Bump versions for v13.09

Thanks to xet7 !

.github/workflows/release-all.yml

@@ -4557,7 +4557,19 @@ jobs:
               ;;
           esac
 
-          sudo snap install snapcraft --classic
+          # The Snap Store has bad minutes - a rate limit, or (v13.07) a refresh
+          # that timed out - so the install is retried as the build job's is;
+          # an outage is said as one, not as a broken credential.
+          installed=""
+          for i in 1 2 3 4 5; do
+            if sudo snap install snapcraft --classic; then installed=1; break; fi
+            echo "snapcraft install attempt $i/5 failed (Snap Store unreachable or throttling); retrying in 30s..."
+            sleep 30
+          done
+          if [ -z "$installed" ]; then
+            echo "::error::snapcraft could not be installed after 5 attempts: the Snap Store did not answer. That is the store, not SNAP_AUTH - re-run the job."
+            exit 1
+          fi
 
           # whoami writes its answer to stdout and its complaint to stderr; both
           # matter, so both are captured.

CHANGELOG-big.md

@@ -124,6 +124,29 @@ its reason.
 
 </details>
 
+# v13.09 2026-11-12 WeKan ® release
+
+**In short:** The release's **Snap Store** credential check retries installing
+snapcraft, so one Snap Store timeout no longer stops a release.
+
+This release has the following developer-tooling fix:
+
+**Release builds** - the snap jobs.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/534646347c4b6467f539cb01171487d27fc7ddc7">snap-auth-check retries installing snapcraft, as the snap build job does</a>. Thanks to xet7.</summary>
+
+The v13.08 release stopped in snap-auth-check before it asked the Snap Store
+anything: the one `snap install snapcraft` timed out reaching api.snapcraft.io,
+while the snap build job already retried five times. The check retries the
+same way now, and when every attempt fails it says the store did not answer
+rather than that SNAP_AUTH is wrong. `tests/snapAuthPreflight.test.cjs` fails on
+any snapcraft install in any workflow without the retry.
+
+</details>
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v13.08 2026-11-12 WeKan ® release
 
 **In short:** The **REST API** creates a card under the **parent** it is given,

CHANGELOG.md

@@ -5,6 +5,13 @@ each one changed and the project status are in
 Written by `node releases/changelog-short.mjs` from CHANGELOG-big.md:
 make changes there.
 
+# v13.09 2026-11-12 WeKan ® release
+
+The release's **Snap Store** credential check retries installing
+snapcraft, so one Snap Store timeout no longer stops a release.
+
+[All changes in v13.09](CHANGELOG-big.md#v1309-2026-11-12-wekan--release)
+
 # v13.08 2026-11-12 WeKan ® release
 
 The **REST API** creates a card under the **parent** it is given,
@@ -45,12 +52,3 @@ Productivity** export no longer fails for a board with a card whose list is
 archived.
 
 [All changes in v13.05](CHANGELOG-big.md#v1305-2026-11-10-wekan--release)
-
-# v13.04 2026-11-09 WeKan ® release
-
-**ListLockBleed** is fixed: when a list refuses a role write
-access, that refusal now also holds for the checklist and checklist-item REST
-routes. The **Sandstorm** and **Android** bundles retry their npm install when
-github.com is briefly unavailable.
-
-[All changes in v13.04](CHANGELOG-big.md#v1304-2026-11-09-wekan--release)

Dockerfile

@@ -38,7 +38,7 @@ FROM --platform=$BUILDPLATFORM debian:trixie AS bundle
 
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=13.08
+ARG VERSION=13.09
 ARG DEBIAN_FRONTEND=noninteractive
 
 COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v13.08.0"
+appVersion: "v13.09.0"
 files:
   userUploads:
     - README.md

docs/Platforms/Propietary/OS/Windows/Offline.md

@@ -10,7 +10,7 @@ This is without container (without Docker or Snap).
 
 Right click and download files 1-4:
 
-1. [wekan-13.08-win64.zip](https://github.com/wekan/wekan/releases/download/v13.08/wekan-13.08-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
+1. [wekan-13.09-win64.zip](https://github.com/wekan/wekan/releases/download/v13.09/wekan-13.09-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
 
 2. [node.exe](https://nodejs.org/dist/latest-v26.x/win-x64/node.exe)
 
@@ -22,7 +22,7 @@ Right click and download files 1-4:
 
