operations, number polarity, rounding and random bounds. Technical wording remains low confidence pending speaker review. All 47 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 35 English placeholders and cover tokens, conditional labels, mathematical notation and operator distinctions. Technical wording remains low confidence pending speaker review. All 46 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 37 English placeholders and cover tokens, insertion versus replacement, copy semantics and comparison labels. Technical wording remains low confidence pending speaker review. All 45 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 42 English placeholders and cover token inventories, retrieval versus removal and list positions. Technical wording remains low confidence pending speaker review. All 44 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 48 English placeholders and cover token inventories, arithmetic operands, positions and navigation distinctions. Technical wording remains low confidence pending speaker review. All 43 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 54 English placeholders and cover token inventories, condition polarity and editing states. Technical wording remains low confidence pending speaker review. All 42 focused checks and 21 human-preference checks pass. Browser, screen-reader and right-to-left layout checks were not run.
Thanks to xet7 !
Fill 39 English placeholders and cover tokens, colour bounds and loop-control distinctions. Technical wording remains low confidence pending speaker review. All 41 focused checks and 21 human-preference checks pass. Browser and right-to-left layout checks were not run.
Thanks to xet7 !
Fill six remaining ordinary English placeholders and verify cancellation safeguards. Default inventory retains only 11 product names and mathematical symbols; none of 149 pending Transifex keys remain English. Technical wording remains low confidence pending speaker review. All 61 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 49 English placeholders and cover tokens, retention limits, null handling and distinct delivery states. Technical wording remains low confidence pending speaker review. All 42 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 54 English placeholders and cover tokens, UTC references, numeric limits and source protection. Technical wording remains low confidence pending speaker review. All 42 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 74 English placeholders and cover token preservation, sprint states, shared labels and unknown estimates. Scrum terminology remains low confidence pending speaker review. All 40 focused checks and 21 human-preference checks pass. Browser checks were not run.
Thanks to xet7 !
Fill 59 English placeholders while preserving existing translations, physical key inscriptions and source tokens. Cover search shortcuts, workspace counts and rule restrictions. Technical wording remains low confidence pending speaker review. All 54 focused checks and 21 human-preference checks pass; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 71 English placeholders while preserving existing translations and tokens. Cover text positions, whitespace, replacement argument order and input prompts. Technical wording remains low confidence pending speaker review. All 53 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 39 English placeholders while preserving existing translations and source tokens. Cover navigation directions and screen-reader toggle instructions. Accessibility wording remains low confidence pending speaker review. All 52 focused checks and 21 human-preference checks pass; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 37 English placeholders and cover token preservation, function return distinctions and invocation restrictions. Technical wording remains low confidence pending speaker review. All 51 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 27 English placeholders preserving existing text, notation and tokens. Trigonometry terminology remains low confidence. All 50 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 29 English placeholders preserving existing text and tokens. Statistical and rounding terminology remains low confidence. All 49 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 28 English placeholders preserving existing text, formulas and tokens. Inverse trigonometry wording remains low confidence. All 48 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 29 English placeholders preserving existing text and tokens. Delimiter and Boolean terminology remains low confidence. All 47 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 32 English placeholders preserving existing text and tokens. Index and case-insensitive sorting terminology remains low confidence. All 46 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 30 English placeholders preserving existing text and tokens. Sublist terminology remains low confidence. All 45 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 30 English placeholders preserving existing text and tokens. Statement-position wording remains low confidence. All 44 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 31 English placeholders preserving existing text and tokens. Delimiter and operand wording remains low confidence. All 43 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 39 English placeholders preserving existing text and tokens. Bitmap-column and inline-input wording remains low confidence. All 42 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 24 English placeholders preserving existing text and tokens. Loop and iteration terminology remains low confidence. All 41 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 20 English placeholders preserving existing translations and tokens. Variable and function terminology remains low confidence. All 40 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 21 placeholders preserving cancellation caveats and physical key names. The remaining eleven default-inventory entries are product names, null and mathematical notation. Pending-Transifex content and wording review remain. All 41 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Fill 26 English placeholders preserving existing text and tokens. Reservation and recovery-metadata terminology remains low confidence. All 40 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 21 English placeholders preserving existing text and tokens. Diagnostic and receipt terminology remains low confidence. All 42 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 23 English placeholders preserving existing text and tokens. Parser, path and representation terminology remains low confidence. All 41 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 26 English placeholders preserving existing translations and tokens. Mapping and baseline terminology remains low confidence. All 40 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 13 English placeholders preserving existing translations and tokens. Snapshot and observation terminology remains low confidence. All 42 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 35 English placeholders with tokens preserved. Retrospective and swimlane terminology remains low confidence. All 41 focused checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 36 English placeholders preserving existing text and tokens. Scrum-role and increment terminology remains low confidence. All 40 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 25 English placeholders preserving existing translations and tokens. Trigger and zoom terminology remains low confidence. All 51 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 36 English placeholders preserving existing text and tokens. Workspace-stack and search-focus terminology remains low confidence. All 50 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 41 English placeholders preserving existing translations and tokens. Case-conversion and substring terminology remains low confidence. All 49 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 44 English placeholders preserving existing translations and tokens. Keyboard-focus and block-stack terminology remains low confidence. All 48 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 40 English placeholders preserving tokens and existing translations. Parent-block and procedure-output terminology remains low confidence. All 47 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 39 English placeholders preserving tokens and symbolic function names. Statistical and trigonometric terminology remains low confidence. All 46 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 40 English placeholders preserving formulas and tokens. Root, prime-number and standard-deviation terminology remains low confidence. All 45 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 29 English placeholders, preserving existing translations and tokens. Case-insensitive sorting terminology remains low confidence. All 44 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 52 English placeholders while preserving existing translations and tokens. Index and sublist terminology remains low confidence. All 43 focused checks and 21 human-preference checks pass; browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 57 English placeholders with source tokens preserved. Statement-position, iteration and replacement terminology remains low confidence. All 42 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 54 English placeholders while preserving existing translations and tokens. Inline input and bitmap terminology remains low confidence. All 41 focused checks and 21 human-preference checks pass. Browser and screen-reader checks were not run.
Thanks to xet7 !
Fill 26 English placeholders while preserving existing translations and tokens. Loop and collapsed-block technical wording remains low confidence. All 40 focused checks and 21 human-preference checks pass; browser checks were not run.
Thanks to xet7 !
Preserve existing values and source order; verify tokens and opened-card wording. Occitan and Moroccan Arabic phrasing is low confidence pending speaker review.
Thanks to xet7 !
Restore key inventories and source order without changing existing values. Handle English variants with legacy locale identifiers and verify language correspondence.
Thanks to xet7 !
Match corresponding language and script, preserve existing values and restore source key order. Verify locale inventories, tokens and base-language correspondence.
Thanks to xet7 !
Restore locale inventories without changing existing values. Preserve British English wording and verify tokens and open-card scope. Wording remains subject to speaker review.
Thanks to xet7 !
Restore locale key inventories and source order without changing existing values. Verify tokens and opened-card scope in representative scripts; wording remains subject to speaker review.
Thanks to xet7 !
Restore locale key inventories and source order without changing existing translation values. Verify tokens and opened-card scope in representative scripts.
Thanks to xet7 !
Correct five shortcut labels and translate the missing due-date shortcut. Verify full locale key order, membership versus assignment and source tokens. Wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Translate six mixed-language values and verify recording versus notification behavior, export exclusions and administrator requirements. Wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Translate 16 English or mixed-language values and verify completion actions, schedule periods and source tokens. Wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Translate 19 mixed-language or misleading values and verify fading levels, role limits and source tokens. Wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Translate 21 English or mixed-language values and preserve numeric limits, repair scope and source tokens. Heap context wording is low confidence; technical wording needs fluent-speaker review.
Thanks to xet7 !
Translate 16 mixed-language values and verify HTML boundaries, logo settings and source tokens. Technical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Correct 38 English or mixed-language strings and restore literal paths and external menu labels. Technical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Translate 19 mixed-language or ambiguous messages and verify dates, units, timestamp direction and source tokens. Wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Translate 17 mixed-language messages, restore Jira API and Trello menu literals and verify export fields. Wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Translate 25 mixed-language messages and verify transfer directions, limits, units and repair descriptions. Technical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Replace the final 27 English-seeded prefix values and verify forecast limits, history gaps, fallback meanings and source tokens. Statistical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Replace 25 prefixed English labels with basic colour names and distinct shade descriptions. Less common shade descriptions remain low confidence pending fluent-speaker and visual review.
Thanks to xet7 !
Replace 21 prefixed English values with parser-compatible keywords and verify operator uniqueness and source tokens. Compact forms and technical loans remain low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 68 mixed-language labels and verify controls, support wording, units and source tokens. Technical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Replace 56 mixed-language labels and verify state changes, backup scope, units and source tokens. Technical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Preserve placeholder inventories and distinguish deletion, copy and paste, screen-reader states and navigation directions. Technical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Fill 55 English messages and preserve source tokens, search/replacement operands, case distinctions and trim directions. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 84 English messages and preserve source tokens, sprint membership and report caveats. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 46 English messages and correct two English-prefixed rule labels. Preserve delivery uncertainty and cancellation limits; technical recovery wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 86 English messages and preserve formula literals, statistical operations and interval boundaries. Compound wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Fill 46 English messages and preserve editing actions and accessibility state announcements. Technical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Fill 82 English messages and preserve counts, search shortcuts, colour ranges and movement directions. Accessibility compounds remain provisional pending fluent-speaker review.
Thanks to xet7 !
tests/newLanguageWiring.test.cjs counts the locales whose translations are
essentially complete and failed on README's 167: translation work since
then completed four more.
Thanks to xet7 !
The new releases/changelog-wrap.mjs failed 'scripts build.sh cannot run'.
Like changelog-archive.mjs it is an editing aid with nothing for a build
menu to do: the format test names it when CHANGELOG lines run long. It is
recorded in the suite's list of by-hand scripts with that reason.
Thanks to xet7 !
Run 3 of EVERYTHING: under load the appended log line reached the file
stream after the test's 5 s wait (4 puts, not 5), and the failed
assertion then left the engine's seal and scan intervals running, so the
suite sat until its 300 s timeout. The engine is now stopped in t.after
whatever happens, and watching gets 20 s; the scan interval stays at an
hour, so the change is still proved to come from watching. Passes alone.
Thanks to xet7 !
v12.22 was released, so the CodeQL fix 433e58a618 starts a new
"# Upcoming WeKan ® release" section, under the established header
"This release fixes the following SECURITY ISSUES found by GitHub CodeQL
code scanning:".
That header is 86 characters, and releases/changelog-wrap.mjs wrapped it
onto two lines - after which tests/changelogFormat.test.cjs no longer found
it as the first subsection header. Subsection headers ("This release ...:",
"and ...:") are one line by rule, so the wrap tool leaves them alone and the
format test does not count them as over-long; tests/changelogWrap.test.cjs
pins it.
Thanks to xet7 !
GitHub CodeQL code scanning alerts #549 and #550
(js/shell-command-injection-from-environment): tests/snapSettingsKeys and
tests/snapSocketDenied ran `bash -c` with a script that interpolated an
absolute path built from __dirname (`source "${configPath}"`,
`source "${helper}"`). A checkout path containing a quote, `$(` or a
backtick would change the command that runs. tests/linuxPackageManagers
and tests/snapCaddyNofile6552 had the same shape without an alert yet.
All four now pass the path (and the soft limit, and the wekan-control
function under test) in environment variables, so every script text is
constant. tests/testShellPathsFromEnv.test.cjs fails on any test that
sources an interpolated value, and checks it catches the flagged forms.
These are test files run on a developer machine or CI, so no attack can be
attempted against a running WeKan and nothing is logged in Admin Panel ->
Problems.
Thanks to GitHub CodeQL and xet7 !
Fill 55 English messages and preserve tokens, search/replacement operands, case distinctions and trim directions. Technical wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
Fill 46 English messages while preserving notification-delivery uncertainty, cancellation limits and rule-editor constraints. Technical recovery wording remains provisional pending fluent-speaker review.
Thanks to xet7 !
A rebase rewrote the commits these entries link to, so the links named commits
that no longer exist and would have 404ed on GitHub. Repointed by
releases/fix-changelog-hashes.sh, which only touches a link no ref in this clone
can reach.
Thanks to xet7 !
Fill 86 English messages with token and mathematical-boundary regression coverage. Statistical compounds and trigonometric wording remain low confidence pending fluent-speaker review.
Thanks to xet7 !
The due/start/end date popup's calendar now gives today's day button the
is-today class and aria-current="date", and its cell is-today-cell. Today
gets a ring and underline in the button's own text colour plus a subtle cell
tint, so it stays visible in every board colour theme, light and dark, and
in RTL. The board Calendar view keeps FullCalendar's today tint and also
marks today's day number with the board theme's colour.
Thanks to mimZD and xet7 !
Fixes#6751,
Fill 46 English placeholders and preserve editing actions and announcement tokens. Accessibility and backpack terminology needs fluent-speaker review.
Thanks to xet7 !
With keyboard shortcuts enabled, d (or Shift+D) clicks the due date + or
badge of the opened card, so it opens the same popup a click does and only
for a user who may edit the card. Inputs, textareas and editable fields are
left alone by the shared shortcut filter. Listed in the shortcuts help.
Thanks to mimZD and xet7 !
Fixes#6750,
Records 479f530da0 (filter matches follow access even when the board
observer stalls) under the bug fixes and in In short, the browser spec
fixes and releases/changelog-wrap.mjs under Tests, and the Tigre date and
Veps kuva commits under translations.
Thanks to xet7 !
Translate 61 English values and verify states, coordinates, operand roles and tokens. Two catalog checks still encounter the concurrent shortcut key addition. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
saved-filter-presets clicked the filter toggle once, right after setting
the language; while the board header was still re-rendering the click
opened nothing and the filter field was never found. It now clicks until
the field is visible. saml-redirect-login read sessionStorage while WebKit
was still finishing the exchange's final navigation ("Execution context was
destroyed"); it now waits for the load and reads it again, at most three
times, and only for that error. Both specs passed in all 139 WebKit runs
against a server built from current main.
Thanks to xet7 !
Fill 59 English placeholders and verify colour ranges, directions and movement states. Two catalog checks still encounter the concurrent due-date shortcut addition. Wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 23 English placeholders and verify counts, keyboard navigation and editing actions. Two catalog checks still fail on the concurrent due-date shortcut addition. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Translate 75 English values and test retrieval, removal, copies and ordering. 53 checks pass; two structural checks encounter the concurrently added shortcut-edit-due-date key missing from other catalogs. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 22 English placeholders and verify name conflicts, deletion counts, rename scope and parameter tokens. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Translate 26 English values and verify truth conditions, comparison boundaries and interpolation tokens. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
card-text-filter failed intermittently in the EVERYTHING runs: after a
member's assigned-only restriction was lifted, the text-filter matches
never widened again (still one match after 100 s). Instrumented on the
polling test server, the failing subscription's board observer delivered
its initial add and then nothing - neither the narrowing nor the widening
write - while the card observers of the same board kept firing; the
narrowing only applied because a card edit happened to trigger a rescan.
With nothing after the widening, nothing rescanned. The same stall would
also have kept a NARROWED member's old matches, which is an access leak.
publishBoardMatches (text matches, movement matches, table pages) now also
re-reads the board every 10 s and rescans when its access fields -
permission, members and the provider's own board fields - differ from
the ones the published result was computed from, unreadable boards
included. An unchanged board does not rescan.
tests/boardTextPublication.test.cjs widens, narrows and revokes with the
observer silent and only the re-check firing; both tests fail on the
previous code. card-text-filter passed 3 of 3 in Firefox afterwards.
Thanks to xet7 !
Fill 55 English placeholders and verify argument inventories, indexing, replacement roles and text formatting. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 84 English placeholders and verify lifecycle states, report limits and source tokens across 102 Scrum messages. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 43 English placeholders and verify local content retention, review scope and preview limits. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 46 English placeholders and verify rule constraints, delivery uncertainty and irreversible cancellation. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 86 English placeholders while preserving formulas and constants. Verify numerical bounds, units, statistical operations and arithmetic distinctions. Mathematical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 26 English placeholders and verify open/close states, screen-reader toggles and conditional labels. Accessibility wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Translate 61 English values including the short on label outside the placeholder count. Verify operand roles, coordinates, pixel states and argument inventories. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 45 English placeholders and verify directions, shortcut arguments and move-state distinctions. Accessibility wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 45 English placeholders and verify names, counts, navigation keys and editing distinctions. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 55 English placeholders and verify interpolation tokens, indexing, case conversion, replacement and whitespace handling. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Translate 50 English values, including three short labels outside the placeholder count. Preserve null and test boolean conditions, function outputs and warnings. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Translate 75 English values including two short fragments excluded from placeholder counts. Verify indexing, removal, copies, sort and conversion direction. Technical wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 61 English placeholders and add regression checks for source tokens, loop conditions, variable deletion and colour ranges. Programming terms remain low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 46 English placeholders and verify rule constraints, delivery uncertainty and recovery limitations. Technical compounds remain low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 63 English placeholders while preserving existing translations. Add regression checks for local content retention, report limits, recovery restrictions and missing versus null estimates. Technical compounds remain low confidence pending fluent-speaker review.
