Bump versions for v13.11

Prepare v13.11 release
CHANGELOG: REST integration deletion answers 404 for a missing integration.
2026-11-13 21:51:59 -05:00 · 2026-11-13 18:11:28 +00:00 · 2026-11-13 20:10:27 +02:00 · 2026-11-13 19:43:09 +02:00 · 2026-11-13 19:41:28 +02:00 · 2026-11-13 19:01:54 +03:00
33 changed files with 1248 additions and 277 deletions
@@ -124,6 +124,109 @@ its reason.

 </details>

+# v13.11 2026-11-13 WeKan ® release
+
+**In short:** The **file-integrity scan** stops reporting attachments and
+avatars that WeKan deleted itself as missing, which had buried real
+**StorageBleed** findings under thousands of false ones. The recurring-checklist
+reset no longer scans every **checklist** on each tick. In the **REST API**, a
+refused custom-field update changes nothing, ownership transfer takes only the
+boards the user administers, and deleting a missing integration answers 404.
+
+This release fixes the following bugs:
+
+**The file-integrity scan** - what it counts as a missing file.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/ec05ff008928c390b11fec225c564f2dd209ec7f">Files WeKan deleted or moved itself are no longer reported missing</a>. Thanks to Raymond-Voogt and xet7.</summary>
+
+The daily scan keeps one baseline per stored file and reports a baseline whose
+file is gone as a StorageBleed. Nothing removed a baseline, so every attachment
+the retention purge deleted and every avatar a user deleted was reported on
+every run from then on; one finding was folded 1,164 times. The baseline is now
+forgotten in Attachments and Avatars `onAfterRemove`, for every version path.
+That is the retention purge's path: Meteor-Files unlinks the files itself after
+that hook, without going through the store strategy. It is also forgotten in
+the filesystem strategy's `unlink()` and, for the old path, in `rename()`. A
+file that vanishes any other way keeps its baseline and is still reported.
+Baselines orphaned before this fix stay until removed, as
+[#6898](https://github.com/wekan/wekan/issues/6898) describes.
+`tests/integrityBaselineForgottenOnDelete.test.cjs` fails on a delete or rename
+in the filesystem strategy that does not forget its baseline, and
+`tests/playwright/specs/integrity-baseline-on-delete.e2e.js` deletes an avatar
+in the UI.
+
+</details>
+
+**Database indexes** - the queries the background jobs make.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/c37575f1faff4e8ca518c7eae0ba7e50d05c1fae">The recurring-checklist reset reads only recurring checklists</a>. Thanks to Raymond-Voogt and xet7.</summary>
+
+The reset cron asks for every checklist with a `resetInterval` on each tick,
+and with no index that read the whole collection (about 45,000 documents on the
+reporting instance), shown as a collection scan on Admin Panel / Problems. A
+partial index on `resetInterval`, like the one recurring cards got, holds only
+the recurring checklists. `tests/checklistResetIndex.test.cjs` pins the index
+and a selector that can use it.
+
+</details>
+
+**The REST API** - custom fields, ownership transfer and integrations.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/a81ec6ecdfea8a0b0709d7c0cd463cfd051ca80f">A refused custom-field update leaves the whole field unchanged</a>. Thanks to AhmedLukman and xet7.</summary>
+
+`PUT /api/boards/:boardId/custom-fields/:customFieldId` wrote each property
+with its own update, so a refused `type` or `settings` left the name and flags
+sent before it already saved. The properties are now saved in one board-scoped
+update that the schema accepts or refuses as a whole. Authorization, the field
+allowlist and the reply are unchanged. `tests/restCustomFieldUpdate.test.cjs`
+and `tests/playwright/specs/rest-custom-field-update.e2e.js` cover both.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/4b4db92a1b97eae43770e56082012073d87c4c9a">Ownership transfer takes only the boards the user administers</a>. Thanks to AhmedLukman and xet7.</summary>
+
+`takeOwnership` selected boards where the user was a member and somebody, not
+necessarily the user, was an administrator. The user and the administrator flag
+are now matched on the same member, so a board where the user is an ordinary
+member is left as it is. `tests/restOwnershipSelection.test.cjs` and
+`tests/playwright/specs/rest-ownership-selection.e2e.js` cover it.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/ab685a7f6fe0450a31b9150a14b17b909933c86f">Deleting a missing or another board's integration answers 404</a>. Thanks to AhmedLukman and xet7.</summary>
+
+`DELETE /api/boards/:boardId/integrations/:intId` answered 200 for an
+integration that did not exist, was on another board or was already deleted,
+because the removal matched nothing and the reply did not check. It now looks
+the integration up on that board first, after the board-admin check, like PUT
+and the activities routes, and answers the same JSON 404. Server errors still
+answer 500. `tests/restIntegrationWriteRoutes404.test.cjs` and
+`tests/playwright/specs/rest-integration-update.e2e.js` cover it, including
+the board's webhook settings.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/a8e25952aa6b244b76891c3fa3cdc1779d35a78f">Ownership transfer finishes before it replies, and a deleted account leaves the board when removed</a>. Thanks to xet7.</summary>
+
+`takeOwnership` called the async `changeOwnership()` without `await`, so the
+reply was sent before the board changed and a failed update was an unhandled
+rejection behind a 200. `Boards.removeMember` tested
+`!ReactiveCache.getUser(id)`, which on the server is a Promise and always
+truthy. Because of that, the branch that removes a member whose account was
+deleted never ran there, and that member only lingered as inactive. Both
+calls are awaited now. `tests/reactiveCacheNegatedAwait.test.cjs` fails on any
+negated un-awaited `ReactiveCache` lookup in `server/` or `models/`.
+
+</details>
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v13.10 2026-11-13 WeKan ® release

 **In short:** The release's **Snap Store** credential check bounds each
@@ -8525,216 +8628,3 @@ plan.
 </details>

 Thanks to above GitHub users for their contributions and translators for their translations.
-
-# v12.42 2026-10-14 WeKan ® release
-
-**In short:** a new **Version Control** board view shows a board as a
-**GitHub** or **Gitea** issue tracker, with releases, a **wiki** and history
-with undo, and a whole **GitHub organization** imports into it, its **GitHub
-Actions** as Rules. Optional **Trello**, **Jira**, **GitHub** and **Gitea**
-compatible APIs let their clients use WeKan as a backend. Old boards get their
-keys in one pass, list sync keeps issue details current, any board view can be
-a **read-only public view**, and WeKan has **Android** bundles.
-
-This release adds the following new features:
-
-**Board views** - a repository's issue tracker as a view, and which views the
-public sees.
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">Version Control: the board as a GitHub or Gitea issue tracker</a>. Thanks to xet7.</summary>
-
-Board → View → **Version Control**, in the board's own theme. A card is an
-issue: open, or closed when archived, in a list named *Closed*, *Done*,
-*Resolved*, *Merged* or *Wontfix*, or closed upstream. The issue number is
-the upstream one of an imported issue, else the card number. The board's
-labels are labels, and labels with a due date and the importers'
-`milestone:` labels are milestones, with progress bars. Comments are the
-conversation, attachments the files. The search box takes GitHub's words:
-`is:open`, `label:`, `-label:`, `milestone:`, `author:`, `assignee:@me`,
-`no:label` and `sort:`. **New issue**, **Close** and **Reopen** write through
-the ordinary collections, so the **History** tab (the board's history table)
-shows them and **Restore** undoes them. A synced issue is closed in its
-tracker. **Import** opens the GitHub, GitLab, Gitea and Forgejo importers, and
-each synced list has a **Sync now** button. Visitors see it read-only. Tested
-by `tests/versionControlView.test.cjs`. See
-[Version Control view](docs/Features/Board/Version-Control-View.md).
-
-</details>
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">A public board's public views are for the public; its members keep theirs</a>. Thanks to xet7.</summary>
-
-Board Settings → Board View's *Show on* and *Default on Public Board* now
-apply to the people looking who are not members: visitors who are not logged
-in, and logged-in users who are not on the board. The board's members get the
-*Private* columns. So a public board can open read-only in Version Control,
-Email, Chat or any other view for the world, and list only the views chosen
-for it, while its members keep every view. Before, a public board's members
-had the public menu too. `boardViewAudience` in
-`models/lib/boardViewSettings.js`; `tests/boardViewSettings.test.cjs` covers
-visitors, non-members, former members and members.
-
-</details>
-
-**Import and sync** - what an issue tracker's issues bring with them.
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">GitHub, GitLab, Gitea and Forgejo issues bring their files</a>. Thanks to xet7.</summary>
-
-The files an issue or its comments link or carry become card attachments in
-Admin Panel → Attachments → Default Storage. These are GitHub
-`user-attachments` and `user-images` links, GitLab `/uploads/` links, and
-Gitea and Forgejo assets and `/attachments/<uuid>` links, at most 50 per
-issue. Each one is downloaded through the import's SSRF guard, which checks
-every redirect hop, and the upload checks its type and size. One that cannot
-be fetched is on the import's loss report. Ordinary links are not files.
-`models/lib/issueAttachments.js`; `tests/issueAttachments.test.cjs`.
-
-</details>
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">List sync can bring each issue's comments, labels, state and files</a>. Thanks to xet7.</summary>
-
-A new Sync option for GitHub, GitLab, Gitea and Forgejo, off by default.
-Comments come from one paged repository-wide list (GitHub and Gitea), or
-from each issue's notes (GitLab). They are keyed by the tracker's comment id,
-and an edit upstream updates them. A label sync added and the issue lost is
-taken off, and labels added in WeKan stay. Each file is downloaded once. It
-runs after a successful sync as a step of its own, so a failure is shown and
-retried and never undoes the title and description sync. Gitea issues are
-fetched with `type=issues`. A rate-limited answer is waited out once when it
-frees up within a minute; otherwise the run ends with the time to try again.
-`tests/listSyncIssueDetails.test.cjs`.
-
-</details>
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/935e68dfdd">A whole GitHub organization imports, each repository as its own board</a>. Thanks to xet7.</summary>
-
-Import → GitHub → **Import a whole GitHub organization**: every repository of
-an organization or user becomes a board named `owner/repository`, opening in
-Version Control. Issues go through the ordinary `importBoard`, run as the
-person who started the job, with their comments, labels and files. Releases
-are cards in a *Releases* list, with their files attached only when chosen.
-`.github/workflows` files become Rules. Each wiki is read from its git
-repository with isomorphic-git (1.42.4, pinned), with every request through
-the SSRF guard and only to github.com. A page is a card in the *Wiki* list:
-its `[[links]]` point at the linked pages' cards and are attached to them,
-and each commit that changed it is a dated edit in the card's history, so
-**Restore** brings back an older version. Version Control gains **Releases**
-and **Wiki** tabs, the wiki laid out as on GitHub. The job shows progress, can
-be cancelled, pauses on a restart and stops at a rate limit. The token is
-kept in memory only. Tests: `tests/githubOrgImport.test.cjs`,
-`tests/githubWiki.test.cjs` and `tests/workflowYaml.test.cjs`, the last
-checking 52 real workflow files against js-yaml.
-
-</details>
-
-**Rules** - what GitHub Actions workflows needed, for everyone.
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/935e68dfdd">GitHub Actions workflows become Rules; Rules gain comments, cron and descriptions</a>. Thanks to xet7.</summary>
-
-Issue events become triggers. Label, close, reopen, comment, assign and
-create steps become actions, from the well-known actions or from `gh issue`
-commands, and `actions/stale` becomes an aging rule. A build, test or script
-is never run: such a workflow is a disabled rule with its YAML as its
-description. For this, WeKan's Rules gain several parts, available to every
-board:
-
- a **commented on** trigger;
- an **add comment** action, written as the person whose change ran the rule
-  and only where they may comment;
- **cron schedules** in UTC (`models/lib/cronSchedule.js`);
- a rule **description**, shown on the rule.
-
-Tests: `tests/githubActionsRules.test.cjs`, `tests/cronSchedule.test.cjs` and
-`tests/ruleCommentCron.test.cjs`.
-
-</details>
-
-**Optional APIs** - other trackers' clients, with WeKan as their backend.
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/86ec72fade">Trello, Jira, GitHub and Gitea compatible APIs, off until an admin ticks them</a>. Thanks to xet7.</summary>
-
-Admin Panel → Settings → Visibility → **Optional APIs** turns on REST APIs
-in Trello's, Jira's, GitHub's and Gitea's shape (#4930), each described with
-the address a client uses. None has rights of its own: each translates a
-request into the matching request to WeKan's own REST API, made with the
-caller's WeKan token, so every WeKan permission applies unchanged. An API that
-is not ticked answers 404, and `WITH_API` turns them all off. Trello covers
-members, boards, lists, cards, labels, comments and checklists. In Jira a
-board is a project (the board key), a card is an issue (`DEV-7`), lists are
-statuses, and simple JQL works. In GitHub and Gitea a board is a repository and
-a card an issue, open or closed as in Version Control. Deleting archives. See
-[Optional APIs](docs/API/Optional-APIs.md). `tests/optionalApis.test.cjs`
-fails if any of them writes past WeKan's REST API.
-`server/lib/tests/compatApi.tests.js` runs them over real HTTP.
-
-</details>
-
-**Cards** - opening a card on a phone.
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">A QR code of the card's link in the card menu</a>. Thanks to xet7.</summary>
-
-Card menu → **QR code** shows the card's link as a QR code, to open the card
-on a phone or tablet. It is drawn in the browser by WeKan's own encoder
-(`models/lib/qrCode.js`: byte mode, level M, versions 1–10), so the link is
-sent to no QR service. `tests/qrCode.test.cjs` checks the encoder module for
-module against qrcode-svg, which Meteor's accounts-2fa ships, and checks that
-no outside QR service is used anywhere.
-
-</details>
-
-**Platforms** - where WeKan runs.
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/b8d9cb2565">Android bundles for Termux, for all four Android CPUs</a>. Thanks to xet7.</summary>
-
-Every release that has wekan/node-patches' Android Node.js also has
-`wekan-<version>-android-arm64.zip`, `-x64`, `-armv7` and `-x86`, with
-FerretDB. Each is the release's Linux bundle rebuilt inside Termux's own
-image with that Node.js, checked against its SHA256: every native addon is
-built for it, and sharp against Termux's libvips. Before it is published,
-each addon's architecture is checked, sharp must load, and the bundle must
-start and answer HTTP 200. A CPU whose Android Node.js is not published yet
-is skipped and builds by itself once it is. `tests/androidBundles.test.cjs`
-covers the build and the workflow. See [Android](docs/Platforms/FOSS/OS/Android.md).
-
-</details>
-
-and fixes the following bugs:
-
-**Board keys** - how old boards get theirs.
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/d0378f33c2">Old boards get their keys in one pass, in seconds rather than hours</a>. Thanks to Raymond-Voogt and xet7.</summary>
-
-v12.41 gave each board without a key one at startup by re-reading every key
-of the instance per board. It also counted up from 2 again for every board
-sharing a title. That is quadratic: on 32,500 boards it ran for hours of slow
-queries. Now the keys in use are read once, the new ones are planned in
-memory, linearly, and written in batches, each only where the board still has
-no key. A single new board reads only the keys that could collide with it,
-through a new index. Tests: `tests/boardKeyBackfill.test.cjs` (32,500 boards
-planned well under a second) and `server/lib/tests/boardKeys.tests.js`.
-
-</details>
-
-**Rules** - when a rule runs.
-
-<details>
-<summary><a href="https://github.com/wekan/wekan/commit/935e68dfdd">A disabled rule no longer runs on a schedule or from its button</a>. Thanks to xet7.</summary>
-
-Turning a rule off (#2322) stopped it only for card events: the scheduler and
-the rule's button ran it anyway, because neither looked at `enabled`. Both
-check it now. Imported GitHub Actions workflows rely on this, since a
-workflow that is code is imported disabled. Pinned by
-`tests/ruleCommentCron.test.cjs`.
-
-</details>
-
-Thanks to above GitHub users for their contributions and translators for their translations.
@@ -5,6 +5,17 @@ each one changed and the project status are in
 Written by `node releases/changelog-short.mjs` from CHANGELOG-big.md:
 make changes there.