 6. Double click `mongodb-windows-x86_64-7.0.34-signed.msi` . In installer, uncheck downloading MongoDB compass.
 
-7. Unzip `wekan-13.08-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-13.09-win64.zip` , inside it is directory `bundle`, to it copy other files:
 
 ```
 bundle (directory)

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "wekan",
-  "version": "v13.08.0",
+  "version": "v13.09.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "wekan",
-      "version": "v13.08.0",
+      "version": "v13.09.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v13.08.0",
+  "version": "v13.09.0",
   "description": "Open-Source kanban",
   "private": true,
   "repository": {

public/api/wekan.html

@@ -3,7 +3,7 @@
 
 <head>
   <meta charset="utf8" />
-  <title>WeKan REST API v13.08</title>
+  <title>WeKan REST API v13.09</title>
   <!-- needed for adaptive design -->
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <style>
@@ -494,11 +494,11 @@ data-styled.g652[id="sc-LDhwn"]{content:"cirFq,"}/*!sc*/
 
 <body>
   
-      <div id="redoc"><div class="sc-jlWaFk kDulYG redoc light" style="--navbar-height:0px;--navbar-stack-height:0px"><div hidden=""><script>try{var r=document.querySelectorAll(".redoc");r=r[r.length-1];var h=document.documentElement,p=h.classList,a=[h.getAttribute("data-bs-theme"),h.getAttribute("data-theme")];var m=p.contains("dark")||a.indexOf("dark")>-1?"dark":p.contains("light")||a.indexOf("light")>-1?"light":localStorage.getItem("redoc.colorMode");if(m!=="light"&&m!=="dark")m=matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light";r.classList.remove("light","dark");r.classList.add(m)}catch(e){}</script></div><div class="sc-NPrTd fpSCXb menu-content"><div class="sc-bJapvR eXtYur"><div data-testid="search-trigger" class="sc-eavxOQ bStpwo"><div class="sc-dGYDtq hRGWCd"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" data-component-name="icons/SearchIcon/SearchIcon" class="sc-gJaedx dpfGSp"><path d="M14.5 13.7931L10.724 10.017C11.6313 8.9277 12.0838 7.5305 11.9872 6.11608C11.8907 4.70165 11.2525 3.37891 10.2055 2.423C9.15857 1.4671 7.78336 0.951637 6.36602 0.983845C4.94867 1.01605 3.5983 1.59345 2.59582 2.59593C1.59335 3.5984 1.01595 4.94877 0.983738 6.36612C0.95153 7.78347 1.46699 9.15867 2.4229 10.2057C3.3788 11.2526 4.70155 11.8908 6.11597 11.9873C7.53039 12.0839 8.92759 11.6314 10.0169 10.7241L13.793 14.5001L14.5 13.7931ZM2.00001 6.50012C2.00001 5.6101 2.26393 4.74007 2.7584 4.00005C3.25286 3.26003 3.95567 2.68325 4.77794 2.34266C5.6002 2.00207 6.505 1.91295 7.37792 2.08658C8.25083 2.26022 9.05266 2.6888 9.68199 3.31814C10.3113 3.94747 10.7399 4.7493 10.9135 5.62221C11.0872 6.49513 10.9981 7.39993 10.6575 8.22219C10.3169 9.04446 9.7401 9.74726 9.00008 10.2417C8.26006 10.7362 7.39003 11.0001 6.50001 11.0001C5.30694 10.9988 4.16312 10.5243 3.31949 9.68064C2.47587 8.83701 2.00133 7.69319 2.00001 6.50012Z"></path></svg><span>Loading...</span></div></div></div><div class="sc-kLsiYl kAUzfx"><ul data-component-name="Menu/Menu" class="sc-jfJzNu hoWuXt"><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-default" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="true" class="sc-cToEys eWEtkC"><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="WeKan REST API" class="sc-hgJgCR dWgUkd">WeKan REST API</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-default" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/section/production-security-concerns" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys iVTRMP"><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="Production Security Concerns" class="sc-hgJgCR dlVNdD">Production Security Concerns</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/login" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-kLEbxe eRqACJ"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="Login" class="sc-hgJgCR dlVNdD">Login</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-fKDFlh joxUYR"></div></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/attachmentstoragesettings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-kLEbxe eRqACJ"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="AttachmentStorageSettings" class="sc-hgJgCR dlVNdD">AttachmentStorageSettings</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-fKDFlh joxUYR"></div></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/settings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-defLine truncated
