v9.06

Fix Snap Candidate attachments directory permissions at parallel snap file path /var/snap/wekan_SOMENAME/common/files/
Thanks to xet7 !
2026-11-08 11:25:19 -05:00 · 2026-05-02 03:55:32 +03:00 · 2026-05-02 03:46:05 +03:00 · 2026-05-02 03:15:24 +03:00 · 2026-05-02 02:43:19 +03:00 · 2026-05-02 02:40:53 +03:00
49 changed files with 2135 additions and 1930 deletions
@@ -1,24 +1,38 @@
 name: Release All Platforms

-# Triggered when maintainer pushes a version tag, e.g.: git tag v8.43 && git push --tags
-# Does not work:
-#   Required GitHub Secrets:
-#   QUAY_USERNAME        - Quay.io username
-#   QUAY_PASSWORD        - Quay.io password or token
-#   DOCKERHUB_USERNAME   - Docker Hub username
-#   DOCKERHUB_TOKEN      - Docker Hub access token
-#   SNAP_STORE_LOGIN     - Snapcraft store credentials: run 'snapcraft export-login --snaps wekan --channels stable -' and base64-encode the output
+# Triggered manually via GitHub CLI or Actions UI.
+# Usage:
+#   gh workflow run release-all.yml -f old_version=8.42 -f new_version=8.43
+#
+# Or use the convenience script (commits pending changes, pushes, and triggers):
+#   ./releases/release-all.sh 8.42 8.43
+#
+# Required GitHub Secrets:
+#   GHCR_AUTH      - base64(username:token) for ghcr.io
+#   DOCKERHUB_AUTH - base64(username:token) for Docker Hub
+#   QUAY_AUTH      - base64(username:token) for Quay.io
+#   SNAP_AUTH      - Snapcraft store credentials

 on:
-  push:
-    tags:
-      - 'v*.*'
+  workflow_dispatch:
+    inputs:
+      old_version:
+        description: 'Previous version number (e.g. 8.42, without v prefix)'
+        required: true
+        type: string
+      new_version:
+        description: 'New version number (e.g. 8.43, without v prefix)'
+        required: true
+        type: string

 permissions:
  contents: write
  packages: write
+  pages: write
+  id-token: write

 jobs:
+
  # ─── 1. Extract version and release notes ───────────────────────────────────
  prepare:
    runs-on: ubuntu-latest
@@ -27,10 +41,15 @@ jobs:
      changelog: ${{ steps.changelog.outputs.content }}
    steps:
      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ needs.prepare.outputs.version }}

-      - name: Extract version from tag
+      - name: Set version from input
        id: version
-        run: echo "version=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
+        run: |
+          VERSION="${{ needs.prepare.outputs.version }}"
+          VERSION="${VERSION#v}"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Extract release notes from CHANGELOG.md
        id: changelog
@@ -65,15 +84,18 @@ jobs:
  # Therefore the full Meteor build always runs here on x86_64.
  # All other Linux architectures then rebuild only the native npm modules
  # from this bundle (much faster than a full Meteor build).
-  # Node.js version must match what Meteor 3.5-beta.7 bundles: 24.14.1 (ABI 143).
+  # Node.js version must match what Meteor 3.5-beta.7 bundles (detected automatically).
  build-amd64:
    needs: prepare
    runs-on: ubuntu-24.04
    timeout-minutes: 180
    env:
      VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION: ${{ needs.prepare.outputs.version }}
    steps:
      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}

      - name: Cache Meteor installation
        uses: actions/cache@v5
@@ -93,11 +115,11 @@ jobs:
          sudo apt-get update
          sudo apt-get install -y build-essential g++ make python3 curl wget zip unzip

-      # Pin to Node 24.14.1 — the exact version bundled by Meteor 3.5-beta.7.
+      # Pin to detected latest Node.js 24.x — must match Meteor's bundled version.
      # Using the same version for build and npm rebuild ensures consistent native module ABI.
      - uses: actions/setup-node@v6
        with:
-          node-version: '24.14.1'
+          node-version: '${{ needs.prepare.outputs.version }}'

      - name: Install Meteor
        run: |
@@ -134,22 +156,26 @@ jobs:
    timeout-minutes: 60
    env:
      VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION_ARM64: ''
    steps:
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential g++ make python3 curl unzip zip

-      - uses: actions/setup-node@v6
-        with:
-          node-version: '24.14.1'
+
+      - name: Set Node.js version for arm64
+        id: node_arm64
+        run: |
+          echo "NODE_VERSION_ARM64=24" >> $GITHUB_ENV

      - name: Download amd64 bundle
        uses: actions/download-artifact@v8
        with:
          name: bundle-amd64

-      - name: Rebuild native modules for arm64
+      - name: Rebuild native modules for arm64 in container
        run: |
          unzip wekan-${VERSION}-amd64.zip
          # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
@@ -166,10 +192,12 @@ jobs:
            popd > /dev/null
            rm -rf "$TMP"
          fi
-          cd bundle/programs/server
-          rm -rf node_modules
-          npm install
-          cd ../..
+          # Use the latest available Node.js 24.x slim image for arm64
+          docker run --rm --platform linux/arm64 \
+            -v "$(pwd)/bundle:/bundle" \
+            -w /bundle/programs/server \
+            node:24-slim \
+            sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"

      - name: Clean up and create arm64 zip
        run: |
@@ -184,14 +212,15 @@ jobs:
  # ─── 4. Build s390x bundle (rebuild native modules via QEMU container) ───────
  # Meteor 3.5-beta.7 does NOT support s390x (installer exits with error on that arch).
  # GitHub Actions has no native s390x runners.
-  # Solution: QEMU emulation + node:24.14.1-slim (s390x variant) for npm rebuild.
-  # node:24.14.1-slim is pinned to match Meteor 3.5-beta.7's bundled Node.js version exactly.
+  # Solution: QEMU emulation + node:<version>-slim (s390x variant) for npm rebuild.
  build-s390x:
    needs: [prepare, build-amd64]
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION_S390X: ''
    steps:
      - name: Set up QEMU for s390x
        uses: docker/setup-qemu-action@v4
@@ -206,6 +235,11 @@ jobs:
        with:
          name: bundle-amd64

+      - name: Set Node.js version for s390x
+        id: node_s390x
+        run: |
+          echo "NODE_VERSION_S390X=24" >> $GITHUB_ENV
+
      - name: Rebuild native modules for s390x in container
        run: |
          unzip wekan-${VERSION}-amd64.zip
@@ -224,11 +258,11 @@ jobs:
            popd > /dev/null
            rm -rf "$TMP"
          fi
-          # node:24.14.1-slim s390x — same Node.js version as Meteor 3.5-beta.7 bundled
+          # Use the latest available Node.js 24.x slim image for s390x
          docker run --rm --platform linux/s390x \
            -v "$(pwd)/bundle:/bundle" \
            -w /bundle/programs/server \
-            node:24.14.1-slim \
+            node:24-slim \
            sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"

      - name: Clean up and create s390x zip
@@ -244,13 +278,15 @@ jobs:
  # ─── 4b. Build ppc64le bundle (rebuild native modules via QEMU container) ────
  # Meteor 3.5-beta.7 does NOT support ppc64le (installer exits with error on that arch).
  # GitHub Actions has no native ppc64le runners.
-  # Solution: QEMU emulation + node:24.14.1-slim (ppc64le variant) for npm rebuild.
+  # Solution: QEMU emulation + node:<version>-slim (ppc64le variant) for npm rebuild.
  build-ppc64le:
    needs: [prepare, build-amd64]
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION_PPC64LE: ''
    steps:
      - name: Set up QEMU for ppc64le
        uses: docker/setup-qemu-action@v4
@@ -265,6 +301,11 @@ jobs:
        with:
          name: bundle-amd64

+      - name: Set Node.js version for ppc64le
+        id: node_ppc64le
+        run: |
+          echo "NODE_VERSION_PPC64LE=24" >> $GITHUB_ENV
+
      - name: Rebuild native modules for ppc64le in container
        run: |
          unzip wekan-${VERSION}-amd64.zip
@@ -283,11 +324,11 @@ jobs:
            popd > /dev/null
            rm -rf "$TMP"
          fi
-          # node:24.14.1-slim ppc64le — same Node.js version as Meteor 3.5-beta.7 bundled
+          # Use the latest available Node.js 24.x slim image for ppc64le
          docker run --rm --platform linux/ppc64le \
            -v "$(pwd)/bundle:/bundle" \
            -w /bundle/programs/server \
-            node:24.14.1-slim \
+            node:24-slim \
            sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"

      - name: Clean up and create ppc64le zip
@@ -340,11 +381,11 @@ jobs:
  #          popd > /dev/null
  #          rm -rf "$TMP"
  #        fi
-  #        # node:24.14.1-slim arm/v7 — same Node.js version as Meteor 3.5-beta.7 bundled
+  #        # node:<version>-slim arm/v7 — same Node.js version as Meteor bundled
  #        docker run --rm --platform linux/arm/v7 \
  #          -v "$(pwd)/bundle:/bundle" \
  #          -w /bundle/programs/server \
-  #          node:24.14.1-slim \
+  #          node:${NODE_VERSION}-slim \
  #          sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
  #
  #    - name: Clean up and create armhf zip
@@ -367,7 +408,7 @@ jobs:
    steps:
      - uses: actions/setup-node@v6
        with:
-          node-version: '24.14.1'
+          node-version: '${{ needs.prepare.outputs.version }}'

      ## With Node 24 these are already preinstalled at GitHub Windows runners
      #- name: Install node-gyp and build tools
@@ -435,6 +476,7 @@ jobs:
      - name: Create GitHub Release with all bundles
        uses: softprops/action-gh-release@v3
        with:
+          tag_name: v${{ needs.prepare.outputs.version }}
          name: v${{ needs.prepare.outputs.version }}
          body: ${{ needs.prepare.outputs.changelog }}
          files: |
@@ -445,102 +487,200 @@ jobs:
            wekan-${{ needs.prepare.outputs.version }}-win64.zip

  # ─── 7. Build and push multi-platform Docker image ──────────────────────────
-  #docker:
-  #  needs: [prepare, release]
-  #  runs-on: ubuntu-latest
-  #  env:
-  #    VERSION: ${{ needs.prepare.outputs.version }}
-  #  steps:
-  #    - uses: actions/checkout@v6
-  #
-  #    - name: Set up QEMU
-  #      uses: docker/setup-qemu-action@v4
-  #
-  #    - name: Set up Docker Buildx
-  #      uses: docker/setup-buildx-action@v3
-  #
-  #    - name: Log in to Docker Hub
-  #      uses: docker/login-action@v4
-  #      with:
-  #        username: ${{ secrets.DOCKERHUB_USERNAME }}
-  #        password: ${{ secrets.DOCKERHUB_TOKEN }}
-  #
-  #    - name: Log in to Quay.io
-  #      uses: docker/login-action@v4
-  #      with:
-  #        registry: quay.io
-  #        username: ${{ secrets.QUAY_USERNAME }}
-  #        password: ${{ secrets.QUAY_PASSWORD }}
-  #
-  #    - name: Log in to GitHub Container Registry
-  #      uses: docker/login-action@v4
-  #      with:
-  #        registry: ghcr.io
-  #        username: ${{ github.actor }}
-  #        password: ${{ secrets.GITHUB_TOKEN }}
-  #
-  #    - name: Build and push Docker image to all registries
-  #      uses: docker/build-push-action@v7
-  #      with:
-  #        context: .
-  #        platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le,linux/s390x
-  #        push: true
-  #        build-args: VERSION=${{ needs.prepare.outputs.version }}
-  #        tags: |
-  #          #wekanteam/wekan:v${{ needs.prepare.outputs.version }}
-  #          #wekanteam/wekan:latest
-  #          quay.io/wekan/wekan:v${{ needs.prepare.outputs.version }}
-  #          quay.io/wekan/wekan:latest
-  #          ghcr.io/wekan/wekan:v${{ needs.prepare.outputs.version }}
-  #          ghcr.io/wekan/wekan:latest
-  #        cache-from: type=gha
-  #        cache-to: type=gha,mode=max
+  docker:
+    needs: [prepare, release]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}