+# v13.11 2026-11-13 WeKan ® release
+
+The **file-integrity scan** stops reporting attachments and
+avatars that WeKan deleted itself as missing, which had buried real
+**StorageBleed** findings under thousands of false ones. The recurring-checklist
+reset no longer scans every **checklist** on each tick. In the **REST API**, a
+refused custom-field update changes nothing, ownership transfer takes only the
+boards the user administers, and deleting a missing integration answers 404.
+
+[All changes in v13.11](CHANGELOG-big.md#v1311-2026-11-13-wekan--release)
+
 # v13.10 2026-11-13 WeKan ® release

 The release's **Snap Store** credential check bounds each
@@ -39,14 +50,3 @@ the **indexes** that LDAP, card member and History queries need are added, and
 Admin Panel → Problems can **Clear** resolved problems, which also age out.

 [All changes in v13.07](CHANGELOG-big.md#v1307-2026-11-12-wekan--release)
-
-# v13.06 2026-11-11 WeKan ® release
-
-**CodeQL** alert #601 in a test is fixed, with two more tests
-that had the same fault. A card's **overtime** set through the REST API is
-saved where WeKan reads it, and cards that lost it before are repaired at
-startup. Card **members and assignees** whose account was deleted can be removed
-and added without an error, and clearing a card **date** no longer passes as a
-date set to the rules, the due date count and the activity feed.
-
-[All changes in v13.06](CHANGELOG-big.md#v1306-2026-11-11-wekan--release)
@@ -38,7 +38,7 @@ FROM --platform=$BUILDPLATFORM debian:trixie AS bundle

 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=13.10
+ARG VERSION=13.11
 ARG DEBIAN_FRONTEND=noninteractive

 COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py
@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v13.10.0"
+appVersion: "v13.11.0"
 files:
  userUploads:
    - README.md
@@ -10,7 +10,7 @@ This is without container (without Docker or Snap).

 Right click and download files 1-4:

-1. [wekan-13.10-win64.zip](https://github.com/wekan/wekan/releases/download/v13.10/wekan-13.10-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
+1. [wekan-13.11-win64.zip](https://github.com/wekan/wekan/releases/download/v13.11/wekan-13.11-win64.zip) or newest available at https://github.com/wekan/wekan/releases/

 2. [node.exe](https://nodejs.org/dist/latest-v26.x/win-x64/node.exe)

@@ -22,7 +22,7 @@ Right click and download files 1-4:

 6. Double click `mongodb-windows-x86_64-7.0.34-signed.msi` . In installer, uncheck downloading MongoDB compass.

-7. Unzip `wekan-13.10-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-13.11-win64.zip` , inside it is directory `bundle`, to it copy other files:

 ```
 bundle (directory)
@@ -1,4 +1,5 @@
 import { requireBoardMutation } from '/models/lib/boardMutationGuard';
+import { forgetIntegrityBaselinesOfFiles } from '/server/lib/fileIntegrityForget';
 import { ReactiveCache } from '/imports/reactiveCache';
 import { Meteor } from 'meteor/meteor';
 import { MongoInternals } from 'meteor/mongo';
@@ -301,6 +302,10 @@ Attachments.interceptDownload = function (http, fileObj, versionName) {

 Attachments.onAfterRemove = function (filesInput) {
  const files = normalizeRemovedFiles(filesInput);
+  // #6898: Meteor-Files unlinks the version paths itself after this hook
+  // (it returns nothing, so the default unlink runs), so this is where a
+  // removed file's integrity baseline is forgotten.
+  forgetIntegrityBaselinesOfFiles(files);

  files.forEach(fileObj => {
    if (!fileObj || !fileObj.versions) {
@@ -1,4 +1,5 @@
 import { ReactiveCache } from '/imports/reactiveCache';
+import { forgetIntegrityBaselinesOfFiles } from '/server/lib/fileIntegrityForget';
 import { Meteor } from 'meteor/meteor';
 import { isFileValid } from './fileValidation';
 import { createBucket } from './lib/grid/createBucket';
@@ -296,6 +297,9 @@ Avatars.onAfterRemove = async function (filesInput) {
    files = [];
  }

+  // #6898: see Attachments.onAfterRemove - forget the removed files' baselines.
+  forgetIntegrityBaselinesOfFiles(files);
+
  files.forEach(fileObj => {
    if (!fileObj || !fileObj.versions) {
      return;
@@ -3097,7 +3097,7 @@ Boards.helpers({
    // never be a meaningful (active) admin and the deactivate-by-index flow
    // below would only leave it lingering, so hard-remove it by userId. This
    // works whether or not the user still exists since matching is by userId.
-    if (memberIndex < 0 || !ReactiveCache.getUser(memberId)) {
+    if (memberIndex < 0 || !(await ReactiveCache.getUser(memberId))) {
      return await Boards.updateAsync(this._id, {
        $set: { members: pullMemberById(this.members, memberId) },
      });
@@ -390,6 +390,11 @@ if (Meteor.isServer) {
  Meteor.startup(async () => {
    await ensureIndex(Checklists, { cardId: 1, sort: 1 });
    await ensureIndex(Checklists, { boardId: 1 });
+    // #6899: the recurring-checklist reset cron reads the checklists with a
+    // resetInterval on every tick. Without an index that was a full scan of
+    // every checklist; a partial index holds only the recurring ones.
+    await ensureIndex(Checklists, { resetInterval: 1 },
+      { partialFilterExpression: { resetInterval: { $exists: true } } });
  });
 }

@@ -0,0 +1,43 @@
+'use strict';
+
+// #6898: which fileIntegrity baseline ids belong to the files WeKan is about to
+// delete or move away. Decided without a database
+// (tests/integrityBaselineForgottenOnDelete.test.cjs).
+//
+// The daily scan (server/lib/fileIntegrityScan.js) keeps one baseline per file,
+// keyed by its path, and reports every baseline whose file is gone as a
+// StorageBleed. Nothing removed a baseline, so every attachment or avatar WeKan
+// deleted itself was reported missing on every run from then on. The deletion
+// paths now forget the baselines of the files they delete; a file that vanishes
+// any OTHER way keeps its baseline and still alarms, which is the point.
+
+const path = require('path');
+
+// The path as recorded (versions.<v>.path, or the path unlink() resolved) and
+// its absolute form: the scan records path.join(<storage root>, ...), and a
+// relative recorded path would otherwise never match it.
+function baselineIdsFor(paths) {
+  const ids = new Set();
+  for (const p of [].concat(paths || [])) {
+    if (typeof p !== 'string' || p === '') continue;
+    ids.add(p);
+    ids.add(path.resolve(p));
+  }
+  return [...ids];
+}
+
+// Every version path of the removed file documents.
+function versionPathsOf(fileObjs) {
+  const out = [];
+  for (const fileObj of [].concat(fileObjs || [])) {
+    const versions = fileObj && fileObj.versions;
+    if (!versions || typeof versions !== 'object') continue;
+    for (const name of Object.keys(versions)) {
+      const p = versions[name] && versions[name].path;
+      if (typeof p === 'string' && p) out.push(p);
+    }
+  }
+  return out;
+}
+
+module.exports = { baselineIdsFor, versionPathsOf };
@@ -42,6 +42,14 @@ const { hasEnoughDiskSpace } = require('./diskSpace');
 // exporter uses it too and where plain Node can test it.
 const { isPathInsideBase: isPathInside } = require('./storagePathContainment');

+// #6898: drop the integrity baselines of files this module deletes or moves.
+function forgetBaselines(paths) {
+  if (!Meteor.isServer) return;
+  try {
+    require('/server/lib/fileIntegrityForget').forgetIntegrityBaselinesSoon(paths);
+  } catch (e) { /* bookkeeping must never break a delete */ }
+}
+
 function tryRealPath(inputPath) {
  try {
    return fs.realpathSync(inputPath);
@@ -643,7 +651,12 @@ export class FileStoreStrategyFilesystem extends FileStoreStrategy {
    // candidatePaths(). A delete that misses leaves the bytes on disk forever.
    const filePath = this.resolveExistingPath()
      || this.version().path;
-    if (filePath) fs.unlink(filePath, () => {});
+    if (filePath) {
+      fs.unlink(filePath, () => {});
+      // #6898: a file WeKan deleted is accounted for; without this the daily
+      // integrity scan reported it as missing on every run from then on.
+      forgetBaselines([filePath, this.version().path]);
+    }
  }

  /** rename the file (physical)
@@ -666,6 +679,9 @@ export class FileStoreStrategyFilesystem extends FileStoreStrategy {
    }
    if (path.resolve(current) === path.resolve(newFilePath)) return;
    fs.renameSync(current, newFilePath);
+    // #6898: the old path is gone on purpose; the scan records the new one as
+    // a first sighting instead of reporting the old one missing forever.
+    forgetBaselines([current, this.version().path]);
  }

  /** return the storage name
@@ -14,7 +14,220 @@ Releases per day:
 | 11 | 6 |
 | 12 | 5 |
 | 13 | 1 |
-| 14 | 2 |
+| 14 | 3 |
+
+# v12.42 2026-10-14 WeKan ® release
+
+**In short:** a new **Version Control** board view shows a board as a
+**GitHub** or **Gitea** issue tracker, with releases, a **wiki** and history
+with undo, and a whole **GitHub organization** imports into it, its **GitHub
+Actions** as Rules. Optional **Trello**, **Jira**, **GitHub** and **Gitea**
+compatible APIs let their clients use WeKan as a backend. Old boards get their
+keys in one pass, list sync keeps issue details current, any board view can be
+a **read-only public view**, and WeKan has **Android** bundles.
+
+This release adds the following new features:
+
+**Board views** - a repository's issue tracker as a view, and which views the
+public sees.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">Version Control: the board as a GitHub or Gitea issue tracker</a>. Thanks to xet7.</summary>
+
+Board → View → **Version Control**, in the board's own theme. A card is an
+issue: open, or closed when archived, in a list named *Closed*, *Done*,
+*Resolved*, *Merged* or *Wontfix*, or closed upstream. The issue number is
+the upstream one of an imported issue, else the card number. The board's
+labels are labels, and labels with a due date and the importers'
+`milestone:` labels are milestones, with progress bars. Comments are the
+conversation, attachments the files. The search box takes GitHub's words:
+`is:open`, `label:`, `-label:`, `milestone:`, `author:`, `assignee:@me`,
+`no:label` and `sort:`. **New issue**, **Close** and **Reopen** write through
+the ordinary collections, so the **History** tab (the board's history table)
+shows them and **Restore** undoes them. A synced issue is closed in its
+tracker. **Import** opens the GitHub, GitLab, Gitea and Forgejo importers, and
+each synced list has a **Sync now** button. Visitors see it read-only. Tested
+by `tests/versionControlView.test.cjs`. See
+[Version Control view](docs/Features/Board/Version-Control-View.md).
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">A public board's public views are for the public; its members keep theirs</a>. Thanks to xet7.</summary>
+
+Board Settings → Board View's *Show on* and *Default on Public Board* now
+apply to the people looking who are not members: visitors who are not logged
+in, and logged-in users who are not on the board. The board's members get the
+*Private* columns. So a public board can open read-only in Version Control,
+Email, Chat or any other view for the world, and list only the views chosen
+for it, while its members keep every view. Before, a public board's members
+had the public menu too. `boardViewAudience` in
+`models/lib/boardViewSettings.js`; `tests/boardViewSettings.test.cjs` covers
+visitors, non-members, former members and members.
+
+</details>
+
+**Import and sync** - what an issue tracker's issues bring with them.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">GitHub, GitLab, Gitea and Forgejo issues bring their files</a>. Thanks to xet7.</summary>
+
+The files an issue or its comments link or carry become card attachments in
+Admin Panel → Attachments → Default Storage. These are GitHub
+`user-attachments` and `user-images` links, GitLab `/uploads/` links, and
+Gitea and Forgejo assets and `/attachments/<uuid>` links, at most 50 per
+issue. Each one is downloaded through the import's SSRF guard, which checks
+every redirect hop, and the upload checks its type and size. One that cannot
+be fetched is on the import's loss report. Ordinary links are not files.
+`models/lib/issueAttachments.js`; `tests/issueAttachments.test.cjs`.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">List sync can bring each issue's comments, labels, state and files</a>. Thanks to xet7.</summary>
+
+A new Sync option for GitHub, GitLab, Gitea and Forgejo, off by default.
+Comments come from one paged repository-wide list (GitHub and Gitea), or
+from each issue's notes (GitLab). They are keyed by the tracker's comment id,
+and an edit upstream updates them. A label sync added and the issue lost is
+taken off, and labels added in WeKan stay. Each file is downloaded once. It
+runs after a successful sync as a step of its own, so a failure is shown and
+retried and never undoes the title and description sync. Gitea issues are
+fetched with `type=issues`. A rate-limited answer is waited out once when it
+frees up within a minute; otherwise the run ends with the time to try again.
+`tests/listSyncIssueDetails.test.cjs`.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/935e68dfdd">A whole GitHub organization imports, each repository as its own board</a>. Thanks to xet7.</summary>
+
+Import → GitHub → **Import a whole GitHub organization**: every repository of
+an organization or user becomes a board named `owner/repository`, opening in
+Version Control. Issues go through the ordinary `importBoard`, run as the
+person who started the job, with their comments, labels and files. Releases
+are cards in a *Releases* list, with their files attached only when chosen.
+`.github/workflows` files become Rules. Each wiki is read from its git
+repository with isomorphic-git (1.42.4, pinned), with every request through
+the SSRF guard and only to github.com. A page is a card in the *Wiki* list:
+its `[[links]]` point at the linked pages' cards and are attached to them,
+and each commit that changed it is a dated edit in the card's history, so
+**Restore** brings back an older version. Version Control gains **Releases**
+and **Wiki** tabs, the wiki laid out as on GitHub. The job shows progress, can
+be cancelled, pauses on a restart and stops at a rate limit. The token is
+kept in memory only. Tests: `tests/githubOrgImport.test.cjs`,
+`tests/githubWiki.test.cjs` and `tests/workflowYaml.test.cjs`, the last
+checking 52 real workflow files against js-yaml.
+
+</details>
+
+**Rules** - what GitHub Actions workflows needed, for everyone.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/935e68dfdd">GitHub Actions workflows become Rules; Rules gain comments, cron and descriptions</a>. Thanks to xet7.</summary>
+
+Issue events become triggers. Label, close, reopen, comment, assign and
+create steps become actions, from the well-known actions or from `gh issue`
+commands, and `actions/stale` becomes an aging rule. A build, test or script
+is never run: such a workflow is a disabled rule with its YAML as its
+description. For this, WeKan's Rules gain several parts, available to every
+board:
+
+- a **commented on** trigger;
+- an **add comment** action, written as the person whose change ran the rule
+  and only where they may comment;
+- **cron schedules** in UTC (`models/lib/cronSchedule.js`);
+- a rule **description**, shown on the rule.
+
+Tests: `tests/githubActionsRules.test.cjs`, `tests/cronSchedule.test.cjs` and
+`tests/ruleCommentCron.test.cjs`.
+
+</details>
+
+**Optional APIs** - other trackers' clients, with WeKan as their backend.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/86ec72fade">Trello, Jira, GitHub and Gitea compatible APIs, off until an admin ticks them</a>. Thanks to xet7.</summary>
+
+Admin Panel → Settings → Visibility → **Optional APIs** turns on REST APIs
+in Trello's, Jira's, GitHub's and Gitea's shape (#4930), each described with
+the address a client uses. None has rights of its own: each translates a
+request into the matching request to WeKan's own REST API, made with the
+caller's WeKan token, so every WeKan permission applies unchanged. An API that
+is not ticked answers 404, and `WITH_API` turns them all off. Trello covers