Thanks to xet7 !
Fill 84 English placeholders while preserving existing translations. Cover all 102 Scrum and related view messages with token and semantic regression checks. Technical compounds remain low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 18 mixed-language values while preserving move/copy distinctions and home removal without deletion. Wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 10 mixed-language values while preserving membership restrictions and preview digits. Font sample is translated without claiming pangram coverage. Wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 18 malformed or mixed-language values while preserving direction, permissions and pending states. Wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 26 mixed-language values while preserving result counts, missing-only restoration and scheduling states. Wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 23 mixed-language values while preserving units, links and assigned-only visibility. Align the Normal role label. Wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 25 mixed-language values while preserving directions, list scope, ordering and provider menu names. Wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
The WebKit run failed map-view in or_IN and pap on a 15 s click timeout
on the Map item of the Board View popup. Each test switches the language
right before opening the popup, and applying it re-renders the header,
which can close the popup between the two clicks. openMap now opens it
again, up to three times, until the item is clicked. All 68 locale runs
passed in WebKit with two workers.
Thanks to xet7 !
Replace 25 damaged or mixed-language values and restore provider names, navigation labels and permission roles from the source. Technical terminology remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 24 damaged or mixed-language values while preserving credential distinctions and storage states. Technical terminology remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Replace 24 damaged or mixed-language values and restore literal search syntax. Preserve format placeholders and HTML entities. Wording remains low confidence pending fluent-speaker review.
Thanks to xet7 !
Four Firefox failures in the EVERYTHING run, each passing alone:
- minicard-checklist-reorder measured the drag source and target right
after resizing the viewport, while the board was still re-laying itself
out, and the drop missed. It now measures once both boxes hold still.
- admin-login-menu waited the default 15 s for the "clear stored secret"
control after Save; it now first asserts the typed secret is still in
the field (so a re-render that wiped it fails clearly) and allows 30 s
for the save and the form's reload.
- activity-notification-recovery clicked Retry right after re-enabling the
recipient, which is also when the one-second automatic recovery may take
the intent and disable the button. It now accepts either path; the
checks that matter stay: completed, exactly one email job, and a
repeated retry is skipped.
- card-text-filter's raw-driver edits reach the page on the next poll; its
checks get two poll cycles (40 s) instead of 15 s. Note: one step in it -
the text-match stream widening back after a member's assigned-only
restriction is lifted - also fails intermittently for a reason that is NOT
timing (still one match after 100 s); that is investigated separately and
the test is left to catch it.
Thanks to xet7 !
Rewrite 24 mixed-language values and preserve access restrictions, count tokens and format identifiers. Role and soft-deletion wording remains provisional.
Thanks to xet7 !
Rewrite 24 mixed-language values, restore a damaged example domain and preserve activity placeholders and deletion conditions. Authentication and tenant wording remains provisional.
Thanks to xet7 !
Correct 99 filler values, preserve schedule intervals and technical identifiers, and reject the repeated phrase across the catalog. Migration and diagnostic terminology remains provisional.
Thanks to xet7 !
Replace 60 generic filler values. Preserve units and technical identifiers, distinguish modes and dates, and document provisional system terminology.
Thanks to xet7 !
Replace 60 generic filler values and restore empty and literal labels. Verify color distinctions, units and placeholders. Uncommon shade, version and WIP wording remains provisional.
Thanks to xet7 !
Fill 27 messages while preserving retained work, no activity recreation and permanent cancellation behavior. Add regression checks and record provisional recovery wording.
Thanks to xet7 !
Preserve retention limits, distinct outcomes, hour units and missing versus null estimate semantics. Add regression checks and document provisional diagnostics wording.
Thanks to xet7 !
Fill 43 messages and preserve local content, unchanged subcards, retry reuse and display limits. Add regression coverage and document provisional technical wording.
Thanks to xet7 !
Preserve unknown estimates, daily observation limits, partial reports and separate close and cancel behavior. Add regression coverage and note provisional terminology.
Thanks to xet7 !
Fill 54 placeholders and correct the generic rules label. Cover arguments, distinct sprint actions and shared view labels; document provisional terminology.
Thanks to xet7 !
Fill text construction, searches, character access, replacement, prompts and trimming. Preserve argument inventories and endpoint distinctions, with regression coverage and wording review notes.
Thanks to xet7 !
Preserve navigation directions, movement and scrolling distinctions, and source placeholders. Add regression coverage and document terminology review needs.
Thanks to xet7 !
Fill 31 messages while preserving procedure results, restrictions, rename scope and screen-reader state transitions. Record provisional accessibility terminology.
Thanks to xet7 !
Fill 39 messages while preserving logarithm bases, angle units and variable distinctions. Record low-confidence mathematical terminology for review.
Thanks to xet7 !
Fill 27 messages while preserving numbered arguments, endpoint inclusion and distinct statistical operations. Record low-confidence mathematical terminology.
Thanks to xet7 !
64 locale runs of 'Blocks supports localized drag, field editing and
context menus' failed: c9cc757aa1 added an expectation that the block
context menu shows the translated "Add comment". The editor injects
Blockly with comments: false on purpose since d273b86ed5 - a workspace
comment has no rule equivalent - so that item never appears and the test
could not pass. The spec now asserts the opposite for every locale.
Seven locales passed against the running test server.
Thanks to xet7 !
Fill 30 messages while preserving mathematical notation, numbered arguments and numeric boundaries. Record low-confidence mathematical terminology for review.
Thanks to xet7 !
The EVERYTHING run failed 'LTR card first paint uses preferred side': the
click reached the fixed-position Alpha Card but no card opened. A
subscription can replace the board DOM just after it loads (the reason
BoardPage.clickCard retries), and then the click hit a detached minicard;
the new one also lacks the fixed rectangle the spec measures from. The
spec now repeats placing, measuring and clicking, up to three times,
until the card opens. 4 tests passed in each of three runs.
Thanks to xet7 !
Fill 47 messages while preserving numbered arguments, mutation semantics and comparison boundaries. Record provisional sorting and programming wording.
Thanks to xet7 !
Two Chromium failures in the EVERYTHING run were the same race: a spec
wrote straight to the database and acted before the browser had received
the change, which the server publishes a moment later.
- directory-info-bleed waited only for some settings document, then read
ldap.enabled from the one sent BEFORE its update: undefined instead of
false. It now waits for the public field, so the private ones (host,
bind DN) are checked on the changed document.
- "changing an existing due date saves the replacement (#6607)" could open
the card before its due date arrived, click "+ add due date", and lose
it to the date badge that replaced it - a timeout, and on a pass a test
of adding rather than changing. It now waits for the badge.
The LDAP spec passed 3 of 3 and the due-date spec 5 of 5 against the
running test server; the due-date one failed 1 of 3 before.
Thanks to xet7 !
Fill 46 messages while preserving arguments, position markers and distinct return/remove semantics. Record provisional list terminology for review.
Thanks to xet7 !
Fill 58 messages while preserving numbered arguments, coordinate identifiers and distinct input roles. Record provisional mathematical and keyboard terminology.
Thanks to xet7 !
Fill 39 messages while preserving action scope, numbered arguments and opposite control states. Record provisional bitmap and multiline terminology.
Thanks to xet7 !
Fill 44 messages and replace three unrelated color-label fillers. Preserve arguments, color bounds and opposite loop conditions; record provisional programming terminology.
Thanks to xet7 !
Fill 16 accessibility labels while preserving arguments and singular/plural distinctions. Extend shared regression coverage and record provisional technical wording.
Thanks to xet7 !
Replace 15 foreign or incomplete labels while preserving actual date-format codes and ISO-week meaning. Record low-confidence color descriptions for visual review.
Thanks to xet7 !
Replace 38 foreign or misleading values while preserving identifiers and distinctions among process statistics. Record provisional statistical terminology and remaining review.
Thanks to xet7 !
Replace 84 French, Walloon or mixed-language values while preserving identifiers, LDAP arguments and recurrence distinctions. Record provisional technical terminology and remaining audit work.
Thanks to xet7 !
Replace 52 French or Walloon values while preserving shared labels, zoom directions, unread comments and timer arguments. Record provisional flow and milestone terminology.
Thanks to xet7 !
Replace 41 French, Walloon or mixed-language values while preserving chart distinctions, recurrence controls and authentication state. Record remaining vocabulary and contextual review.
Thanks to xet7 !
Translate 42 operator and predicate values and exercise the actual parser for localized text queries, attachment existence and modified dates. Record provisional compact query wording.
Thanks to xet7 !
Replace 21 French or Walloon values while preserving the sync interval, failure token and credential-state distinctions. Use single-word Waray attachment query aliases and record remaining search-label review.
Thanks to xet7 !
Replace 44 French, Walloon or mixed-language values with Waray wording. Preserve authentication requirements, forecast tokens and file extensions; record provisional terminology and remaining audit work.
Thanks to xet7 !
Fill 27 messages while preserving retry behavior, pending-work retention and irreversible cancellation distinctions. Record provisional recovery terminology and outstanding locale review.
Thanks to xet7 !
Fill 29 remaining messages while preserving retention limits, access requirements, null semantics and delivery failure distinctions. Record provisional diagnostic terminology.
Thanks to xet7 !
Fill 43 messages while preserving local content, source-write restrictions, replacement reuse and report limits. Record provisional synchronization and parser terminology.
Thanks to xet7 !
Fill 40 remaining Scrum messages and correct the wrong-language Export label. Preserve report scope, unknown estimates, UTC observations and count tokens; record provisional terminology.
Thanks to xet7 !
Fill 54 remaining messages while preserving rule validation, administrator permissions, conflict recovery and sprint action distinctions. Record provisional Scrum terminology for review.
Thanks to xet7 !
Fill 44 remaining messages while preserving shortcut names, fragment spacing, variable distinctions and numbered arguments. Record remaining contextual review.
Thanks to xet7 !
Fill 53 text-operation messages while preserving positions, replacement scope, copy semantics and whitespace behavior. Record contextual wording review still needed.
Thanks to xet7 !
Fill 42 remaining accessibility messages while preserving directions, state transitions and shortcut arguments. Record contextual accessibility review still needed.
Thanks to xet7 !
Fill 51 remaining labels and tooltips while preserving function results, restrictions and numeric arguments. Record low-confidence mathematical terminology for review.
Thanks to xet7 !
Fill 28 remaining messages while preserving random-number bounds, logarithm bases and operation distinctions. Record provisional mathematical wording for review.
Thanks to xet7 !
Fill 25 remaining math messages and preserve argument tokens and operation distinctions. Statistical terminology remains provisional and is recorded for review.
Thanks to xet7 !
Fill 27 placeholders with preserved mathematical notation and arguments. Extend checks for condition quantifiers, angle ranges and inclusive limits; document uncertain terminology.
Thanks to xet7 !
Fill 29 placeholders while preserving arguments, comparison boundaries and negation meanings. Extend regressions and document provisional terminology.
Thanks to xet7 !
Fill 30 placeholders with preserved arguments, missing-result values and copy semantics. Extend operation regressions and document provisional wording.
Thanks to xet7 !
Fill 27 placeholders while preserving list positions and retrieval/removal distinctions. Extend regression checks and document provisional programming terminology.
Thanks to xet7 !
Fill 33 placeholders with preserved arguments, operand distinctions and navigation steps. Extend regression checks and document provisional wording.
Thanks to xet7 !
Fill 34 placeholders while preserving arguments and icon-action direction. Extend condition and list-input distinctions and document provisional terminology.
Thanks to xet7 !
Fill 35 placeholders while preserving arguments and condition polarity. Extend opposite-action and bitmap regressions and document provisional terminology.
Thanks to xet7 !
tests/changelogFormat.test.cjs failed five times today on prose wider than
80 columns, each time from new translation progress entries, and each time
wrapped by hand. releases/changelog-wrap.mjs does it: only the lines the
test counts, bullets continued two spaces in, never a continuation line that
markdown would read as a heading, list, table or HTML (an issue number such
as #6514 is carried down with the word before it), fenced code untouched,
whitespace only, idempotent. The format test's failure now names it.
tests/changelogWrap.test.cjs pins those rules. CHANGELOG.md is wrapped with
it (24 lines, whitespace only).
Thanks to xet7 !
tests/vepsMediaWikiTerms.test.cjs failed: the Blockly image field's Veps
value equals Finnish (kuva), and the suite requires every remaining
Finnish match to be reviewed. kuva is the Veps word for a picture already
used by add-cover ("koren kuva") and every avatar string ("kävutajan
kuva"), so it is recorded as an intentionally shared term.
Thanks to xet7 !
96fd0432bd changed custom-field-date and blockly-ARIA_TYPE_FIELD_DATE to
ዕለት, reasoning that ተመር is also the date fruit. ተመር is the reviewed
Tigre "date" in 42 other values - `date` itself, every date popup title
(tests/tigreDateControls.test.cjs) and the audited repair table - so the
"Date" field type disagreed with every date popup, and
tests/tigreTranslationProgress.test.cjs and
tests/auditedTranslationCorrections.test.cjs failed; the repair tool would
also have reverted it. Both keys use ተመር again, and the new test now
requires them to equal `date`.
Whether ተመር should become ዕለት is a question for a Tigre speaker, to be
decided for every value at once.
Thanks to xet7 !
Fill 39 English placeholders with preserved arguments and ranges. Extend checks for loop and conditional distinctions and document provisional terminology.
Thanks to xet7 !
Replace 31 Walloon values while preserving repair counts, negative outcomes and search syntax. Extend regressions and document the limits of the language scan.
Thanks to xet7 !
Replace 20 Walloon values while preserving configuration identifiers, report aggregation and history distinctions. Extend regressions and document provisional technical wording.
Thanks to xet7 !
Replace 25 Walloon values while preserving toggle direction, read-only status and default-off wording. Extend regressions and document provisional terminology.
Thanks to xet7 !
Records 9ae7388a7e and 63a7fba465 under Upcoming, removes the TODO Later
note about Meteor's cookie refresh limit that 63a7fba465 resolves, and
wraps prose added since the last wrap at 80 columns (whitespace only).
Thanks to xet7 !
Meteor answers more than 30 refreshes of the HttpOnly login cookie per 10
seconds from one client address with 429, and every page load is one. The
whole browser suite comes from localhost, so a quick run signed its own
test users out: 18-rtl-layout "list pages" landed on the sign-in page on
its third full navigation in one of two runs with two workers. TODO Later
recorded this on 2026-10-05.
ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT now sets the allowance per 10 seconds;
anything but a positive whole number keeps Meteor's default, and the
limiter is never switched off. The browser test server sets it to 100000.
It also helps an install where many users reach WeKan through a proxy
that is not trusted for the client address and so share one address;
documented beside the login settings. loginWithToken additionally waits
out a 429 on the cookie refresh and resumes once, and only for that.
tests/cookieRefreshRateLimit.test.cjs runs the parser with valid and
invalid values and pins the server, build.sh, docs and helper wiring.
Thanks to xet7 !
Replace 25 Walloon values, preserve template variables and configuration identifiers, and extend regressions for admin restrictions and movement directions. Document provisional terminology.
Thanks to xet7 !
Document the 40 language corrections and move 39 translation entries not contained in v12.21 into Upcoming, as verified by the release ancestry check.
Thanks to xet7 !
Fill 32 block labels and correct 15 Walloon values mistakenly inserted into the Waray catalog. Repair the regression that enforced wrong-language labels, preserve arguments and document provisional wording.
Thanks to xet7 !
Fill 32 placeholders with preserved numbered arguments, extend regression checks and document provisional regional and technical wording.
Thanks to xet7 !
Fill 64 placeholders in Kinyarwanda, Kirundi, Luganda and Chichewa. Preserve numbered arguments and document vocabulary corrections and provisional wording.
Thanks to xet7 !
