Bump versions for v12.99

Thanks to xet7 !

.github/workflows/release-all.yml

@@ -2624,7 +2624,12 @@ jobs:
     permissions:
       contents: write
     needs: [prepare, build-amd64, release]
-    runs-on: macos-14   # macos-14 runners are Apple Silicon (arm64)
+    # Apple Silicon (arm64). It was `macos-14`, and GitHub RETIRED that image:
+    # the v12.98 run's build-mac-arm64 was cancelled with "The configuration
+    # 'macos-14-arm64-us-default' is not supported", so v12.98 shipped no
+    # mac-arm64 bundle. macos-15 is Apple Silicon too (the same label mac.yml
+    # already builds on).
+    runs-on: macos-15
     timeout-minutes: 60
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
@@ -2900,7 +2905,8 @@ jobs:
       contents: write
     needs: [prepare, build-amd64, release]
     # Intel (x86_64) macOS. It was `macos-13`, and GitHub RETIRED that image -
-    # actions/runner-images publishes macos-14, macos-15 and macos-26 only, and
+    # actions/runner-images publishes macos-15 and macos-26 only (macos-14 was
+    # retired later too), and
     # macos-13 is gone from the hosted-runner table. A retired label does not
     # fail: the job QUEUES FOREVER waiting for a runner that will never come, so
     # every release since then had a build-mac-x64 sitting there for hours until
@@ -2908,7 +2914,7 @@ jobs:
     # what skipped the charts jobs (they had not started yet).
     # No release has ever carried a wekan-<version>-mac-x64.zip because of it.
     # Intel macOS is still offered, under new labels: macos-15-intel and
-    # macos-26-intel (macos-14/15/26 without the suffix are Apple Silicon). This
+    # macos-26-intel (macos-15/26 without the suffix are Apple Silicon). This
     # is the same label .tools/TSC already builds its Intel Mac on.
     runs-on: macos-15-intel
     timeout-minutes: 60

AGENTS.md

@@ -427,48 +427,6 @@ directly after the merge.
     application-specific names (say "the client" / "a Meteor 3 driver" / a bare
     `#NNNN`); its `CHANGELOG.md` may use `wekan/wekan#NNNN`.
 
-### Gambas Web Kanban companion: `.tools/weba`
-
-- `.tools/weba` is the separate `wekan/weba` repository, a Gambas Web UI
-  Kanban application with SQLite by default. Its project is `.tools/weba/WeKan`,
-  its entry form is `WeKan/.src/WebformLogin.class`, and its logged-in UI is
-  `WeKan/.src/WebformMain.class` / `.webform`. Custom browser reports live in
-  `WeKan/.public/kanban.js` and `kanban.css`; database access lives in
-  `WebDatabase.module` and `KanbanStore.module`. These files belong to weba,
-  never to a WeKan commit.
-- Apply this repository's author, local-commit-only and no-push rules there too:
-  check weba's own identity and branch, commit as Lauri Ojansivu on `main`, update
-  its own `CHANGELOG.md` in its existing format. Do not add instruction files to
-  weba. Track active work, limitations and remaining WeKan page parity in its
-  `TODO.md`, keeping completed work distinct from unverified work.
-- The user-provided Gambas installation and source are under
-  `.tools/bin/gambas3`: IDE archives in `bin/`, components in `lib/gambas3/`,
-  class metadata in `usr/share/gambas3/info/`, and upstream source in
-  `src/gambas/`. Inspect the actual files before use: the initial copy contains
-  the IDE archives but no `bin/gbc3` or `bin/gbx3`. An IDE archive requires the
-  Gambas interpreter and is not itself the compiler. Do not assume a complete
-  runtime or a particular CPU architecture from the directory name.
-- Gambas tools are `gbc3` (compiler), `gbx3` (project runner), and `gba3`
-  (archiver). Compile with `gbc3 -j 1 -a .tools/weba/WeKan`; `-j 1` avoids
-  restricted process-group errors in the sandbox. A relocated compiler accepts
-  `-r <installation-prefix>`; a relocated runner may need `GB_PATH` pointing
-  at its component directory and `LD_LIBRARY_PATH` for local native dependencies.
-  Keep these settings scoped to the command. Place downloaded test toolchains
-  under `.tools/` and set repository-local `TMPDIR` before builds and tests.
-- Run `tests/run-store.sh` from weba with `TMPDIR` set; it copies the project and
-  SQLite database before CRUD and authentication tests, so never run its test
-  modules directly against the real database. `GBC` and `GBX` can select local
-  executables. Run `node tests/reports.test.cjs` with `jsdom` available (the
-  parent WeKan `node_modules` can supply it through `NODE_PATH`). A successful
-  compile or DOM test does not establish a working browser login session.
-- Prefer Gambas `Connection.Tables` / `Fields` for schema creation and driver
-  `Find`, `Create`, `Edit`, `LastInsertId` and parameterized `Exec` for data.
-  Do not introduce SQLite-specific DDL, PRAGMA, SQL date functions, conflict
-  clauses or driver-specific generated-key SQL. SQLite is the tested default;
-  other writable Gambas drivers need separate conformance runs and their driver
-  components enabled. Connection overrides are `WEBA_DB_TYPE`, `WEBA_DB_HOST`,
-  `WEBA_DB_NAME`, `WEBA_DB_USER` and `WEBA_DB_PASSWORD`; never log credentials.
-
 ### CHANGELOG
 