+members, boards, lists, cards, labels, comments and checklists. In Jira a
+board is a project (the board key), a card is an issue (`DEV-7`), lists are
+statuses, and simple JQL works. In GitHub and Gitea a board is a repository and
+a card an issue, open or closed as in Version Control. Deleting archives. See
+[Optional APIs](docs/API/Optional-APIs.md). `tests/optionalApis.test.cjs`
+fails if any of them writes past WeKan's REST API.
+`server/lib/tests/compatApi.tests.js` runs them over real HTTP.
+
+</details>
+
+**Cards** - opening a card on a phone.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/326d9bbf61">A QR code of the card's link in the card menu</a>. Thanks to xet7.</summary>
+
+Card menu → **QR code** shows the card's link as a QR code, to open the card
+on a phone or tablet. It is drawn in the browser by WeKan's own encoder
+(`models/lib/qrCode.js`: byte mode, level M, versions 1–10), so the link is
+sent to no QR service. `tests/qrCode.test.cjs` checks the encoder module for
+module against qrcode-svg, which Meteor's accounts-2fa ships, and checks that
+no outside QR service is used anywhere.
+
+</details>
+
+**Platforms** - where WeKan runs.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/b8d9cb2565">Android bundles for Termux, for all four Android CPUs</a>. Thanks to xet7.</summary>
+
+Every release that has wekan/node-patches' Android Node.js also has
+`wekan-<version>-android-arm64.zip`, `-x64`, `-armv7` and `-x86`, with
+FerretDB. Each is the release's Linux bundle rebuilt inside Termux's own
+image with that Node.js, checked against its SHA256: every native addon is
+built for it, and sharp against Termux's libvips. Before it is published,
+each addon's architecture is checked, sharp must load, and the bundle must
+start and answer HTTP 200. A CPU whose Android Node.js is not published yet
+is skipped and builds by itself once it is. `tests/androidBundles.test.cjs`
+covers the build and the workflow. See [Android](docs/Platforms/FOSS/OS/Android.md).
+
+</details>
+
+and fixes the following bugs:
+
+**Board keys** - how old boards get theirs.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/d0378f33c2">Old boards get their keys in one pass, in seconds rather than hours</a>. Thanks to Raymond-Voogt and xet7.</summary>
+
+v12.41 gave each board without a key one at startup by re-reading every key
+of the instance per board. It also counted up from 2 again for every board
+sharing a title. That is quadratic: on 32,500 boards it ran for hours of slow
+queries. Now the keys in use are read once, the new ones are planned in
+memory, linearly, and written in batches, each only where the board still has
+no key. A single new board reads only the keys that could collide with it,
+through a new index. Tests: `tests/boardKeyBackfill.test.cjs` (32,500 boards
+planned well under a second) and `server/lib/tests/boardKeys.tests.js`.
+
+</details>
+
+**Rules** - when a rule runs.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/935e68dfdd">A disabled rule no longer runs on a schedule or from its button</a>. Thanks to xet7.</summary>
+
+Turning a rule off (#2322) stopped it only for card events: the scheduler and
+the rule's button ran it anyway, because neither looked at `enabled`. Both
+check it now. Imported GitHub Actions workflows rely on this, since a
+workflow that is code is imported disabled. Pinned by
+`tests/ruleCommentCron.test.cjs`.
+
+</details>
+
+Thanks to above GitHub users for their contributions and translators for their translations.

 # v12.41 2026-10-14 WeKan ® release

@@ -1,12 +1,12 @@
 {
  "name": "wekan",
-  "version": "v13.10.0",
+  "version": "v13.11.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "wekan",
-      "version": "v13.10.0",
+      "version": "v13.11.0",
      "hasInstallScript": true,
      "license": "MIT",
      "dependencies": {
@@ -1,6 +1,6 @@
 {
  "name": "wekan",
-  "version": "v13.10.0",
+  "version": "v13.11.0",
  "description": "Open-Source kanban",
  "private": true,
  "repository": {
@@ -3,7 +3,7 @@

 <head>
  <meta charset="utf8" />
-  <title>WeKan REST API v13.10</title>
+  <title>WeKan REST API v13.11</title>
  <!-- needed for adaptive design -->
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <style>
@@ -494,11 +494,11 @@ data-styled.g652[id="sc-LDhwn"]{content:"cirFq,"}/*!sc*/

 <body>
  
-      <div id="redoc"><div class="sc-jlWaFk kDulYG redoc light" style="--navbar-height:0px;--navbar-stack-height:0px"><div hidden=""><script>try{var r=document.querySelectorAll(".redoc");r=r[r.length-1];var h=document.documentElement,p=h.classList,a=[h.getAttribute("data-bs-theme"),h.getAttribute("data-theme")];var m=p.contains("dark")||a.indexOf("dark")>-1?"dark":p.contains("light")||a.indexOf("light")>-1?"light":localStorage.getItem("redoc.colorMode");if(m!=="light"&&m!=="dark")m=matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light";r.classList.remove("light","dark");r.classList.add(m)}catch(e){}</script></div><div class="sc-NPrTd fpSCXb menu-content"><div class="sc-bJapvR eXtYur"><div data-testid="search-trigger" class="sc-eavxOQ bStpwo"><div class="sc-dGYDtq hRGWCd"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" data-component-name="icons/SearchIcon/SearchIcon" class="sc-gJaedx dpfGSp"><path d="M14.5 13.7931L10.724 10.017C11.6313 8.9277 12.0838 7.5305 11.9872 6.11608C11.8907 4.70165 11.2525 3.37891 10.2055 2.423C9.15857 1.4671 7.78336 0.951637 6.36602 0.983845C4.94867 1.01605 3.5983 1.59345 2.59582 2.59593C1.59335 3.5984 1.01595 4.94877 0.983738 6.36612C0.95153 7.78347 1.46699 9.15867 2.4229 10.2057C3.3788 11.2526 4.70155 11.8908 6.11597 11.9873C7.53039 12.0839 8.92759 11.6314 10.0169 10.7241L13.793 14.5001L14.5 13.7931ZM2.00001 6.50012C2.00001 5.6101 2.26393 4.74007 2.7584 4.00005C3.25286 3.26003 3.95567 2.68325 4.77794 2.34266C5.6002 2.00207 6.505 1.91295 7.37792 2.08658C8.25083 2.26022 9.05266 2.6888 9.68199 3.31814C10.3113 3.94747 10.7399 4.7493 10.9135 5.62221C11.0872 6.49513 10.9981 7.39993 10.6575 8.22219C10.3169 9.04446 9.7401 9.74726 9.00008 10.2417C8.26006 10.7362 7.39003 11.0001 6.50001 11.0001C5.30694 10.9988 4.16312 10.5243 3.31949 9.68064C2.47587 8.83701 2.00133 7.69319 2.00001 6.50012Z"></path></svg><span>Loading...</span></div></div></div><div class="sc-kLsiYl kAUzfx"><ul data-component-name="Menu/Menu" class="sc-jfJzNu hoWuXt"><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-default" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="true" class="sc-cToEys eWEtkC"><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="WeKan REST API" class="sc-hgJgCR dWgUkd">WeKan REST API</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-default" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/section/production-security-concerns" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys iVTRMP"><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="Production Security Concerns" class="sc-hgJgCR dlVNdD">Production Security Concerns</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/login" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-kLEbxe eRqACJ"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="Login" class="sc-hgJgCR dlVNdD">Login</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-fKDFlh joxUYR"></div></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/attachmentstoragesettings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-kLEbxe eRqACJ"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="AttachmentStorageSettings" class="sc-hgJgCR dlVNdD">AttachmentStorageSettings</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-fKDFlh joxUYR"></div></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/settings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-defLine truncated
+      <div id="redoc"><div class="sc-jlWaFk kDulYG redoc light" style="--navbar-height:0px;--navbar-stack-height:0px"><div hidden=""><script>try{var r=document.querySelectorAll(".redoc");r=r[r.length-1];var h=document.documentElement,p=h.classList,a=[h.getAttribute("data-bs-theme"),h.getAttribute("data-theme")];var m=p.contains("dark")||a.indexOf("dark")>-1?"dark":p.contains("light")||a.indexOf("light")>-1?"light":localStorage.getItem("redoc.colorMode");if(m!=="light"&&m!=="dark")m=matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light";r.classList.remove("light","dark");r.classList.add(m)}catch(e){}</script></div><div class="sc-NPrTd fpSCXb menu-content"><div class="sc-bJapvR eXtYur"><div data-testid="search-trigger" class="sc-eavxOQ bStpwo"><div class="sc-dGYDtq hRGWCd"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" data-component-name="icons/SearchIcon/SearchIcon" class="sc-gJaedx dpfGSp"><path d="M14.5 13.7931L10.724 10.017C11.6313 8.9277 12.0838 7.5305 11.9872 6.11608C11.8907 4.70165 11.2525 3.37891 10.2055 2.423C9.15857 1.4671 7.78336 0.951637 6.36602 0.983845C4.94867 1.01605 3.5983 1.59345 2.59582 2.59593C1.59335 3.5984 1.01595 4.94877 0.983738 6.36612C0.95153 7.78347 1.46699 9.15867 2.4229 10.2057C3.3788 11.2526 4.70155 11.8908 6.11597 11.9873C7.53039 12.0839 8.92759 11.6314 10.0169 10.7241L13.793 14.5001L14.5 13.7931ZM2.00001 6.50012C2.00001 5.6101 2.26393 4.74007 2.7584 4.00005C3.25286 3.26003 3.95567 2.68325 4.77794 2.34266C5.6002 2.00207 6.505 1.91295 7.37792 2.08658C8.25083 2.26022 9.05266 2.6888 9.68199 3.31814C10.3113 3.94747 10.7399 4.7493 10.9135 5.62221C11.0872 6.49513 10.9981 7.39993 10.6575 8.22219C10.3169 9.04446 9.7401 9.74726 9.00008 10.2417C8.26006 10.7362 7.39003 11.0001 6.50001 11.0001C5.30694 10.9988 4.16312 10.5243 3.31949 9.68064C2.47587 8.83701 2.00133 7.69319 2.00001 6.50012Z"></path></svg><span>Loading...</span></div></div></div><div class="sc-kLsiYl kAUzfx"><ul data-component-name="Menu/Menu" class="sc-jfJzNu hoWuXt"><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-default" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="true" class="sc-cToEys eWEtkC"><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="WeKan REST API" class="sc-hgJgCR dWgUkd">WeKan REST API</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-default" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/section/production-security-concerns" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys iVTRMP"><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="Production Security Concerns" class="sc-hgJgCR dlVNdD">Production Security Concerns</span></span></div></li></a></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/login" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-kLEbxe eRqACJ"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="Login" class="sc-hgJgCR dlVNdD">Login</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-fKDFlh joxUYR"></div></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/attachmentstoragesettings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-default" data-component-name="icons/ChevronRightIcon/ChevronRightIcon" class="sc-kLEbxe eRqACJ"><path d="M11 8L6.00002 13L5.30002 12.3L9.60002 8L5.30002 3.7L6.00002 3L11 8Z"></path></svg></div><div class="sc-fIruOr dBwuTA"><span class="sc-gwVKcS efjekG"><span data-text="AttachmentStorageSettings" class="sc-hgJgCR dlVNdD">AttachmentStorageSettings</span></span></div></li></a><div style="display:none;height:0px;overflow:hidden" class="sc-fKDFlh joxUYR"></div></div><div data-component-name="Menu/MenuItem" class="sc-jEekwy kJsUv menu-item-type-group" role="listitem"><a class="sc-gzhUzI kKmXTr" href="/settings" data-discover="true"><li role="none" data-testid="menu-item-label" data-active="false" class="sc-cToEys jYycQW"><div class="sc-dGPMcj PCvEP"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" color="--tree-content-color-defLine truncated
      <script type="module">
      import { hydrate } from "https://cdn.redocly.com/redoc/v3.1.0/bundles/redoc.standalone.js";

-      const __redoc_definition = {"openapi":"3.2.0","info":{"title":"WeKan REST API","version":"v13.10","description":"The REST API allows you to control and extend WeKan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production WeKan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}},"/api/admin/attachment-settings":{"get":{"operationId":"get_attachment_settings","summary":"Get the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. Returns the Admin Panel >\n Attachments settings document, including `limitSettings.attachmentsUploadBlocked`\n and `limitSettings.avatarsUploadBlocked` plus the size limits. Cloud-storage\n secret keys (S3 secretAccessKey, Azure accountKey/connectionString, GCS\n credentials) are masked and never returned; a boolean `\u003cfield>Set` marker\n shows whether a value exists.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}},"put":{"operationId":"update_attachment_settings","summary":"Update the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. The request body is a\n partial settings object (for example\n `{\"limitSettings\": {\"avatarsUploadBlocked\": true}}`). It is applied through\n the same update path as the `updateAttachmentStorageSettings` Meteor method,\n so validation and `$set` semantics are identical: cloud-storage secrets left\n blank are preserved. The masked, updated settings document is returned.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}}},"/api/admin/domains":{"get":{"operationId":"get_admin_domains","summary":"List email domains with their user counts (GlobalAdmin)","description":"Only the global admin can call this. CountsLine truncated