The browser suite failed "Card -> More lists the other parents and removes
one" in 66 of 67 locales. Two faults, traced in the running app:
The board list was empty. Both helpers filtered
`_id: { $ne: currentUser.getTemplatesBoardId() }`, and that id is undefined
for a user without a templates board. The client ReactiveCache keys each
query by EJSON.stringify(selector) and runs the PARSED key, which drops
undefined: the query became `_id: {}` and matched no board. So "Change
card's parent -> Source board" and the multi-selection destination picker
offered nothing to such a user. The templates board is now excluded only
when there is one. (dialogWithBoardSwimlaneList queries Boards directly and
was not affected.)
The spec opened More from document.body, without the card behind it, and
straight after writing the parents to the database, before this browser had
received parentId. It now opens More from the card's menu as a member does,
waits until the client has the primary parent, and asserts the board and
the parent card are offered.
tests/reactiveCacheUndefinedSelector.test.cjs shows the EJSON round trip,
pins both helpers, and fails on any ReactiveCache selector that puts a
call such as getTemplatesBoardId() under $ne (it flags the previous
cardDetails.js). Run against the bundle built before this change, the spec
now fails only on the board list - the bug fixed here.
Thanks to xet7 !
pbkdf2 <= 3.1.6 hashes an over-long password again on every iteration, so a
1 MiB password costs a full hash per round (CVE-2026-102414, denial of
service). 3.1.7 hashes it once.
meteor-node-stubs 1.2.30 bundles pbkdf2 3.1.3 inside its own tarball, where
npm overrides cannot reach it, and no meteor-node-stubs release bundles 3.1.7.
Instead of forking meteor-node-stubs again, WeKan now depends on pbkdf2
^3.1.7 directly and the new postinstall script
scripts/patch-meteor-node-stubs-pbkdf2.cjs removes the bundled copy, so
crypto-browserify resolves the patched top-level package, and drops the
bundled entries from package-lock.json. It fails the install if the patched
package is missing.
The vendored jade lockfile moves from pbkdf2 3.1.5 to 3.1.7.
tests/dependencySecurityUpdates.test.cjs fails when any tracked lockfile
holds pbkdf2 <= 3.1.6, flags a synthetic 3.1.3 bundled entry, and drives the
postinstall script against fixture trees.
Thanks to dependabot and xet7 !
The Select all / Unselect all handlers did set the selection, and each
row's checkbox followed it, but the checkboxes were never on screen:
forms.css hides every native checkbox app-wide (display: none,
visibility: hidden, position: absolute and a -9999px offset), and the
rules list used native ones with nothing undoing that. So the buttons
changed invisible state, and no rule could be ticked by hand for Delete
selected / Export selected either.
rules.css now undoes all parts of that rule for .js-rule-select, with a
selector that outranks [type="checkbox"]:checked, and the checkbox is
labelled with its rule's title. tests/rulesSelectAllCheckboxes.test.cjs
runs the select-all / unselect-all / single-toggle logic with several
rules, pins the override, and as the negative test checks that no native
checkbox under client/components/rules is left hidden. Playwright spec
44-rules checks the boxes are visible and follow both buttons.
Thanks to titver968 and xet7 !
Fixes#6749,
Fill 48 placeholders in Sesotho, Setswana and Northern Sotho, preserve numbered arguments and extend regression coverage. Document vocabulary evidence and provisional technical wording.
Thanks to xet7 !
The swatch click handler of the rule action color popup read the color
from Template.currentData(). Inside a Blaze event handler that is the data
of the template the handler is defined on - the popup, opened with the
cardActions context { ruleName, triggerVar, ruleId } - not the clicked
swatch, so every click set the selection to undefined and the action could
only ever be saved with the "green" default. The handler now reads the
swatch's own data with Blaze.getData(event.currentTarget), like the card,
list and swimlane color popups, and ignores anything that is not a card
color. The Save button is type="button" so it cannot submit the form.
Tests: tests/ruleSetColorActionPicker.test.cjs drives the real handlers
with Blaze event semantics (every color is selectable and saved, a click
without a valid color keeps the selection, nothing applies without Save)
and scans every palette click handler under client/ so none takes its
color from Template.currentData() first; a Playwright spec picks red in
the Rules editor and checks the stored action.
Thanks to titver968 and xet7 !
Fixes#6748,
Fill 80 placeholders across Zulu, Xhosa, Swati and Northern Ndebele catalogs. Preserve numbered arguments, extend regression checks and document lower-confidence wording and number agreement.
Thanks to xet7 !
Fill 64 placeholders with preserved arguments, extend translation regressions and record provisional technical wording and contextual bubble paraphrases.
Thanks to xet7 !
Records a3048e4a7a (a stopped Launchpad build is retried with a new build),
576a8438aa (the activity notification intent test), the two CHANGELOG
wrapping commits and the Tigre and Tamazight fixes under Upcoming. The two
Snap entries added for #6746 linked 941aa91929, a translation commit that
landed between that fix and its changelog commit; they now link the fix,
f927cb3c50. Prose added since the last wrap is wrapped at 80 columns again
(whitespace only).
Thanks to xet7 !
The v12.21 s390x snap failed. Attempt 1's Launchpad build stopped
because the build farm's own package proxy answered "501 Gateway error"
for libyaml-cpp0.8_0.8.0+dfsg-6build1_s390x.deb while every neighbouring
package downloaded. Attempt 2 submitted a new build that also stopped,
and snapcraft crashed fetching its log (MissingSchema "Invalid URL
'None'"). Attempt 3 then ran `remote-build --recover`, which reconnects to
that SAME stopped build, and was over in eight seconds: a finished build
cannot be recovered into a snap. Each attempt also reprinted every
earlier attempt's log, so attempt 1's failure appeared again under
attempt 2.
Now an attempt whose build ended "Stopped:"/"Failed:"/"Cancelled:" for
the architecture makes the next attempt submit a new build; recovery is
still what reconnects after a TLS/polling error or an auth failure, as
before. Each attempt prints only the build logs it downloaded, and says
so when it got none. A 5xx from the build farm's package proxy is named
as Launchpad infrastructure with the package that failed, so the next
step is a re-run rather than an edit of snapcraft.yaml.
tests/releaseSnapRecovery.test.cjs runs the real step with a stand-in
snapcraft: a stopped build is retried without --recover and then builds;
negatively, three stopped builds with the proxy error fail with the
infrastructure message, print attempt 1's log once, and are not called a
deterministic stage-package failure. Both new tests fail on the previous
workflow. Not run on GitHub Actions or Launchpad here.
Thanks to xet7 !
Fill 64 placeholders in Maori, Samoan, Hawaiian and Tongan. Preserve arguments, extend distinction checks and document provisional terminology with dictionary references.
Thanks to xet7 !
Fill 64 placeholders in Yiddish, Turkmen, Bhojpuri and Maithili while preserving numbered arguments. Extend translation regressions and record lower-confidence terminology and pending contextual review.
Thanks to xet7 !
Fill 11 field labels and extend regression checks. Record very low confidence in technical phrases and the need for grammatical review.
Thanks to xet7 !
Fill ten field labels and correct three controls. Add token and distinction regressions and document low-confidence wording; angle remains pending vocabulary evidence.
Thanks to xet7 !
Fill 22 field labels and correct three foreign-language controls. Document low-confidence technical paraphrases and extend regression coverage.
Thanks to xet7 !
The mocha test "stores intent before dispatch, preserves pending failures
and suppresses deferred or disabled capture" failed about one run in four
with "notification hook did not settle". Traced with in-memory lease,
recovery and gate events: the two activities' insert hooks dispatch
concurrently, and when the second activity reached the subscriber first,
intentIds[0] held ITS intent - the one the test makes fail on purpose. The
test then waited for that intent to complete, which never happens, while
the one-second recovery scan kept retrying it. The application behaved as
designed; the test assumed an order the hooks never promised.
Intents are now recorded against their activity. The checks that counted
subscriber calls also allowed for the recovery scan, which legitimately
retries a pending intent on its own: the recipient is denied before the
replacement subscriber is installed, calls are compared with a snapshot,
the final retry waits out a scan that holds the lease at that instant, and
exactly one delivery is required whichever of the two made it.
The test passed 12 of 12 runs in isolation afterwards; it failed 1 of 4
before.
Thanks to xet7 !
Fill 33 English placeholders and correct two Malay-seeded Acehnese selectors. Extend semantic and token regressions and record provisional technical wording.
Thanks to xet7 !
Fill 44 English placeholders and extend field-type distinction checks while preserving existing translations and source arguments. Record provisional technical terminology.
Thanks to xet7 !
Fill 33 English placeholders and correct four mixed-language selectors. Extend field-type and semantic regressions; document low-confidence technical wording.
Thanks to xet7 !
Fill 33 English placeholders, preserve existing translations and source arguments, and extend field-type distinctions. Document vocabulary sources and provisional terminology.
Thanks to xet7 !
Fill 33 English placeholders and repair four selector labels. Extend semantic and token coverage and document vocabulary sources and provisional technical phrasing.
Thanks to xet7 !
Fill 44 English placeholders in Bislama, Tok Pisin, Fijian and Samoan and correct four mixed-language selector labels. Extend regressions and record provisional technical wording.
Thanks to xet7 !
Fill 55 English placeholders and replace two mixed-language Luganda control labels. Extend semantic and argument regressions and record provisional terminology.
Thanks to xet7 !
28 lines added since the last wrap - the new Upcoming section and
translation progress notes - ran past 80 columns and failed
tests/changelogFormat.test.cjs. Whitespace only; the rendered text is the
same.
Thanks to xet7 !
Fill 44 English labels and replace five foreign or filler values in Venda and Tsonga. Extend semantic and token regressions and document low-confidence technical wording.
Thanks to xet7 !
The logs in #6746 show the real cause of "write: permission denied" from
database-restore and of WeKan waiting forever for FerretDB: 1300 kernel
lines of apparmor="DENIED" operation="file_perm" class="net" for
snap.wekan.wekan on 127.0.0.1:27019, with the same denial for snap-store
and standard-notes on that computer. FerretDB was running and accepting
connections; the kernel refused the first write. That is snapd 2.77.1 on a
kernel with an AppArmor socket mediation bug (Launchpad snapd bug 2169038),
fixed by a newer kernel and worked around by `snap revert snapd`.
WeKan cannot lift that denial, so it now says what it is. A new
bin/socket-denied recognises the refusal and prints the denial to look for,
the upstream bug and both ways out. wekan-control's FerretDB and MongoDB
wait loops keep each attempt's error and print it on the first refused
attempt instead of "not ready yet" for two minutes; database-backup and
database-restore stop at once instead of starting an already running
service and waiting 90 seconds.
The same log began with "error: snapctl: get which option?" four times:
SAML_IDP_PROFILE, SAML_WANT_RESPONSE_SIGNED, SAML_WANT_ASSERTIONS_SIGNED
and SAML_LOGIN_FLOW were listed in bin/config without a KEY_ name, so
wekan-read-settings ran a bare `snapctl get` for them and `snap set` could
never reach them. They now have their snap keys, the CORS_EXPOSE_HEADERS
description has its right name, and a key without a snap name falls back
to its default instead of calling snapctl.
Tests: snapSocketDenied, snapSettingsKeys, and extended snapDatabaseRestore
and ferretdbWaitTimeout.
Related to #6746: the reporter still has to update the kernel or revert
snapd, so the issue stays open until that is confirmed.
Thanks to fabiosalles and xet7 !
Fill 66 English placeholders in six locale paths, preserve existing translations and source arguments, and extend type-distinction regressions. Document terminology sources and provisional wording.
Thanks to xet7 !
Fill 34 English placeholders and correct three foreign seed labels in Walloon. Extend field-type and language regression coverage; record provisional terminology.
Thanks to xet7 !
Fill 55 English placeholders in Turkmen, Odia, Konkani, Papiamento and Wu Chinese. Extend field-type distinction checks and record provisional terminology.
Thanks to xet7 !
tests/upcomingTamazightPlaceholderRepair.test.cjs failed: the
r-trigger-vars-hint translation from 58c0d84d7a named checklist fields
with the verification noun the suite rejects as unsupported. It now uses
the file's own checklist term, the one `checklist` itself carries. The
placeholders are unchanged; every suite that reads the Tamazight file
passes.
Thanks to xet7 !
Fill 88 English placeholders, preserve source arguments and existing translations, and test distinct image, selector and name types. Record provisional terminology and outstanding spoken accessibility review.
Thanks to xet7 !
tests/tigreAllBoardCardContexts.test.cjs and
tests/tigreAllEstablishedNounContexts.test.cjs failed: newly translated
hints for auto-archiving, list age, Leo import, parent cards, rule
triggers, rule people variables, notification settings, saved filters,
card-text filtering and map placement used the Tigrinya forms ካርድ, ስም,
አስማት and ፋይል instead of the established Tigre ones. They now use ወረቀት
ካርድ for card, ስሜት for name, the corpus-attested plural አስማይ for names
and ፈይል for file, as the rest of the Tigre file does. Placeholders and
variables are unchanged.
Low confidence: the surrounding wording is still provisional and needs a
Tigre speaker's review. All Tigre suites and the human-preference checks
pass.
Thanks to xet7 !
Fill fifteen English placeholders and extend opposite-action, argument and context-menu coverage. Record vocabulary references and low-confidence technical paraphrases for review.
Thanks to xet7 !
tests/changelogFormat.test.cjs failed twice over. Two links in the v12.16
translation entry used the commit hashes b76be84186 and c9e622f1b5 as
their text; the text now says what each commit translated and the links
are unchanged. And 1,542 prose lines - bullets and paragraphs, mostly
translation progress notes - ran past 80 columns. They are wrapped at word
boundaries, bullet continuations indented two spaces, never starting a
line with something markdown reads as a heading or a list, so the
rendered text is the same; links, summaries, language lists and the
closing sentence stay on one line as the test allows. The TODO Later note
asking whether to correct the released link text is removed.
Every suite that reads CHANGELOG.md passes.
Thanks to xet7 !
Fill fifteen English placeholders, extend control and context-menu regressions, and document vocabulary sources and low-confidence technical phrasing.
Thanks to xet7 !
Fill thirteen English placeholders while preserving existing comment commands and source arguments. Extend control regressions and browser assertions. Record low-confidence technical wording for review.
Thanks to xet7 !
Fill comment and input controls, extend placeholder and opposing-action checks, and document provisional wording and vocabulary references.
Thanks to xet7 !
Use researched Veps vocabulary, preserve source arguments, extend regression coverage and record low-confidence technical adaptations.
Thanks to xet7 !
Preserve existing labels, correct three generic text labels, and extend placeholder and opposite-action checks. Document provisional technical wording.
Thanks to xet7 !
Records fa75d59fd0 under Upcoming as a Snap bug fix, and lists #6746 in
TODO Later until the reporter's FerretDB service log shows why FerretDB
did not answer.
Thanks to fabiosalles and xet7 !
Preserve existing Ewe translations, correct the Akan text label, and extend placeholder and opposite-action checks. Record low-confidence technical phrasing for review.
Thanks to xet7 !
wekan.database-restore and wekan.database-backup talked to whatever was
on the database port and nothing else. After `snap stop wekan`, which the
restore steps tell people to run, nothing is there; on a FerretDB snap the
database is its own service that starting WeKan alone does not bring back.
The tools then failed after a 30-second server-selection timeout with a
driver topology dump naming neither the service nor its log.
The new bin/database-ready asks bin/database-role which database holds
the data, starts that service when nothing answers, waits for it, and when
it still does not answer stops with the driver's own error and the
`snap logs` / `snap services` commands that show the reason. A "permission
denied" is explained as a security-policy denial on this system, not the
database, with the journal command that names the rule.
WeKan's own wait for FerretDB discarded the ping error, so its log said only
"FerretDB not ready yet" for every cause. db-eval now prints why a command
failed on stderr, and the wait's one-time hint shows it. The same hint
suggested `snap set wekan database=mongodb`, a setting the configure hook
removes, so that advice did nothing; it is gone.
The backup script also sources its settings and passes the archive path
quoted now, so a path with a space works.
tests/snapDatabaseRestore.test.cjs runs both scripts in a stand-in snap:
FerretDB or MongoDB started by role, a running database left alone, and,
negatively, a database that never answers stopping the tool before it
runs, with the error shown. A source guard requires both tools to wait for
the database first. tests/ferretdbWaitTimeout.test.cjs now requires the
ping error in the hint and rejects the removed setting. Not run inside an
installed snap here.
Thanks to fabiosalles and xet7 !
Fill comment and input labels while preserving existing Manx and Aromanian translations. Extend regression coverage and document provisional wording.
Thanks to xet7 !
Fill comment and input labels, correct the Tongan text filler, and extend placeholder and opposing-action checks. Record provisional wording and vocabulary references.
Thanks to xet7 !