-  # ─── 8. Build and publish snap packages (all architectures via Launchpad) ────
-  # Uses snapcraft remote-build on Launchpad's native builders (more reliable
-  # than QEMU for snap builds). Each architecture bundles its own database:
-  #   amd64, arm64         — MongoDB 7.x prebuilt native binary
-  #   armhf, s390x, ppc64el — MongoDB 7.x amd64 binary run via qemu-x86_64-static
-  #                           (no prebuilt MongoDB binaries exist for these arches)
-  #snap:
-  #  needs: [prepare, release]
-  #  runs-on: ubuntu-latest
-  #  env:
-  #    VERSION: ${{ needs.prepare.outputs.version }}
-  #  steps:
-  #    - uses: actions/checkout@v6
-  #
-  #    - name: Install snapcraft
-  #      run: sudo snap install snapcraft --classic
-  #
-  #    - name: Remote-build snap for all architectures via Launchpad
-  #      env:
-  #        SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
-  #      run: |
-  #        snapcraft remote-build \
-  #          --build-for=amd64,arm64,armhf,s390x,ppc64el \
-  #          --launchpad-accept-public-upload
-  #
-  #    - name: Upload all snap files as artifacts
-  #      uses: actions/upload-artifact@v7
-  #      with:
-  #        name: snaps-all-arches
-  #        path: "*.snap"
-  #        retention-days: 30
-  #
-  #    # Publish to edge — NOT stable.
-  #    # Stable channel holds the old WeKan version until database migrations are ready.
-  #    # Promote to stable manually via the Snap Store dashboard when migrations exist.
-  #    - name: Publish all snaps to Snap Store (candidate, beta, edge)
-  #      env:
-  #        SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
-  #      run: |
-  #        for snap_file in *.snap; do
-  #          echo "Publishing $snap_file ..."
-  #          snapcraft upload --release=edge "$snap_file"
-  #        done
-  #
-  #    - name: Upload all snaps to GitHub Release
-  #      uses: softprops/action-gh-release@v3
-  #      with:
-  #        files: "*.snap"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Create Docker config with registry credentials
+        run: |
+          mkdir -p ~/.docker
+          cat > ~/.docker/config.json <<EOF
+          {
+            "auths": {
+              "ghcr.io": {
+                "auth": "${{ secrets.GHCR_AUTH }}"
+              },
+              "https://index.docker.io/v1/": {
+                "auth": "${{ secrets.DOCKERHUB_AUTH }}"
+              },
+              "quay.io": {
+                "auth": "${{ secrets.QUAY_AUTH }}"
+              }
+            }
+          }
+          EOF
+
+      - name: Create and use buildx builder
+        run: |
+          docker buildx create --name mybuilder --driver docker-container --use
+          docker buildx inspect --bootstrap
+
+      - name: Build and push Docker image to all registries
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64,linux/s390x,linux/ppc64le \
+            -t wekanteam/wekan:v${VERSION} \
+            -t wekanteam/wekan:latest \
+            -t quay.io/wekan/wekan:v${VERSION} \
+            -t quay.io/wekan/wekan:latest \
+            -t ghcr.io/wekan/wekan:v${VERSION} \
+            -t ghcr.io/wekan/wekan:latest \
+            --push .
+
+  # ─── 8. Build and publish snap packages ──────────────────────────────────────
+  # Build snap with snapcraft pack (like releases/snap-build.sh) using LXD,
+  # then push to Snap Store edge channel (like releases/snap-push-to-store.sh).
+  # Promote to stable manually via the Snap Store dashboard when ready.
+  snap:
+    needs: [prepare, release]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}
+
+      - name: Install snapcraft
+        run: sudo snap install snapcraft --classic
+
+      - name: Build snap
+        run: sudo snapcraft pack --destructive-mode
+
+      - name: Upload snap files as artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: snaps
+          path: "*.snap"
+          retention-days: 30
+
+      - name: Push all snaps to Snap Store edge channel
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_AUTH }}
+        run: |
+          for snap_file in *.snap; do
+            echo "Publishing $snap_file ..."
+            snapcraft upload --release=edge "$snap_file"
+          done
+
+      - name: Upload all snaps to GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: v${{ needs.prepare.outputs.version }}
+          files: "*.snap"
+
+  # ─── 9. Update Helm charts and deploy to GitHub Pages ─────────────────────────
+  # Chart source is in helm/wekan/, published packages + index.yaml in docs/wekan/.
+  # GitHub Pages deploys docs/wekan/ via Actions, serving at https://wekan.fi/wekan/
+  helm:
+    needs: [prepare, docker]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}
+
+      - name: Install Helm
+        run: |
+          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+
+      - name: Update Chart.yaml and values.yaml with new version
+        run: |
+          CHART_PATH=docs/wekan
+          CHART_FILE=$CHART_PATH/Chart.yaml
+          VALUES_FILE=$CHART_PATH/values.yaml
+          CHARTS_DIR=docs/charts
+          INDEX_FILE=$CHARTS_DIR/index.yaml
+          VERSION=${VERSION}
+          # Update Chart.yaml (appVersion and version)
+          sed -i "s/^appVersion: .*/appVersion: \"$VERSION\"/" "$CHART_FILE"
+          sed -i "s/^version: .*/version: $VERSION.0/" "$CHART_FILE"
+          # Update values.yaml (image.tag)
+          sed -i "s/^  tag: v.*/  tag: v$VERSION/" "$VALUES_FILE"
+
+      - name: Build Helm dependencies
+        run: |
+          cd docs/wekan
+          helm repo add mongo https://groundhog2k.github.io/helm-charts/ || true
+          helm dependency update
+          helm dependency build
+
+      - name: Package chart to docs/charts and update index.yaml
+        run: |
+          CHART_PATH=docs/wekan
+          CHARTS_DIR=docs/charts
+          INDEX_FILE=$CHARTS_DIR/index.yaml
+          VERSION=${VERSION}
+          cd $CHARTS_DIR
+          helm package ../wekan -d .
+          ARCHIVE=wekan-$VERSION.0.tgz
+          SHA256=$(sha256sum "$ARCHIVE" | awk '{print $1}')
+          CREATED=$(TZ='Europe/Helsinki' date '+%Y-%m-%dT%H:%M:%S.000000000%:z')
+          if [ -f "$INDEX_FILE" ]; then
+            awk '/^- apiVersion: v2/{flag=1;print;next}/^- apiVersion: v2/{flag=0}flag' "$INDEX_FILE" | head -n 30 > /tmp/topentry.yaml
+            sed -i "s/appVersion: .*/appVersion: \"$VERSION\"/" /tmp/topentry.yaml
+            sed -i "s/created: .*/created: \"$CREATED\"/" /tmp/topentry.yaml
+            sed -i "s/digest: .*/digest: $SHA256/" /tmp/topentry.yaml
+            sed -i "s|urls:.*|urls:\n    - https://wekan.github.io/wekan/wekan-$VERSION.0.tgz|" /tmp/topentry.yaml
+            sed -i "s/version: .*/version: $VERSION.0/" /tmp/topentry.yaml
+            awk 'NR==1{print;system("cat /tmp/topentry.yaml");next} /^  - apiVersion: v2/ && !p{p=1;next} 1' "$INDEX_FILE" > /tmp/index.yaml
+            mv /tmp/index.yaml "$INDEX_FILE"
+            rm /tmp/topentry.yaml
+          else
+            echo "index.yaml not found, skipping index update."
+          fi
+
+      - name: Commit updated chart and index
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add docs/wekan/ docs/charts/
+          git commit -m "${VERSION}.0"
+          git push origin HEAD:refs/heads/main
+
+      - name: Upload docs/charts/ as Pages artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: docs/charts/
+
+      - name: Commit updated chart
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add docs/wekan/
+          git commit -m "${VERSION}.0"
+          git push origin HEAD:refs/heads/main
+
+      - name: Upload docs/wekan/ as Pages artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: docs/wekan/
+
+  # ─── 10. Deploy Helm chart to GitHub Pages ───────────────────────────────────
+  deploy-pages:
+    needs: helm
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5
@@ -127,7 +127,7 @@ jobs:
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
-          node-version: '24.14.1'
+          node-version: '24.15.0'

      - name: Setup meteor
        uses: meteorengineer/setup-meteor@v3
@@ -18,14 +18,6 @@ aldeed:schema-index@4.0.0-beta.5
 reywood:publish-composite
 mongo@2.3.0-beta350.7

-# The holy trifecta - this is a replacement for subs-manager
-# for IndexedDB persistence and auto-sync
-jam:offline 
-# for optimistic methods with offline queuing
-jam:method 
-# global subscription caching
-jam:pub-sub
-
 # Account system
 accounts-password@3.2.3-beta350.7
 communitypackages:core
@@ -67,3 +59,6 @@ ejson@1.2.0-beta350.7
 logging@1.3.6
 wekan-fullcalendar
 wekan-fontawesome
+jam:offline
+jam:method
+jam:pub-sub
@@ -76,7 +76,7 @@ ordered-dict@1.2.0
 ostrio:cookies@2.9.1
 ostrio:cstorage@4.0.1
 ostrio:files@3.0.1
-ostrio:flow-router-extra@3.12.1
+ostrio:flow-router-extra@3.13.0
 ostrio:i18n@3.2.1
 promise@1.0.0
 quave:synced-cron@2.4.0
@@ -26,6 +26,372 @@ Versions:
 - WeKan 8.00-8.06 had wrong raw database directory setting /var/snap/wekan/common/wekan and some cards were not visible,
  it was fixed at WeKan 8.07 where database directory is back to /var/snap/wekan/common and all cards are visible.