+      const __redoc_definition = {"openapi":"3.2.0","info":{"title":"WeKan REST API","version":"v13.11","description":"The REST API allows you to control and extend WeKan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production WeKan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}},"/api/admin/attachment-settings":{"get":{"operationId":"get_attachment_settings","summary":"Get the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. Returns the Admin Panel >\n Attachments settings document, including `limitSettings.attachmentsUploadBlocked`\n and `limitSettings.avatarsUploadBlocked` plus the size limits. Cloud-storage\n secret keys (S3 secretAccessKey, Azure accountKey/connectionString, GCS\n credentials) are masked and never returned; a boolean `\u003cfield>Set` marker\n shows whether a value exists.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}},"put":{"operationId":"update_attachment_settings","summary":"Update the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. The request body is a\n partial settings object (for example\n `{\"limitSettings\": {\"avatarsUploadBlocked\": true}}`). It is applied through\n the same update path as the `updateAttachmentStorageSettings` Meteor method,\n so validation and `$set` semantics are identical: cloud-storage secrets left\n blank are preserved. The masked, updated settings document is returned.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}}},"/api/admin/domains":{"get":{"operationId":"get_admin_domains","summary":"List email domains with their user counts (GlobalAdmin)","description":"Only the global admin can call this. CountsLine truncated
      const __redoc_options = {"skipBundle":true,"disableTelemetry":false};

      hydrate(__redoc_definition, __redoc_options, document.getElementById('redoc'));
@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
  title: WeKan REST API
-  version: v13.10
+  version: v13.11
  description: |
    The REST API allows you to control and extend WeKan with ease.

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
    appTitle = (defaultText = "Wekan"),
    # The name of the app as it is displayed to the user.

-    appVersion = 1310,
+    appVersion = 1311,
    # Increment this for every release.

-    appMarketingVersion = (defaultText = "13.10~2026-11-13"),
+    appMarketingVersion = (defaultText = "13.11~2026-11-13"),
    # Human-readable presentation of the app version.

    minUpgradableAppVersion = 0,
@@ -0,0 +1,20 @@
+// #6898: forget the file-integrity baselines of files WeKan itself deletes or
+// moves, so the daily scan does not report them as missing forever. See
+// models/lib/fileIntegrityBaselineIds.cjs.
+const { baselineIdsFor, versionPathsOf } = require('/models/lib/fileIntegrityBaselineIds.cjs');
+
+export async function forgetIntegrityBaselines(paths) {
+  const ids = baselineIdsFor(paths);
+  if (ids.length === 0) return 0;
+  const FileIntegrity = require('/models/fileIntegrity').default;
+  return FileIntegrity.removeAsync({ _id: { $in: ids } });
+}
+
+// Fire-and-forget: a delete must never fail because its bookkeeping did.
+export function forgetIntegrityBaselinesSoon(paths) {
+  forgetIntegrityBaselines(paths).catch(() => { /* bookkeeping only */ });
+}
+
+export function forgetIntegrityBaselinesOfFiles(fileObjs) {
+  forgetIntegrityBaselinesSoon(versionPathsOf(fileObjs));
+}
@@ -183,29 +183,19 @@ WebApp.handlers.put('/api/boards/:boardId/custom-fields/:customFieldId', async f
    boardIds: { $in: [paramBoardId] },
  };

-  if (Object.prototype.hasOwnProperty.call(req.body, 'name')) {
-    await CustomFields.direct.updateAsync(boardScopedField, { $set: { name: req.body.name } });
+  // Validate and save the requested fields together so a rejected value cannot
+  // leave earlier fields persisted from the same request.
+  const set = {};
+  for (const field of [
+    'name', 'type', 'settings', 'showOnCard', 'automaticallyOnCard',
+    'alwaysOnCard', 'showLabelOnMiniCard', 'showSumAtTopOfList',
+  ]) {
+    if (Object.prototype.hasOwnProperty.call(req.body, field)) {
+      set[field] = req.body[field];
+    }
  }
-  if (Object.prototype.hasOwnProperty.call(req.body, 'type')) {
-    await CustomFields.direct.updateAsync(boardScopedField, { $set: { type: req.body.type } });
-  }
-  if (Object.prototype.hasOwnProperty.call(req.body, 'settings')) {
-    await CustomFields.direct.updateAsync(boardScopedField, { $set: { settings: req.body.settings } });
-  }
-  if (Object.prototype.hasOwnProperty.call(req.body, 'showOnCard')) {
-    await CustomFields.direct.updateAsync(boardScopedField, { $set: { showOnCard: req.body.showOnCard } });
-  }
-  if (Object.prototype.hasOwnProperty.call(req.body, 'automaticallyOnCard')) {
-    await CustomFields.direct.updateAsync(boardScopedField, { $set: { automaticallyOnCard: req.body.automaticallyOnCard } });
-  }
-  if (Object.prototype.hasOwnProperty.call(req.body, 'alwaysOnCard')) {
-    await CustomFields.direct.updateAsync(boardScopedField, { $set: { alwaysOnCard: req.body.alwaysOnCard } });
-  }
-  if (Object.prototype.hasOwnProperty.call(req.body, 'showLabelOnMiniCard')) {
-    await CustomFields.direct.updateAsync(boardScopedField, { $set: { showLabelOnMiniCard: req.body.showLabelOnMiniCard } });
-  }
-  if (Object.prototype.hasOwnProperty.call(req.body, 'showSumAtTopOfList')) {
-    await CustomFields.direct.updateAsync(boardScopedField, { $set: { showSumAtTopOfList: req.body.showSumAtTopOfList } });
+  if (Object.keys(set).length > 0) {
+    await CustomFields.direct.updateAsync(boardScopedField, { $set: set });
  }

  sendJsonResult(res, {
@@ -277,6 +277,7 @@ WebApp.handlers.delete('/api/boards/:boardId/integrations/:intId', async functio
    const paramBoardId = req.params.boardId;
    const paramIntId = req.params.intId;
    await Authentication.checkBoardAdmin(req.userId, paramBoardId);
+    if (!(await integrationOr404(res, paramBoardId, paramIntId))) return;

    await Integrations.direct.removeAsync({ _id: paramIntId, boardId: paramBoardId });
    sendJsonResult(res, {
@@ -2725,7 +2725,9 @@ WebApp.handlers.put('/api/users/:userId', async function(req, res) {
    }
    if (action === 'takeOwnership') {
      const boards = await ReactiveCache.getBoards(
-        { 'members.userId': id, 'members.isAdmin': true },
+        // Both conditions must describe the same member; another member's
+        // admin role does not make this user's ordinary membership ownership.
+        { members: { $elemMatch: { userId: id, isAdmin: true } } },
        { sort: { sort: 1 } },
      );
      data = [];
@@ -2733,7 +2735,7 @@ WebApp.handlers.put('/api/users/:userId', async function(req, res) {
        if (board.hasMember(req.userId)) {
          await board.removeMember(req.userId);
        }
-        board.changeOwnership(id, req.userId);
+        await board.changeOwnership(id, req.userId);
        data.push({ _id: board._id, title: board.title });
      }
    } else {
@@ -19,7 +19,7 @@
 #   base: core24 (not core26) · no build-base: devel · grade: stable
 # ─────────────────────────────────────────────────────────────────────────────
 name: wekan
-version: '13.10'
+version: '13.11'
 base: core24
 confinement: strict
 grade: stable
@@ -703,18 +703,18 @@ parts:
                armhf)   WEKAN_ARCH="armhf"   ;;
                *) echo "Unsupported architecture: ${CRAFT_ARCH_BUILD_FOR}"; exit 1 ;;
            esac
-            WEKAN_ZIP="wekan-13.10-${WEKAN_ARCH}.zip"
+            WEKAN_ZIP="wekan-13.11-${WEKAN_ARCH}.zip"
            echo "Cleaning environment first"
            rm -rf .build
            mkdir .build
            cd .build
-            #wget https://github.com/wekan/wekan/releases/download/v13.10/wekan-13.10-amd64.zip
+            #wget https://github.com/wekan/wekan/releases/download/v13.11/wekan-13.11-amd64.zip
            # Retry: a release asset can 404 for a short while right after it is
            # uploaded (CDN/propagation lag), and a plain wget treated that as
            # fatal. --retry-on-http-error covers the 404/5xx window; a genuinely
            # missing bundle still fails after the tries are spent.
            wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 \
-              "https://github.com/wekan/wekan/releases/download/v13.10/${WEKAN_ZIP}"
+              "https://github.com/wekan/wekan/releases/download/v13.11/${WEKAN_ZIP}"
            unzip "${WEKAN_ZIP}"
            python3 ../releases/check-telemetry.py --bundle bundle
            rm "${WEKAN_ZIP}"
@@ -0,0 +1,43 @@
+'use strict';
+
+// #6899: the recurring-checklist reset cron reads the checklists with a
+// resetInterval on every tick; with no index that was a full scan of every
+// checklist (about 45,000 on the reporting instance), reported on Admin Panel
+// -> Problems as db.collection-scan. A partial index holds only the recurring
+// checklists, as #6825 did for recurring cards.
+// Run: node tests/checklistResetIndex.test.cjs
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const read = rel => fs.readFileSync(path.join(__dirname, '..', rel), 'utf8');
+let passed = 0;
+const test = (name, fn) => { fn(); passed += 1; console.log('  ok -', name); };
+
+test('checklists have a partial index on resetInterval, ensured at startup', () => {
+  const src = read('models/checklists.js');
+  const startup = src.slice(src.indexOf('Meteor.startup(async () => {'));
+  assert.match(startup,
+    /await ensureIndex\(Checklists, \{ resetInterval: 1 \},\s+\{ partialFilterExpression: \{ resetInterval: \{ \$exists: true \} \} \}\);/);
+});
+
+test('the cron selector asks $exists: true, which lets MongoDB use the partial index', () => {
+  // negative: a selector without $exists: true could not use a partial index
+  // and would go back to scanning every checklist
+  assert.match(read('server/checklistResetSchedule.js'),
+    /resetInterval: \{ \$exists: true, \$nin: \[null, 'none'\] \}/);
+});
+
+test('every server-side resetInterval query carries $exists: true', () => {
+  const root = path.join(__dirname, '..');
+  const walk = d => fs.readdirSync(d, { withFileTypes: true }).flatMap(e =>
+    e.isDirectory() ? walk(path.join(d, e.name)) : e.name.endsWith('.js') ? [path.join(d, e.name)] : []);
+  for (const file of [...walk(path.join(root, 'server')), ...walk(path.join(root, 'models'))]) {
+    for (const m of fs.readFileSync(file, 'utf8').matchAll(/resetInterval: \{ \$nin[^}]*\}/g)) {
+      assert.fail(`${path.relative(root, file)}: ${m[0]} cannot use the partial index`);
+    }
+  }
+});
+
+console.log(`\n${passed} tests passed`);
@@ -88,7 +88,10 @@ test('CustomFieldBleed: every REST custom-field write is scoped to the URL board
  // The PUT route still applies its fields through the scoped selector.
  const put = sections.find(s => s.startsWith("WebApp.handlers.put('/api/boards/:boardId/custom-fields/:customFieldId'"));
  assert.ok(put, 'the custom-field PUT route exists');
-  assert.ok(customFieldWrites(put).length >= 8, 'PUT updates each supported field');
+  // PUT now saves the supported fields together so validation cannot leave a
+  // partial update. Field coverage lives in restCustomFieldUpdate.test.cjs;
+  // this guard still checks the selector of every write.
+  assert.equal(customFieldWrites(put).length, 1, 'PUT saves its fields in one update');
  assert.ok(customFieldWrites(put).every(w => w.selector === 'boardScopedField'));
 });

@@ -0,0 +1,117 @@
+'use strict';
+
+// #6898: the daily file-integrity scan reported every file WeKan itself had
+// deleted as a StorageBleed "missing" on every run, because nothing ever removed
+// its baseline. On an instance that purges attachments daily one finding was
+// folded 1,164 times, burying any real tamper finding.
+//
+// Every place WeKan deletes or moves a stored local file now forgets that
+// file's baseline. A file that disappears any other way keeps its baseline, so
+// the scan still reports it.
+// Run: node --test tests/integrityBaselineForgottenOnDelete.test.cjs
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const { test } = require('node:test');
+const { baselineIdsFor, versionPathsOf } = require('../models/lib/fileIntegrityBaselineIds.cjs');
+
+const root = path.join(__dirname, '..');
+const read = rel => fs.readFileSync(path.join(root, rel), 'utf8');
+
+function body(source, signature) {
+  const start = source.indexOf(signature);
+  assert.ok(start >= 0, `${signature} not found`);
+  let depth = 0;
+  for (let i = source.indexOf('{', start); i < source.length; i++) {
+    if (source[i] === '{') depth++;
+    else if (source[i] === '}' && --depth === 0) return source.slice(start, i + 1);
+  }
+  throw new Error('unbalanced braces');
+}
+
+test('baseline ids are the recorded path and its absolute form', () => {
+  assert.deepEqual(baselineIdsFor('/data/attachments/a.png'), ['/data/attachments/a.png']);
+  assert.deepEqual(baselineIdsFor('rel/a.png'), ['rel/a.png', path.resolve('rel/a.png')]);
+  assert.deepEqual(baselineIdsFor(['/x', '/x']), ['/x']);
+});
+
+test('no paths, empty paths and non-strings forget nothing', () => {
+  assert.deepEqual(baselineIdsFor(undefined), []);
+  assert.deepEqual(baselineIdsFor(['', null, 5, {}]), []);
+});
+
+test('every version path of every removed file is collected', () => {
+  assert.deepEqual(versionPathsOf([
+    { versions: { original: { path: '/a/1' }, thumb: { path: '/a/2' } } },
+    { versions: { original: {} } },
+    null,
+    { versions: null },
+  ]), ['/a/1', '/a/2']);
+});
+
+test('forgetIntegrityBaselines removes exactly those ids, and nothing when there are none', async () => {
+  const src = read('server/lib/fileIntegrityForget.js')
+    .replace(/^export /gm, '')
+    .concat('\n;({ forgetIntegrityBaselines, forgetIntegrityBaselinesSoon });');
+  const removed = [];
+  const FileIntegrity = { async removeAsync(selector) { removed.push(selector); return 1; } };
+  const api = vm.runInNewContext(src, {
+    require: id => (id.endsWith('fileIntegrityBaselineIds.cjs')
+      ? require('../models/lib/fileIntegrityBaselineIds.cjs')
+      : { default: FileIntegrity }),
+  });
+  assert.equal(await api.forgetIntegrityBaselines([]), 0);
+  assert.deepEqual(removed, []);
+  await api.forgetIntegrityBaselines(['/data/attachments/a.png']);