+      <div id="redoc"><div class="sc-jlWaFk kDulYG redoc light" style="--navbar-height:0px;--navbar-stack-height:0px"><div hidden=""><script>try{var r=document.querySelectorAll(".redoc");r=r[r.length-1];var h=document.documentElement,p=h.classList,a=[h.getAttribute("data-bs-theme"),h.getAttribute("data-theme")];var m=p.contains("dark")||a.indexOf("dark")>-1?"dark":p.contains("light")||a.indexOf("light")>-1?"light":localStorage.getItem("redoc.colorMode");if(m!=="light"&&m!=="dark")m=matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light";r.classList.remove("light","dark");r.classList.add(m)}catch(e){}</script></div><div class="sc-NPrTd fpSCXb menu-content"><div class="sc-bJapvR eXtYur"><div data-testid="search-trigger" class="sc-eavxOQ bStpwo"><div class="sc-dGYDtq hRGWCd"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" data-component-name="icons/SearchIcon/SearchIcon" class="sc-gJaedx dpfGSp"><path d="M14.5 13.7931L10.724 10.017C11.6313 8.9277 12.0838 7.5305 11.9872 6.11608C11.8907 4.70165 11.2525 3.37891 10.2055 2.423C9.15857 1.4671 7.78336 0.951637 6.36602 0.983845C4.94867 1.01605 3.5983 1.59345 2.59582 2.59593C1.59335 3.5984 1.01595 4.94877 0.983738 6.36612C0.95153 7.78347 1.46699 9.15867 2.4229 10.2057C3.3788 11.2526 4.70155 11.8908 6.11597 11.9873C7.53039 12.0839 8.92759 11.6314 10.0169 10.7241L13.793 14.5001L14.5 13.7931ZM2.00001 6.50012C2.00001 5.6101 2.26393 4.74007 2.7584 4.00005C3.25286 3.26003 3.95567 2.68325 4.77794 2.34266C5.6002 2.00207 6.505 1.91295 7.37792 2.08658C8.25083 2.26022 9.05266 2.6888 9.68199 3.31814C10.3113 3.94747 10.7399 4.7493 10.9135 5.62221C11.0872 6.49513 10.9981 7.39993 10.6575 8.22219C10.3169 9.04446 9.7401 9.74726 9.00008 10.2417C8.26006 10.7362 7.39003 11.0001 6.50001 11.0001C5.30694 10.9988 4.16312 10.5243 3.31949 9.68064C2.47587 8.83701 2.00133 7.69319 2.00001 6.50012Z"></path></svg><span>Loading...</span></div></div></div><div class="sc-kLsiYl kAUzfx"><ul data-component-name="Menu/Menu" class="sc-jfJzNu hoWuXt"><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-default" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="true" class="sc-cToEys eWEtkC"><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="WeKan REST API" class="sc-hgJgCR dWgUkd">WeKan REST API</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-default" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/section/production-security-concerns" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys iVTRMP"><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="Production Security Concerns" class="sc-hgJgCR dlVNdD">Production Security Concerns</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/login" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-kLEbxe eRqACJ"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="Login" class="sc-hgJgCR dlVNdD">Login</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-fKDFlh joxUYR"></div></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/attachmentstoragesettings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-kLEbxe eRqACJ"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="AttachmentStorageSettings" class="sc-hgJgCR dlVNdD">AttachmentStorageSettings</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-fKDFlh joxUYR"></div></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/settings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-defLine truncated
       <script type="module">
       import { hydrate } from "https://cdn.redocly.com/redoc/v3.1.0/bundles/redoc.standalone.js";
 
-      const __redoc_definition = {"openapi":"3.2.0","info":{"title":"WeKan REST API","version":"v13.08","description":"The REST API allows you to control and extend WeKan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production WeKan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}},"/api/admin/attachment-settings":{"get":{"operationId":"get_attachment_settings","summary":"Get the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. Returns the Admin Panel >\n Attachments settings document, including `limitSettings.attachmentsUploadBlocked`\n and `limitSettings.avatarsUploadBlocked` plus the size limits. Cloud-storage\n secret keys (S3 secretAccessKey, Azure accountKey/connectionString, GCS\n credentials) are masked and never returned; a boolean `\u003cfield>Set` marker\n shows whether a value exists.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}},"put":{"operationId":"update_attachment_settings","summary":"Update the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. The request body is a\n partial settings object (for example\n `{\"limitSettings\": {\"avatarsUploadBlocked\": true}}`). It is applied through\n the same update path as the `updateAttachmentStorageSettings` Meteor method,\n so validation and `$set` semantics are identical: cloud-storage secrets left\n blank are preserved. The masked, updated settings document is returned.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}}},"/api/admin/domains":{"get":{"operationId":"get_admin_domains","summary":"List email domains with their user counts (GlobalAdmin)","description":"Only the global admin can call this. CountsLine truncated