+# v9.06 2026-05-02 WeKan ® release
+
+This release adds the following updates:
+
+- [Docs: Update lxc commands](https://github.com/wekan/wekan/commit/3c8db21d2f56eefe3d8b7f3228b580407a4fe89b).
+  Thanks to xet7.
+- [Docs: Added firewall config for Internet access from LXD Ubuntu container at Fedora Asahi Linux Remix, because building Linux arm64 .zip bundle of WeKan](https://github.com/wekan/wekan/commit/82c78ebd1efb888940ccf64affd23400f5485755).
+  Thanks to xet7.
+- [Docs: Added Manual Parallel Snap](https://github.com/wekan/wekan/commit/eb824938cb750921bec721d80eab2670ba567869).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix Snap Candidate WRITABLE_PATH directory permissions at Parallel Snap file path /var/snap/wekan_SOMENAME/common/files/](https://github.com/wekan/wekan/commit/7556b3ed8e29b9edd074c1dd8c03a9b804787523).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.05 2026-05-02 WeKan ® release
+
+This release adds the following updates:
+
+- [Update version script and dependencies](https://github.com/wekan/wekan/commit/4e77df9ff52ef2aed44e95ad4ef58d0cde6593b7).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- Fix Snap Candidate attachments WRITABLE_PATH for Parallel Snap installs.
+  [Part 1](https://github.com/wekan/wekan/commit/cadd015d20e6b677fefb040ab8c5b1a3e972a394),
+  [Part 2](https://github.com/wekan/wekan/commit/cd2c69f5f05d932074ca80ae569cc8d836770f7b).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.04 2026-05-01 WeKan ® release
+
+This release adds the following updates:
+
+- [Upgrade to MongoDB 7.0.32. Update version script.](https://github.com/wekan/wekan/commit/653c61081a8d9306fb0b152f6a3a497c2607a1cf).
+  Thanks to MongoDB developers and xet7.
+- [Upgrade to MongoDB 7.0.32 at Helm Chart](https://github.com/wekan/charts/commit/c55e9d3a130a7d259681185561b2741a64a8353e).
+  Thanks to MongoDB developers.
+- [Upgrade to MongoDB 7.0.32 at Windows Bundle docs](https://github.com/wekan/wekan/commit/2a3aa981d2ba02ec87981e3af843811e31328fea).
+  Thanks to MongoDB developers.
+
+and fixes the following bugs:
+
+- [Fix can not edit checklist title](https://github.com/wekan/wekan/commit/309b488861c29b4d74262f099ee11329f6d151c7).
+  Thanks to xet7.
+- [Fix Cannot delete card checklist title, by removing "Delete" and "Convert to Card" that belong to Checklist Items only. Checklist Menu already has Delete Checklist](https://github.com/wekan/wekan/commit/9defe9681b8091eec3037872882d0894fbdeeb20).
+  Thanks to rileybroberts and xet7.
+- [Fix: Added space between Card Number and Card Title at Minicard and Opened Card](https://github.com/wekan/wekan/commit/d04beea6f8797856806ee63df6cd30a0c6446bd5).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.03 2026-04-29 WeKan ® release
+
+This release adds the following new features:
+
+- [Add missing board‑attachments API endpoint](https://github.com/wekan/wekan/pull/6321).
+  Thanks to KhaoulaMaleh.
+
+and adds the following updates:
+
+- Update version script.
+  [Part 1](https://github.com/wekan/wekan/commit/e547be9ab81f6a880954b3e34fc3b5e3edc8efc5),
+  [Part 2](https://github.com/wekan/wekan/commit/e22f4226151d54593d11ad8040cd46c39435ce5b).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.02 2026-04-28 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix mongodb in snap 9.01 on Ubuntu 24.04 crashes because of missing libcrypto.so.1.1](https://github.com/wekan/wekan/commit/a4b5ac6c4e2cfba6983b81ff0282e1c787576d06).
+  Thanks to sbaecker.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.01 2026-04-28 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated Docker platforms for what currently builds successfully](https://github.com/wekan/wekan/commit/fdb477f3517383eb17169b1dfff2ef94c12b6296).
+  Thanks to xet7.
+- [Docs: Updated s390x page](https://github.com/wekan/wekan/commit/855cb86088c7c54734eddb1ddc5a007b432a0d91).
+  Thanks to xet7.
+- [Removed charts, that are moved back to github.com/wekan/charts](https://github.com/wekan/wekan/commit/b49aa050e91b4bd560512af1beece791c6e39114).
+  Thanks to xet7.
+- [Moved website to separate repo. Moved docs2 back to docs](https://github.com/wekan/wekan/commit/f6d8befb56c88eb0867c70bac708f867fe731a5a).
+  Thanks to xet7.
+- [Disable not working GitHub workflows](https://github.com/wekan/wekan/commit/58de6bb73714e6c6d4010de5c72499f429bd9a41).
+  Thanks to xet7.
+- [Fix Snap mongodb port wrong](https://github.com/wekan/wekan/commit/11a2c95ea70a3dcf9243369f8feeaea301a93bb6).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.00 2026-04-27 WeKan ® release
+
+This release adds the following updates:
+
+- [Bump actions/upload-pages-artifact from 4 to 5](https://github.com/wekan/wekan/pull/6304).
+  Thanks to dependabot.
+- [Bump docker/setup-buildx-action from 3 to 4](https://github.com/wekan/wekan/pull/6305).
+  Thanks to dependabot.
+- [Bump actions/deploy-pages from 4 to 5](https://github.com/wekan/wekan/pull/6306).
+  Thanks to dependabot.
+- [Update release scripts](https://github.com/wekan/wekan/commit/db2701f1d731898c80b44606a985d5d132f7f6ed).
+  Thanks to xet7.
+- [Added back jam packages. Updated dependencies](https://github.com/wekan/wekan/commit/bf5ca3d3ebef7f00778eb1a518fcfaf5b5fc5d5c).
+  Thanks to xet7.
+- [Updated dependencies](https://github.com/wekan/wekan/commit/16832124ce169c823ab1f95a43a85bec22d5556f).
+  Thanks to xet7.
+- [Update security.md etc](https://github.com/wekan/wekan/commit/7700efde1fba8483a78c67d03e3a0d214cedb67b).
+  Thanks to xet7.
+- [Updated HoF](https://github.com/wekan/wekan/commit/675c6611146a4a47eee1e513b83152007e3b9aee).
+  Thanks to xet7.
+- [Update releases scripts](https://github.com/wekan/wekan/commit/64f58455ff471b5a5567d7230850124cf0afacb0).
+  Thanks to xet7.
+- [Update release and version scripts](https://github.com/wekan/wekan/commit/699b9a9c712f01068324c051be4fb149dfc6f100).
+  Thanks to xet7.
+- Updated dependencies.
+  [Part 1](https://github.com/wekan/wekan/commit/b459151798d9808b4243d230ff6759a58d4016f5),
+  [Part 2](https://github.com/wekan/wekan/commit/74965f5f95ba4e4dfd7381becd55184731a60fca).
+  Thanks to developers of dependencies.
+- [Updated website](https://github.com/wekan/wekan/commit/ef4161889af58827f105749362196fd471e3e38c).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Update cards.js](https://github.com/wekan/wekan/pull/6299).
+  Thanks to snowsky.
+- [Fix MongoDB replicaset setup at docker-compose.yml](https://github.com/wekan/wekan/commit/c4e084ffbbc5870a13e79f80a2982d2eb7f2f04e).
+  Thanks to C0rn3j.
+- [Add permission checks to list width method](https://github.com/wekan/wekan/pull/6303).
+  Thanks to Raawen-dev.
+- [Fix UI hangs and data loss by disabling changeStreams, until there is new Meteor release that included bugfix to changeStreams](https://github.com/wekan/wekan/commit/c47eb013b4d8d0f2dea7b801adc60151f6e3aee1).
+  Thanks to bcook-konza and italojs.
+- [Fix list actions popup overflow](https://github.com/wekan/wekan/pull/6310).
+  Thanks to Raawen-dev.
+- [Fix mycards subscription](https://github.com/wekan/wekan/pull/6314).
+  Thanks to aminsaidane.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.99 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Release scripts: Update versions](https://github.com/wekan/wekan/commit/32e1ec9d2251840dc2d57ffa7976f2c60546ca9d).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.98 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Release scripts: Detect newest Node.js 24.x version](https://github.com/wekan/wekan/commit/fde59148dc8bd712e30cbf969d4007b2a7f01e6f).
+  Thanks to xet7.
+- [Release scripts: Update versions at website with release-website.sh script](https://github.com/wekan/wekan/commit/9174001862f1545626730b9a51754ab77b645338).
+  Thanks to xet7.
+- [Release scripts: Detect newest MongoDB 7.x stable version and update to use it](https://github.com/wekan/wekan/commit/72f6d96dbc3becc2767eb6f88b0f218679d1ac78).
+  Thanks to xet7.
+- [Moved website from repo wekan/wekan.fi to wekan/wekan/docs](https://github.com/wekan/wekan/commit/3c36db33e91e504722edc60faec5d6b4aa301850).
+  Thanks to xet7.
+- [Moved docs to docs2, and wekan.fi to docs, to be able publish with GitHub Pages](https://github.com/wekan/wekan/commit/1c0d8e9964af40be91eda9668dfeebd01b3a5720).
+  Thanks to xet7.
+- [Update markdown docs links from docs to docs2](https://github.com/wekan/wekan/commit/c1639ea58973efcae0758385cc5d8d7ffbf1e8d9).
+  Thanks to xet7.
+- [Commented out requirement to update website manually](https://github.com/wekan/wekan/commit/64d351d835628dad80062e3c362701b35ae5bb33).
+  Thanks to xet7.
+- [Moved Helm Charts from helm directory to docs/wekan and docs/charts to be at wekan.fi/wekan and wekan.fi/charts](https://github.com/wekan/wekan/commit/38e488ee4a63d61159d8efcddb6e454347bce91a).
+  Thanks to xet7.
+- [Release scripts: Fix indentation at release-all.yml](https://github.com/wekan/wekan/commit/10f009f5b15fd077577a71504b0e0c89c4e6fd95).
+  Thanks to xet7.
+- [Release scripts: Use latest available Node.js slim docker images when building](https://github.com/wekan/wekan/commit/d998e8cb4a5280c93448d144ab01335ce29b43dc).
+  Thanks to xet7.
+- [Release scripts: Fix updating version numbers](https://github.com/wekan/wekan/commit/7b0e2213cfbf0e2a17a143aa7ad9f979fb0fbf07).
+  Thanks to xet7.
+- [Release scripts: Require only newest version number when releasing](https://github.com/wekan/wekan/commit/052d8c15844dfc709dc3ac281795629c175869e0).
+  Thanks to xet7.
+- [Release scripts: Use 24-slim fallback](https://github.com/wekan/wekan/commit/a0c190137dfe9fd8da71380f6c67344812561f9f).
+  Thanks to xet7.
+- [Release scripts: use node:24-slim directly](https://github.com/wekan/wekan/commit/51ad6ed99df7ecdc925d314a6c5fab345f75d549).
+  Thanks to xet7.
+- [Fix Helm Chart parts to docs/wekan and docs/charts](https://github.com/wekan/wekan/commit/1820804b9f46e510c4bf05324755a5eeec5a3b13).
+  Thanks to xet7.
+- [Release scripts: Updated creating Helm Charts to docs/wekan and docs/charts](https://github.com/wekan/wekan/commit/f6198dee30ed6514974d2e821997d340e67fc954).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.97 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- Release Scripts: Clean GitHub Cache.
+  [Part 1](https://github.com/wekan/wekan/commit/e59bc9cd86cc16333e24b2e7e8e5d5cf72f81e3e),
+  [Part 2](https://github.com/wekan/wekan/commit/13cdf08e223e83ef9a2f36417c11ad002e884f29),
+  [Part 3](https://github.com/wekan/wekan/commit/6d0978d0ede8316a1d9ac6afc0ecf7f02d9193d6).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix GitHub Actions builds](https://github.com/wekan/wekan/commit/6478d27d1ca2f6e27c025e0cc97b618bc255083f).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.96 2026-04-16 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix GitHub Actions builds](https://github.com/wekan/wekan/commit/03ba747bc073f3993d933b814d35c7380fea745d).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.95 2026-04-16 WeKan ® release
+
+This release adds the following new features:
+
+- [Helm Chart: Add single-node ReplicaSet support with auto MONGO_OPLOG_URL](https://github.com/wekan/wekan/pull/6292).
+  Thanks to titver968.
+- [Helm Chart: Use current Finland time for created field at index.yaml for newest built Helm Chart release](https://github.com/wekan/wekan/commit/135af977af4a1c598d2e067de0facb6eae8f8de1).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix Cannot find module /build/main.js error in latest Docker image](https://github.com/wekan/wekan/commit/6dfe81cbcb0c6e2003b1984586d56042a6408e70).
+  Thanks to s8321414 and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.94 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated dompurify](https://github.com/wekan/wekan/commit/c27d5d04124f3eec659bbe5187a625c43176fc4f).
+  Thanks to developers of dompurify.
+
+and fixes the following bugs:
+
+- [Fix Can't start latest docker image because of MongoDB Index errors](https://github.com/wekan/wekan/commit/d537b7c9f3505fd4c1653f87d5f86d7e7729a514).
+  Thanks to s8321414 and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.93 2026-04-16 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix SSO Login broken. Part 2](https://github.com/wekan/wekan/commit/4aa7b6aa2034f27efeb67d5dfa8f6acbe0005786).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.92 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated Helm Charts versions](https://github.com/wekan/wekan/commit/24ebb4ba45344ad152747c31e7df76217e5b8909).
+  Thanks to xet7.
+- [GitHub Actions: Added missing sudo to snap build](https://github.com/wekan/wekan/commit/2c8a6c8ec6e24b6b6bb153da3edd089e0f0087cc).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.91 2026-04-16 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix building Snap at GitHub Actions](https://github.com/wekan/wekan/commit/89de05ee91612cef4f13fa8ad32d112dca5bdb43).
+  Thanks to xet7.
+- [Updated Helm Chart URL at readme](https://github.com/wekan/wekan/commit/529e0d25ef2ea84953d1c1e6a23b5798d34583fb).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.90 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Added GitHub Actions builds for Docker and Snap. Moved Helm Charts from charts repo to wekan repo](https://github.com/wekan/wekan/commit/f57ce521984f6f358410863c71fcaee342bb8107).
+  Thanks to xet7.
+- [Changed ArtifactHub from wekan/charts repo to wekan/wekan repo](https://github.com/wekan/wekan/commit/99519af83adc45eca7beb40a4e82f5b73764b7fc).
+  Thanks to xet7.
+- [Release scripts: Moved more steps to GitHub Actions](https://github.com/wekan/wekan/commit/357f63d01fc013ea412501dabbdd977e5f1efa61).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Removed jam:offline jam:method jam:pub-sub, because they are not used, and they cause too much database usage](https://github.com/wekan/wekan/commit/0dd924f14889100e74fbd5e8d17bb3a7209025ca).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.89 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Disable jam:offline keepAll BEFORE any collections are created. Part 2](https://github.com/wekan/wekan/commit/f6a851a3d887ce9fa2fa5f62aad2a2ecf326c863).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.88 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Disable jam:offline keepAll to prevent full-collection COLLSCAN queries and Ensure standard GridFS index on attachments.chunks for efficient chunk lookups](https://github.com/wekan/wekan/commit/ec0c1bc9afd6e3fd8b60f9f17f96dc5df52dbfc2).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.87 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Try to fix Snap](https://github.com/wekan/wekan/commit/fc02a15753badc8d06d020aa97daae28ac05a310).
+  Thanks to xet7.
+- [Improve handling of ROOT_URL as an environement variable](https://github.com/wekan/wekan/pull/6286).
+  Thanks to FlorentDotMe.
+- [UI: Enable the horizontal scroll in the quick access menu boards list](https://github.com/wekan/wekan/pull/6287).
+  Thanks to FlorentDotMe.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.86 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Try to fix Snap](https://github.com/wekan/wekan/commit/10f801d31b7e2b1a8c562bf24f65c4cc6efe6013).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.85 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Try to fix Snap](https://github.com/wekan/wekan/commit/0e13bfc50eadc72adccfe785a1b47c30d0ba5429).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.84 2026-04-15 WeKan ® release
+
+This release adds the following new features:
+
+- [Helm Chart: Make readiness, liveness and startup probes configurable](https://github.com/wekan/charts/pull/51).
+  Thanks to snowsky.
+
+and fixes the following bugs:
+
+- [Fix SSO Login OIDC and OpenID Connect](https://github.com/wekan/wekan/pull/6284).
+  Thanks to sbaecker and nebulade.
+- [Try to fix Snap Candidate](https://github.com/wekan/wekan/commit/bc92978fa9c9373947de40fe9ca584e133825610).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v8.83 2026-04-14 WeKan ® release