Fill comment and input controls across ten locale paths, extend placeholder and opposite-action checks, and record provisional wording and vocabulary references.
Thanks to xet7 !
Fill comment and input controls with intact placeholders and distinct opposing actions. Extend regression coverage and document provisional technical phrasing.
Thanks to xet7 !
Fill comment and input-control labels, preserve source arguments and distinguish opposite actions. Correct the Tatar text label and record provisional technical wording.
Thanks to xet7 !
Complete this announcement group across all non-English locales and extend placeholder and direction checks. Record low-confidence Cherokee phrasing for further review.
Thanks to xet7 !
Fill twelve movement and scrolling announcements, preserve arguments and extend regression coverage. Record low-confidence technical clauses and the spatial vocabulary references used.
Thanks to xet7 !
Fill 24 movement and scrolling announcements, preserve arguments and extend regression coverage. Record low-confidence technical wording and case endings in both locales.
Thanks to xet7 !
Fill 48 announcements in Nahuatl, Wolaytta, Tamazight and Wu Chinese. Preserve arguments and extend regression coverage. Record low-confidence technical clauses in Nahuatl, Wolaytta and Tamazight.
Thanks to xet7 !
Fill 72 announcements in Quechua, Aymara, Guarani, Veps, Volapuk and Klingon. Preserve arguments and extend regression coverage. Record provisional wording, particularly Aymara, Veps, Volapuk and Klingon.
Thanks to xet7 !
Fill 72 announcements in Buryat, Chuvash, Sakha, Tibetan, Dzongkha and Tigrinya. Preserve arguments and extend regression coverage. Record provisional technical wording, particularly Buryat, Chuvash, Sakha and Dzongkha.
Thanks to xet7 !
Fill 72 announcements in Akan, Bambara, Ewe, Wolof, Fulah and Kashmiri. Preserve arguments, extend regression coverage and record provisional technical wording, particularly Bambara, Ewe and Fulah.
Thanks to xet7 !
Fill 60 announcements in Walloon, Waray, Acehnese, Northern Sami and Venetian. Preserve existing Manx and Aromanian values and extend coverage to all seven locales. Record provisional technical wording, particularly Walloon, Acehnese and Northern Sami.
Thanks to xet7 !
Fill 108 movement and scrolling announcements, preserve arguments and extend regression coverage. Record provisional technical wording, particularly Tongan, Hawaiian and Luganda.
Thanks to xet7 !
Fill 120 movement and scrolling announcements across ten locale files, preserving arguments and existing translations. Extend regression coverage and record low-confidence technical wording, particularly Swati, Northern Ndebele and Venda.
Thanks to xet7 !
Preserve arguments and directions across 96 values. Technical phrasing remains provisional, particularly Maithili, Konkani and Papiamento.
Thanks to xet7 !
Add a provisional Cherokee ability-to-pull phrase and check the label in all non-English catalogs. The derived Cherokee grammar remains low-confidence and requires review.
Thanks to xet7 !
Fill seven remaining locales and check both labels in all non-English catalogs. The final seven sets remain low-confidence drafts, especially Cherokee.
Thanks to xet7 !
Preserve both directions and extend localized checks. Technical wording remains provisional, especially Chuvash, Veps, Volapuk and Klingon.
Thanks to xet7 !
Keep both directions distinct and extend browser coverage. Manx, Aromanian, Fulah and Kashmiri wording remains particularly provisional; the Fulah vocabulary lookup was inconclusive.
Thanks to xet7 !
Cover both directions and localized editing. Pronoun agreement and technical wording remain provisional, particularly Swati, Northern Ndebele, Venda, Fijian and Tongan.
Thanks to xet7 !
Distinguish both relationship directions and extend localized editing coverage. Chichewa, Samoan and Konkani wording remains provisional.
Thanks to xet7 !
Add Cherokee, Inuktitut and Tigre drafts and verify examples in all non-English locales. These final translations remain low-confidence, especially the Cherokee technical clause.
Thanks to xet7 !
Replace Wolaytta English filler and preserve literal code examples. All four translations remain low-confidence technical drafts requiring semantic review.
Thanks to xet7 !
Preserve literal examples and extend localized checks. All six sets remain low-confidence technical drafts, particularly Veps, Volapuk and Klingon.
Thanks to xet7 !
Preserve code examples and cover localized hint visibility. Technical wording remains provisional, especially in Fijian, Tongan and Hawaiian.
Thanks to xet7 !
Preserve variable examples and replace a Xitsonga filler label. Technical wording remains provisional, particularly in Konkani, Swati, Northern Ndebele and Venda.
Thanks to xet7 !
Preserve executable context examples and URL encoding syntax. Correct mixed-language Tatar format labels and its malformed space entity. Chichewa and Samoan technical wording remains provisional.
Thanks to xet7 !
Fill thirty English placeholders in Cherokee, Inuktitut and Tigre and check the ten saved-filter strings across all 234 non-English locales. The new technical clauses remain low-confidence drafts requiring semantic review.
Thanks to xet7 !
Fill forty English placeholders and extend positive and negative filter coverage. All four sets remain low-confidence technical drafts requiring semantic review.
Thanks to xet7 !
Fill sixty English placeholders and extend positive and negative filter coverage. All six locale sets remain low-confidence technical drafts, particularly Veps, Volapük and Klingon.
Thanks to xet7 !
Fill sixty English placeholders and extend positive and negative filter coverage. Technical clauses remain provisional, especially Buryat, Chuvash and Dzongkha.
Thanks to xet7 !
Fill sixty English placeholders and extend positive and negative filter coverage. Technical clauses remain provisional, especially Ewe, Fulah and Kashmiri.
Thanks to xet7 !
Fill seventy English placeholders, correct wrong-language filter labels and extend positive and negative filter coverage. Technical clauses remain provisional, especially Waray, Acehnese, Manx and Aromanian.
Thanks to xet7 !
Fill ninety English placeholders and extend positive and negative filter coverage. Technical clauses remain provisional, especially Fijian, Tongan, Hawaiian and Kirundi.
Thanks to xet7 !
Fill one hundred English placeholders and extend positive and negative filter coverage. Technical clauses remain provisional, especially Swati, Northern Ndebele, Tsonga and Venda.
Thanks to xet7 !
Fill eighty English placeholders and extend positive and negative filter coverage. Technical clauses remain provisional, especially Konkani and Papiamentu.
Thanks to xet7 !
Fill seventy English placeholders, correct mixed-language Tatar filter wording and extend positive and negative filter coverage. Technical clauses remain provisional, especially Chichewa and Samoan.
Thanks to xet7 !
Fill thirty English placeholders in Cherokee, Inuktitut and Tigre and check the ten report strings across all 234 non-English locales. The new technical clauses remain low-confidence drafts requiring semantic review.
Thanks to xet7 !
Fill thirty English placeholders and extend report regression coverage. All three sets remain low-confidence technical drafts requiring semantic review.
Thanks to xet7 !
Fill sixty English placeholders and extend report regression coverage. All six locale batches remain low-confidence technical drafts, particularly Veps, Volapük and Klingon.
Thanks to xet7 !
Fill sixty English placeholders and extend report regression coverage. Technical clauses remain provisional, especially Buryat, Chuvash and Dzongkha.
Thanks to xet7 !
Fill sixty English placeholders and extend report regression coverage. Technical clauses remain provisional, especially Ewe, Fulah and Kashmiri.
Thanks to xet7 !
Fill seventy English placeholders and extend report regression coverage. Technical clauses remain provisional, especially Acehnese, Manx and Aromanian.
Thanks to xet7 !
Fill ninety English placeholders and extend report regression coverage. Technical clauses remain provisional, particularly Fijian, Tongan, Hawaiian and Kirundi.
Thanks to xet7 !
Fill one hundred English placeholders and extend report regression coverage. Full technical clauses remain provisional, especially Swati, Northern Ndebele, Tsonga and Venda.
Thanks to xet7 !
Fill eighty English placeholders and extend report regression coverage. Technical clauses remain provisional, especially Konkani and Papiamentu.
Thanks to xet7 !
Fill seventy English placeholders and extend report regression coverage. Technical clauses remain provisional, especially Chichewa and Samoan.
Thanks to xet7 !
Explain the last focused field and extend locale and browser coverage. Technical phrasing remains provisional, especially Konkani, Southern Sotho, Tswana, Chichewa and Samoan. Focused checks pass; browser execution remains unverified.
Thanks to xet7 !
Complete non-English placeholder coverage for the Leo instruction and remove its pending key. The Cherokee draft remains very low-confidence and wider linguistic review stays open. Focused checks pass; browser execution remains unverified.
Thanks to xet7 !
Preserve existing translations and extend locale and browser checks. Both full instructions remain very low-confidence drafts requiring vocabulary and grammar review. Focused checks pass; browser execution remains unverified.
Thanks to xet7 !
Preserve existing translations and extend locale and browser checks. All six technical drafts remain provisional, especially Dzongkha, Quechua, Aymara and Guarani. Focused checks pass; browser execution remains unverified.
Thanks to xet7 !
Preserve existing translations and cover the new instructions in locale and browser checks. Technical phrasing remains provisional, especially Konkani, Swati, Northern Ndebele and Venda. Focused checks pass; browser execution remains unverified.
Thanks to xet7 !
Fill remaining English instructions and extend locale and browser coverage. Technical phrasing, especially Somali and Chichewa, remains provisional. Browser execution is unverified; focused Node checks pass.
Thanks to xet7 !
Add Tigre and Wolaytta drafts with low-confidence limitations; remove three keys from the pending inventory after checking all 234 non-English locales.
Thanks to xet7 !
Clarify relationship removal and extend label and card-preservation coverage. Record provisional technical wording in the translation audit.
Thanks to xet7 !
Fill 14 placeholders and extend locale and browser coverage. Technical sentences are low-confidence drafts; floor-plan and map/card wording require language review. Focused checks pass; browser execution remains pending.
Thanks to xet7 !
Fill 14 placeholders and extend locale and browser coverage. Check map, drag, drawing and click vocabulary against dictionaries. Full technical sentences remain provisional. Focused checks pass; browser execution remains pending.
Thanks to xet7 !
Fill 35 placeholders and extend locale and browser coverage. Technical phrases, especially floor-plan wording and the Wolof map/card distinction, remain provisional. Focused checks pass; browser execution remains pending.
Thanks to xet7 !
Fill 28 placeholders and extend locale and browser coverage. Technical wording remains provisional, especially floor-plan and click terms. Focused checks pass; browser execution remains pending.
Thanks to xet7 !
Fill 42 placeholders for Sesotho, Setswana, Northern Sotho, Zulu and Xhosa. Floor-plan terminology remains provisional, especially Northern Sotho. Extend locale and browser coverage; focused checks pass and browser execution remains pending.
Thanks to xet7 !
Fill 35 Somali, Oromo, Kinyarwanda, Kirundi and Chichewa placeholders. Distinguish map and task card terms in Kinyarwanda and Kirundi. Technical sentences and floor-plan terms remain provisional. Extend regression and browser coverage; browser execution remains pending.
Thanks to xet7 !
Fill five Cherokee recovery messages with provisional low-confidence wording. Extend coverage to all 234 non-English locales and remove the five completed keys from the pending queue. Add the Cherokee browser scenario; focused and human-preference checks pass, browser execution remains pending.
Thanks to xet7 !
Fill twenty recovery messages and extend regression coverage. Full clauses and software terminology remain provisional pending language review.
Thanks to xet7 !
Fill twenty recovery messages and extend regression coverage. Full clauses and software terminology remain provisional pending language review.
Thanks to xet7 !
Fill Southern Sotho, Tswana, Northern Sotho, Zulu and Xhosa recovery messages and extend regression coverage. Full clauses and technical terminology remain provisional pending language review.
Thanks to xet7 !
Fill Somali, Oromo, Kinyarwanda, Kirundi and Chichewa recovery messages and extend regression coverage. Full clauses and software terms remain provisional pending language review.
Thanks to xet7 !
Fill Moroccan Arabic, Bhojpuri, Maithili, Odia and Konkani recovery messages and extend regression coverage. Full clauses and software terminology remain provisional pending language review.
Thanks to xet7 !
Fill Kurmanji, Sorani, Tatar, Turkmen and Yiddish recovery messages, preserving undo/redo and retry/forget distinctions. Extend the existing browser scenario and token coverage. Full clauses and minority-language software terms remain provisional pending language review.
Thanks to xet7 !
Translate the remaining Cherokee messages, extend regression coverage to all 234 non-English locales and remove the three filled keys from the pending inventory. Preserve RTL navigation arrows. Cherokee full sentences and technical phrasing remain low confidence pending language review.
Thanks to xet7 !
Fill three messages and replace the Tigrinya Admin Panel phrase. Full sentences, warning paraphrase and technical terminology remain low confidence pending language review.
Thanks to xet7 !
Fill three messages and replace the Arabic Admin Panel seed with Tamazight wording. Full sentences and technical terminology remain low confidence pending language review.
Thanks to xet7 !
Fill three messages with the recovery navigation path and extend regression coverage. Full sentences and software terminology remain low confidence pending language review.
Thanks to xet7 !
Fill three messages and replace two prefixed-English recovery menu labels. Full sentences and technical terminology remain low confidence pending language review.
Thanks to xet7 !
Fill six import-report messages with preserved navigation paths and extend regression coverage. Full clauses and technical terminology remain low confidence pending language review.
Thanks to xet7 !
Fill import report messages and replace the Venda recovery-menu seed. Veps clauses, warning paraphrase and derived recovery terminology remain low confidence pending language review.
Thanks to xet7 !
Fill three English placeholders using dictionary vocabulary and extend regression coverage. Passive tense, agreement and technical use of the import verb have low confidence and need fluent review. Browser coverage was syntax-checked only.
Thanks to xet7 !
Fill six English values and extend source-order, token and localized browser coverage. Technical phrasing and agreement in both drafts have low confidence and require fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill nine English values, replace four prefixed English menu labels and extend regression coverage. All three drafts have low-confidence technical nouns, incomplete-transfer clauses and inflection requiring fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill nine English placeholders and extend source-order, token and localized browser coverage. Technical phrasing, Aromanian derivation and grammatical agreement have low confidence and need fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill nine English placeholders and extend source-order, token and localized browser coverage. Technical phrasing and grammatical agreement in all three drafts have low confidence and need fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill twelve English placeholders and extend source-order, token and localized browser coverage. All four drafts have low-confidence case endings, passive and negative constructions, and technical phrasing requiring fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill 18 English values and correct two prefixed English Tongan menu labels. Extend token, source-order, vocabulary and localized browser coverage. Acehnese, Bambara, Ewe and Fulah phrasing has low confidence and needs fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill 24 English values and correct eleven generic or wrong-language menu labels. Extend source-order, token, vocabulary and localized browser coverage. Wolof, Swati, Venda, Waray and Venetian phrasing has lower confidence and needs fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill 24 English values, replace five mixed-language or malformed menu values and extend regression coverage. Samoan, Hawaiian, Papiamentu and Northern Ndebele technical phrasing has lower confidence and needs fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill 30 English placeholders and extend source-order, token and localized browser coverage. Preserve existing translations and the recovery menu path. Oromo, Kirundi, Chichewa and Northern Sotho technical phrasing has lower confidence and needs fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Fill 30 English placeholders and correct two Tatar recovery menu labels. Preserve source order, tokens and existing translations. Add report text and rejected-input UI coverage.
Konkani, Bhojpuri, Maithili, Turkmen and Kurdish technical phrasing has lower confidence and needs fluent review. Browser cases were syntax-checked only.
Thanks to xet7 !
Add three Cherokee drafts and extend board visibility translation coverage to every non-English locale. Remove the filled group from the pending inventory. Record low-confidence Cherokee grammar and technical phrasing for fluent-speaker review.
Thanks to xet7 !
Fill three English placeholders and extend translation regression coverage. Document grammar references and low-confidence software vocabulary and agreement for fluent-speaker review.
Thanks to xet7 !
Fill three English placeholders and extend translation regression coverage. Document low-confidence login phrasing, negation and membership wording for fluent-speaker review.
Thanks to xet7 !
Fill three English placeholders in syllabics and extend translation regression coverage. Document low-confidence technical phrasing and inflection for fluent-speaker review.
Thanks to xet7 !
Fill three English placeholders in Tifinagh and extend translation regression coverage. Document low-confidence login phrasing, passive morphology and dialect consistency for fluent-speaker review.
Thanks to xet7 !
Fill three English placeholders and extend translation regression coverage. Document references and low-confidence software terminology, passive construction and dialect consistency for fluent-speaker review.
Thanks to xet7 !