+      const __redoc_definition = {"openapi":"3.2.0","info":{"title":"WeKan REST API","version":"v13.09","description":"The REST API allows you to control and extend WeKan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production WeKan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}},"/api/admin/attachment-settings":{"get":{"operationId":"get_attachment_settings","summary":"Get the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. Returns the Admin Panel >\n Attachments settings document, including `limitSettings.attachmentsUploadBlocked`\n and `limitSettings.avatarsUploadBlocked` plus the size limits. Cloud-storage\n secret keys (S3 secretAccessKey, Azure accountKey/connectionString, GCS\n credentials) are masked and never returned; a boolean `\u003cfield>Set` marker\n shows whether a value exists.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}},"put":{"operationId":"update_attachment_settings","summary":"Update the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. The request body is a\n partial settings object (for example\n `{\"limitSettings\": {\"avatarsUploadBlocked\": true}}`). It is applied through\n the same update path as the `updateAttachmentStorageSettings` Meteor method,\n so validation and `$set` semantics are identical: cloud-storage secrets left\n blank are preserved. The masked, updated settings document is returned.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}}},"/api/admin/domains":{"get":{"operationId":"get_admin_domains","summary":"List email domains with their user counts (GlobalAdmin)","description":"Only the global admin can call this. CountsLine truncated
       const __redoc_options = {"skipBundle":true,"disableTelemetry":false};
 
       hydrate(__redoc_definition, __redoc_options, document.getElementById('redoc'));

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: WeKan REST API
-  version: v13.08
+  version: v13.09
   description: |
     The REST API allows you to control and extend WeKan with ease.
 

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 1308,
+    appVersion = 1309,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "13.08~2026-11-12"),
+    appMarketingVersion = (defaultText = "13.09~2026-11-12"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

snapcraft.yaml

@@ -19,7 +19,7 @@
 #   base: core24 (not core26) · no build-base: devel · grade: stable
 # ─────────────────────────────────────────────────────────────────────────────
 name: wekan
-version: '13.08'
+version: '13.09'
 base: core24
 confinement: strict
 grade: stable
@@ -703,18 +703,18 @@ parts:
                 armhf)   WEKAN_ARCH="armhf"   ;;
                 *) echo "Unsupported architecture: ${CRAFT_ARCH_BUILD_FOR}"; exit 1 ;;
             esac
-            WEKAN_ZIP="wekan-13.08-${WEKAN_ARCH}.zip"
+            WEKAN_ZIP="wekan-13.09-${WEKAN_ARCH}.zip"
             echo "Cleaning environment first"
             rm -rf .build
             mkdir .build
             cd .build
-            #wget https://github.com/wekan/wekan/releases/download/v13.08/wekan-13.08-amd64.zip
+            #wget https://github.com/wekan/wekan/releases/download/v13.09/wekan-13.09-amd64.zip
             # Retry: a release asset can 404 for a short while right after it is
             # uploaded (CDN/propagation lag), and a plain wget treated that as
             # fatal. --retry-on-http-error covers the 404/5xx window; a genuinely
             # missing bundle still fails after the tries are spent.
             wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 \
-              "https://github.com/wekan/wekan/releases/download/v13.08/${WEKAN_ZIP}"
+              "https://github.com/wekan/wekan/releases/download/v13.09/${WEKAN_ZIP}"
             unzip "${WEKAN_ZIP}"
             python3 ../releases/check-telemetry.py --bundle bundle
             rm "${WEKAN_ZIP}"

tests/snapAuthPreflight.test.cjs

@@ -101,6 +101,24 @@ test('the credential itself is never printed', () => {
   assert.ok(/echo "\$out"/.test(job), "only whoami's answer is");
 });
 
+test('every snapcraft install in the workflows is retried', () => {
+  // v13.07: snap-auth-check installed snapcraft once, the Snap Store timed out
+  // ("Client.Timeout exceeded while awaiting headers") and the whole release
+  // check failed, while the build job's install already retried five times.
+  const dir = path.join(__dirname, '..', '.github', 'workflows');
+  for (const f of fs.readdirSync(dir).filter(n => /\.ya?ml$/.test(n))) {
+    const lines = fs.readFileSync(path.join(dir, f), 'utf8').split('\n');
+    lines.forEach((line, i) => {
+      if (!/snap install snapcraft/.test(line) || /^\s*#/.test(line)) return;
+      const before = lines.slice(Math.max(0, i - 3), i).join('\n');
+      assert.ok(/for i in 1 2 3 4 5; do/.test(before),
+        `${f}:${i + 1} installs snapcraft without the five-attempt retry`);
+    });
+  }
+  assert.ok(/the Snap Store did not answer. That is the store, not SNAP_AUTH/.test(job),
+    'an outage is not reported as a credential problem');
+});
+
 test('a shell that keeps going long enough to classify the failure', () => {
   // `set -e` around the whoami call would kill the step at the failure, before
   // the case that says WHICH failure it was.