 This release adds the following updates:
@@ -7,14 +7,14 @@ LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 # TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=8.83
+ARG VERSION=9.06
 ARG DEBIAN_FRONTEND=noninteractive

 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"

 ENV \
    DEBUG=false \
-    NODE_VERSION=v24.14.1 \
+    NODE_VERSION=v24.15.0 \
    METEOR_RELEASE=METEOR@3.5-beta.7 \
    USE_EDGE=false \
    NPM_VERSION=11.11.0 \
@@ -190,7 +190,7 @@ rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc
 ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs"

 # NPM configuration
-npm install -g npm@${NPM_VERSION} --production
+npm install -g npm@${NPM_VERSION}
 chown --recursive wekan:wekan /home/wekan/

 # Temporary Tar swap for Meteor bundle
@@ -203,7 +203,7 @@ cd /home/wekan/app
 wget "https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip"
 unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip"
 rm "wekan-${VERSION}-${WEKAN_ARCH}.zip"
-npm install --production --no-audit --prefix ./bundle/programs/server
+npm install --prefix ./bundle/programs/server
 mv /home/wekan/app/bundle /build

 # Restore original tar
@@ -1,36 +1,19 @@
-## About Money
+## About Money: No bounty

-See [CONTRIBUTING](CONTRIBUTING.md)
+There is no bounty, like described at [CONTRIBUTING.md](CONTRIBUTING.md),
+because WeKan is NOT Big Tech. WeKan is FLOSS.

 ## Responsible Security Disclosure

-1. To send email, if possible, use PGP key [security-at-wekan.fi.asc](security-at-wekan.fi.asc)
-2. Send info about security issue ONLY to security@wekan.fi . NOT TO ANYWHERE ELSE. NO CC, NO BCC.
-3. Wait for new WeKan release that fixes security issue to appear to top of
+1. Please email info about security issue to security@wekan.fi .
+   If possible, include code for fixing security issue.
+   Optional PGP key is at [security-at-wekan.fi.asc](security-at-wekan.fi.asc)
+2. Wait for new WeKan release that fixes security issue to appear to top of
   https://github.com/wekan/wekan/blob/main/CHANGELOG.md
-4. We will thank you by adding you to Hall the of Fame: https://wekan.fi/hall-of-fame/
-5. All vulnerability details will be private to security@wekan.fi ,
-   unless you help all WeKan platforms to have a way to upgrade, like sending
-   database migrations code to security@wekan.fi or PRs to https://github.com/wekan/wekan/pulls .
-   There is no benefit to the Wordwide Security Community to have more details about vulnerabilities,
-   if Worldwide Security Community does not help to make upgrades possible.
-6. If some day a way becomes available to upgrade all WeKan platforms,
-   this page will be updated to add permission for security researchers
-   to request new GHSA or CVE ID and publish your vulnerability details at your blog, talks, etc,
-   and send that info also to security@wekan.fi to be added to
-   Hall of Fame: https://wekan.fi/hall-of-fame/ to get Upgrade Bonus Point Stars.
-   In that case, it will become possible for security@wekan.fi to publish all
-   remaining private security details, and publicly thank Worldwide Security Community.
-
-## Bonus Points
-
- If you include code for fixing security issue
-
-## Losing Points
-
- If you ask about [bounty](CONTRIBUTING.md). There is no bounty. WeKan is NOT Big Tech. WeKan is FLOSS.
- If you forget to include vulnerability details.
- If you send info about security issue to somewhere else than security@wekan.fi
+3. We will thank you by adding you to 
+   Hall the of Fame: https://wekan.fi/hall-of-fame/
+4. If you get CVE number assigned, please send it to security@wekan.fi, it will be added to
+   Hall the of Fame: https://wekan.fi/hall-of-fame/

 ## How Should Reports Be Formatted?

@@ -60,12 +43,12 @@ and we don't have any permissions to do security scans on those donated servers.
 Please don't perform research that could impact other users. Second, please keep
 the reports short and succinct. If we fail to understand the logic of your bug, we will tell you.

-You can [Install Wekan](https://github.com/wekan/wekan/releases) on your own computer
+You can [Install Wekan](https://wekan.fi/install/) on your own computer
 and scan it's vulnerabilities there.

 ## About Wekan Versions

-There are only 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.
+There are 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.

 ### Standalone Wekan Security

@@ -78,7 +61,8 @@ WeKan is used in most countries of the world https://snapcraft.io/wekan
 and by companies that have 30k users.

 - Wekan private board attachments are not accessible without logging in.
- There is feature to set board public, so that board is visible without logging in in readonly mode, with realtime updates.
+- There is feature to set board public, so that board is visible without logging
+  in readonly mode, with realtime updates.
 - Admin Panel has feature to disable all public boards, so all boards are private.

 ## SSL/TLS
@@ -107,7 +91,8 @@ and by companies that have 30k users.
 Q:

 Hello,
-I have just seen the Meteor DevTools Evolved extension and was wondering if anyone had asked themselves the question of security.
+I have just seen the Meteor DevTools Evolved extension and was wondering if anyone
+had asked themselves the question of security.
 Insofar as all data is shown in the minimongo tab in plain text.
 How can data be hidden from this extension?

@@ -115,11 +100,14 @@ A:

 ## PubSub

- It is not a security issue to show text or images that the user has permission to see. It is a security issue, if browserside is some text or image that user should not see.
+- It is not a security issue to show text or images that the user has permission to see.
+  It is a security issue, if browserside is some text or image that user should not see.
 - Meteor has browserside minimongo database, made with JavaScript, updated with Publish/Subscribe, PubSub.
- Publish/Subscribe means, that realtime web framework reads database changes stream, and then immediately updates webpage,
-  like like dashboards, chat, kanban. That is the point of any realtime web framework in any programming language.
- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that at minimongo is only text that user has permission to see.
+- Publish/Subscribe means, that realtime web framework reads database changes stream,
+  and then immediately updates webpage, like dashboards, chat, kanban.
+  That is the point of any realtime web framework in any programming language.
+- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that
+  at minimongo is only text that user has permission to see.
 - Check as a logged-in user and as a logged-out user.
 - Check permissions and sanitize before allowing some change, because someone could modify content of input field,
  PubSub/websocket data (for example with Burp Suite Community Edition), etc.
@@ -129,7 +117,8 @@ A:
 - PubSub uses WebSockets, so you need those to be enabled on the webserver like Caddy/Nginx/Apache etc, examples of settings
  at right menu of https://github.com/wekan/wekan/wiki
 - Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to
-  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods at https://github.com/wekan/wekan/tree/main/models
+  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods
+  at https://github.com/wekan/wekan/tree/main/models
 - For Admin:
  - You can have input field for password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
  - You can save password to database https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
@@ -276,14 +265,9 @@ a security issue, we'd like to know about it, and also how to fix it:

 Typical already-known or 'no impact' bugs such as:

- [Wekan API old tokens not replaced correctly](https://github.com/wekan/wekan/issues/1437)
- Missing Cookie flags on non-session cookies or 3rd party cookies
- Logout CSRF
 - Social engineering
 - Denial of service
- SSL BEAST/CRIME/etc. WeKan does not have SSL built-in; it uses Caddy/Nginx/Apache, etc., on the front end.
-  Integrated Caddy support is updated often.
- Email spoofing, SPF, DMARC & DKIM. Wekan does not include email server.
+- SSL BEAST/CRIME/etc. WeKan does not have SSL built-in; it uses Caddy/Nginx/Apache on the front end.