Fill three English placeholders and extend translation regression coverage. Document vocabulary references and lower-confidence technical phrasing and inflection for fluent-speaker review.
Thanks to xet7 !
Fill three English placeholders and extend translation regression coverage. Record references and low-confidence login phrasing and case endings for fluent-speaker review.
Thanks to xet7 !
Fill three English placeholders and extend translation regression coverage. Document vocabulary references and lower-confidence technical phrasing for fluent-speaker review.
Thanks to xet7 !
Fill six English placeholders and extend token and markup regression coverage. Document lower-confidence technical phrasing and Klingon clause structure for fluent-speaker review.
Thanks to xet7 !
Fill nine English placeholders and extend translation regression coverage. Document vocabulary references and lower-confidence login phrasing and dialect choices for fluent-speaker review.
Thanks to xet7 !
Fill nine English placeholders and extend token and markup coverage. Document references and lower-confidence grammar and dialect choices for fluent-speaker review.
Thanks to xet7 !
Fill nine English placeholders and extend translation regression coverage. Record lower-confidence technical phrasing and grammar for fluent-speaker review.
Thanks to xet7 !
Fill 12 English placeholders in Buryat, Chuvash, Sakha and Northern Sámi. Extend translation regression coverage and document terminology references and lower-confidence grammar for fluent-speaker review.
Thanks to xet7 !
Fill 18 English values in Acehnese, Bambara, Ewe, Fulah, Fijian and Tongan. Extend translation regression coverage and record lower-confidence login terminology and grammar for fluent-speaker review.
Thanks to xet7 !
Fill 24 English placeholders in eight locales and extend source-order, placeholder, markup and rendered-emphasis regression checks. Record lower-confidence technical phrasing for fluent-speaker review.
Thanks to xet7 !
Fill 24 English values and extend token, markup and rendered-emphasis coverage. Record lower-confidence Hawaiian, Samoan and Northern Ndebele phrasing for fluent-speaker review.
Thanks to xet7 !
Fill 30 English placeholders and extend markup and token regression coverage. Record lower-confidence Oromo, Kirundi and Sotho–Tswana wording for fluent-speaker review.
Thanks to xet7 !
Fill 30 English placeholders while preserving confirmation markup and source tokens. Add locale regression coverage and record remaining work in the translation audit.
Lower-confidence wording in Moroccan Arabic, Kurdish varieties, Bhojpuri, Maithili, Konkani and Yiddish needs fluent-speaker review.
Thanks to xet7 !
Discover all non-English locales in the regression suite and remove the filled hint from the pending inventory. Record low-confidence Cherokee wording and ongoing quality review.
Thanks to xet7 !
Preserve literal scheme names and extend regression coverage. Record lower-confidence technical wording and grammatical agreement for review.
Thanks to xet7 !
Preserve literal scheme names and extend regression coverage. Document lower-confidence terminology and grammatical agreement for review.
Thanks to xet7 !
Preserve literal scheme identifiers and extend regression coverage. Record lower-confidence regional grammar and technical wording for review.
Thanks to xet7 !
Preserve scheme identifiers and extend regression coverage. Record lower-confidence technical wording and dictionary references for review.
Thanks to xet7 !
Preserve literal scheme identifiers and extend regression coverage. Record lower-confidence technical wording and regional spelling for review.
Thanks to xet7 !
Fill English placeholders and preserve literal scheme identifiers. Record lower confidence in technical wording and extend regression coverage.
Thanks to xet7 !
Preserve literal identifiers and extend hint checks to 39 recently filled locales. Parser, sanitizer, structural and human-preference checks pass. Record vocabulary sources and lower-confidence wording; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Preserve literal identifiers and extend hint checks to 37 recently filled locales. Parser, sanitizer, structural and human-preference checks pass. Record lower-confidence wording; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Preserve all scheme identifiers and extend checks to 34 recently filled locales. Parser, sanitizer, structural and human-preference checks pass. Record lower-confidence technical wording; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill Kinyarwanda, Kirundi, Luganda, Tsonga and Venda values with exact scheme identifiers. Parser, sanitizer, structural and human-preference checks pass. Record lower-confidence technical wording; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill eight values and extend exact-identifier checks to 24 recently filled locales. Parser, sanitizer, structural and human-preference checks pass. Record lower-confidence technical wording; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Preserve scheme identifiers and extend translation coverage to 16 recently filled locales. Parser, sanitizer, structural and human-preference checks pass. Record lower-confidence Oromo and Nyanja prose; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Preserve all five literal scheme identifiers and extend positive and negative regression coverage. Parser, sanitizer, structural and human-preference checks pass. Record lower-confidence technical wording; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill Cherokee and Wolaytta labels and verify the pair across all 234 non-English locales. Remove two filled pending keys. Record lower-confidence wording for native review. Runtime, structural and human-preference checks pass; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill six labels and extend placement checks to 64 recently filled locales. Record vocabulary sources and lower-confidence wording. Runtime, structural and human-preference checks pass; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill six spatial placement labels and extend translation checks to 61 recently filled locales. Record vocabulary sources and lower-confidence standalone wording. Runtime, structural and human-preference checks pass; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill eight labels and extend placement checks to 58 recently filled locales. Record vocabulary references and lower-confidence Veps wording. Runtime, structural and human-preference checks pass; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill ten Buryat, Chuvash, Yakut, Aromanian and Klingon labels. Record vocabulary references and native-review limitations. Placement checks now cover 54 recently filled locales; runtime, structural and human-preference checks pass. Browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill 26 before/after labels using spatial terminology and extend translation checks to 49 recently filled locales. Record vocabulary references and lower-confidence Aymara, Northern Sami and Waray wording. Runtime, structural and human-preference checks pass; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill 72 before/after labels and verify distinct placement choices, source tokens and key order. Preserve existing translations. Lower-confidence minority-language wording is recorded for review. Runtime and structural checks pass; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill seven Cherokee strings and check the group across all 234 non-English locale paths. Preserve literal rule variables and source tokens; retire the seven pending keys. Technical Cherokee wording remains low confidence and requires native review. Runtime, structural and human-preference checks pass; browser scenarios were syntax-checked but not run without the app stack.
Thanks to xet7 !
Fill seven pending strings and extend literal-variable regression coverage. Runtime, structural and human-preference checks pass. Technical wording is low confidence and requires Tigre speaker review; browser scenarios remain unrun without the app stack.
Thanks to xet7 !
Fill seven instructions and correct five prefixed rule labels. Preserve literal variables and cover the values with translation regressions. Runtime, structural and human-preference checks pass. Technical wording is lower confidence and needs native review; browser scenarios could not run without the app stack.
Thanks to xet7 !
Fill seven pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs native terminology and dialect review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill seven pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs native terminology and regional-usage review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill seven pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and uses the borrowed software word card; speaker review remains open. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill seven pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs native terminology and dialect review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill seven pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill seven pending values and correct three labels. Extend literal-variable and label regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs speaker review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill seven pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill seven pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs native dialect and terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill seven pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs native review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and replace three prefixed English labels. Extend literal-variable and label regression checks. Runtime matching, all-locale structural and human-preference checks pass. Both translations have lower confidence and need native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Kashmiri prose has lower confidence; both locales need native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Both translations have lower confidence and need native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Both translations have lower confidence and need native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and correct three Nguni seed labels in Venda. Extend literal-variable and label regression checks. Runtime matching, all-locale structural and human-preference checks pass. Both translations have lower confidence and need native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Both translations have lower confidence and need native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and correct five wrong-language labels. Extend literal-variable and label regression checks. Runtime matching, all-locale structural and human-preference checks pass. Aromanian prose has lower confidence; both locales need native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Both translations have lower confidence and need native terminology review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and correct the English trigger label in Luganda. Extend literal-variable and label regression checks. Runtime matching, all-locale structural and human-preference checks pass. Technical prose has lower confidence and needs native review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and correct three wrong-language seed labels in Waray. Extend literal-variable and seed-label regression checks. Runtime matching, all-locale structural and human-preference checks pass. Akan technical prose has lower confidence and needs native review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and extend literal-variable regression checks. Runtime matching, all-locale structural and human-preference checks pass. Manx prose has lower confidence; technical vocabulary and composed date fragments need native review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 21 pending values and replace two prefixed English labels in Tongan. Preserve literal variables and extend regression checks. Runtime matching, all-locale structural and human-preference checks pass. Fijian and Tongan technical prose has lower confidence and needs native review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 28 values in Northern Ndebele, Swati, Northern Sotho and Tsonga. Preserve literal variables and extend regression checks. Runtime matching, all-locale structural and human-preference checks pass. Northern Ndebele and Swati prose has lower confidence; native terminology and browser review remain open. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and correct three Persian seed labels in the Moroccan Arabic locale. Extend exact variable and wrong-language regression checks. Runtime matching, all-locale structural and human-preference checks pass. Native terminology and RTL browser review remain open; browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 pending values and extend exact variable preservation checks. Runtime matching, all-locale structural and human-preference checks pass. Konkani prose has lower confidence; terminology and composed date labels need native/UI review. Browser scenarios were not run because the app stack was unavailable.
Thanks to xet7 !
Fill 14 values while preserving literal variables. Extend translation checks to 21 locales; technical terminology and composed date labels need native and UI review.
Thanks to xet7.
Fill 21 values while preserving literal variables. Extend translation checks to 19 locales. Technical terminology and composed date labels need native and UI review, especially the Kirundi phrases.
Thanks to xet7.
Fill 14 values while preserving literal variables. Extend translation checks to 16 locales. Technical phrases and composed date labels have lower confidence and need native and UI review.
Thanks to xet7.
Fill 21 values across three locale paths while preserving literal variables. Extend translation checks to 14 locales. Composed date labels and trigger terminology need native and UI review.
Thanks to xet7.
Fill 21 values and preserve literal variable expressions. Review date fragments against the condition selector. Samoan and Hawaiian phrases and technical terminology need native and UI review.
Thanks to xet7.
Fill 14 values and preserve literal variable expressions. Extend translation checks to eight locales; trigger terminology and composed date fragments need native and UI review.
Thanks to xet7.
Fill 21 values and preserve literal variable examples. Extend translation checks to six locales. Date-condition fragments and trigger terminology need native and UI review.
Thanks to xet7.
Fill 21 values and preserve literal rule-variable examples. Extend trigger-variable tests to cover translated brace tokens. Trigger and swimlane terms and date-condition fragments need native and UI review.
Thanks to xet7.
Add low-confidence Tigre and Cherokee phrases requiring native review. Verify non-English placeholder coverage across 234 locales and remove the key from the pending queue. Borrowed Cherokee browser-tab labels remain a terminology review item.
Thanks to xet7.
Extend popup-error checks to 64 recently filled locales. Full phrases and browser-tab terminology are low confidence and need native review.
Thanks to xet7.
Extend popup-error checks to 58 recently filled locales. Full phrases are low confidence; Klingon browser and tab terms remain borrowed and need terminology review.
Thanks to xet7.
Extend popup-error checks to 56 recently filled locales. Full phrases and browser-tab terminology are low confidence and need native review.
Thanks to xet7.
Extend popup-error checks to 52 recently filled locales. Browser-tab terminology and full Acehnese and Dzongkha phrases are low confidence and need native review.
Thanks to xet7.
Extend popup-error checks to 47 recently filled locales. Aromanian phrases and browser-tab terminology are low confidence and need native review.
Thanks to xet7.
Extend popup-error translation checks to 40 recently filled locales. Manx and Walloon phrases and browser/tab terminology are low confidence and need native review.
Thanks to xet7.
Preserve existing translations and extend popup-error checks to 32 recently filled locales. Browser/tab terminology in the southern African, Oromo, Fijian and Tongan phrases is lower confidence and needs native review.
Thanks to xet7.
Preserve existing translations and extend popup-error translation checks. Pacific and southern African browser-tab terminology has lower confidence and needs native review.
Thanks to xet7.
Fill six Cherokee placeholders with low-confidence phrases requiring native review. Verify the reminder group across 234 non-English locales and remove its six keys from the pending queue; language-quality review remains open.
Thanks to xet7.
Fill six English placeholders and extend reminder regression coverage. Full phrases and technical terminology are low confidence and need native review.
Thanks to xet7.
Fill six English placeholders and extend reminder regression coverage. Full phrases and technical terminology are low confidence and need native review.
Thanks to xet7.
Fill six English placeholders and extend reminder regression coverage. Full phrases and technical terminology are low confidence and need native review.
Thanks to xet7.
Fill six English placeholders in Tifinagh and extend reminder regression coverage. Full phrases and technical terminology are low confidence and require native review.
Thanks to xet7.
Fill six placeholders and extend reminder regression coverage. Veps phrases and technical terms are low confidence and need native review; unrelated wrong-language values remain recorded in the audit.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Full instructions, comparisons and technical compounds remain low-confidence drafts for native review, including dialect consistency.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions, inflections and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions, comparisons and technical compounds remain low-confidence drafts for fluent-speaker review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for fluent-speaker review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review, including dialect consistency.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review, including dialect consistency.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios, and record remaining native-review scope.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios, and record the remaining native-review scope.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Full instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Full instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Aromanian instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Complete instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and outgoing webhooks. Extend translation checks and browser scenarios. Technical compounds and complete Manx and Walloon instructions remain low-confidence drafts for native review.
Thanks to xet7.
Preserve signed offsets, defaults, limits and webhook delivery, and extend translation checks and browser scenarios. Technical compounds and complete Fijian and Tongan instructions remain low-confidence drafts for native review.
Thanks to xet7.
Fill Northern Ndebele, Swati, Northern Sotho and Tsonga reminders and extend regression checks and browser scenarios. Northern Ndebele and Swati instructions and technical compounds remain low-confidence drafts for native review.
Thanks to xet7.
Fill 24 strings preserving signed offset directions, numeric limits and server fallback. Extend translation and UI coverage to twenty-three locales. Structural and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 18 strings preserving offset directions, numeric limits, comma separation and server fallback. Extend translation and UI coverage to nineteen locales. Structural and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 30 strings across five locale paths while preserving signed offset directions and numeric limits. Extend translation and UI coverage to sixteen locales. Structural and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 18 strings while preserving signed offsets, numeric limits, comma separation and server fallback. Extend translation and UI coverage to eleven locales. Structural and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 30 strings in Kurdish, Sorani, Papiamento, Tok Pisin and Bislama. Preserve signed offset direction, limits and server fallback. Extend translation and UI coverage to eight locales; structural and human-preference checks pass, browser tests are syntax-checked only.
Thanks to xet7.
Fill 18 reminder strings while preserving offset direction, comma-separated input, server fallback and validation limits. Add translation checks and extend browser coverage for labels and saved/error messages. Structural and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Remove 13 filled keys from the pending manifest after structural checks across all 234 non-English locale paths. Keep language-quality review open and record the next due-reminder group. Pending keys decrease to 188; ordinary missing values remain 51,575.
Thanks to xet7.
Fill 13 notification placeholders with provisional Cherokee wording and document review needs. Verify this group has no empty or English-placeholder values across all 234 non-English locale paths. Structural and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 notification placeholders and document low-confidence vocabulary and grammar needing fluent review. Translation and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 notification placeholders and document low-confidence wording and reference limitations. Translation and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 notification placeholders in syllabics. Document terminology sources and low-confidence wording. Translation and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 notification placeholders in Tifinagh and extend script and token checks. Document dictionary references and low-confidence wording. Translation and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 notification placeholders while preserving existing locale values. Record dictionary sources and low-confidence wording. Translation and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 notification placeholders using existing locale terms. Record dictionary references and low-confidence wording for review. Translation and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders using existing locale terminology. Document vocabulary sources and low-confidence wording. Translation and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 notification strings and replace the French assignee label. Document provisional technical wording and vocabulary sources. Translation and human-preference checks pass; browser coverage is syntax-checked only.
Thanks to xet7.
Fill 13 notification preferences and replace the Esperanto member label with Volapuk. Record low-confidence technical compounds in the translation audit. Translation and human-preference checks pass; browser coverage is syntax-checked but was not run.
Thanks to xet7.