 - **[maintainer only] Changelogs are updated only in maintainer mode.** This whole

CHANGELOG-big.md

@@ -124,6 +124,33 @@ its reason.
 
 </details>
 
+# v12.99 2026-11-06 WeKan ® release
+
+**In short:** The **mac-arm64** release bundle builds again: its job asked for
+GitHub's retired **macos-14** runner and was cancelled in the v12.98 release
+run. The **weba** instructions now live in the weba repository itself.
+
+This release fixes the following release build bug:
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/7e4483b1a9">The mac-arm64 bundle is built on macos-15, because GitHub retired macos-14</a>. Thanks to xet7.</summary>
+
+In the v12.98 release run, build-mac-arm64 was cancelled with "The
+configuration 'macos-14-arm64-us-default' is not supported", so v12.98 has no
+mac-arm64 bundle. The job now runs on `macos-15`, which is Apple Silicon too
+and is what `mac.yml` already uses. `tests/workflowRunnerLabels.test.cjs` lists
+`macos-14` as retired, so no workflow can ask for it again, and checks that
+build-mac-arm64 asks for a current Apple Silicon runner.
+
+</details>
+
+and has the following developer documentation change:
+
+- [The weba instructions moved from AGENTS.md and CLAUDE.md into the weba repository](https://github.com/wekan/wekan/commit/b4cb989391).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v12.98 2026-11-06 WeKan ® release
 
 **In short:** **GroupLinkBleed** is fixed: a board admin can no longer skip the

CHANGELOG.md

@@ -5,6 +5,14 @@ each one changed and the project status are in
 Written by `node releases/changelog-short.mjs` from CHANGELOG-big.md:
 make changes there.
 
+# v12.99 2026-11-06 WeKan ® release
+
+The **mac-arm64** release bundle builds again: its job asked for
+GitHub's retired **macos-14** runner and was cancelled in the v12.98 release
+run. The **weba** instructions now live in the weba repository itself.
+
+[All changes in v12.99](CHANGELOG-big.md#v1299-2026-11-06-wekan--release)
+
 # v12.98 2026-11-06 WeKan ® release
 
 **GroupLinkBleed** is fixed: a board admin can no longer skip the
@@ -47,12 +55,3 @@ and the Docker image's **nodemailer**, **body-parser**, **qs**, **uuid** and
 **postcss-selector-parser** are raised past the advisories a Grype scan found.
 
 [All changes in v12.95](CHANGELOG-big.md#v1295-2026-11-05-wekan--release)
-
-# v12.94 2026-11-04 WeKan ® release
-
-On an iPad the **opened card covers the header bar** instead of
-sitting
-behind it, and the speed test measures where the time goes when a WeKan board is
-opened, on FerretDB and on MongoDB.
-
-[All changes in v12.94](CHANGELOG-big.md#v1294-2026-11-04-wekan--release)

CLAUDE.md

@@ -427,48 +427,6 @@ directly after the merge.
     application-specific names (say "the client" / "a Meteor 3 driver" / a bare
     `#NNNN`); its `CHANGELOG.md` may use `wekan/wekan#NNNN`.
 