 Wekan is Open Source with MIT license, and free to use also for commercial use.
 We welcome all fixes to improve security by email to security@wekan.fi
@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v8.83.0"
+appVersion: "v9.06.0"
 files:
  userUploads:
    - README.md
@@ -66,7 +66,7 @@ template(name="cardDetails")
            +viewer
              if currentBoard.allowsCardNumber
                span.card-number
-                  | ##{getCardNumber}
+                  | ##{getCardNumber} &nbsp;
              = getTitle
            if isWatching
              i.card-details-watch
@@ -34,7 +34,7 @@ template(name="checklists")
 template(name="checklistDetail")
  .js-checklist.checklist.nodragscroll
    +inlinedForm(classNames="js-edit-checklist-title" checklist = checklist)
-      +editChecklistItemForm(checklist = checklist)
+      +editChecklistForm(checklist = checklist)
    else
      .checklist-title
        span
@@ -85,6 +85,19 @@ template(name="addChecklistItemForm")
          label.toggle-label(for="toggleNewlineBecomesNewChecklistItemOriginOrder")
          | {{_ 'originOrder'}}

+template(name="editChecklistForm")
+  a.fa.fa-copy(title="{{_ 'copy-text-to-clipboard'}}")
+  span.copied-tooltip {{_ 'copied'}}
+  textarea.js-edit-checklist-item(rows='1' autofocus dir="auto")
+    if $eq type 'item'
+      = item.title
+    else
+      = checklist.title
+  .edit-controls.clearfix
+    button.primary.confirm.js-submit-edit-checklist-item-form(type="submit") {{_ 'save'}}
+    a.fa.fa-times-thin.js-close-inlined-form(title="{{_ 'close-edit-checklist-item'}}")
+    span(title=createdAt) {{ displayDate createdAt }}
+
 template(name="editChecklistItemForm")
  a.fa.fa-copy(title="{{_ 'copy-text-to-clipboard'}}")
  span.copied-tooltip {{_ 'copied'}}
@@ -135,8 +135,11 @@ Template.checklists.events({
    event.preventDefault();
    const textarea = tpl.find('textarea.js-edit-checklist-item');
    const title = textarea.value.trim();
-    const checklist = Template.currentData().checklist;
-    checklist.setTitle(title);
+    const formData = Blaze.getData(event.currentTarget) || Blaze.getData(event.target);
+    const checklist = formData?.checklist;
+    if (checklist) {
+      checklist.setTitle(title);
+    }
  },
  'submit .js-add-checklist-item'(event, tpl) {
    event.preventDefault();
@@ -74,7 +74,7 @@ template(name="minicard")
      +viewer
        if showCardNumber
          span.card-number
-            | ##{getCardNumber}
+            | ##{getCardNumber} &nbsp;
        = getTitle
    if showLabels
      if labels
@@ -177,7 +177,6 @@
 }
 #header-quick-access ul.header-quick-access-list {
  transition: opacity 0.2s;
-  overflow: hidden;
  white-space: nowrap;
  padding: 10px;
  margin: -10px;
@@ -185,16 +184,18 @@
  min-width: 0; /* Allow shrinking below content size */
  display: flex; /* Use flexbox for better control */
  align-items: center;
+  overflow-x: auto;
+  scrollbar-color: white #2573a7;
 }

 /* Hide scrollbar completely */
 #header-quick-access ul.header-quick-access-list::-webkit-scrollbar {
-  display: none;
+  display: flex;
 }

 #header-quick-access ul.header-quick-access-list {
-  -ms-overflow-style: none; /* IE and Edge */
-  scrollbar-width: none; /* Firefox */
+  -ms-overflow-style: thin; /* IE and Edge */
+  scrollbar-width: thin; /* Firefox */
 }
 #header-quick-access ul.header-quick-access-list li {
  display: inline-block; /* Keep inline-block for proper spacing */
@@ -70,10 +70,6 @@ template(name="header")
          else
            li.current.empty(title="{{_ 'quick-access-description'}}")
            | {{_ 'quick-access-description'}}
-        #header-new-board-icon
-      // Next line is used only for spacing at header,
-      // there is no visible clickable icon.
-      #header-new-board-icon
      //
        Hide duplicate create board button,
      //
@@ -767,3 +767,124 @@ body.mobile-mode .pop-over .content-wrapper {
  overflow-y: auto !important;
  overflow-x: hidden !important;
 }
+
+/* ============================================
+   FIX: List actions popup overflow (Issue #6221)
+   Prevents menu from overflowing outside viewport
+   ============================================ */
+
+/* General fix for all popups with many items */
+.pop-over .pop-over-list {
+  max-height: 60vh;
+  overflow-y: auto;
+  overflow-x: hidden;
+}
+
+/* Specific fix for list actions menu */
+.pop-over[data-popup="listActionsPopup"] {
+  max-height: 85vh !important;
+  overflow-y: auto !important;
+}
+
+.pop-over[data-popup="listActionsPopup"] .content-wrapper {
+  max-height: calc(85vh - 50px) !important;
+  overflow-y: auto !important;
+}
+
+/* Prevent any popup from overflowing viewport */
+.pop-over {
+  max-height: 90vh !important;
+  display: flex !important;
+  flex-direction: column !important;
+}
+
+.pop-over .content-wrapper {
+  flex: 1 1 auto !important;
+  overflow-y: auto !important;
+  min-height: 0 !important;
+}
+
+.pop-over .content-container {
+  flex: 1 1 auto !important;
+  display: flex !important;
+  flex-direction: column !important;
+  min-height: 0 !important;
+}
+
+.pop-over .content {
+  flex: 1 1 auto !important;
+  overflow-y: auto !important;
+  min-height: 0 !important;
+}
+
+/* Keep header fixed while content scrolls */
+.pop-over .header {
+  flex-shrink: 0 !important;
+}
+
+/* Mobile-specific adjustments */
+@media screen and (max-width: 800px) {
+  .pop-over[data-popup="listActionsPopup"] {
+    max-height: 100vh !important;
+  }
+  
+  .pop-over[data-popup="listActionsPopup"] .content-wrapper {
+    max-height: calc(100vh - 48px) !important;
+  }
+}
+/* STRONGER FIX - Override inline styles */
+.pop-over[style*="height"],
+.pop-over[style*="max-height"] {
+  max-height: 80vh !important;
+  height: auto !important;
+  overflow-y: auto !important;
+}
+
+.pop-over[style*="height"] .content-wrapper,
+.pop-over[style*="max-height"] .content-wrapper {
+  max-height: calc(80vh - 60px) !important;
+  height: auto !important;
+  overflow-y: auto !important;
+}
+
+/* Force list popups to have a max height and scroll */
+.pop-over .pop-over-list {
+  max-height: 300px !important;
+  overflow-y: auto !important;
+}
+
+/* Make sure the popup doesn't grow too tall */
+.pop-over:has(.pop-over-list) {
+  max-height: 400px !important;
+  height: auto !important;
+}
+
+/* For the list actions menu specifically */
+[data-popup="listActionsPopup"] .pop-over-list,
+.js-open-list-menu + .pop-over .pop-over-list {
+  max-height: 350px !important;
+  overflow-y: auto !important;
+}
+
+/* ============================================
+   FIX: List actions popup overflow (Issue #6221)
+   ============================================ */
+
+/* Force list popups to have a max height and scroll */
+.pop-over .pop-over-list {
+  max-height: 300px !important;
+  overflow-y: auto !important;
+}
+
+/* Make sure the popup doesn't grow too tall */
+.pop-over:has(.pop-over-list) {
+  max-height: 400px !important;
+  height: auto !important;
+}
+
+/* For the list actions menu specifically */
+[data-popup="listActionsPopup"] .pop-over-list,
+.js-open-list-menu + .pop-over .pop-over-list {
+  max-height: 350px !important;
+  overflow-y: auto !important;
+}
@@ -171,7 +171,7 @@ services:
  # Leave it unset or empty to skip migration.
  #-------------------------------------------------------------------------------------
  #wekan-migrate:
-  #  image: node:24.14.1-slim
+  #  image: node:24.15.0-slim
  #  container_name: wekan-migrate
  #  restart: "no"
  #  networks:
@@ -229,12 +229,31 @@ services:
    #command: mongod --logpath /dev/null --oplogSize 128 --replSet rs0 --quiet
    #command: mongod --oplogSize 128 --replSet rs0 --quiet
    command: >
-      sh -c "
-        mongod --oplogSize 128 --replSet rs0 --quiet --bind_ip_all &
-        until mongosh --eval 'rs.initiate()' > /dev/null 2>&1; do
+      sh -c '
+        mongod --oplogSize 128 --replSet rs0 --bind_ip_all --quiet &
+        until mongosh --host 127.0.0.1 --quiet --eval "
+          try {
+            const status = rs.status();
+            quit(status.ok === 1 ? 0 : 1);
+          } catch (e) {
+            if (
+              e.codeName === \"NotYetInitialized\" ||
+              e.message.includes(\"no replset config has been received\") ||
+              e.message.includes(\"not yet initialized\")
+            ) {
+              rs.initiate({
+                _id: \"rs0\",
+                members: [{ _id: 0, host: \"wekandb:27017\" }]
+              });
+              quit(1);
+            }
+            quit(1);
+          }
+        " >/dev/null 2>&1; do
          sleep 2
-        done;
-        wait"
+        done
+        wait
+      '
    networks:
      - wekan-tier
    expose:
@@ -294,7 +313,10 @@ services:
      #- METEOR_REACTIVITY_ORDER=polling
      # https://forums.meteor.com/t/meteor-3-5-beta-change-streams-performance-improvements/64461#change-streams-setup-3
      # https://github.com/meteor/meteor/blob/release-3.5/v3-docs/docs/performance/change-streams-observer-driver.md#choosing-the-reactivity-driver-order
-      - METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+      # Use oplog,polling to fix performance until changeStreams is fixed at next release of Meteor 3.5 Beta:
+      # https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
+      # Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+      - METEOR_REACTIVITY_ORDER=oplog,polling
      #-----------------------------------------------------------------
      # ==== WRITEABLE PATH FOR FILE UPLOADS ====
      - WRITABLE_PATH=/data
@@ -104,10 +104,20 @@ sudo snap list
 ```
 If not, change to candidate:
 ```
-sudo snap refresh wekan_customer1 --channel=latest/candidate
+sudo snap refresh wekan_customer1 --channel=latest/candidate --amend
+```
+## Manual Parallel Snap
+
+If using manual snap package, with Parallel Snap, that has name wekan_other:
+```
+sudo snap install --dangerous wekan-VERSION.snap --name wekan_other
+```
+Back to channel:
+```
+sudo snap refresh wekan_other --channel=latest/candidate --amend
 ```
 If it complains about old database version (was at stable), stop it, move old files somewhere safe, and start again.
-WARNING: this deletes 
+WARNING: this deletes stuff.
 ```
 sudo su
 mkdir old_customer1_common
@@ -333,16 +343,21 @@ files.company.com {

 To server and LXC/LXD containers, install these packages:

+Ubuntu:
 ```
 sudo apt install libsquashfuse0 squashfuse fuse
 ```
-
+Fedora
+```
+sudo dnf install squashfuse fuse
+```
 Source: https://forum.snapcraft.io/t/system-does-not-fully-support-snapd/14767/11