Fill 13 English placeholders and extend regression coverage. Technical wording and dialect consistency are low confidence pending speaker review. Browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders and extend regression coverage. Technical wording is low confidence pending speaker review. Browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 26 English placeholders and extend regression coverage. Technical wording and dialect consistency are low confidence pending speaker review. Browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders and extend regression coverage. Technical wording and diacritics are low confidence pending speaker review. Browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders and extend regression coverage. Technical wording is provisional pending speaker review. Browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders and extend regression coverage. Technical wording is low confidence pending speaker review. Browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders and extend regression coverage. Technical wording is provisional pending speaker review. Browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders and extend regression coverage. Technical wording is low confidence pending speaker review. Browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders and extend notification regression coverage. Preserve existing translations and the reminder/mention exception. Technical wording is low confidence pending speaker review; browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 26 English placeholders and replace six Zulu/Afrikaans labels in Venda. Extend notification and wrong-language regression checks. Technical wording is low confidence pending speaker review; browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 39 English placeholders and extend notification regression coverage. Preserve existing translations and the reminder/mention exception. Technical wording is low confidence pending speaker review; browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 13 English placeholders and extend notification regression coverage. Preserve existing translations and the reminder/mention exception. Technical wording is low confidence pending speaker review; browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 26 English placeholders and extend notification regression coverage. Preserve existing translations and the reminder/mention exception. Technical wording is low confidence pending speaker review; browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 39 English placeholders and extend notification regression coverage. Preserve existing translations and the reminder/mention exception. Technical wording is low confidence pending speaker review; browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 39 English placeholders and extend notification regression coverage. Preserve existing translations and the reminder/mention exception. Technical wording is low confidence pending speaker review; browser scenarios are syntax-checked only.
Thanks to xet7.
Fill 39 English placeholders and extend translation and mute/unmute browser coverage. Preserve the reminder and mention exception and document provisional technical wording for review.
Thanks to xet7.
Fill 26 English placeholders and extend translation and mute/unmute browser coverage. Preserve the reminder and mention exception and record provisional technical wording for review.
Thanks to xet7.
Fill 39 English placeholders and extend translation and mute/unmute browser coverage. Preserve the reminder and mention exception. Record provisional technical wording for review.
Thanks to xet7.
Fill 26 English placeholders and extend translation and mute/unmute browser coverage. Preserve the reminder and mention exception and distinguish members from assigned workers.
Thanks to xet7.
Fill 39 English placeholders and extend translation and mute/unmute browser coverage. Preserve the reminder and mention exception and distinguish members from assigned workers.
Thanks to xet7.
Fill 39 English placeholders and extend translation and mute/unmute browser coverage. Preserve the reminder and mention exception and distinguish members from assigned workers.
Thanks to xet7.
Fill 104 English placeholders in Māori, Samoan, Hawaiian, both Zulu locales, Xhosa, Sesotho and Setswana. Extend translation and browser coverage while preserving the reminder and mention exception. Record technical terminology review needs.
Thanks to xet7.
Fill 65 English placeholders in Kurmanji, Sorani, Papiamento, Tok Pisin and Bislama. Preserve the reminder and mention exception and extend translation and mute/unmute browser coverage.
Thanks to xet7.
Fill 39 English placeholders in Turkmen, Tatar and Somali. Preserve the due-reminder and mention exception, distinguish members from assignees, and extend translation and mute/unmute browser coverage.
Thanks to xet7.
Fill 23 English placeholders. Expand feature checks to all 234 non-English locale paths, accept equivalent native digits, and remove completed auto-archive keys from the pending queue. Document low-confidence Cherokee wording and broader review limitations.
Thanks to xet7.
Fill 23 English placeholders and extend feature and browser coverage. Preserve literal query syntax and document low-confidence technical wording for speaker review.
Thanks to xet7.
Fill 23 English placeholders and repair three English-prefixed time labels. Extend feature and browser coverage; document low-confidence wording for speaker review.
Thanks to xet7.
Fill 23 English placeholders in Tifinagh and extend feature and browser coverage. Preserve query literals and document low-confidence regional and technical wording for review.
Thanks to xet7.
Fill 23 English placeholders and extend feature and browser coverage. Document low-confidence grammar and terminology requiring speaker review.
Thanks to xet7.
Fill 23 English placeholders and extend feature and browser coverage. Record vocabulary references and low-confidence wording for speaker review.
Thanks to xet7.
Fill 23 English placeholders and extend feature and browser coverage. Document terminology references and low-confidence wording for speaker review.
Thanks to xet7.
Fill 23 English placeholders and extend feature and browser coverage. Document low-confidence grammar, technical loans and dialect review needs.
Thanks to xet7.
Fill 23 English placeholders and correct date, week and month labels. Extend feature and browser coverage; document low-confidence wording and dictionary evidence for review.
Thanks to xet7.
Fill 23 English placeholders, preserve query syntax, and extend feature and browser coverage. Record low-confidence wording and terminology sources for speaker review.
Thanks to xet7.
Fill 46 English placeholders and correct the Acehnese days label. Extend regression coverage and document low-confidence wording and vocabulary sources for speaker review.
Thanks to xet7.
Fill 46 English placeholders and correct Akan day and list labels. Extend feature and browser coverage. Document terminology sources and low-confidence wording for speaker review.
Thanks to xet7.
Fill 46 English placeholders and repair four prefixed time labels. Extend feature and browser coverage; document low-confidence grammar and terminology requiring speaker review.
Thanks to xet7.
Fill 115 English placeholders in Guaraní, Ewe, Wolof, Fulah and Klingon. Preserve existing translations and literal query syntax, and extend feature and browser coverage. Wording remains low confidence pending speaker review; record terminology sources and review limitations.
Thanks to xet7.
Fill 207 English placeholders in Tibetan, Buryat, Chuvash, Kashmiri, Tigrinya, Manx, Venetian, Veps and Venda. Preserve existing translations, numeric bounds and literal filter syntax. Extend the shared regression suite and browser mutation scenario.
Wording is provisional and low confidence pending speaker review, especially inclusive ranges and list-age explanations. Record vocabulary sources and remaining wrong-language seed text. Locale-wide key/order/token, archiving and human-preference checks pass; browser scenarios are syntax-checked only.
Thanks to xet7 !
Add the remaining 101 non-English catalogs and align eleven English variants. All 234 non-English locale paths now contain the three login-setting messages. Preserve all existing translations and remove the completed keys from the pending queue.
All 237 translation suites pass. Native-script and related-language regression checks cover the new labels; existing browser scenarios remain syntax-checked only.
Minority-language technical compounds are provisional, especially Cherokee, Inuktitut, Tigre, Wolaytta, Aymara, Nahuatl, Tamazight, Veps, Ladin, Aromanian, Volapuk and Klingon. Record terminology sources and broader mixed-language findings for continued review.
Thanks to xet7 !
Translate header authentication, stored-value removal and restart guidance in 31 physical catalogs plus a shared Khmer alias. Preserve existing values and source tokens; extend regression coverage to 133 locale paths.
Kyrgyz, Mongolian, Burmese, Khmer, Pashto, Sindhi and Uyghur technical wording is provisional and needs speaker review. Structural and human-preference checks pass.
Thanks to xet7 !
Refresh TODO Later with the current backlog and distinguish pending Transifex keys from the standard report. Record the 101-locale login batch and its validation.
Changelog link and release membership tests pass. The format suite retains its pre-existing failure on two visible Turkmen commit hashes, reproduced against the prior changelog.
Thanks to xet7 !
Add HTTP-header login, stored-value removal and restart guidance in 100 physical catalogs and their shared regional alias. Preserve every existing translation and source placeholder. Add locale-wide structural checks and Finnish, Arabic and Japanese browser scenarios.
Locale checks, human preference, URL placeholders, menu wiring and board-item tests pass. Browser scenarios are syntax-checked; Playwright and a running application are unavailable here. Remaining languages and feature messages stay in progress.
Thanks to xet7 !
Template.cardDetails.onCreated called Meteor.subscribe('unsaved-edits') in
no computation, so nothing stopped it: every card open added one more live
publication on the server for that user. It is the template's own
subscription now.
Thanks to markusst1982 and xet7 !
Fixes#6745.
The snap set CARDS_LOADING=all whenever cards-loading was unset, so every
board on a snap shipped all of its cards, comments, checklists and attachment
records to the browser, while the code's own default is auto (a board with
more than 500 cards loads only the visible cards). The snap default, its
description, wekan-help (which pointed at an Admin Panel toggle that no longer
exists) and server/cards-loading.js now say auto.
Thanks to markusst1982 and xet7 !
Fixes#6745.
The card, list and swimlane sortables re-applied handle, items and disabled
from autoruns. jQuery UI does not skip an unchanged value: setting handle
re-tags every card of the list, about k^2 work for k cards, in every list.
setSortableOptions (models/lib/sortableOptions.js) sets only what differs. The
swimlanes autorun also asked canModifyCard() with no card, which reads the
open card, so it re-ran on every open and close; it asks canModifyBoard().
Thanks to markusst1982 and xet7 !
Fixes#6745.
The routes set popupCardId and popupCardBoardId to null, and a card open or
close deleted them. A delete followed by set(null) is a change, and
Utils.getCurrentBoardId() reads popupCardBoardId, so every minicard re-ran its
currentBoard helpers. Every place now clears them to null.
Thanks to markusst1982 and xet7 !
Fixes#6745.
The card and board routes rendered the board layout on every navigation, and
flow-router-extra re-creates the layout each time: every swimlane, list and
minicard was torn down and built again for a card link, the up/down card
keys, back/forward, and closing a card opened from a link. The router now
remembers which board the layout is mounted for (models/lib/boardLayoutMount.js)
and the card and board routes reuse it; the board already follows Session.
Another board, a first load and the list/swimlane routes still render.
tests/playwright/specs/large-board-card-open.e2e.js checks in Chromium,
Firefox and WebKit that a minicard element survives a card opened and closed
by its address, and counts the Tracker work of a click open and close.
Thanks to markusst1982 and xet7 !
Fixes#6745.
Opening a card writes the user document (profile.cardLastViews, #3078). The
board view (Utils.storedBoardView and allowBoardView, which every list's card
loop reads) and the helpers every minicard runs read the WHOLE user document,
so that one write re-ran every list's card loop, and Blaze then re-evaluated
every minicard: 37,452 Tracker invalidations for one card open on a 40-card
board. Measured in the running app, it is now 390.
client/lib/currentUserWith.js reads the current user with only the named
fields; minimongo re-runs a field-limited query only when a projected field
changes. The board view, feature preview, unread comments, folds, drag
handles, label text, dependency layers, date format, week number, mobile mode
and the admin-only custom field check now use it. setCardLastViewed $sets one
entry instead of rewriting the whole map, which is also capped at 5,000.
Thanks to markusst1982 and xet7 !
Fixes#6745.
The advisory reports that the route checks only the login, because it calls
Authentication.checkUserId, and that any account can read any board's domain
sharing. checkUserId is the site admin check: a logged-in caller who is not an
admin gets 403. The route has answered only site admins since #5850 added it.
Before v12.15 the check refused `admin === undefined`, and Meteor's
findOneAsync gives undefined for no match, so it refused everyone else then too.
Nothing to fix in the route. Its OpenAPI description claimed anyone able to read
the board may list the domains; it now says site admin, and that members get the
list with GET /api/boards/:boardId. checkUserId gets a comment saying what it is.
tests/restBoardDomainsAccess.test.cjs runs the real handler with the real
Authentication object: the reporter's non-member, members, ended memberships and
logged-out callers are refused, a missing board answers like an existing one, a
site admin reads the list. A whole-tree negative test checks that every REST
route with :boardId checks that board or a site admin, and that a login check
alone would be caught. tests/playwright/specs/rest-board-domains-access.e2e.js
runs the report's proof of concept against a running WeKan in Chromium, WebKit
and Firefox: 403.
Thanks to a25370 and xet7 !
The *_FILE secrets for mail, MongoDB and S3, LDAP Test connection without a
service account, the unread LOGOUT_* variables, header login switched on from
the Admin Panel, the unloaded ldap_sync_now, the released section that fails
changelogFormat, the cookie refresh limit in browser tests, the three pending
strings, a real Active Directory check of #6744, and the UCS and Nextcloud
settings kept in other repositories - each with the reason it is not done.
Thanks to xet7 !
LDAP_AUTHENTIFICATION_PASSWORD_FILE and OAUTH2_SECRET_FILE were listed in the
Dockerfile, snap, docker-compose and start-wekan since #5724, but no code read
them, so a password could only be an environment variable. WeKan now reads the
file itself, at each login (a rotated secret applies at once), so the password
is never in the environment - the point of Docker / Kubernetes secrets. The
order is the Admin Panel, the variable, then its file; one trailing line break
is dropped. The application code is the same on every platform, so it works in
Docker, the snap (files under /var/snap/wekan/common), bundles, AppImage,
Flatpak, Mac and Windows. Admin Panel / People shows when the password comes
from the file and when the file cannot be read, never the path or content.
The path itself is an environment variable only: settable in the Admin Panel
next to the LDAP host or the OAuth2 token endpoint, it would let the server
read any file and send it there as the password.
DEFAULT_AUTHENTICATION_METHOD is a field of the Login pane's settings form.
Choosing a method overrides the variable; Default gives it back. Before, the
variable rewrote the stored method at every start, so an administrator's
choice was lost on restart. The published method is now the override, else the
variable, else password. On upgrade, a method chosen with the old dropdown
while no variable was set becomes the override, once, so it is not lost. The
old dropdown is removed: two controls for one setting on one page.
The snap key for the LDAP password file was spelled
ldap-authentification-password-file, unlike its siblings and its help text;
it is ldap-authentication-password-file now (it had no effect before).
MAIL_SERVICE_PASSWORD_FILE, MONGO_PASSWORD_FILE and S3_SECRET_FILE are still
not read by WeKan; secrets/README.md says so.
Thanks to Roemer, CrashOverride-lab, ww-daniel-mora and xet7 !
Each login method has its own section: LDAP, OAuth2 (OpenID Connect and
Oracle OIM), CAS and Header login are new or complete, and the Login pane
gets PASSWORD_LOGIN_ENABLED and ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS.
models/lib/authConfigCatalog.js lists all 103 variables; server/lib/
authConfig.js resolves each one at run time (Admin Panel value first, then
the environment variable) for the app and, through
globalThis.__wekanAuthEnv, for the wekan-ldap, wekan-oidc and
wekan-accounts-cas packages. OAuth2 and CAS service configurations and LDAP
background sync are reapplied when their settings are saved.
Passwords and client secrets (LDAP_AUTHENTIFICATION_PASSWORD, OAUTH2_SECRET)
never reach the browser: the page learns only whether one is set and where
it comes from. Other values have credentials written inside a URL masked on
the server, and a URL field refuses them.
Fixed on the way:
- The Admin Panel LDAP overrides never applied. The bridge read Settings with
a server-side findOne(), which Meteor 3 refuses; the error was swallowed and
the environment used. The settings are now held in an observed cache.
- LDAP Test connection never existed on the server (testConnection.js was not
imported) and used the synchronous Meteor.user().
- PROPAGATE_OIDC_DATA=false turned the feature on.
- CAS read only the misspelled CASE_VALIDATE_URL; CAS_VALIDATE_URL now works
and the old name still does.
- snap help named three group-filter keys snap set does not know.
Every catalog variable is now listed in the Dockerfile, the docker-compose
files, snap config and help, and start-wekan.sh/.bat; 14 were missing.
tests/authConfigCatalog.test.cjs pins resolution, secrets, input validation,
platform coverage, and - across the whole tree - that no code reads a login
variable outside the catalog or straight from process.env, and that no
server code calls the synchronous Settings.findOne() or Meteor.user().
tests/playwright/specs/admin-login-env-overrides.e2e.js drives the pages.
Thanks to xet7 !
Since v12.08 (DirectoryGroupBleed) LDAP_USER_AUTHENTICATION=true logins check
LDAP_GROUP_FILTER_ENABLE, which they did not do before. The membership clause
(member=<user DN>) matches direct members only, so in Active Directory, where
access is granted through a team group nested in the access group, legitimate
users were refused, REST clients got 401, and the refusals were listed in
Admin Panel / Problems as ldap.group-denied.
LDAP_GROUP_FILTER_NESTED=true makes both group searches use AD's
LDAP_MATCHING_RULE_IN_CHAIN, (member:1.2.840.113556.1.4.1941:=<user DN>), so
the login filter and admin, role and org/team sync see nested membership. It
is off by default, and an attribute already written as the extensible match
is used as written. The user DN stays escaped, and a user who cannot be named
is still refused without a search.
Documented in LDAP.md with an upgrade note, and added to the Dockerfiles,
docker-compose files, snap config and start-wekan scripts.
tests/ldapNestedGroups.test.cjs drives isUserInGroup and getUserGroups with and
without the setting, and checks that every member clause in ldap.js goes through
groupMemberClause.
Thanks to rmb82 and xet7 !
Fixes#6744.