-### Gambas Web Kanban companion: `.tools/weba`
-
-- `.tools/weba` is the separate `wekan/weba` repository, a Gambas Web UI
-  Kanban application with SQLite by default. Its project is `.tools/weba/WeKan`,
-  its entry form is `WeKan/.src/WebformLogin.class`, and its logged-in UI is
-  `WeKan/.src/WebformMain.class` / `.webform`. Custom browser reports live in
-  `WeKan/.public/kanban.js` and `kanban.css`; database access lives in
-  `WebDatabase.module` and `KanbanStore.module`. These files belong to weba,
-  never to a WeKan commit.
-- Apply this repository's author, local-commit-only and no-push rules there too:
-  check weba's own identity and branch, commit as Lauri Ojansivu on `main`, update
-  its own `CHANGELOG.md` in its existing format. Do not add instruction files to
-  weba. Track active work, limitations and remaining WeKan page parity in its
-  `TODO.md`, keeping completed work distinct from unverified work.
-- The user-provided Gambas installation and source are under
-  `.tools/bin/gambas3`: IDE archives in `bin/`, components in `lib/gambas3/`,
-  class metadata in `usr/share/gambas3/info/`, and upstream source in
-  `src/gambas/`. Inspect the actual files before use: the initial copy contains
-  the IDE archives but no `bin/gbc3` or `bin/gbx3`. An IDE archive requires the
-  Gambas interpreter and is not itself the compiler. Do not assume a complete
-  runtime or a particular CPU architecture from the directory name.
-- Gambas tools are `gbc3` (compiler), `gbx3` (project runner), and `gba3`
-  (archiver). Compile with `gbc3 -j 1 -a .tools/weba/WeKan`; `-j 1` avoids
-  restricted process-group errors in the sandbox. A relocated compiler accepts
-  `-r <installation-prefix>`; a relocated runner may need `GB_PATH` pointing
-  at its component directory and `LD_LIBRARY_PATH` for local native dependencies.
-  Keep these settings scoped to the command. Place downloaded test toolchains
-  under `.tools/` and set repository-local `TMPDIR` before builds and tests.
-- Run `tests/run-store.sh` from weba with `TMPDIR` set; it copies the project and
-  SQLite database before CRUD and authentication tests, so never run its test
-  modules directly against the real database. `GBC` and `GBX` can select local
-  executables. Run `node tests/reports.test.cjs` with `jsdom` available (the
-  parent WeKan `node_modules` can supply it through `NODE_PATH`). A successful
-  compile or DOM test does not establish a working browser login session.
-- Prefer Gambas `Connection.Tables` / `Fields` for schema creation and driver
-  `Find`, `Create`, `Edit`, `LastInsertId` and parameterized `Exec` for data.
-  Do not introduce SQLite-specific DDL, PRAGMA, SQL date functions, conflict
-  clauses or driver-specific generated-key SQL. SQLite is the tested default;
-  other writable Gambas drivers need separate conformance runs and their driver
-  components enabled. Connection overrides are `WEBA_DB_TYPE`, `WEBA_DB_HOST`,
-  `WEBA_DB_NAME`, `WEBA_DB_USER` and `WEBA_DB_PASSWORD`; never log credentials.
-
 ### CHANGELOG
 
 - **[maintainer only] Changelogs are updated only in maintainer mode.** This whole

Dockerfile

@@ -38,7 +38,7 @@ FROM --platform=$BUILDPLATFORM debian:trixie AS bundle
 
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=12.98
+ARG VERSION=12.99
 ARG DEBIAN_FRONTEND=noninteractive
 
 COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v12.98.0"
+appVersion: "v12.99.0"
 files:
   userUploads:
     - README.md

docs/Platforms/Propietary/OS/Windows/Offline.md

@@ -10,7 +10,7 @@ This is without container (without Docker or Snap).
 