 ## LXD init CIDR

 IPv4 CIDR: 10.1.1.1/24

+Ubuntu:
 ```
 sudo apt install snapd

@@ -351,7 +366,28 @@ sudo reboot
 sudo snap install lxd

 lxd init
+```
+Fedora:
+```
+sudo dnf install snapd

+sudo reboot
+
+sudo snap install lxd
+
+# Any Fedora Linux or Fedora Linux Asahi Remix at Apple Silicon:
+# Internet access from LXD container:
+# 1) Allow LXD-bridge:
+sudo firewall-cmd --zone=trusted --add-interface=lxdbr0 --permanent
+sudo firewall-cmd --reload
+# 2) Allow IP Masquerading:
+sudo firewall-cmd --zone=public --add-masquerade --permanent
+sudo firewall-cmd --reload
+
+lxd init
+```
+Answers for lxd init:
+```
 Would you like to use LXD clustering? (yes/no) [default=no]: 
 Do you want to configure a new storage pool? (yes/no) [default=yes]: 
 Name of the new storage pool [default=default]: 
@@ -418,7 +454,7 @@ Ubuntu Touch:
 ```
 sudo su

-snap install lxd --channel=5.21/stable
+snap install lxd
 ```

 3. From Ubuntu Touch Terminal, lxd init, etc.
@@ -434,17 +470,17 @@ sudo lxc profile set default security.nesting true
 5. Start new lxc container

 ```
-# launch-ubu2504.sh
+# launch-ubu2604.sh
 # lxc launch image-name container-name
-lxc launch ubuntu:25.04 ubu2504
+lxc launch ubuntu:26.04 ubu2604
 ```

 6. Bash shell to inside of container:

 ```
-# into-ubu2504.sh
+# into-ubu2604.sh
 # lxc exec container-name -- /bin/bash
-lxc exec ubu2504 -- /bin/bash
+lxc exec ubu2604 -- /bin/bash
 ```

 ## 3) Snapd and Wekan
@@ -471,7 +507,7 @@ You can also add more lxc containers to different subdomains and proxy to them i

 ### New Ubuntu container
 ```
-lxc launch images:ubuntu/20.04 lxccontainername
+lxc launch ubuntu:26.04 lxccontainername
 ```
 ### Inside LXC container
 ```
@@ -1,3 +1,20 @@
+## From xet7, WeKan at s390x
+
+- https://www.openmainframeproject.org/blog/2020/11/20/wekan-open-source-kanban-on-s390x
+
+[xet7](https://github.com/xet7), as maintainer of [WeKan](https://wekan.fi), got access
+to mainframe at IBM LinuxOne Community Cloud.
+Access to those servers is monitored, it's running on a real mainframe.
+
+Previously xet7 had ssh access. At 2023-09 xet7 got web console access,
+and IBM bumped quota to 2 VMs with 8 GB of memory, 200 GB disk and 4 CPUs each.
+At web console it is possible to create and remove VMs, and select distro
+like RHEL/SUSE/Ubuntu. xet7 did do-release-upgrade to upgrade newest Ubuntu.
+
+## Download
+
+- https://github.com/wekan/wekan/releases
+
 ## About s390x

 - Dave's Garage at 2023-10: Why Do Mainframes Still Exist? What's Inside One? 40TB, 200+ Cores, AI, and more! https://www.youtube.com/watch?v=ouAG4vXFORc
@@ -106,22 +123,12 @@ Transfer/sec:     70.23MB
 Ported by others, not xet7:
 - PostreSQL https://news.ycombinator.com/item?id=38398305

-
-## From xet7, WeKan at s390x
-
- https://www.openmainframeproject.org/blog/2020/11/20/wekan-open-source-kanban-on-s390x
-
-[xet7](https://github.com/xet7), as maintainer of [WeKan](https://wekan.fi), got access to mainframe at IBM LinuxOne Community Cloud. Access to those servers is monitored, it's running on a real mainframe.
-
-Previously xet7 had ssh access. At 2023-09 xet7 got web console access, and IBM bumped quota to 2 VMs with 8 GB of memory, 200 GB disk and 4 CPUs each. At web console it is possible to create and remove VMs, and select distro like RHEL/SUSE/Ubuntu. xet7 did do-release-upgrade to upgrade newest Ubuntu 23.10.
-
-## Download
-
- wekan-VERSION-s390x.zip at https://releases.wekan.team/s390x/
-
 ## Installing MongoDB for s390x

-This Snap package https://snapcraft.io/juju-db , created by Canonical, has MongoDB for various CPU architectures . It is internal package for Canonical's Juju service https://jaas.ai . Snap repo at https://github.com/juju/juju-db-snap and copy at https://github.com/wekan/mongodb-snap
+This Snap package https://snapcraft.io/juju-db , created by Canonical,
+has MongoDB for various CPU architectures .
+It is internal package for Canonical's Juju service https://jaas.ai .
+Snap repo at https://github.com/juju/juju-db-snap and copy at https://github.com/wekan/mongodb-snap

 Install Snap for your distro https://snapcraft.io/docs/installing-snapd

@@ -10,18 +10,18 @@ This is without container (without Docker or Snap).

 Right click and download files 1-4:

-1. [wekan-8.83-win64.zip](https://github.com/wekan/wekan/releases/download/v8.83/wekan-8.83-win64.zip)
+1. [wekan-9.06-win64.zip](https://github.com/wekan/wekan/releases/download/v9.06/wekan-9.06-win64.zip)
 2. [node.exe](https://nodejs.org/dist/latest-v24.x/win-x64/node.exe)

-3. [mongodb-windows-x86_64-7.0.31-signed.msi](https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-7.0.31-signed.msi)
+3. [mongodb-windows-x86_64-7.0.32-signed.msi](https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-7.0.32-signed.msi)

 4. [start-wekan.bat](https://raw.githubusercontent.com/wekan/wekan/main/start-wekan.bat)

 5. Copy files from steps 1-4 with USB stick or DVD to offline Windows computer

-6. Double click `mongodb-windows-x86_64-7.0.31-signed.msi` . In installer, uncheck downloading MongoDB compass.
+6. Double click `mongodb-windows-x86_64-7.0.32-signed.msi` . In installer, uncheck downloading MongoDB compass.