Every job that builds a release file now attaches it to the GitHub Release
as its own last step, right after the build and its checks pass, through
releases/github-release-upload.sh (retried, bounded, verified by name and
size). Nothing waits for the other builds any more:
- build-amd64 creates the release (releases/ensure-github-release.sh) and
attaches its zip; build-arm64 attaches its own. The release job no
longer downloads and uploads them; it writes the notes and checks both
base bundles and their .sha256sum are on the release.
- The win64, win-arm64, win32, mac-arm64, mac-x64, extra-arch, Sandstorm
and snap jobs use the shared uploader.
- AppImage.yml, mac.yml and Flatpak.yml attach from each matrix build job
instead of a final publish job; windows.yml attaches from its build job
and its publish job is gone. release-all-missing.yml's extra-arches
attach uses the shared uploader.
A cancelled run keeps what finished: every attach step runs on always()
plus its build step's success, and the final jobs (release notes, what is
still missing, the AppImage/Mac/Flatpak summaries and the Flatpak
repository) run on always() while still requiring the release to exist.
The uploader no longer needs GNU timeout, so it also runs on the macOS
runners and in Windows Git Bash.
Thanks to xet7 !
Add the release summary and linked Sharp, MongoDB, Chai and TypeScript ESLint updates, with Dependabot credit. The read-only release preflight and both changelog regression suites pass.
Thanks to dependabot and xet7 !
if curl -fsS -o /dev/null "http://127.0.0.1:8080/sign-in"; then echo "WeKan answered on port 8080 in Alpine."; kill $pid; exit 0; fi
kill -0 $pid 2>/dev/null || break
sleep 2
done
kill $pid 2>/dev/null || true
echo "::error::the musl AppImage did not answer on port 8080 in Alpine; its log follows"
tail -n 100 smoke.log
exit 1'
exit 0
fi
# A CHECK THAT CANNOT RUN IS NOT A FAILED CHECK. Probe the INNER Node,
# not the AppImage runtime: on the arm64 runner the armhf AppImage
# runtime itself executes, while its bundled hard-float Node cannot
@@ -393,7 +486,7 @@ jobs:
# AppDir is the exact tree just packed, so this also avoids extracting
# the large image merely to make the capability decision.
if ! LD_LIBRARY_PATH="$PWD/AppDir/usr/lib/wekan/bundle/node-runtime${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" AppDir/usr/lib/wekan/bundle/node --version >/dev/null 2>&1; then
echo "::warning::this runner cannot execute the bundled ${{ matrix.appimage_arch }} Node binary, so the AppImage was packed but not started. It is uploaded unchecked."
echo "::warning::this runner cannot execute the bundled ${MATRIX_APPIMAGE_ARCH} Node binary, so the AppImage was packed but not started. It is uploaded unchecked."
echo "::notice::No base bundle (wekan-${{ needs.release.outputs.version }}-{amd64,arm64}.zip) is on ${{ needs.release.outputs.tag }} yet, so there is nothing to wrap - skipping. release-all.yml builds the AppImages once the base bundles are published."
echo "::notice::No base bundle (wekan-${version}-{amd64,arm64}.zip) is on ${NEEDS_RELEASE_TAG} yet, so there is nothing to wrap - skipping. release-all.yml builds the AppImages once the base bundles are published."
exit 0
fi
echo "::error::A base bundle is published but no architecture produced an AppImage - every build job failed. Their logs say why; nothing is uploaded."
if [ "${NEEDS_BUILD_RESULT}" = "cancelled" ]; then
echo "::warning::The run was cancelled before any AppImage finished building; nothing was attached."
exit 0
fi
echo "::error::A base bundle is published but no architecture attached an AppImage - every build job failed. Their logs say why."
exit 1
fi
- name:Upload them
env:
GH_TOKEN:${{ github.token }}
run:|
set -euo pipefail
if ! ls assets/*.AppImage >/dev/null 2>&1; then
echo "Nothing to upload (no base bundle was published to wrap)."
exit 0
fi
# --repo, because this job does NOT check the repository out - it only
# downloads artifacts - so `gh` has no git remote to infer the repo
# from and fails with "fatal: not a git repository". Every other gh
# call in this workflow already passes it; these two did not, so the
# AppImages were built, smoke-tested and uploaded as artifacts, and
- name:Check DOCKERHUB_AUTH is configured and works
env:
DOCKERHUB_AUTH:${{ secrets.DOCKERHUB_AUTH }}
INPUT_IMAGE:${{ inputs.image }}
run:|
set -uo pipefail
if [ -z "${DOCKERHUB_AUTH:-}" ]; then
@@ -79,16 +80,19 @@ jobs:
user="${creds%%:*}"
token="${creds#*:}"
if ! printf '%s' "$token" | docker login docker.io -u "$user" --password-stdin; then
echo "::error::docker-variant: DOCKERHUB_AUTH was REJECTED by docker.io (login failed as user '$user'). The token is wrong, expired, or lacks push rights for wekanteam/${{ inputs.image }}."
echo "::error::docker-variant: DOCKERHUB_AUTH was REJECTED by docker.io (login failed as user '$user'). The token is wrong, expired, or lacks push rights for wekanteam/${INPUT_IMAGE}."
exit 1
fi
echo "docker-variant: DOCKERHUB_AUTH works for docker.io (user '$user')."
- name:Work out which version to publish
id:v
env:
INPUT_VERSION:${{ inputs.version }}
INPUT_IMAGE:${{ inputs.image }}
run:|
set -euo pipefail
version="${{ inputs.version }}"
version="${INPUT_VERSION}"
if [ -z "$version" ]; then
# The newest release of wekan/wekan, asked of GitHub rather than guessed.
echo "::error::v${{ steps.plan.outputs.version }} still lacks ${{ steps.plan.outputs.manual }} after recovery. Inspect the matching full-release run; older unnamed runs need their failed jobs retried manually."
echo "::error::v${STEP_PLAN_VERSION} still lacks ${STEP_PLAN_MANUAL} after recovery. Inspect the matching full-release run; older unnamed runs need their failed jobs retried manually."
exit 1
# The six architectures nobody else builds for, repacked from the PUBLISHED
# amd64 bundle - which is what makes this possible without a Meteor build.
echo "::error::SANDSTORM_KEYRING secret is not set. meteor-spk pack signs the .spk with the WeKan Sandstorm app's private key, which lives in this keyring, so packing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
echo "::error::SANDSTORM_KEYRING secret is not set. spk pack signs the .spk with the WeKan Sandstorm app's private key, which lives in this keyring, so packing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
exit 1
fi
@@ -112,7 +115,11 @@ jobs:
set -euo pipefail
STAMP="$(date +'%Y_%m_%d-%H_%M_%S')"
SPK="wekan-sandstorm-${STAMP}.spk"
meteor-spk pack "$SPK"
# The Sandstorm package profile, the linux/x64 sockjs trim and a
# `spk pack` of the trimmed trees (not `meteor-spk pack`, which would
# rebuild the bundle and undo the trim). The script restores
# .meteor/packages and .meteor/versions when it ends.
bash releases/sandstorm-slim-spk.sh "$SPK"
# Report the packed size and warn if it exceeds Cloudflare's 100 MB upload
# cap (a proxied browser upload to a Cloudflare-fronted Sandstorm 413s above
# this; install via a DNS-only host / SSH tunnel, or trim further).
@@ -35,7 +35,7 @@ contributor — that offer is the mistake, not the rule.
The maintainer's half is the release flow, not taste. Releases here are frequent —
several a day when a fault is being chased — and `releases/release-all.sh` cuts one
from whatever is on `main`, taking the version from the `# Upcoming WeKan ® release`
section of `CHANGELOG.md`. Work parked on a branch is work that is not in the next
section of `CHANGELOG-big.md`. Work parked on a branch is work that is not in the next
release, and `tests/changelogEntriesBelongToTheirRelease.test.cjs` fails when a
released section links a commit that release does not contain.
@@ -340,7 +340,7 @@ directly after the merge.
the two patch repositories under `.tools/` — node-patches and mongo-tools-patches.
- Directory structure:
- `wekan` — this repo (https://github.com/wekan/wekan); see
`docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG.md` at root. It is at
`docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG-big.md` and `CHANGELOG.md` at root. It is at
`~/repos/wekan` on Linux, `~/Documents/repos/wekan` on macOS and
`Downloads\repos\wekan` on Windows. The maintainer commits on `main`; a
contributor works on a branch and opens a pull request — see "Where this
@@ -373,7 +373,7 @@ directly after the merge.
| --- | --- | --- | --- |
| `.tools/FerretDB` | wekan/FerretDB | `main-v1` | the FerretDB v1 fork WeKan ships as its default database |
| `.tools/node-patches` | wekan/node-patches | `main` | patches to upstream Node.js; builds the `node-<platform>` binaries the bundles, the Docker image and the snap embed |
| `.tools/mongo-tools-patches` | wekan/mongo-tools-patches | `main` | patches to the MongoDB Database Tools; builds `<tool>-<arch>` |
| `.tools/mongo-tools-patches` | wekan/mongo-tools-patches | `main` | patches to the MongoDB Database Tools; builds `mongo-tools-<arch>`, all eight tools as one program |
| `.tools/TSC` | Secretchronicles/TSC | `devel` | the game xet7 also maintains — same author and maintainer mode, its own GNU ChangeLog and release process |
| `.tools/sandstorm` | sandstorm-io/sandstorm | — | upstream Sandstorm, when present — somebody else's project, cloned for reference |
@@ -414,7 +414,7 @@ directly after the merge.
| Repository | File | Format |
| --- | --- | --- |
| `wekan/wekan` | `CHANGELOG.md` | the WeKan format this section describes: `# Status` (Platforms/Version/TODO Later nested as `<details>`), then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
| `wekan/wekan` | `CHANGELOG-big.md` (and the generated `CHANGELOG.md`, below) | the WeKan format this section describes: `# Status` (Platforms/Version/TODO Later nested as `<details>`), then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
| `wekan/node-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming node-patches release` |
| `wekan/mongo-tools-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming mongo-tools-patches release` |
| `wekan/FerretDB` | `CHANGELOG.md` | **upstream FerretDB's** format, not WeKan's: `## [v1.48.0](tag URL) (YYYY-MM-DD)` and `### New Features 🎉` / `### Fixed 🐛` / `### Other Changes 🤖` bullets ending `by @xet7. Thanks to xet7.` |
@@ -426,6 +426,52 @@ directly after the merge.
out and would break the tooling that parses them. When this file and the file being
edited disagree, **the file being edited wins** — and everything below in this
section is about the WeKan format specifically.
- **WeKan has TWO changelogs, and only one is written.** `CHANGELOG-big.md` is
the changelog: `# Status`, `# Upcoming WeKan ® release` and every release in
full, in the `<details>` format below - every rule in the rest of this section
is about it, and every entry, fix and release goes into it. `CHANGELOG.md` is
the SHORT changelog, generated from it by `node releases/changelog-short.mjs`
and never edited by hand:
| | `CHANGELOG.md` |
| --- | --- |
| Status, TODO Later | none |
| First | the unreleased `# Upcoming WeKan ® release`, when there is one: its **In short** paragraph only, then `[All changes so far](CHANGELOG-big.md#upcoming-wekan--release)` |
| Below it | the five newest `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` |
| Per release | its **In short** paragraph only, then `[All changes in v…](CHANGELOG-big.md#anchor)` |
| Markup | plain Markdown: no `<details>`, `<summary>`, `</summary>` or `</details>`, and every HTML link a Markdown link |
It exists because the big file is for whoever writes and audits a release,
and most readers - GitHub's front page, the Sandstorm App Market
(`sandstorm-pkgdef.capnp` embeds it), the Helm chart's changelog link - want
what changed lately, at a glance. `releases/release-all.sh` regenerates it
right after naming the new release, so it is in the same release commit, and
`releases/changelog.sh` does the same; `tests/changelogShort.test.cjs` fails
when it is not exactly what the generator writes. So: write
`CHANGELOG-big.md`, run the generator, commit both - and never edit
`CHANGELOG.md` to fix something, because the next run overwrites it.
- **"Update wekan changelog" means both files, in this order:**
1. Find what is not in the changelog yet: `git log` since the newest commit
`CHANGELOG-big.md`'s Upcoming section (or, when it has none, the newest
release's `Prepare v… release` commit) already covers, by anybody - a
merged pull request and the maintainer's own commits alike.
2. Check whether a release was cut since the last update (`release-all.sh`
renames Upcoming to `# v<NEW> …` and opens no new one). If there is no
@@ -35,7 +35,7 @@ contributor — that offer is the mistake, not the rule.
The maintainer's half is the release flow, not taste. Releases here are frequent —
several a day when a fault is being chased — and `releases/release-all.sh` cuts one
from whatever is on `main`, taking the version from the `# Upcoming WeKan ® release`
section of `CHANGELOG.md`. Work parked on a branch is work that is not in the next
section of `CHANGELOG-big.md`. Work parked on a branch is work that is not in the next
release, and `tests/changelogEntriesBelongToTheirRelease.test.cjs` fails when a
released section links a commit that release does not contain.
@@ -340,7 +340,7 @@ directly after the merge.
the two patch repositories under `.tools/` — node-patches and mongo-tools-patches.
- Directory structure:
- `wekan` — this repo (https://github.com/wekan/wekan); see
`docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG.md` at root. It is at
`docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG-big.md` and `CHANGELOG.md` at root. It is at
`~/repos/wekan` on Linux, `~/Documents/repos/wekan` on macOS and
`Downloads\repos\wekan` on Windows. The maintainer commits on `main`; a
contributor works on a branch and opens a pull request — see "Where this
@@ -373,7 +373,7 @@ directly after the merge.
| --- | --- | --- | --- |
| `.tools/FerretDB` | wekan/FerretDB | `main-v1` | the FerretDB v1 fork WeKan ships as its default database |
| `.tools/node-patches` | wekan/node-patches | `main` | patches to upstream Node.js; builds the `node-<platform>` binaries the bundles, the Docker image and the snap embed |
| `.tools/mongo-tools-patches` | wekan/mongo-tools-patches | `main` | patches to the MongoDB Database Tools; builds `<tool>-<arch>` |
| `.tools/mongo-tools-patches` | wekan/mongo-tools-patches | `main` | patches to the MongoDB Database Tools; builds `mongo-tools-<arch>`, all eight tools as one program |
| `.tools/TSC` | Secretchronicles/TSC | `devel` | the game xet7 also maintains — same author and maintainer mode, its own GNU ChangeLog and release process |
| `.tools/sandstorm` | sandstorm-io/sandstorm | — | upstream Sandstorm, when present — somebody else's project, cloned for reference |
@@ -414,7 +414,7 @@ directly after the merge.
| Repository | File | Format |
| --- | --- | --- |
| `wekan/wekan` | `CHANGELOG.md` | the WeKan format this section describes: `# Status` (Platforms/Version/TODO Later nested as `<details>`), then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
| `wekan/wekan` | `CHANGELOG-big.md` (and the generated `CHANGELOG.md`, below) | the WeKan format this section describes: `# Status` (Platforms/Version/TODO Later nested as `<details>`), then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
| `wekan/node-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming node-patches release` |
| `wekan/mongo-tools-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming mongo-tools-patches release` |
| `wekan/FerretDB` | `CHANGELOG.md` | **upstream FerretDB's** format, not WeKan's: `## [v1.48.0](tag URL) (YYYY-MM-DD)` and `### New Features 🎉` / `### Fixed 🐛` / `### Other Changes 🤖` bullets ending `by @xet7. Thanks to xet7.` |
@@ -426,6 +426,52 @@ directly after the merge.
out and would break the tooling that parses them. When this file and the file being
edited disagree, **the file being edited wins** — and everything below in this
section is about the WeKan format specifically.
- **WeKan has TWO changelogs, and only one is written.** `CHANGELOG-big.md` is
the changelog: `# Status`, `# Upcoming WeKan ® release` and every release in
full, in the `<details>` format below - every rule in the rest of this section
is about it, and every entry, fix and release goes into it. `CHANGELOG.md` is
the SHORT changelog, generated from it by `node releases/changelog-short.mjs`
and never edited by hand:
| | `CHANGELOG.md` |
| --- | --- |
| Status, TODO Later | none |
| First | the unreleased `# Upcoming WeKan ® release`, when there is one: its **In short** paragraph only, then `[All changes so far](CHANGELOG-big.md#upcoming-wekan--release)` |
| Below it | the five newest `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` |
| Per release | its **In short** paragraph only, then `[All changes in v…](CHANGELOG-big.md#anchor)` |
| Markup | plain Markdown: no `<details>`, `<summary>`, `</summary>` or `</details>`, and every HTML link a Markdown link |
It exists because the big file is for whoever writes and audits a release,
and most readers - GitHub's front page, the Sandstorm App Market
(`sandstorm-pkgdef.capnp` embeds it), the Helm chart's changelog link - want
what changed lately, at a glance. `releases/release-all.sh` regenerates it
right after naming the new release, so it is in the same release commit, and
`releases/changelog.sh` does the same; `tests/changelogShort.test.cjs` fails
when it is not exactly what the generator writes. So: write
`CHANGELOG-big.md`, run the generator, commit both - and never edit
`CHANGELOG.md` to fix something, because the next run overwrites it.