 Right click and download files 1-4:
 
-1. [wekan-12.98-win64.zip](https://github.com/wekan/wekan/releases/download/v12.98/wekan-12.98-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
+1. [wekan-12.99-win64.zip](https://github.com/wekan/wekan/releases/download/v12.99/wekan-12.99-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
 
 2. [node.exe](https://nodejs.org/dist/latest-v26.x/win-x64/node.exe)
 
@@ -22,7 +22,7 @@ Right click and download files 1-4:
 
 6. Double click `mongodb-windows-x86_64-7.0.34-signed.msi` . In installer, uncheck downloading MongoDB compass.
 
-7. Unzip `wekan-12.98-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-12.99-win64.zip` , inside it is directory `bundle`, to it copy other files:
 
 ```
 bundle (directory)

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "wekan",
-  "version": "v12.98.0",
+  "version": "v12.99.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "wekan",
-      "version": "v12.98.0",
+      "version": "v12.99.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v12.98.0",
+  "version": "v12.99.0",
   "description": "Open-Source kanban",
   "private": true,
   "repository": {

public/api/wekan.html

@@ -3,7 +3,7 @@
 
 <head>
   <meta charset="utf8" />
-  <title>WeKan REST API v12.98</title>
+  <title>WeKan REST API v12.99</title>
   <!-- needed for adaptive design -->
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <style>
@@ -484,11 +484,11 @@ data-styled.g658[id="sc-hHttOM"]{content:"dKSNwp,"}/*!sc*/
 
 <body>
   
-      <div id="redoc"><div hidden=""><script>try{var m=localStorage.getItem("redoc.colorMode");if(m!=="light"&&m!=="dark")m=matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light";document.documentElement.classList.add(m)}catch(e){}</script></div><div style="--navbar-height:0px;--navbar-stack-height:0px" class="sc-kIbBWU fFQMWf"><div class="sc-cjUTkN dGsweu menu-content"><div class="sc-jqwVmx jjzLa-d"><div data-testid="search-trigger" class="sc-cToEys dffrbr"><div class="sc-cRcubC ddjiE"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" data-component-name="icons/SearchIcon/SearchIcon" class="sc-cHazmW gTzQi"><path d="M14.5 13.7931L10.724 10.017C11.6313 8.9277 12.0838 7.5305 11.9872 6.11608C11.8907 4.70165 11.2525 3.37891 10.2055 2.423C9.15857 1.4671 7.78336 0.951637 6.36602 0.983845C4.94867 1.01605 3.5983 1.59345 2.59582 2.59593C1.59335 3.5984 1.01595 4.94877 0.983738 6.36612C0.95153 7.78347 1.46699 9.15867 2.4229 10.2057C3.3788 11.2526 4.70155 11.8908 6.11597 11.9873C7.53039 12.0839 8.92759 11.6314 10.0169 10.7241L13.793 14.5001L14.5 13.7931ZM2.00001 6.50012C2.00001 5.6101 2.26393 4.74007 2.7584 4.00005C3.25286 3.26003 3.95567 2.68325 4.77794 2.34266C5.6002 2.00207 6.505 1.91295 7.37792 2.08658C8.25083 2.26022 9.05266 2.6888 9.68199 3.31814C10.3113 3.94747 10.7399 4.7493 10.9135 5.62221C11.0872 6.49513 10.9981 7.39993 10.6575 8.22219C10.3169 9.04446 9.7401 9.74726 9.00008 10.2417C8.26006 10.7362 7.39003 11.0001 6.50001 11.0001C5.30694 10.9988 4.16312 10.5243 3.31949 9.68064C2.47587 8.83701 2.00133 7.69319 2.00001 6.50012Z"></path></svg><span>Loading...</span></div></div></div><div class="sc-dNLPWG dtcefb"><ul data-component-name="Menu/Menu" class="sc-kBPbfe ctPApS"><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-default" role="listitem"><a class="sc-iJONRL iBHKJo" href="/" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="true" class="sc-epufQc fYmDZR"><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="Wekan REST API" class="sc-eStdmu iyAVQU">Wekan REST API</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-default" role="listitem"><a class="sc-iJONRL iBHKJo" href="/section/production-security-concerns" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-epufQc itBMtf"><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="Production Security Concerns" class="sc-eStdmu liVEkC">Production Security Concerns</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-group" role="listitem"><a class="sc-iJONRL iBHKJo" href="/login" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-epufQc hKPPiy"><div class="sc-jokKPH jtaKKl"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-iUlCMS kEEIsB"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="Login" class="sc-eStdmu liVEkC">Login</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-hgJgCR