-7. Unzip `wekan-8.83-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-9.06-win64.zip` , inside it is directory `bundle`, to it copy other files:

 ```
 bundle (directory)
@@ -1399,7 +1399,7 @@
  "accessibility": "Accessibility",
  "accessibility-page-enabled": "تم تمكين صفحة إمكانية الوصول",
  "accessibility-info-not-added-yet": "Accessibility info has not been added yet",
-  "accessibility-title": "Accessibility title",
+  "accessibility-title": "عنوان إمكانية الوصول",
  "accessibility-content": "محتوى إمكانية الوصول",
  "accounts-lockout-settings": "Brute Force Protection Settings",
  "accounts-lockout-info": "These settings control how login attempts are protected against brute force attacks.",
@@ -189,7 +189,7 @@
  "board-private-info": "Denna tavla kommer vara <strong>privat</strong>.",
  "board-public-info": "Denna tavla kommer vara <strong>publik</strong>.",
  "board-drag-drop-reorder-or-click-open": "Dra och släpp för att ändra ordning på tavelsymboler. Klicka på tavelsymbolen för att öppna tavlan.",
-  "board-open-and-move-between-remaining-and-workspaces": "Click board icon to open board. Drag board between __remaining__ and __workspaces__.",
+  "board-open-and-move-between-remaining-and-workspaces": "Klicka på tavlans ikon för att öppna tavlan. Dra tavlan mellan __remaining__ och __workspaces__.",
  "boardChangeColorPopup-title": "Ändra tavelbakgrund",
  "boardChangeBackgroundImagePopup-title": "Ändra bakgrundsbild",
  "allBoardsChangeColorPopup-title": "Ändra färg",
@@ -809,9 +809,9 @@
  "modifiedAt": "Senast ändrad",
  "verified": "Verifierad",
  "active": "Aktiv",
-  "active-team": "Active Team",
-  "active-org": "Active Organization",
-  "active-person": "Active Person",
+  "active-team": "Aktivt team",
+  "active-org": "Aktiv organisation",
+  "active-person": "Aktiv person",
  "card-received": "Mottagen",
  "card-received-on": "Mottagen den",
  "card-end": "Avslutades",
@@ -1,5 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { Meteor } from 'meteor/meteor';
+import { MongoInternals } from 'meteor/mongo';
 import { check } from 'meteor/check';
 import { isFileValid } from './fileValidation';
 import { createBucket } from './lib/grid/createBucket';
@@ -327,6 +328,18 @@ Meteor.methods({

 Meteor.startup(async () => {
  await Attachments.collection.createIndexAsync({ 'meta.cardId': 1 });
+
+  // Ensure standard GridFS index on attachments.chunks for efficient chunk lookups.
+  // Without this, queries like find({files_id: ObjectId}) do full collection scans.
+  const db = MongoInternals.defaultRemoteCollectionDriver().mongo.db;
+  const chunksCollection = db.collection('attachments.chunks');
+  try {
+    await chunksCollection.createIndex({ files_id: 1, n: 1 }, { unique: true });
+  } catch (e) {
+    // Index already exists, which is fine — skip the error.
+    if (e.code !== 86) throw e;
+  }
+
  const sp = fileStoreStrategyFactory.storagePath;
  if (!fs.existsSync(sp)) {
    console.log("create storagePath because it doesn't exist: " + sp);
@@ -1,6 +1,6 @@
 {
  "name": "wekan",
-  "version": "v8.83.0",
+  "version": "v9.06.0",
  "description": "Open-Source kanban",
  "private": true,
  "repository": {
@@ -22,8 +22,8 @@
  "devDependencies": {
    "@meteorjs/rspack": "^1.0.2",
    "@rsdoctor/rspack-plugin": "^1.2.3",
-    "@rspack/cli": "^1.7.1",
-    "@rspack/core": "^1.7.1",
+    "@rspack/cli": "^1.7.11",
+    "@rspack/core": "^1.7.11",
    "chai": "^6.2.2",
    "chai-as-promised": "^8.0.2",
    "css-loader": "^7.1.4",
@@ -42,14 +42,14 @@
    "@textcomplete/core": "^0.1.13",
    "@textcomplete/textarea": "^0.1.13",
    "@wekanteam/dragscroll": "^0.0.9",
-    "@wekanteam/exceljs": "^4.7.0",
+    "@wekanteam/exceljs": "^4.7.1",
    "@wekanteam/html-to-markdown": "^1.0.2",
    "@wekanteam/meteor-globals": "^1.1.6",
    "@wekanteam/meteor-reactive-cache": "^1.0.8",
    "archiver": "^7.0.1",
    "autosize": "^6.0.1",
    "bson": "^7.2.0",
-    "dompurify": "^3.3.3",
+    "dompurify": "^3.4.0",
    "escape-string-regexp": "^5.0.0",
    "filesize": "^11.0.13",
    "glob": "^13.0.6",
@@ -71,6 +71,9 @@
  },
  "overrides": {
    "sourcemap-codec": "npm:@jridgewell/sourcemap-codec@^1.4.15",
-    "elliptic": "^6.6.1"
+    "elliptic": "^6.6.1",
+    "archiver-utils": {
+      "glob": "$glob"
+    }
  }
 }
@@ -319,7 +319,7 @@ var getTokenContent = function (token) {
      var signature = Buffer.from(parts[2], 'base64');
      var signed = parts[0] + '.' + parts[1];
    } catch (err) {
-      this.content = {
+      content = {
        exp: 0
      };
    }
@@ -3,7 +3,7 @@

 <head>
  <meta charset="utf8" />
-  <title>WeKan REST API v8.83</title>
+  <title>WeKan REST API v8.98</title>
  <!-- needed for adaptive design -->
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <style>
@@ -390,7 +390,7 @@ data-styled.g138[id="sc-iJQrDi"]{content:"gtHWGb,"}/*!sc*/
          55.627 l 55.6165,55.627 -231.245496,231.24803 c -127.185,127.1864
          -231.5279,231.248 -231.873,231.248 -0.3451,0 -104.688,
          -104.0616 -231.873,-231.248 z
-        " fill="currentColor"></path></g></svg></div></div><div class="sc-juTflS gfWNtA api-content"><div class="sc-eDDNvO eTiIZG"><div class="sc-iAEyYj cmAaWK"><div class="sc-hLseeT hoYmkG api-info"><h1 class="sc-fsQipe sc-crPCXn ePkAIL bSStQp">Wekan REST API<!-- --> <span>(<!-- -->v8.83<!-- -->)</span></h1><p>Download OpenAPI specification<!-- -->:</p><div class="sc-iKGpAq sc-cCYyou dXXcln dHaogz"></div><div data-role="redoc-summary" html="" class="sc-iKGpAq sc-cCYyou dXXcln dHaogz"></div><div data-role="redoc-description" html="&lt;p&gt;The REST API allows you to control and extend Wekan with ease.&lt;/p&gt;
+        " fill="currentColor"></path></g></svg></div></div><div class="sc-juTflS gfWNtA api-content"><div class="sc-eDDNvO eTiIZG"><div class="sc-iAEyYj cmAaWK"><div class="sc-hLseeT hoYmkG api-info"><h1 class="sc-fsQipe sc-crPCXn ePkAIL bSStQp">Wekan REST API<!-- --> <span>(<!-- -->v8.98<!-- -->)</span></h1><p>Download OpenAPI specification<!-- -->:</p><div class="sc-iKGpAq sc-cCYyou dXXcln dHaogz"></div><div data-role="redoc-summary" html="" class="sc-iKGpAq sc-cCYyou dXXcln dHaogz"></div><div data-role="redoc-description" html="&lt;p&gt;The REST API allows you to control and extend Wekan with ease.&lt;/p&gt;
 &lt;p&gt;If you are an end-user and not a dev or a tester, &lt;a href=&quot;https://github.com/wekan/wekan/issues/new&quot;&gt;create an issue&lt;/a&gt; to request new APIs.&lt;/p&gt;
 &lt;blockquote&gt;
 &lt;p&gt;All API calls in the documentation are made using &lt;code&gt;curl&lt;/code&gt;.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.&lt;/p&gt;
@@ -446,7 +446,7 @@ data-styled.g138[id="sc-iJQrDi"]{content:"gtHWGb,"}/*!sc*/
 " class="sc-iKGpAq sc-cCYyou sc-cjERFZ dXXcln fTBBlJ dkmSdy"><p>Error in registration</p>
 </div></button></div></div></div><div class="sc-jTrPJt sc-gLDzao dVngAA fYLqku"><div class="sc-fYzRkH dHdMVa"><button class="sc-jYvNnh iWrBta"><span type="post" class="sc-eGFuAY ejslkd http-verb post">post</span><span class="sc-GJyyy dkiPkt">/users/register</span><svg class="sc-fbJfz ivEQut" style="margin-right:-25px" version="1.1" viewBox="0 0 24 24" x="0" xmlns="http://www.w3.org/2000/svg" y="0" aria-hidden="true"><polygon points="17.3 8.3 12 13.6 6.7 8.3 5.3 9.7 12 16.4 18.7 9.7 "></polygon></svg></button><div aria-hidden="true" class="sc-fnxdBX dplsyJ"><div class="sc-llcuoK cNCbuV"><div html="" class="sc-iKGpAq sc-cCYyou dXXcln cFvDiF"></div><div tabindex="0" role="button"><div class="sc-jnsZEx eobUac"><span></span>/users/register</div></div></div></div></div></div></div></div></div><div class="sc-emEvRt jYOHCb"></div></div></div>
      <script>
-      const __redoc_state = {"menu":{"activeItemIdx":-1},"spec":{"data":{"openapi":"3.0.0","info":{"title":"Wekan REST API","version":"v8.83","description":"The REST API allows you to control and extend Wekan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production Wekan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}}},"components":{"securitySchemes":{"UserSecurity":{"type":"apiKey","in":"header","name":"Authorization"}}}}},"searchIndex":{"store":["section/Production-Security-Concerns","tag/Login","tag/Login/operation/login","tag/Login/operation/register"],"index":{"version":"2.3.9","fields":["title","description"],"fieldVectors":[["title/0",[0,0.641,1,1.113,2,1.113]],["description/0",[0,0.353,3,1.592,4,0.613,5,0.613,6,0.995,7,0.613,8,0.995,9,1.257,10,0.613,11,0.613,12,0.613,13,0.295,14,0.353,15,0.613,16,0.613,17,0.613,18,0.613,19,0.613,20,0.613,21,0.613,22,0.182,23,0.182,24,0.613,25,0.613,26,0.613,27,0.353,28,0.724,29,0.613,30,0.613,31,0.613,32,0.353,33,0.613,34,0.613,35,0.613,36,0.613,37,0.613]],["title/1",[13,0.473]],["description/1",[]],["title/2",[13,0.33,22,0.33,23,0.33]],["description/2",[38,1.941]],["title/3",[22,0.33,23,0.33,39,1.113]],["description/3",[14,0.841,27,0.841,28,0.841,32,0.841,40,1.46,41,1.46,42,1.46,43,1.46]]],"invertedIndex":[["",{"_index":28,"title":{},"description":{"0":{},"3":{}}}],["api",{"_index":23,"title":{"2":{},"3":{}},"description":{"0":{}}}],["authent",{"_index":42,"title":{},"description":{"3":{}}}],["author",{"_index":31,"title":{},"description":{"0":{}}}],["call",{"_index":3,"title":{},"description":{"0":{}}}],["certif",{"_index":12,"title":{},"description":{"0":{}}}],["concern",{"_index":2,"title":{"0":{}},"description":{}}],["ensur",{"_index":6,"title":{},"description":{"0":{}}}],["expir",{"_index":33,"title":{},"description":{"0":{}}}],["few",{"_index":25,"title":{},"description":{"0":{}}}],["highli",{"_index":20,"title":{},"description":{"0":{}}}],["http",{"_index":9,"title":{},"description":{"0":{}}}],["implement",{"_index":29,"titLine truncated
+      const __redoc_state = {"menu":{"activeItemIdx":-1},"spec":{"data":{"openapi":"3.0.0","info":{"title":"Wekan REST API","version":"v8.98","description":"The REST API allows you to control and extend Wekan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production Wekan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}}},"components":{"securitySchemes":{"UserSecurity":{"type":"apiKey","in":"header","name":"Authorization"}}}}},"searchIndex":{"store":["section/Production-Security-Concerns","tag/Login","tag/Login/operation/login","tag/Login/operation/register"],"index":{"version":"2.3.9","fields":["title","description"],"fieldVectors":[["title/0",[0,0.641,1,1.113,2,1.113]],["description/0",[0,0.353,3,1.592,4,0.613,5,0.613,6,0.995,7,0.613,8,0.995,9,1.257,10,0.613,11,0.613,12,0.613,13,0.295,14,0.353,15,0.613,16,0.613,17,0.613,18,0.613,19,0.613,20,0.613,21,0.613,22,0.182,23,0.182,24,0.613,25,0.613,26,0.613,27,0.353,28,0.724,29,0.613,30,0.613,31,0.613,32,0.353,33,0.613,34,0.613,35,0.613,36,0.613,37,0.613]],["title/1",[13,0.473]],["description/1",[]],["title/2",[13,0.33,22,0.33,23,0.33]],["description/2",[38,1.941]],["title/3",[22,0.33,23,0.33,39,1.113]],["description/3",[14,0.841,27,0.841,28,0.841,32,0.841,40,1.46,41,1.46,42,1.46,43,1.46]]],"invertedIndex":[["",{"_index":28,"title":{},"description":{"0":{},"3":{}}}],["api",{"_index":23,"title":{"2":{},"3":{}},"description":{"0":{}}}],["authent",{"_index":42,"title":{},"description":{"3":{}}}],["author",{"_index":31,"title":{},"description":{"0":{}}}],["call",{"_index":3,"title":{},"description":{"0":{}}}],["certif",{"_index":12,"title":{},"description":{"0":{}}}],["concern",{"_index":2,"title":{"0":{}},"description":{}}],["ensur",{"_index":6,"title":{},"description":{"0":{}}}],["expir",{"_index":33,"title":{},"description":{"0":{}}}],["few",{"_index":25,"title":{},"description":{"0":{}}}],["highli",{"_index":20,"title":{},"description":{"0":{}}}],["http",{"_index":9,"title":{},"description":{"0":{}}}],["implement",{"_index":29,"titLine truncated