+  assert.deepEqual(JSON.parse(JSON.stringify(removed)), [{ _id: { $in: ['/data/attachments/a.png'] } }]);
+
+  // A failing removal never surfaces as an error to the delete that caused it.
+  FileIntegrity.removeAsync = async () => { throw new Error('db down'); };
+  assert.doesNotThrow(() => api.forgetIntegrityBaselinesSoon(['/x']));
+  await new Promise(r => setImmediate(r));
+});
+
+test('the filesystem strategy forgets the baseline when it deletes or renames a file', () => {
+  const src = read('models/lib/fileStoreStrategy.js');
+  const cls = body(src, 'export class FileStoreStrategyFilesystem');
+  assert.match(body(cls, 'unlink() {'), /fs\.unlink\(filePath[\s\S]*forgetBaselines\(\[filePath/);
+  assert.match(body(cls, 'rename(newFilePath) {'), /fs\.renameSync\(current, newFilePath\);\s+[\s\S]*forgetBaselines\(\[current/);
+  const helper = body(src, 'function forgetBaselines(paths)');
+  assert.match(helper, /if \(!Meteor\.isServer\) return;/);
+  assert.match(helper, /try \{[\s\S]*\} catch \(e\)/, 'bookkeeping must never break a delete');
+});
+
+test('every delete or rename in the filesystem strategy forgets the baseline (negative)', () => {
+  const cls = body(read('models/lib/fileStoreStrategy.js'), 'export class FileStoreStrategyFilesystem')
+    .replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/.*$/gm, '');
+  const deletes = cls.match(/fs\.(unlink|unlinkSync|rm|rmSync|renameSync|promises\.unlink|promises\.rename)\(/g) || [];
+  const forgets = cls.match(/forgetBaselines\(/g) || [];
+  assert.ok(deletes.length > 0);
+  assert.equal(forgets.length, deletes.length, 'a delete or rename without forgetBaselines() leaves a stale baseline');
+});
+
+test('attachment and avatar removal forget the removed files and keep the default unlink', () => {
+  for (const [file, sig] of [
+    ['models/attachments.server.js', 'Attachments.onAfterRemove = function'],
+    ['models/avatars.server.js', 'Avatars.onAfterRemove = async function'],
+  ]) {
+    const src = read(file);
+    assert.match(src, /import \{ forgetIntegrityBaselinesOfFiles \} from '\/server\/lib\/fileIntegrityForget';/, file);
+    const hook = body(src, sig);
+    assert.match(hook, /forgetIntegrityBaselinesOfFiles\(files\);/, file);
+    // Meteor-Files skips its own unlink of the version paths when this hook
+    // returns true; the files would then never be deleted at all.
+    assert.doesNotMatch(hook, /return true/, file);
+  }
+});
+
+test('the scan and the baseline model still never remove a baseline themselves', () => {
+  // A file that vanishes without going through WeKan - rm, disk corruption,
+  // tampering - must keep its baseline and still be reported missing.
+  for (const file of ['server/lib/fileIntegrityScan.js', 'models/fileIntegrity.js']) {
+    assert.doesNotMatch(read(file), /FileIntegrity\.(remove|removeAsync|deleteMany|deleteOne)\(/, file);
+  }
+  assert.match(read('server/lib/fileIntegrityScan.js'), /expected file is missing/);
+});
@@ -0,0 +1,54 @@
+'use strict';
+
+// #6898: a file WeKan deletes itself must not be reported by the daily
+// file-integrity scan as "missing" forever. Deleting an uploaded avatar from
+// the avatar popup goes through Avatars.onAfterRemove, which now forgets that
+// file's baseline - and only that file's: an unrelated baseline stays, so a
+// file that vanishes some other way is still reported.
+
+const { test, expect } = require('../fixtures');
+const db = require('../helpers/db');
+const { loginWithToken } = require('../helpers/auth');
+
+const BASE_URL = process.env.WEKAN_BASE_URL || 'http://localhost:3000';
+// 1x1 transparent PNG.
+const PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==',
+  'base64',
+);
+
+test('deleting an avatar forgets its integrity baseline and no other', async ({ page, user }) => {
+  const unrelated = `/e2e-not-a-real-file-${db.uid('baseline')}`;
+  db.insertOne('fileIntegrity', { _id: unrelated, path: unrelated, size: 1, at: new Date() });
+  try {
+    await loginWithToken(page, user.id, user.token);
+    await page.goto(BASE_URL, { waitUntil: 'domcontentloaded' });
+    await page.locator('.js-open-header-member-menu').click();
+    await page.locator('.js-pop-over .js-change-avatar').click();
+    await page.locator('.js-pop-over .js-upload-avatar-input')
+      .setInputFiles({ name: 'avatar.png', mimeType: 'image/png', buffer: PNG });
+
+    await expect.poll(() => db.find('avatars', { userId: user.id }).length, { timeout: 30_000 }).toBe(1);
+    const avatar = db.find('avatars', { userId: user.id })[0];
+    const filePath = avatar.versions?.original?.path;
+    test.skip(!filePath, 'avatar storage keeps no local path in this configuration');
+
+    // What the scan would have recorded on its first sight of the file.
+    db.deleteOne('fileIntegrity', { _id: filePath });
+    db.insertOne('fileIntegrity', { _id: filePath, path: filePath, size: PNG.length, at: new Date() });
+
+    const item = page.locator('.js-pop-over .avatar-list-item').filter({ has: page.locator('.js-delete-avatar') });
+    await expect(item).toHaveCount(1);
+    await item.locator('.js-delete-avatar').click();
+    await page.locator('.js-pop-over button.js-confirm').click();
+
+    await expect.poll(() => db.countDocuments('avatars', { userId: user.id }), { timeout: 15_000 }).toBe(0);
+    await expect.poll(() => db.countDocuments('fileIntegrity', { _id: filePath }), { timeout: 15_000 }).toBe(0);
+    // negative: a baseline for a file WeKan did not delete is kept, so the scan
+    // still reports a file that disappears out of band.
+    expect(db.countDocuments('fileIntegrity', { _id: unrelated })).toBe(1);
+  } finally {
+    db.deleteOne('fileIntegrity', { _id: unrelated });
+    db.deleteMany('avatars', { userId: user.id });
+  }
+});
@@ -0,0 +1,87 @@
+'use strict';
+
+const { test, expect } = require('../fixtures');
+const db = require('../helpers/db');
+
+const headers = token => ({ Authorization: `Bearer ${token}` });
+
+async function createField(request, user, board) {
+  const base = `/api/boards/${board.boardId}/custom-fields`;
+  const response = await request.post(base, {
+    headers: headers(user.token),
+    data: { name: 'Original field', type: 'text', settings: {}, showOnCard: true, showLabelOnMiniCard: true },
+  });
+  expect(response.status()).toBe(200);
+  const { _id } = await response.json();
+  return { id: _id, url: `${base}/${_id}` };
+}
+
+for (const invalid of [{ settings: 'invalid' }, { type: 'invalid' }]) {
+  test(`rejected custom-field ${Object.keys(invalid)[0]} leaves the entire definition unchanged`, async ({ request, user, board }) => {
+    const field = await createField(request, user, board);
+    const before = db.findOne('customFields', { _id: field.id });
+    const response = await request.put(field.url, {
+      headers: headers(user.token), data: { name: 'Changed field', ...invalid, showOnCard: false },
+    });
+    expect(response.status()).toBe(500);
+    expect(db.findOne('customFields', { _id: field.id })).toEqual(before);
+    const read = await request.get(field.url, { headers: headers(user.token) });
+    expect(read.status()).toBe(200);
+    expect(await read.json()).toMatchObject({ name: before.name, type: before.type, settings: before.settings, showOnCard: before.showOnCard });
+  });
+}
+
+test('custom-field updates persist together and the board displays the accepted name', async ({ boardPage: page, request, user, board }) => {
+  const field = await createField(request, user, board);
+  const card = db.findOne('cards', { boardId: board.boardId, title: 'Alpha Card' });
+  db.updateOne('boards', { _id: board.boardId }, { $set: { allowsCustomFieldsOnMinicard: true } });
+  db.updateOne('cards', { _id: card._id }, { $set: { customFields: [{ _id: field.id, value: 'Visible value' }] } });
+  const minicard = page.locator('.minicard-wrapper').filter({ hasText: 'Alpha Card' });
+  await expect(minicard).toContainText('Original field');
+  const body = {
+    name: 'Updated field', type: 'text', settings: {}, showOnCard: true,
+    automaticallyOnCard: false, alwaysOnCard: false, showLabelOnMiniCard: true, showSumAtTopOfList: false,
+  };
+  const response = await request.put(field.url, { headers: headers(user.token), data: body });
+  expect(response.status()).toBe(200);
+  expect(await response.json()).toEqual({ _id: field.id });
+  expect(db.findOne('customFields', { _id: field.id })).toMatchObject(body);
+  await expect(minicard).toContainText('Updated field');
+  await expect(minicard).not.toContainText('Original field');
+  await expect(minicard).toContainText('Visible value');
+
+  const rejected = await request.put(field.url, {
+    headers: headers(user.token), data: { name: 'Rejected field', settings: 'invalid' },
+  });
+  expect(rejected.status()).toBe(500);
+  expect(db.findOne('customFields', { _id: field.id })).toMatchObject(body);
+  await page.reload();
+  await expect(minicard).toContainText('Updated field');
+  await expect(minicard).not.toContainText('Rejected field');
+});
+
+test('custom-field updates preserve authorization, board scope, false values and omitted fields', async ({ request, user, user2, board }) => {
+  const field = await createField(request, user, board);
+  const before = db.findOne('customFields', { _id: field.id });
+  for (const options of [{}, { headers: headers(user2.token) }]) {
+    const response = await request.put(field.url, { ...options, data: { name: 'Forbidden field' } });
+    expect([401, 403]).toContain(response.status());
+    expect(db.findOne('customFields', { _id: field.id })).toEqual(before);
+  }
+  const other = db.seedBoard({ ownerId: user.id });
+  try {
+    const response = await request.put(`/api/boards/${other.boardId}/custom-fields/${field.id}`, {
+      headers: headers(user.token), data: { name: 'Wrong board' },
+    });
+    expect(response.status()).toBe(200);
+    expect(db.findOne('customFields', { _id: field.id })).toEqual(before);
+  } finally { db.cleanup({ boardIds: [other.boardId] }); }
+
+  for (const body of [{}, { boardIds: ['other'], adminOnly: true }, { type: 'number', settings: {}, showOnCard: false, showLabelOnMiniCard: false }]) {
+    const response = await request.put(field.url, { headers: headers(user.token), data: body });
+    expect(response.status()).toBe(200);
+    expect(await response.json()).toEqual({ _id: field.id });
+  }
+  const after = db.findOne('customFields', { _id: field.id });
+  expect(after).toEqual({ ...before, modifiedAt: after.modifiedAt, type: 'number', showOnCard: false, showLabelOnMiniCard: false });
+});
@@ -73,6 +73,91 @@ test('integration PUT preserves authentication and board-admin requirements', as
  expect(db.findOne('integrations', { _id: integration.id })).toEqual(before);
 });

+test('integration DELETE rejects missing and wrong-board IDs and removes only its own integration', async ({ request, user, board, integration }) => {
+  const other = db.seedBoard({ ownerId: user.id });
+  try {
+    const before = db.findOne('integrations', { _id: integration.id });
+    for (const path of [
+      integrationPath(board.boardId, 'missing-integration'),
+      integrationPath(other.boardId, integration.id),
+    ]) {
+      const response = await request.delete(path, { headers: headers(user.token) });
+      expect(response.status()).toBe(404);
+      expect(response.headers()['content-type']).toContain('application/json');
+      expect(await response.json()).toEqual({ error: 'Integration not found' });
+      expect(db.findOne('integrations', { _id: integration.id })).toEqual(before);
+    }
+    const response = await request.delete(integration.path, { headers: headers(user.token) });
+    expect(response.status()).toBe(200);
+    expect(await response.json()).toEqual({ _id: integration.id });
+    expect(db.findOne('integrations', { _id: integration.id })).toBeNull();
+    const read = await request.get(integration.path, { headers: headers(user.token) });
+    expect(read.status()).toBe(404);
+    const repeated = await request.delete(integration.path, { headers: headers(user.token) });
+    expect(repeated.status()).toBe(404);
+    expect(await repeated.json()).toEqual({ error: 'Integration not found' });
+  } finally {
+    db.cleanup({ boardIds: [other.boardId] });
+  }
+});
+
+test('integration DELETE preserves authentication and board-admin requirements', async ({ request, board, integration }) => {
+  const before = db.findOne('integrations', { _id: integration.id });
+  for (const id of [integration.id, 'missing-integration']) {
+    const path = integrationPath(board.boardId, id);
+    expect((await request.delete(path)).status()).toBe(401);
+    const member = db.seedUser();
+    try {
+      db.updateOne('boards', { _id: board.boardId }, { $push: { members: {
+        userId: member.id, isActive: true, isAdmin: false, isNoComments: false, isCommentOnly: false,
+      } } });
+      expect((await request.delete(path, { headers: headers(member.token) })).status()).toBe(403);
+      expect(db.findOne('integrations', { _id: integration.id })).toEqual(before);
+    } finally {
+      db.cleanup({ userIds: [member.id] });
+    }
+  }
+});
+
+test('webhook settings retain a rejected deletion and react to a successful REST deletion', async ({ request, user, board, integration, boardPage }) => {
+  const other = db.seedBoard({ ownerId: user.id });
+  let siblingId;
+  try {
+    const created = await request.post(`/api/boards/${board.boardId}/integrations`, {
+      headers: headers(user.token), data: { url: 'https://example.com/other-webhook' },
+    });
+    expect(created.status()).toBe(200);
+    siblingId = (await created.json())._id;
+    const sibling = db.findOne('integrations', { _id: siblingId });
+    const menu = boardPage.locator('.board-sidebar .js-open-board-menu');
+    if (!(await menu.isVisible())) await boardPage.locator('.js-toggle-page-sidebar').first().click();