dlNiXx"></div></div><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-group" role="listitem"><a class="sc-iJONRL iBHKJo" href="/attachmentstoragesettings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-epufQc hKPPiy"><div class="sc-jokKPH jtaKKl"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-iUlCMS kEEIsB"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="AttachmentStorageSettings" class="sc-eStdmu liVEkC">AttachmentStorageSettings</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-hgJgCR dlNiXx"></div></div><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-group" role="listitem"><a class="sc-iJONRL iBHKJo" href="/settings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-epufQc hKPPiy"><div class="sc-jokKPH jtaKKl"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-iUlCMS kEEIsB"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="Settings" classLine truncated
+      <div id="redoc"><div hidden=""><script>try{var m=localStorage.getItem("redoc.colorMode");if(m!=="light"&&m!=="dark")m=matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light";document.documentElement.classList.add(m)}catch(e){}</script></div><div style="--navbar-height:0px;--navbar-stack-height:0px" class="sc-kIbBWU fFQMWf"><div class="sc-cjUTkN dGsweu menu-content"><div class="sc-jqwVmx jjzLa-d"><div data-testid="search-trigger" class="sc-cToEys dffrbr"><div class="sc-cRcubC ddjiE"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" data-component-name="icons/SearchIcon/SearchIcon" class="sc-cHazmW gTzQi"><path d="M14.5 13.7931L10.724 10.017C11.6313 8.9277 12.0838 7.5305 11.9872 6.11608C11.8907 4.70165 11.2525 3.37891 10.2055 2.423C9.15857 1.4671 7.78336 0.951637 6.36602 0.983845C4.94867 1.01605 3.5983 1.59345 2.59582 2.59593C1.59335 3.5984 1.01595 4.94877 0.983738 6.36612C0.95153 7.78347 1.46699 9.15867 2.4229 10.2057C3.3788 11.2526 4.70155 11.8908 6.11597 11.9873C7.53039 12.0839 8.92759 11.6314 10.0169 10.7241L13.793 14.5001L14.5 13.7931ZM2.00001 6.50012C2.00001 5.6101 2.26393 4.74007 2.7584 4.00005C3.25286 3.26003 3.95567 2.68325 4.77794 2.34266C5.6002 2.00207 6.505 1.91295 7.37792 2.08658C8.25083 2.26022 9.05266 2.6888 9.68199 3.31814C10.3113 3.94747 10.7399 4.7493 10.9135 5.62221C11.0872 6.49513 10.9981 7.39993 10.6575 8.22219C10.3169 9.04446 9.7401 9.74726 9.00008 10.2417C8.26006 10.7362 7.39003 11.0001 6.50001 11.0001C5.30694 10.9988 4.16312 10.5243 3.31949 9.68064C2.47587 8.83701 2.00133 7.69319 2.00001 6.50012Z"></path></svg><span>Loading...</span></div></div></div><div class="sc-dNLPWG dtcefb"><ul data-component-name="Menu/Menu" class="sc-kBPbfe ctPApS"><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-default" role="listitem"><a class="sc-iJONRL iBHKJo" href="/" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="true" class="sc-epufQc fYmDZR"><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="Wekan REST API" class="sc-eStdmu iyAVQU">Wekan REST API</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-default" role="listitem"><a class="sc-iJONRL iBHKJo" href="/section/production-security-concerns" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-epufQc itBMtf"><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="Production Security Concerns" class="sc-eStdmu liVEkC">Production Security Concerns</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-group" role="listitem"><a class="sc-iJONRL iBHKJo" href="/login" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-epufQc hKPPiy"><div class="sc-jokKPH jtaKKl"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-iUlCMS kEEIsB"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="Login" class="sc-eStdmu liVEkC">Login</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-hgJgCR dlNiXx"></div></div><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-group" role="listitem"><a class="sc-iJONRL iBHKJo" href="/attachmentstoragesettings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-epufQc hKPPiy"><div class="sc-jokKPH jtaKKl"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-iUlCMS kEEIsB"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="AttachmentStorageSettings" class="sc-eStdmu liVEkC">AttachmentStorageSettings</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-hgJgCR dlNiXx"></div></div><div data-component-name="Menu/MenuItem" class="sc-gwVKcS fGSWQx menu-item-type-group" role="listitem"><a class="sc-iJONRL iBHKJo" href="/settings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-epufQc hKPPiy"><div class="sc-jokKPH jtaKKl"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-iUlCMS kEEIsB"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-boLXHU jshptd"><span class="sc-bcyEQV hrIrOF"><span data-text="Settings" classLine truncated