- **"Update wekan changelog" means both files, in this order:**
1. Find what is not in the changelog yet: `git log` since the newest commit
`CHANGELOG-big.md`'s Upcoming section (or, when it has none, the newest
release's `Prepare v… release` commit) already covers, by anybody - a
merged pull request and the maintainer's own commits alike.
2. Check whether a release was cut since the last update (`release-all.sh`
renames Upcoming to `# v<NEW> …` and opens no new one). If there is no
if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}""${NODE_MAJOR}")";then
echo"No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2
exit1
fi
eval"${NODE_META}"
echo"Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})"
- Storage: MongoDB GridFS, Filesystem, S3/MinIO, Azure Blob, Google Cloud
- Database migration
- Problems
- Summary
- Security
- Delete: Optional enable permanent delete.
- History Undo/Redo available at Board, List, Card, etc menus at Swimlanes and List views
- Notifications
- Reports
- Security: shows any attempted attacks based on names from https://wekan.fi/hall-of-fame/ like built-in SIEM with country flag and city based of location of IP address based on location headers like CloudFlare etc
@@ -23,8 +159,8 @@ docker-compose.yml at https://github.com/wekan/wekan/blob/main/docker-compose.ym
## Standards
- [WeKan and Standard for Public Code](https://wekan.fi/standard-for-public-code/) assessment was made at 2023-11.
Currently Wekan meets 8 out of 16 criteria out of the box.
- [WeKan and Standard for Public Code](https://wekan.fi/standard-for-public-code/) assessment was made at 2023-11. At 2026 WeKan becameß full FLOSS with [FerretDB v1 Fork](https://github.com/wekan/FerretDB), also see 2026 talk WeKan 10 years at https://wekan.fi/docs for more details.
Currently Wekan meets 9 out of 16 criteria out of the box.
Some others could be met with small changes.
## Code stats
@@ -48,11 +184,6 @@ It's better than at chat where details get lost when chat scrolls up.
See bottom of https://github.com/wekan/wekan/issues/3874
## FAQ
**NOTE**:
@@ -60,28 +191,6 @@ See bottom of https://github.com/wekan/wekan/issues/3874
- Please read the [FAQ](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md) first
- Please don't feed the [trolls](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-troll) and [spammers](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-spammer) that are mentioned in the FAQ :)
## About WeKan ®
WeKan ® is a completely [Open Source][open_source] and [Free software][free_software]
collaborative kanban board application with MIT license.
Whether you’re maintaining a personal todo list, planning your holidays with some friends,
or working in a team on your next revolutionary idea, Kanban boards are an unbeatable tool
to keep your things organized. They give you a visual overview of the current state of your project,
and make you productive by allowing you to focus on the few items that matter the most.
Since WeKan ® is a free software, you don’t have to trust us with your data and can
install Wekan on your own computer or server. In fact we encourage you to do
that by providing one-click installation on various platforms.
- WeKan ® is used in [most countries of the world](https://snapcraft.io/wekan).
- WeKan ® largest user has 30k users using WeKan ® in their company.
- WeKan ® has been [translated](https://app.transifex.com/wekan/) to 234 languages,
167 of them essentially complete.
- [Features][https://github.com/wekan/wekan/tree/main/docs/Features]: WeKan ® has real-time user interface.
- [Platforms](https://wekan.fi/install/): WeKan ® supports many platforms.
WeKan ® is critical part of new platforms Wekan is currently being integrated to.
## Requirements
- 1 GB RAM minimum free for WeKan ®. Production server should have minimum total 4 GB RAM.
@@ -113,7 +222,7 @@ By working directly with WeKan ® you get the benefit of active maintenance and
## Getting Started with Development
The main branch uses Meteor 3.6-beta.1 with Node.js 26.x.
The main branch uses Meteor 3.x with Node.js 26.x.
See [CHANGELOG.md](https://github.com/wekan/wekan/blob/main/CHANGELOG.md) for the latest runtime updates.
To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./build.sh` (or `./build.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-install-dependencies-build-wekan-and-run-the-dev-server). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
@@ -169,7 +278,7 @@ If a dev server is already running on that port, the **Dev server** options stop
### WSL Users
WSL users can use Snap Candidate. See [install docs](https://wekan.fi/install/).
WSL users can use Snap. See [install docs](https://wekan.fi/install/).
please do. The maintainer of WeKan then requests the CVE through that GHSA, and
your Hall of Fame row is upgraded from 3 stars to 5.
- **CVE Policy**: WeKan Security requests CVE at GitHub when releasing Security Advisory.
### 3. Post-Release and Public Disclosure:
@@ -264,13 +272,13 @@ Meteor.startup(() => {
On the Sandstorm platform, Standalone WeKan features like the Admin Panel are turned off using environment variables, because Sandstorm platform provides SSO for all apps running on Sandstorm.
[Sandstorm](https://sandstorm.io) is a separate Open Source platform that has been
[security audited](https://sandstorm.io/news/2017-03-02-security-review) and found bugs fixed.
[Sandstorm](https://sandstorm.org) is a separate Open Source platform that has been
[security audited](https://sandstorm.org/news/2017-03-02-security-review) and found bugs fixed.
Sandstorm also has passwordless login, LDAP, SAML, Google, and other auth options already.
On Sandstorm, code is read-only and signed by app maintainers; only grain content can be modified.
WeKan on Sandstorm runs in a sandboxed grain; it does not have access elsewhere without a user-visible PowerBox request or opening a randomly-generated API key URL.
Also read [Sandstorm Security Practices](https://docs.sandstorm.io/en/latest/using/security-practices/) and
python3 api.py importboard EXPORT.json # Import a whole board (with rules/workflows) from a WeKan export
python3 api.py migratefromwekan REMOTE_URL REMOTE_USER REMOTE_PASS # Import ALL boards+workflows+rules from another WeKan
python3 api.py exportboardpdf BOARDID OUTPUT.pdf # Export a whole board to PDF
python3 api.py importboardfrom SOURCE EXPORT.json # Import from trello/wekan/csv/jira/kanboard/excel/deck/openproject/github/gitlab/gitea/forgejo/asana/zenkit
python3 api.py exportboardformat BOARDID FORMAT OUTPUT.json # Export to kanboard/trello/jira/deck/openproject/github/gitlab/gitea/forgejo/asana/zenkit
python3 api.py importboardfrom SOURCE FILE [--csv-mapping MAPPING.json] # Import a tool's export file (csv and excel: --csv-mapping says which column is which field); SOURCE is a key of the import page (trello, jira, csv, excel, planner, wrike, notion, ...), see docs/Features/Board-Sidebar/Board-Settings/Import-Export
python3 api.py exportboardformat BOARDID FORMAT OUTPUTFILE # Export to a tool's format; FORMAT is a key of the export menu (kanboard, trello, planner, wrike, wrikeworkflow, ...)
python3 api.py importboardsfrom SOURCE [--split] FILE_OR_DIR ... # Import many boards: each file (or each file of a directory or .zip) becomes a board; --split makes one board per project
python3 api.py exportallboards FORMAT OUTPUTFILE [--boards ID1,ID2] # Export all boards: Excel as one workbook with a sheet per board, other formats as a .zip with a file per board
python3 api.py importics BOARDID SWIMLANEID LISTID CALENDAR.ics # Import an iCalendar (.ics) file into a board as cards (one card per VEVENT)
echoWARNING: Rule @typescript-eslint/no-floating-promises is NOT configured in .eslintrc.json
echoFAIL: Rule @typescript-eslint/no-floating-promises is NOT configured in .eslintrc.json
set"FLOATING_RC=1"
)else(
echo OK: Rule @typescript-eslint/no-floating-promises is configured in .eslintrc.json
)
echo.
echo Scanning for unawaited Authentication.checkBoardAccess/checkBoardWriteAccess in server\models
node -e "const fs=require('fs'),path=require('path');function walk(d,acc){for(const e of fs.readdirSync(d,{withFileTypes:true})){const fp=path.join(d,e.name);if(e.isDirectory())walk(fp,acc);else if(/\.js$/.test(e.name))acc.push(fp);}return acc;}let found=false;for(const f of walk('server/models',[])){const lines=fs.readFileSync(f,'utf8').split(/\r?\n/);lines.forEach((ln,i)=>{if(/Authentication\.checkBoard(Access|WriteAccess)\(/.test(ln)&&!/await Authentication\.checkBoard/.test(ln)){found=true;console.log(f+':'+(i+1)+': '+ln.trim());}});}console.log(found?'WARNING: Found possible unawaited board auth checks above':'OK: No unawaited board auth checks found');"
exit /b 0
node -e "const fs=require('fs'),path=require('path');function walk(d,acc){for(const e of fs.readdirSync(d,{withFileTypes:true})){const fp=path.join(d,e.name);if(e.isDirectory())walk(fp,acc);else if(/\.js$/.test(e.name))acc.push(fp);}return acc;}let found=false;for(const f of walk('server/models',[])){const lines=fs.readFileSync(f,'utf8').split(/\r?\n/);lines.forEach((ln,i)=>{if(/Authentication\.checkBoard(Access|WriteAccess)\(/.test(ln)&&!/await Authentication\.checkBoard/.test(ln)){found=true;console.log(f+':'+(i+1)+': '+ln.trim());}});}console.log(found?'FAIL: these board auth checks are not awaited':'OK: No unawaited board auth checks found');process.exit(found?1:0);"
iferrorlevel1set"FLOATING_RC=1"
exit /b %FLOATING_RC%
REM ===========================================================================
:save_deps
@@ -1490,6 +1627,13 @@ for /f "usebackq delims=" %%P in (`powershell.exe -NoProfile -Command "[Environm
ifnot"%FORGE_INSTALL_STATUS%"=="0"echo One or more mirror tools could not be installed. See MISSING entries above.
exit /b %FORGE_INSTALL_STATUS%
REM ===========================================================================
:test_live
REM releases/live-tests/run.mjs runs every live test there (the GitLab one is
REM releases\live-tests\gitlab-write-back.mjs); each skips a service with no login.
node "%REPO%\releases\live-tests\run.mjs"
gotoend
REM ===========================================================================
:mirror_forge
call"%REPO%\releases\mirror.bat"
@@ -1665,6 +1809,9 @@ REM Best-effort by image name; the per-port free below does the real work and is
REM narrow enough not to touch unrelated Node apps.
taskkill /F /IM meteor.exe /T >nul 2>&1
taskkill /F /IM mongod.exe /T >nul 2>&1
REM `rspack build --watch` listens on no port, so the per-port free below cannot
REM find it; stop it by its command line, as build.sh's pkill does.
if[ -n "$(git status --porcelain -- CHANGELOG.md 2>/dev/null)"];then
git add CHANGELOG.md
if[ -n "$(git status --porcelain -- CHANGELOG-big.md CHANGELOG.md 2>/dev/null)"];then
git add CHANGELOG-big.md CHANGELOG.md
git commit -q -m "CHANGELOG: repoint commit links after history moved.
A rebase rewrote the commits these entries link to, so the links named commits
@@ -2595,7 +2645,7 @@ choose() {
# snap/bundle, not on a maintainer's machine) and the superseded old-*.sh and
# translations/fill_translations.py.
# Release notes summarize translations as affected languages; other changelog
# details stay in CHANGELOG.md. Notes include only In short, Security,
# details stay in CHANGELOG-big.md. Notes include only In short, Security,
# Translations language list, thanks and the changelog link. Binary provenance remains
# a build artifact and must not be appended by any release entry point.
RELEASE_SCRIPTS=("Release|Release All: audit, commit, push and build with Actions|releases/release-all.sh|||"
@@ -2647,6 +2697,7 @@ RELEASE_SCRIPTS=( "Release|Release All: audit, commit, push and build with Actio
"Bundles|Fetch the built bundle from the ppc64le build host|releases/up-o.sh|WeKan version, e.g. 10.50||"
"Bundles|Fetch the built bundle from the s390x build host|releases/up-s.sh|WeKan version, e.g. 10.50||"
"Bundles|Upload the Windows bundle to the download server|releases/up-w.sh|WeKan version, e.g. 10.50||"
"Docker images|Test Nextcloud 32-35 with native local services|tests/nextcloud/run.sh|Nextcloud majors (default 32 33 34 35)|linux|nextcloud-tests"
"Docker images|Build the WeKan Docker image|releases/docker-build.sh|||"
"Docker images|Create the multi-platform buildx builder|releases/docker-build-deps.sh|||"
"Docker images|Publish a variant image (wekan-gantt-gpl / wekan-ondra)|releases/docker-publish-variant.sh|Image and version, e.g. wekan-gantt-gpl 10.50||"
"Count tests by category|Count amount of tests by category"\
"Run all FerretDB tests - SEQUENTIAL|Run all FerretDB tests - SEQUENTIAL: unit, vet and the integration suite of the FerretDB subdirectory of this repo, one at a time, logs in log/<datetime>/"\
"All databases (sequential)|Test all databases that have a Docker image for this CPU, SEQUENTIALLY: build newest FerretDB v1 from source, then run every FerretDB v1 query type against each database and compare that they all answer the same (results in log/<datetime>/)";;
"Live tests|Run live tests against real services with your own accounts: GitLab write-back with the mirror's glab login (only scratch items it creates and removes) and the API imports, read only (releases/live-tests/README.md); a service with no login here is skipped, log in .tools/log/<datetime>/"\
"All databases (sequential)|Test all databases that have a Docker image for this CPU, SEQUENTIALLY: build newest FerretDB v1 from source, then run every FerretDB v1 query type against each database and compare that they all answer the same (results in log/<datetime>/)"\
"Database speed test|Time the common WeKan queries on every database that has a Docker image for this CPU, SEQUENTIALLY, with twice a production WeKan of dummy data; check they all answer the same and write docs/Databases/FerretDB/1/SpeedTest/Results.md";;
"Tools")
choose "Tools"\
"Save Meteor deps list|Save Meteor dependency chain to ../meteor-deps.txt"\
@@ -2963,12 +3016,35 @@ for _once in 1; do
;;
*)echo"Unsupported Linux distribution; install a C/C++ toolchain, git, curl, wget, 7zip, zip, unzip, file and npm." >&2;exit1;;
# No shell rc file is edited: build.sh and the releases/ scripts put
# .tools/nvm's Node.js and .tools/.meteor on PATH themselves
# (releases/tools-env.sh).
# Meteor as https://docs.meteor.com/about/install.html installs it:
# `npx meteor`, as this user, never sudo, with HOME=.tools for the
# installer only (see the Linux branch).
if[ -x "$WEKAN_TOOLS_DIR/.meteor/meteor"];then
echo"Meteor is already installed in $WEKAN_TOOLS_DIR/.meteor"
else
HOME="$WEKAN_TOOLS_DIR"npx -y meteor
fi
. "$WEKAN_DIR/releases/tools-env.sh"
exit;
elif[["$OSTYPE"=="cygwin"]];then
# POSIX compatibility layer and Linux environment emulation for Windows
@@ -3299,6 +3377,14 @@ for _once in 1; do
break
;;
"Run live tests against real services with your own accounts: GitLab write-back with the mirror's glab login (only scratch items it creates and removes) and the API imports, read only (releases/live-tests/README.md); a service with no login here is skipped, log in .tools/log/<datetime>/")
# releases/live-tests/run.mjs: every live test there; each skips a
# service it has no login for. Human-run only - they write to the
# services (scratch items they remove), so no automatic run calls them.
node "$WEKAN_DIR/releases/live-tests/run.mjs"
break
;;
"Mirror GitHub to active mirrors: code, issues, PR conversations, releases and assets")
mirror_forge
break
@@ -3328,6 +3414,12 @@ for _once in 1; do
./releases/db-conformance.sh
;;
"Time the common WeKan queries on every database that has a Docker image for this CPU, SEQUENTIALLY, with twice a production WeKan of dummy data; check they all answer the same and write docs/Databases/FerretDB/1/SpeedTest/Results.md")
Loaded 100 of 4604 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Lauri Ojansivu
github-actions[bot]
dependabot[bot]
Jacob Weisz
Michael Nutt