+    await menu.click();
+    await boardPage.locator('.js-outgoing-webhooks').click();
+    const form = boardPage.locator('form.integration-form').filter({
+      has: boardPage.locator(`input[name="id"][value="${integration.id}"]`),
+    });
+    await expect(form).toBeVisible();
+    const before = db.findOne('integrations', { _id: integration.id });
+    const rejected = await request.delete(integrationPath(other.boardId, integration.id), {
+      headers: headers(user.token),
+    });
+    expect(rejected.status()).toBe(404);
+    expect(db.findOne('integrations', { _id: integration.id })).toEqual(before);
+    await expect(form).toBeVisible();
+
+    const response = await request.delete(integration.path, { headers: headers(user.token) });
+    expect(response.status()).toBe(200);
+    expect(await response.json()).toEqual({ _id: integration.id });
+    expect(db.findOne('integrations', { _id: integration.id })).toBeNull();
+    await expect(form).toHaveCount(0);
+    expect(db.findOne('integrations', { _id: siblingId })).toEqual(sibling);
+    await expect(boardPage.locator(`form.integration-form input[name="id"][value="${siblingId}"]`)).toHaveCount(1);
+  } finally {
+    if (siblingId) db.deleteOne('integrations', { _id: siblingId });
+    db.cleanup({ boardIds: [other.boardId] });
+  }
+});
+
 test('successful REST updates appear in webhook settings after invalid updates are rejected', async ({ request, user, board, integration, boardPage }) => {
  const other = db.seedBoard({ ownerId: user.id });
  try {
@@ -0,0 +1,47 @@
+'use strict';
+const { test, expect } = require('../fixtures');
+const db = require('../helpers/db');
+const { loginWithToken, openBoard } = require('../helpers/auth');
+
+test('ownership transfer leaves ordinary memberships unchanged and transfers administered boards', async ({ page, request, adminUser, user, user2 }) => {
+  const owned = db.seedBoard({ ownerId: user.id, title: 'Owned board' });
+  const ordinary = db.seedBoard({ ownerId: user2.id, title: 'Ordinary membership', cardTitlesPerList: [['Retained card']] });
+  const absent = db.seedBoard({ ownerId: user2.id, title: 'Unrelated board' });
+  db.addBoardMember({ boardId: ordinary.boardId, userId: user.id });
+  db.addBoardMember({ boardId: ordinary.boardId, userId: adminUser.id });
+  const ordinaryBefore = db.findOne('boards', { _id: ordinary.boardId });
+  const absentBefore = db.findOne('boards', { _id: absent.boardId });
+  try {
+    await loginWithToken(page, user.id, user.token);
+    await openBoard(page, ordinary.boardId, ordinary.slug);
+    await expect(page.locator('.minicard-title').filter({ hasText: 'Retained card' })).toBeVisible();
+    const response = await request.put(`/api/users/${user.id}`, {
+      headers: { Authorization: `Bearer ${adminUser.token}` }, data: { action: 'takeOwnership' },
+    });
+    expect(response.status()).toBe(200);
+    expect(await response.json()).toEqual([{ _id: owned.boardId, title: 'Owned board' }]);
+    await expect.poll(() => db.findOne('boards', { _id: owned.boardId }).members.some(m => m.userId === adminUser.id && m.isAdmin)).toBe(true);
+    expect(db.findOne('boards', { _id: owned.boardId }).members.some(m => m.userId === user.id)).toBe(false);
+    expect(db.findOne('boards', { _id: ordinary.boardId })).toEqual(ordinaryBefore);
+    expect(db.findOne('boards', { _id: absent.boardId })).toEqual(absentBefore);
+    const repeated = await request.put(`/api/users/${user.id}`, {
+      headers: { Authorization: `Bearer ${adminUser.token}` }, data: { action: 'takeOwnership' },
+    });
+    expect(repeated.status()).toBe(200);
+    expect(await repeated.json()).toEqual([]);
+    expect(db.findOne('boards', { _id: ordinary.boardId })).toEqual(ordinaryBefore);
+    await page.reload();
+    await expect(page.locator('.minicard-title').filter({ hasText: 'Retained card' })).toBeVisible();
+  } finally {
+    db.cleanup({ boardIds: [owned.boardId, ordinary.boardId, absent.boardId] });
+  }
+});
+
+test('ordinary users cannot request ownership transfer', async ({ request, user, user2, board }) => {
+  const before = db.findOne('boards', { _id: board.boardId });
+  for (const headers of [{}, { Authorization: `Bearer ${user2.token}` }]) {
+    const response = await request.put(`/api/users/${user.id}`, { headers, data: { action: 'takeOwnership' } });
+    expect([401, 403]).toContain(response.status());
+    expect(db.findOne('boards', { _id: board.boardId })).toEqual(before);
+  }
+});
@@ -0,0 +1,84 @@
+'use strict';
+
+// On the server ReactiveCache.get*() is async and returns a Promise, which is
+// always truthy. `!ReactiveCache.getUser(id)` was therefore always false, and
+// Boards.removeMember's #5330 branch for members whose account was deleted
+// never ran on the server. These tests pin the fix and keep the shape out of
+// the whole tree.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const root = path.join(__dirname, '..');
+function walk(dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap(e => {
+    // rspack output is skipped by prefix (tests/sourceWalkersSkipBuildOutput.test.cjs).
+    if (e.name === 'node_modules' || e.name.startsWith('.') || e.name.startsWith('_build')) return [];
+    const p = path.join(dir, e.name);
+    return e.isDirectory() ? walk(p) : /\.(c|m)?js$/.test(e.name) ? [p] : [];
+  });
+}
+
+function extractMethod(source, signature) {
+  const start = source.indexOf(signature);
+  assert.ok(start >= 0, `${signature} not found`);
+  let depth = 0;
+  for (let i = source.indexOf('{', start); i < source.length; i++) {
+    if (source[i] === '{') depth++;
+    else if (source[i] === '}' && --depth === 0) return source.slice(start, i + 1);
+  }
+  throw new Error('unbalanced braces');
+}
+
+function removeMemberFixture({ userExists }) {
+  const source = fs.readFileSync(path.join(root, 'models/boards.js'), 'utf8');
+  const method = extractMethod(source, 'async removeMember(memberId)');
+  const updates = [];
+  const scope = {
+    ReactiveCache: { async getUser() { return userExists ? { _id: 'gone' } : null; } },
+    Boards: { async updateAsync(id, modifier) { updates.push(modifier); } },
+    pullMemberById: (members, id) => members.filter(m => m.userId !== id),
+  };
+  const make = new Function(...Object.keys(scope), `return { ${method} };`);
+  const board = Object.assign(make(...Object.values(scope)), {
+    _id: 'b1',
+    members: [
+      { userId: 'admin', isAdmin: true, isActive: true },
+      { userId: 'gone', isAdmin: false, isActive: true },
+    ],
+    memberIndex(id) { return this.members.map(x => x.userId).indexOf(id); },
+    activeAdmins() { return this.members.filter(m => m.isAdmin && m.isActive); },
+  });
+  return { board, updates };
+}
+
+test('a member whose account was deleted is removed from the board, not just deactivated', async () => {
+  const { board, updates } = removeMemberFixture({ userExists: false });
+  await board.removeMember('gone');
+  assert.deepEqual(JSON.parse(JSON.stringify(updates)), [
+    { $set: { members: [{ userId: 'admin', isAdmin: true, isActive: true }] } },
+  ]);
+});
+
+test('an existing user is still deactivated by index, keeping the history', async () => {
+  const { board, updates } = removeMemberFixture({ userExists: true });
+  await board.removeMember('gone');
+  assert.equal(updates.length, 1);
+  assert.deepEqual(updates[0].$set, { 'members.1.isActive': false, 'members.1.isAdmin': false });
+});
+
+test('no server-side code negates an un-awaited async ReactiveCache lookup', () => {
+  // client/ is excluded: ReactiveCache is synchronous in the browser.
+  const offenders = [];
+  for (const file of ['server', 'models'].flatMap(d => walk(path.join(root, d)))) {
+    const lines = fs.readFileSync(file, 'utf8').split('\n');
+    lines.forEach((line, i) => {
+      if (/!\s*ReactiveCache\.get[A-Z]\w*\(/.test(line)) {
+        offenders.push(`${path.relative(root, file)}:${i + 1}: ${line.trim()}`);
+      }
+    });
+  }
+  assert.deepEqual(offenders, []);
+});
@@ -0,0 +1,106 @@
+'use strict';
+
+// Execute the registered REST handler; live schema/database coverage is in Playwright.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const { test } = require('node:test');
+
+const route = '/api/boards/:boardId/custom-fields/:customFieldId';
+const plain = value => JSON.parse(JSON.stringify(value));
+
+function fixture({ deny = false } = {}) {
+  const calls = [];
+  const document = { _id: 'field', boardIds: ['board'], name: 'Original', type: 'text', settings: {}, showOnCard: true };
+  let handler;
+  const context = {
+    WebApp: { handlers: Object.fromEntries(['get', 'post', 'put', 'delete'].map(verb => [verb, (url, fn) => {
+      if (verb === 'put' && url === route) handler = fn;
+    }])) },
+    Authentication: { async checkBoardWriteAccess(userId, boardId) {
+      calls.push(['access', userId, boardId]);
+      if (deny) throw new Error('Forbidden');
+    } },
+    CustomFields: { direct: { async updateAsync(selector, modifier) {
+      calls.push(['update', plain(selector), plain(modifier)]);
+      const fields = plain(modifier.$set);
+      if ('settings' in fields && typeof fields.settings !== 'object') throw new Error('Invalid settings');
+      if ('type' in fields && !['text', 'number'].includes(fields.type)) throw new Error('Invalid type');
+      if (selector._id !== document._id || !selector.boardIds.$in.some(id => document.boardIds.includes(id))) return 0;
+      Object.assign(document, fields);
+      return 1;
+    } } },
+    sendJsonResult(res, result) { res.responses.push(plain(result)); },
+  };
+  const source = fs.readFileSync(path.join(__dirname, '../server/models/customFields.js'), 'utf8');
+  vm.runInNewContext(source.slice(source.indexOf('WebApp.handlers.get(')), context);
+  assert.equal(typeof handler, 'function');
+  return {
+    calls, document,
+    async put(body, params = {}) {
+      const res = { responses: [] };
+      await handler({ userId: 'member', params: { boardId: 'board', customFieldId: 'field', ...params }, body }, res);
+      assert.equal(res.responses.length, 1);
+      return res.responses[0];
+    },
+  };
+}
+
+for (const invalid of [{ settings: 'invalid' }, { type: 'invalid' }]) {
+  test(`a rejected ${Object.keys(invalid)[0]} update leaves accompanying fields unchanged`, async () => {
+    const f = fixture();
+    const before = plain(f.document);
+    await assert.rejects(f.put({ name: 'Changed', ...invalid }), /Invalid/);
+    assert.deepEqual(f.document, before);
+  });
+}
+
+test('accepted fields are saved together, including false values, with the existing response', async () => {
+  const f = fixture();
+  const body = {
+    name: 'Changed', type: 'number', settings: {}, showOnCard: false,
+    automaticallyOnCard: false, alwaysOnCard: false, showLabelOnMiniCard: false, showSumAtTopOfList: false,
+  };
+  assert.deepEqual(await f.put(body), { code: 200, data: { _id: 'field' } });
+  assert.deepEqual(f.document, { _id: 'field', boardIds: ['board'], ...body });
+  assert.deepEqual(f.calls, [
+    ['access', 'member', 'board'],
+    ['update', { _id: 'field', boardIds: { $in: ['board'] } }, { $set: body }],
+  ]);
+});
+
+test('empty or unsupported updates retain the successful response without a write', async () => {
+  for (const body of [{}, { boardIds: ['other'], adminOnly: true, readOnly: true, unexpected: 'value' }]) {
+    const f = fixture();
+    const before = plain(f.document);
+    assert.deepEqual(await f.put(body), { code: 200, data: { _id: 'field' } });
+    assert.deepEqual(f.document, before);
+    assert.deepEqual(f.calls, [['access', 'member', 'board']]);
+  }
+});
+
+test('only own properties are accepted', async () => {
+  const f = fixture();
+  const body = Object.assign(Object.create({ name: 'Inherited', type: 'number' }), { showOnCard: false });
+  await f.put(body);
+  assert.equal(f.document.name, 'Original');
+  assert.equal(f.document.type, 'text');
+  assert.equal(f.document.showOnCard, false);
+});
+
+test('the update stays scoped to its board and field', async () => {
+  for (const params of [{ boardId: 'other' }, { customFieldId: 'missing' }]) {
+    const f = fixture();
+    const before = plain(f.document);
+    await f.put({ name: 'Changed' }, params);
+    assert.deepEqual(f.document, before);
+  }
+});
+
+test('authorization runs before any write', async () => {
+  const f = fixture({ deny: true });
+  await assert.rejects(f.put({ name: 'Changed', settings: 'invalid' }), /Forbidden/);
+  assert.deepEqual(f.calls, [['access', 'member', 'board']]);
+  assert.equal(f.document.name, 'Original');
+});
@@ -17,12 +17,12 @@ const { publicErrorData } = require('../server/lib/apiResponseHelpers');
 const file = path.join(__dirname, '..', 'server/models/integrations.js');
 const source = fs.readFileSync(file, 'utf8');

-test('every handler that updates an integration looks it up on that board first', () => {
+test('every handler that updates or deletes an integration looks it up on that board first', () => {
  const updating = source.split(/\nWebApp\.handlers\./).slice(1)
-    .filter(block => /Integrations\.direct\.updateAsync/.test(block));
-  assert.ok(updating.length >= 3, 'PUT and both activities routes are found');
+    .filter(block => /Integrations\.direct\.(update|remove)Async/.test(block));
+  assert.ok(updating.length >= 4, 'PUT, both activities routes and DELETE are found');
  for (const block of updating) {
-    const update = block.indexOf('Integrations.direct.updateAsync');
+    const update = block.search(/Integrations\.direct\.(update|remove)Async/);
    const guard = block.indexOf('integrationOr404(');
    assert.ok(guard > -1 && guard < update, `${block.split('\n')[0]} checks before it writes`);