       <script type="module">
       import { hydrate } from "https://cdn.redocly.com/redoc/v3.0.1/bundles/redoc.standalone.js";
 
-      const __redoc_definition = {"openapi":"3.2.0","info":{"title":"Wekan REST API","version":"v12.98","description":"The REST API allows you to control and extend Wekan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production Wekan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}},"/api/admin/attachment-settings":{"get":{"operationId":"get_attachment_settings","summary":"Get the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. Returns the Admin Panel >\n Attachments settings document, including `limitSettings.attachmentsUploadBlocked`\n and `limitSettings.avatarsUploadBlocked` plus the size limits. Cloud-storage\n secret keys (S3 secretAccessKey, Azure accountKey/connectionString, GCS\n credentials) are masked and never returned; a boolean `\u003cfield>Set` marker\n shows whether a value exists.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}},"put":{"operationId":"update_attachment_settings","summary":"Update the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. The request body is a\n partial settings object (for example\n `{\"limitSettings\": {\"avatarsUploadBlocked\": true}}`). It is applied through\n the same update path as the `updateAttachmentStorageSettings` Meteor method,\n so validation and `$set` semantics are identical: cloud-storage secrets left\n blank are preserved. The masked, updated settings document is returned.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}}},"/api/admin/domains":{"get":{"operationId":"get_admin_domains","summary":"List email domains with their user counts (GlobalAdmin)","description":"Only the global admin can call this. CountsLine truncated
+      const __redoc_definition = {"openapi":"3.2.0","info":{"title":"Wekan REST API","version":"v12.99","description":"The REST API allows you to control and extend Wekan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production Wekan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}},"/api/admin/attachment-settings":{"get":{"operationId":"get_attachment_settings","summary":"Get the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. Returns the Admin Panel >\n Attachments settings document, including `limitSettings.attachmentsUploadBlocked`\n and `limitSettings.avatarsUploadBlocked` plus the size limits. Cloud-storage\n secret keys (S3 secretAccessKey, Azure accountKey/connectionString, GCS\n credentials) are masked and never returned; a boolean `\u003cfield>Set` marker\n shows whether a value exists.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}},"put":{"operationId":"update_attachment_settings","summary":"Update the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. The request body is a\n partial settings object (for example\n `{\"limitSettings\": {\"avatarsUploadBlocked\": true}}`). It is applied through\n the same update path as the `updateAttachmentStorageSettings` Meteor method,\n so validation and `$set` semantics are identical: cloud-storage secrets left\n blank are preserved. The masked, updated settings document is returned.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}}},"/api/admin/domains":{"get":{"operationId":"get_admin_domains","summary":"List email domains with their user counts (GlobalAdmin)","description":"Only the global admin can call this. CountsLine truncated
       const __redoc_options = {"skipBundle":true,"disableTelemetry":false};
 
       hydrate(__redoc_definition, __redoc_options, document.getElementById('redoc'));

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v12.98
+  version: v12.99
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 1298,
+    appVersion = 1299,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "12.98~2026-11-06"),
+    appMarketingVersion = (defaultText = "12.99~2026-11-06"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

snapcraft.yaml

@@ -19,7 +19,7 @@