    // and only after board-admin authorization, so the answer tells nobody anything
@@ -35,33 +35,81 @@ test('negative: the check is not the old "write, then answer 200 with whatever i
  assert.match(source, /code: 404, data: \{ error: 'Integration not found' \}/);
 });

-function run(handlerUrl, verb, integrations) {
+function run(handlerUrl, verb, integrations, { deny = false, lookupError, removeError } = {}) {
  const calls = [];
+  const lookups = [];
  let handler;
  const context = {
    WebApp: { handlers: Object.fromEntries(['get', 'post', 'put', 'delete'].map(v => [v, (url, fn) => {
      if (v === verb && url === handlerUrl) handler = fn;
    }])) },
-    Authentication: { async checkBoardAdmin() {} },
+    Authentication: { async checkBoardAdmin() {
+      if (deny) throw Object.assign(new Error('Forbidden'), { statusCode: 403 });
+    } },
    ReactiveCache: { async getIntegration(selector) {
+      lookups.push(selector);
+      if (lookupError) throw lookupError;
      return integrations.find(i => i._id === selector._id && i.boardId === selector.boardId);
    } },
-    Integrations: { direct: { async updateAsync(...args) { calls.push(args); return 1; } } },
+    Integrations: { direct: {
+      async updateAsync(...args) { calls.push(args); return 1; },
+      async removeAsync(...args) {
+        calls.push(args);
+        if (removeError) throw removeError;
+        return 1;
+      },
+    } },
    normalizeDeliverySettings: x => x,
    publicErrorData,
    sendJsonResult(res, result) { res.responses.push(JSON.parse(JSON.stringify(result))); },
  };
  vm.runInNewContext(source.slice(source.indexOf('WebApp.handlers.get(')), context);
  return {
-    calls,
+    calls, lookups,
    async call(params, body) {
      const res = { responses: [] };
      await handler({ userId: 'u', params, body }, res);
+      assert.equal(res.responses.length, 1, 'respond exactly once');
      return res.responses[0];
    },
  };
 }

+const deleteUrl = '/api/boards/:boardId/integrations/:intId';
+
+test('DELETE answers 404 without removing anything for missing, foreign and repeated IDs', async () => {
+  const integrations = [{ _id: 'i1', boardId: 'b1' }, { _id: 'i2', boardId: 'b2' }];
+  const r = run(deleteUrl, 'delete', integrations);
+  for (const params of [{ boardId: 'b1', intId: 'missing' }, { boardId: 'b1', intId: 'i2' }]) {
+    assert.deepEqual(await r.call(params), { code: 404, data: { error: 'Integration not found' } });
+  }
+  assert.equal(r.calls.length, 0);
+  assert.deepEqual(await r.call({ boardId: 'b1', intId: 'i1' }), { code: 200, data: { _id: 'i1' } });
+  assert.deepEqual(JSON.parse(JSON.stringify(r.calls)), [[{ _id: 'i1', boardId: 'b1' }]]);
+  integrations.shift();
+  assert.deepEqual(await r.call({ boardId: 'b1', intId: 'i1' }), { code: 404, data: { error: 'Integration not found' } });
+  assert.equal(r.calls.length, 1);
+});
+
+test('DELETE checks authorization before looking up existing or missing integrations', async () => {
+  const r = run(deleteUrl, 'delete', [{ _id: 'i1', boardId: 'b1' }], { deny: true });
+  for (const intId of ['i1', 'missing']) {
+    assert.equal((await r.call({ boardId: 'b1', intId })).code, 403);
+  }
+  assert.equal(r.lookups.length, 0);
+  assert.equal(r.calls.length, 0);
+});
+
+for (const operation of ['lookup', 'remove']) {
+  test(`DELETE preserves server errors from ${operation} instead of reporting 404 or success`, async () => {
+    const r = run(deleteUrl, 'delete', [{ _id: 'i1', boardId: 'b1' }], {
+      [`${operation}Error`]: new Error('database unavailable'),
+    });
+    assert.equal((await r.call({ boardId: 'b1', intId: 'i1' })).code, 500);
+    assert.equal(r.calls.length, operation === 'lookup' ? 0 : 1);
+  });
+}
+
 for (const verb of ['post', 'delete']) {
  test(`${verb.toUpperCase()} .../activities answers 404 and writes nothing for a missing or foreign integration`, async () => {
    const url = '/api/boards/:boardId/integrations/:intId/activities';
@@ -0,0 +1,108 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const { test } = require('node:test');
+const { publicErrorData } = require('../server/lib/apiResponseHelpers');
+
+const source = fs.readFileSync(path.join(__dirname, '../server/models/users.js'), 'utf8');
+const start = source.indexOf("WebApp.handlers.put('/api/users/:userId'");
+const end = source.indexOf("WebApp.handlers.post('/api/boards/:boardId/members/:userId/add'", start);
+assert.ok(start >= 0 && end > start);
+const plain = value => JSON.parse(JSON.stringify(value));
+
+function fixture({ missing = false, denied = false, boards = [] } = {}) {
+  const calls = [];
+  let handler;
+  vm.runInNewContext(source.slice(start, end), {
+    WebApp: { handlers: { put(route, callback) { handler = callback; } } },
+    Authentication: { async checkUserId(userId) {
+      calls.push(['authorize', userId]);
+      if (denied) throw Object.assign(new Error('Forbidden'), { statusCode: 403 });
+    } },
+    ReactiveCache: {
+      async getUser() { calls.push(['user']); return missing ? null : { _id: 'target' }; },
+      async getBoards(selector, options) {
+        calls.push(['boards', plain(selector), plain(options)]);
+        // Require both criteria on ONE member. The live suite exercises this
+        // query against MongoDB with a different administrator on the board.
+        assert.deepEqual(plain(selector), { members: { $elemMatch: { userId: 'target', isAdmin: true } } });
+        return boards;
+      },
+    },
+    publicErrorData,
+    sendJsonResult(res, result) { res.responses.push(plain(result)); },
+  });
+  return { calls, async put() {
+    const res = { responses: [] };
+    await handler({ userId: 'admin', params: { userId: 'target' }, body: { action: 'takeOwnership' } }, res);
+    assert.equal(res.responses.length, 1);
+    return res.responses[0];
+  } };
+}
+
+test('ownership selection binds the user and administrator flag to the same member', async () => {
+  const f = fixture();
+  assert.deepEqual(await f.put(), { code: 200, data: [] });
+  assert.deepEqual(f.calls, [
+    ['authorize', 'admin'], ['user'],
+    ['boards', { members: { $elemMatch: { userId: 'target', isAdmin: true } } }, { sort: { sort: 1 } }],
+  ]);
+});
+
+test('selected boards retain the existing ownership helper and response format', async () => {
+  const calls = [];
+  const board = {
+    _id: 'owned', title: 'Owned board',
+    hasMember(id) { calls.push(['hasMember', id]); return false; },
+    async changeOwnership(from, to) { calls.push(['changeOwnership', from, to]); },
+  };
+  const f = fixture({ boards: [board] });
+  assert.deepEqual(await f.put(), { code: 200, data: [{ _id: 'owned', title: 'Owned board' }] });
+  assert.deepEqual(calls, [['hasMember', 'admin'], ['changeOwnership', 'target', 'admin']]);
+});
+
+test('denied callers and missing users do not select boards', async () => {
+  for (const [options, code] of [[{ denied: true }, 403], [{ missing: true }, 404]]) {
+    const f = fixture(options);
+    assert.equal((await f.put()).code, code);
+    assert.ok(!f.calls.some(([name]) => name === 'boards'));
+  }
+});
+
+test('ownership changes finish before the response, and their failures are reported', async () => {
+  let finished = false;
+  const board = {
+    _id: 'owned', title: 'Owned board',
+    hasMember() { return false; },
+    async changeOwnership() { await new Promise(r => setImmediate(r)); finished = true; },
+  };
+  const f = fixture({ boards: [board] });
+  assert.equal((await f.put()).code, 200);
+  // The response used to be sent before the board update had run.
+  assert.equal(finished, true);
+
+  const failing = fixture({ boards: [{
+    _id: 'owned', title: 'Owned board', hasMember() { return false; },
+    async changeOwnership() { throw Object.assign(new Error('update failed'), { statusCode: 500 }); },
+  }] });
+  // Previously an unhandled rejection with a 200 reply; now a reported error.
+  assert.notEqual((await failing.put()).code, 200);
+});
+
+test('every board ownership change in the server code is awaited', () => {
+  const root = path.join(__dirname, '..');
+  for (const dir of ['server', 'models']) {
+    const walk = d => fs.readdirSync(d, { withFileTypes: true }).flatMap(e =>
+      e.isDirectory() ? walk(path.join(d, e.name)) : e.name.endsWith('.js') ? [path.join(d, e.name)] : []);
+    for (const file of walk(path.join(root, dir))) {
+      const text = fs.readFileSync(file, 'utf8');
+      for (const m of text.matchAll(/^.*\.changeOwnership\(.*$/gm)) {
+        if (/async\s+changeOwnership\(/.test(m[0])) continue;
+        assert.match(m[0], /\b(await|return)\s+\S*\.changeOwnership\(/, `${path.relative(root, file)}: ${m[0].trim()}`);
+      }
+    }
+  }
+});
Author	SHA1	Message	Date
github-actions[bot]	06e7db85dc	Bump versions for v13.11	2026-11-13 18:11:28 +00:00
Lauri Ojansivu	a97fde20c9	Prepare v13.11 release	2026-11-13 20:10:27 +02:00
Lauri Ojansivu	a22dbc5b34	CHANGELOG: REST integration deletion answers 404 for a missing integration. Thanks to AhmedLukman and xet7 !	2026-11-13 19:43:09 +02:00
Lauri Ojansivu	cbe8a56d9d	Merge pull request #6900 from AhmedLukman/codex/fix-integration-delete-not-found Fix integration deletion acknowledging missing records	2026-11-13 19:41:28 +02:00
Ahmed Lukman	ab685a7f6f	Fix integration deletion acknowledging missing records Reuse the board-scoped integration lookup before deleting, after board-admin authorization. Missing, wrong-board and already deleted integrations now return the existing JSON 404 response instead of acknowledging an unmatched selector. Extend route regressions for deletion, authorization and database errors. Add live API and browser coverage for rejected and successful deletions, persisted state and retention of other webhooks in settings.	2026-11-13 19:01:54 +03:00
Lauri Ojansivu	24d5b2cdfd	CHANGELOG: file-integrity baselines of deleted files, the checklist resetInterval index, REST custom-field and ownership fixes. Thanks to Raymond-Voogt, AhmedLukman and xet7 !	2026-11-13 17:45:45 +02:00
Lauri Ojansivu	ec05ff0089	File-integrity scan no longer reports files WeKan deleted itself as missing. The daily scan keeps one baseline per stored file and reports every baseline whose file is gone as a StorageBleed. Nothing ever removed a baseline, so every attachment purged by retention and every avatar deleted was reported missing on every run from then on - one finding folded 1,164 times. The baseline is now forgotten where WeKan deletes or moves a local file: - Attachments and Avatars onAfterRemove, for every version path. This is the retention purge's path: Meteor-Files unlinks the version paths itself after that hook, without going through the store strategy, so a fix in the strategy's unlink() alone would not have covered it; - the filesystem strategy's unlink() (moving a file to GridFS or cloud); - the filesystem strategy's rename(), for the old path. A file that vanishes any other way keeps its baseline and is still reported. The removal is fire-and-forget and can never break a delete. Baselines already orphaned before this fix stay reported until removed, as described in the issue. Thanks to Raymond-Voogt and xet7 ! Fixes #6898.	2026-11-13 17:45:05 +02:00
Lauri Ojansivu	c37575f1fa	Checklists have a partial index on resetInterval for the recurring-reset cron. The recurring-checklist reset cron queries resetInterval: { $exists: true, $nin: [null, 'none'] } on every tick, and with no index that read the whole checklists collection (about 45,000 documents on the reporting instance), reported as db.collection-scan on Admin Panel -> Problems. A partial index on resetInterval, like the one #6825 added for recurring cards, holds only the recurring checklists. Thanks to Raymond-Voogt and xet7 ! Fixes #6899.	2026-11-13 17:45:05 +02:00
Lauri Ojansivu	a8e25952aa	REST takeOwnership awaits the board update, and removeMember awaits its user lookup. PUT /api/users/:userId with action takeOwnership called the async board.changeOwnership() without await: the reply was sent before the board was changed, and a failed update was an unhandled rejection behind a 200. Boards.removeMember tested `!ReactiveCache.getUser(memberId)`. On the server that lookup is async and returns a Promise, which is always truthy, so the #5330 branch that hard-removes a member whose account was deleted never ran on the server; such a member was only deactivated and lingered. Tests pin both, and fail the tree for any un-awaited changeOwnership() or negated un-awaited ReactiveCache lookup in server/ and models/. Thanks to xet7 !	2026-11-13 17:45:05 +02:00
Lauri Ojansivu	22bf506ea1	Merge pull request #6896 from AhmedLukman/codex/fix-ownership-board-selection Fix ownership transfer selecting ordinary board memberships	2026-11-13 17:23:36 +02:00
Lauri Ojansivu	41ff6da28d	Merge pull request #6897 from AhmedLukman/codex/fix-custom-field-update-atomicity Fix partial REST custom-field updates	2026-11-13 17:23:19 +02:00
Ahmed Lukman	a81ec6ecdf	Fix partial REST custom-field updates Save supported custom-field properties in one board-scoped update so schema validation rejects the entire change before any accompanying fields persist. Preserve the existing authorization, field allowlist and response behavior. Add handler regressions and live database/browser coverage for rejected settings and types, accepted updates, false values, omitted fields and board scoping.	2026-11-13 17:00:17 +03:00
Ahmed Lukman	4b4db92a1b	Fix ownership transfer selecting ordinary board memberships Match the target user and administrator flag within the same board member, following the existing membership query pattern. Leave boards where the target is only a normal member unchanged. Cover selection, successful transfers, unchanged unrelated memberships, repeated requests, authorization, and retained browser access.	2026-11-13 11:51:40 +03:00