 #   base: core24 (not core26) · no build-base: devel · grade: stable
 # ─────────────────────────────────────────────────────────────────────────────
 name: wekan
-version: '12.98'
+version: '12.99'
 base: core24
 confinement: strict
 grade: stable
@@ -703,18 +703,18 @@ parts:
                 armhf)   WEKAN_ARCH="armhf"   ;;
                 *) echo "Unsupported architecture: ${CRAFT_ARCH_BUILD_FOR}"; exit 1 ;;
             esac
-            WEKAN_ZIP="wekan-12.98-${WEKAN_ARCH}.zip"
+            WEKAN_ZIP="wekan-12.99-${WEKAN_ARCH}.zip"
             echo "Cleaning environment first"
             rm -rf .build
             mkdir .build
             cd .build
-            #wget https://github.com/wekan/wekan/releases/download/v12.98/wekan-12.98-amd64.zip
+            #wget https://github.com/wekan/wekan/releases/download/v12.99/wekan-12.99-amd64.zip
             # Retry: a release asset can 404 for a short while right after it is
             # uploaded (CDN/propagation lag), and a plain wget treated that as
             # fatal. --retry-on-http-error covers the 404/5xx window; a genuinely
             # missing bundle still fails after the tries are spent.
             wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 \
-              "https://github.com/wekan/wekan/releases/download/v12.98/${WEKAN_ZIP}"
+              "https://github.com/wekan/wekan/releases/download/v12.99/${WEKAN_ZIP}"
             unzip "${WEKAN_ZIP}"
             python3 ../releases/check-telemetry.py --bundle bundle
             rm "${WEKAN_ZIP}"

tests/workflowRunnerLabels.test.cjs

@@ -15,8 +15,8 @@
 //
 // So the label is checked here, where it costs a second, instead of being
 // discovered as a two-hour queue during a release. Intel macOS did not go away -
-// it was RENAMED: macos-15-intel and macos-26-intel. macos-14/15/26 without the
-// suffix are Apple Silicon.
+// it was RENAMED: macos-15-intel and macos-26-intel. macos-15/26 without the
+// suffix are Apple Silicon (macos-14 is retired as well).
 //
 // This list is GitHub's hosted-runner set (docs.github.com "GitHub-hosted
 // runners"). When GitHub adds an image, add the label here too - a label this
@@ -39,13 +39,16 @@ const CURRENT = new Set([
   'windows-latest', 'windows-2025', 'windows-2025-vs2026', 'windows-2022',
   'windows-11-arm', 'windows-11-vs2026-arm',
   // macOS arm64, then macOS Intel
-  'macos-latest', 'macos-26', 'macos-15', 'macos-14',
+  'macos-latest', 'macos-26', 'macos-15',
   'macos-26-intel', 'macos-15-intel',
 ]);
 
 // Labels GitHub has REMOVED. Kept by name so the failure can say what replaced
 // them rather than only "unknown label".
 const RETIRED = new Map([
+  // The v12.98 release's build-mac-arm64 was cancelled with "The configuration
+  // 'macos-14-arm64-us-default' is not supported".
+  ['macos-14', 'retired - Apple Silicon macOS is now macos-15 / macos-26'],
   ['macos-15-large', 'a larger-runner label, not available here'],
   ['macos-13', 'retired - Intel macOS is now macos-15-intel / macos-26-intel'],
   ['macos-13-xl', 'retired - Intel macOS is now macos-15-intel / macos-26-intel'],
@@ -128,4 +131,25 @@ test('build-mac-x64 asks for an Intel macOS runner, not an Apple Silicon one', (
     `(macos-15-intel / macos-26-intel); it asks for "${m[1]}", which is Apple Silicon`);
 });
 
+function jobRunsOn(job) {
+  const workflow = fs.readFileSync(path.join(workflowDir, 'release-all.yml'), 'utf8');
+  const start = workflow.indexOf(`\n  ${job}:\n`);
+  assert.notStrictEqual(start, -1, `release-all.yml has no ${job} job`);
+  const rest = workflow.slice(start + 1);
+  const next = rest.search(/\n  [a-z0-9-]+:\n/);
+  const body = next === -1 ? rest : rest.slice(0, next);
+  const m = body.match(/^\s*runs-on:\s*(\S+)/m);
+  assert.ok(m, `${job} has no runs-on`);
+  return m[1];
+}
+
+test('build-mac-arm64 asks for a current Apple Silicon runner, not Intel or retired', () => {
+  const label = jobRunsOn('build-mac-arm64');
+  assert.ok(/^macos-(latest|\d+)$/.test(label),
+    `build-mac-arm64 builds the arm64 macOS bundle, so it needs an Apple Silicon ` +
+    `runner (macos-15 / macos-26); it asks for "${label}"`);
+  assert.ok(CURRENT.has(label) && !RETIRED.has(label),
+    `build-mac-arm64 asks for "${label}", which GitHub does not currently offer`);
+});
+
 console.log(`\n${passed} passed`);