      var container = document.getElementById('redoc');
      Redoc.hydrate(__redoc_state, container);
@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
  title: Wekan REST API
-  version: v8.83
+  version: v8.98
  description: |
    The REST API allows you to control and extend Wekan with ease.

@@ -25,7 +25,7 @@ do
 			sudo apt install -y build-essential gcc g++ make git curl wget p7zip-full zip unzip unp npm p7zip-full
 			#sudo chown -R $(id -u):$(id -g) $HOME/.npm
 			sudo npm -g install n
-			sudo n 24.14.1
+			sudo n 24.15.0
 			sudo npm -g install meteor --unsafe-perm
 			#sudo chown -R $(id -u):$(id -g) $HOME/.npm $HOME/.meteor
 		elif [[ "$OSTYPE" == "darwin"* ]]; then
@@ -27,8 +27,10 @@ fi
 # Ensure you are using the correct builder
 docker buildx use mybuilder

+#  --platform linux/amd64,linux/arm64,linux/s390x,linux/ppc64le \
+
 docker buildx build \
-  --platform linux/amd64,linux/arm64,linux/s390x,linux/ppc64le \
+  --platform linux/amd64,linux/arm64 \
  -t wekanteam/wekan:v${VERSION} \
  -t wekanteam/wekan:latest \
  -t quay.io/wekan/wekan:v${VERSION} \
@@ -36,4 +38,3 @@ docker buildx build \
  -t ghcr.io/wekan/wekan:v${VERSION} \
  -t ghcr.io/wekan/wekan:latest \
  --push .
-
@@ -1,2 +0,0 @@
-#!/bin/bash
-cat ~/repos/wekan/Dockerfile | grep NODE_VERSION=v | sed 's|\\||g' - | sed 's| ||g' - | sed 's|NODE_VERSION=v||g' -
@@ -1,6 +1,6 @@
 #!/bin/bash

-# WeKan full release script.
+# WeKan release script — commits pending changes and triggers GitHub Actions.
 #
 # Usage:
 #   ./releases/release-all.sh PREVIOUS-VERSION NEW-VERSION
@@ -12,158 +12,85 @@
 #   - Make sure all code changes are ready to ship
 #
 # What this script does:
-#   0. Updates Node.js to the latest 24.x release across all files
-#   1. Rebuilds OpenAPI docs (wekan.yml + wekan.html) from current source
-#   2. Updates all WeKan version numbers in release files
-#   3. Commits and pushes the version bump
-#   4. Creates and pushes the git tag  <-- this triggers GitHub Actions
-#   5. Updates the website repo if ~/repos/w/wekan.fi exists
+#   1. Commits and pushes any pending changes (e.g. CHANGELOG.md edits)
+#   2. Triggers the GitHub Actions release workflow (release-all.yml)
 #
 # GitHub Actions (release-all.yml) then automatically:
+#   - Updates Node.js to the latest 24.x across all files
+#   - Rebuilds OpenAPI docs (wekan.yml + wekan.html) from current source
+#   - Updates all WeKan version numbers in release files
+#   - Commits the version bump and creates the git tag
 #   - Builds amd64 bundle (full Meteor 3 build)
-#   - Builds arm64, s390x, win64 bundles from the amd64 base
+#   - Builds arm64, s390x, ppc64le, win64 bundles from the amd64 base
 #   - Creates the GitHub Release with CHANGELOG notes
-#   - Uploads all four .zip bundles to the release
+#   - Uploads all .zip bundles to the release
 #   - Builds and pushes multi-platform Docker image to Docker Hub, Quay.io, GHCR
 #   - Builds and publishes the snap package to the Snap Store
 #   - Uploads the .snap file to the GitHub Release
+#   - Updates Helm chart and deploys to GitHub Pages
 #
 # Track progress at: https://github.com/wekan/wekan/actions

-if [ $# -ne 2 ]; then
-  echo "Usage:   ./releases/release-all.sh PREVIOUS-VERSION NEW-VERSION"
-  echo "Example: ./releases/release-all.sh 8.40 8.41"
-  exit 1
-fi
+# Version update logic moved to ./releases/update-all-versions.sh
+set -e

-OLD="$1"
-NEW="$2"
+# Extract latest and previous version from CHANGELOG.md (e.g. # v8.98 2026-04-16)
+#RELEASE_LINES=( $(grep -E '^# v[0-9]+\.[0-9]+(\.[0-9]+)?[ -]+[0-9]{4}-[0-9]{2}-[0-9]{2}' CHANGELOG.md | head -2) )
+#LATEST_VERSION=$(echo "${RELEASE_LINES[0]}" | grep -oE 'v[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1 | sed 's/^v//')
+#PREVIOUS_VERSION=$(echo "${RELEASE_LINES[1]}" | grep -oE 'v[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1 | sed 's/^v//')
+#if [ -z "$LATEST_VERSION" ] || [ -z "$PREVIOUS_VERSION" ]; then
+#  echo "Could not determine both latest and previous version from CHANGELOG.md" >&2
+#  exit 1
+#fi
+#echo "Latest version from CHANGELOG.md: $LATEST_VERSION"
+#echo "Previous version from CHANGELOG.md: $PREVIOUS_VERSION"
+#NEW="v${LATEST_VERSION}"
+#OLD="v${PREVIOUS_VERSION}"
+NEW=$2
+OLD=$1

-# Validate version number format: digits.digits only
-if ! echo "$OLD" | grep -qE '^[0-9]+\.[0-9]+$' || \
-   ! echo "$NEW" | grep -qE '^[0-9]+\.[0-9]+$'; then
-  echo "Error: version numbers must be in X.Y format (e.g. 8.40)"
-  exit 1
-fi
-
-# Delete all GitHub Actions Caches, so that old stuff does not break builds.
-gh cache delete --all
+# Update all versions
+./releases/version.sh $OLD $NEW

 # Resolve repo root from script location so this works regardless of CWD
 REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-RELEASES_DIR="$REPO_DIR/releases"
-
-# Stop immediately if any command fails
-set -e
-
 cd "$REPO_DIR"

-echo "=== WeKan release: v$OLD  ->  v$NEW ==="
+echo "=== WeKan release: v$OLD -> v$NEW ==="
 echo ""

-# ── Check if this is a resume from a previous interrupted run ────────────────
-if git tag -l | grep -q "^v$NEW$"; then
-  echo "--- Resume detected: Tag v$NEW already exists locally ---"
-
-  # Check if tag was already pushed
-  if git ls-remote --tags origin 2>/dev/null | grep -q "refs/tags/v$NEW"; then
-    echo "Tag v$NEW already exists on remote. Nothing to do!"
-    echo "GitHub Actions release is already in progress at: https://github.com/wekan/wekan/actions"
-    exit 0
-  else
-    echo "Tag exists locally but not on remote. Skipping to Step 4 (push only)..."
-    SKIP_TO_STEP_4=1
-  fi
-else
-  SKIP_TO_STEP_4=0
-fi
-echo ""
-
-if [ "$SKIP_TO_STEP_4" = "0" ]; then
-
-# ── Step 0: Update Node.js to the latest 24.x release ───────────────────────
-# Fetches https://nodejs.org/dist/latest-v24.x/ and updates Dockerfile,
-# snapcraft.yaml, GitHub Actions workflow, rebuild-wekan.sh, and
-# releases/test-download-urls.sh so all platforms use the same newest version.
-echo "--- Step 0: Updating Node.js to latest 24.x ---"
-"$RELEASES_DIR/update-node-version.sh"
-echo "Done."
-echo ""
-
-# ── Step 1: Rebuild API docs from current source ─────────────────────────────
-# Runs before the version bump so the freshly generated docs are included in
-# the commit and therefore in both the wekan repo and the wekan.fi website.
-echo "--- Step 1: Rebuilding API docs ---"
-"$RELEASES_DIR/rebuild-docs.sh" "$NEW"
-echo "Done."
-echo ""
-
-# ── Step 2: Update WeKan version numbers in all release files ────────────────
-echo "--- Step 2: Updating WeKan version numbers ---"
-"$RELEASES_DIR/sed-release-versions.sh" "$OLD" "$NEW"
-echo "Done."
-echo ""
-
-# ── Step 3: Commit and push ──────────────────────────────────────────────────
-echo "--- Step 3: Committing and pushing version bump ---"
-git add --all
-if git diff --cached --quiet; then
-  echo "No changes to commit (already at v$NEW). Skipping commit."
-else
-  git commit -m "v$NEW"
-fi
-timeout 60 git push || {
-  echo "Warning: git push failed (timeout or connection error), continuing to tag push..."
-}
-echo "Done."
-echo ""
-
-fi  # End of: if [ "$SKIP_TO_STEP_4" = "0" ]
-
-# ── Step 4: Tag and push (this triggers GitHub Actions release-all.yml) ──────
-echo "--- Step 4: Creating and pushing tag v$NEW ---"
-
-# Check if tag already exists locally
-if git tag -l | grep -q "^v$NEW$"; then
-  echo "Tag v$NEW already exists locally. Skipping tag creation."
-else
-  git tag -a "v$NEW" -m "v$NEW"
-  echo "Created tag v$NEW"
+# ── Step 1: Commit and push any pending changes ─────────────────────────────
+if ! git diff --quiet || ! git diff --cached --quiet; then
+  echo "--- Committing pending changes ---"
+  git add --all
+  git commit -m "Prepare v$NEW release"
+  echo "Done."
+  echo ""
 fi

-# Push tag to remote (always do this, in case it was created but not pushed)
-echo "Pushing tag v$NEW to remote..."
-timeout 60 git push origin "v$NEW" || {
-  echo "Error: Failed to push tag v$NEW (timeout or connection error)"
-  exit 1
-}
-
-# Verify tag was pushed
-if ! git ls-remote --tags origin 2>/dev/null | grep -q "refs/tags/v$NEW"; then
-  echo "Error: Tag v$NEW was not found on remote after push"
-  exit 1
+# Push if there are unpushed commits
+LOCAL=$(git rev-parse HEAD)
+REMOTE=$(git rev-parse @{upstream} 2>/dev/null || echo "")
+if [ "$LOCAL" != "$REMOTE" ]; then
+  echo "--- Pushing to remote ---"
+  git push
+  echo "Done."
+  echo ""
 fi
+
+# ── Step 2: Trigger the release workflow ─────────────────────────────────────
+echo "--- Triggering GitHub Actions release workflow ---"
+gh workflow run release-all.yml \
+  -f old_version="$OLD" \
+  -f new_version="$NEW"
 echo "Done."
 echo ""

-echo "=== GitHub Actions is now building and releasing v$NEW ==="
-echo "    Building:  amd64 (full Meteor build), arm64, s390x, ppc64le, win64 bundles"
-echo "    Releasing: GitHub Release with CHANGELOG notes + all .zip bundles"
-echo "    Docker:    wekanteam/wekan, quay.io/wekan/wekan, ghcr.io/wekan/wekan"
-echo "    Snap:      published edge, released to candidate"
+echo "=== Release workflow triggered for v$NEW ==="
 echo "    Follow at: https://github.com/wekan/wekan/actions"
 echo ""
-
-# ── Step 5: Update website repo (skipped if not present) ─────────────────────
-WEBSITE_DIR="../w/wekan.fi"
-if [ -d "$WEBSITE_DIR" ]; then
-  echo "--- Step 5: Updating website ---"
-  "$RELEASES_DIR/release-website.sh" "$OLD" "$NEW"
-  echo "Done."
-else
-  echo "--- Step 5: Website repo not found at $WEBSITE_DIR, skipping ---"
-  echo "    Run manually when ready: ./releases/release-website.sh $OLD $NEW"
-fi
-echo ""
-
-echo "=== release-all.sh finished for v$NEW ==="
+# .github.com/workflows/release-all.yml automaticall updates
+# versions at website wekan.fi/install/
+# so manual website update is not needed:
+# Update the website:"
+./releases/release-website.sh $OLD $NEW
@@ -1,6 +1,6 @@
 #!/bin/bash

-# Release website with new WeKan version number and new API docs.
+# Release website with new WeKan version number and new API $HOME/repos/wekan/docs.
 #
 # Usage:
 #   ./releases/release-website.sh 8.42 8.43
@@ -23,20 +23,44 @@ sedi() {
 }

 # Go to website directory and pull latest changes
-if [ -d "$HOME/repos/w/wekan.fi" ]; then
-  cd "$HOME/repos/w/wekan.fi" || exit 1
-elif [ -d "$HOME/Documents/repos/w/wekan.fi" ]; then
-  cd "$HOME/Documents/repos/w/wekan.fi" || exit 1
+if [ -d "$HOME/repos/wekan/docs" ]; then
+  WEBDIR="$HOME/repos/wekan/docs"
+  WEKANREPODIR="$HOME/repos/wekan"
+elif [ -d "$HOME/Documents/repos/wekan/docs" ]; then
+  WEBDIR="$HOME/Documents/repos/wekan/docs"
+  WEKANREPODIR="$HOME/Documents/repos/wekan"
 else
  echo "Website directory not found, ignoring."
  exit 0
 fi
-git pull
+#git pull
+# Update MongoDB version in $WEBDIR/install/index.html from snapcraft.yaml
+MONGO_LINE=$(grep -o 'mongodb-linux-x86_64-ubuntu[0-9]\+-7\.[0-9][0-9]*\.[0-9][0-9]*' $WEKANREPODIR/snapcraft.yaml | head -1)
+if [ -n "$MONGO_LINE" ]; then
+  UBUNTU_VER=$(echo "$MONGO_LINE" | sed -E 's/.*ubuntu([0-9]+)-7\..*/\1/')
+  MONGODB_VERSION=$(echo "$MONGO_LINE" | sed -E 's/.*-7/7/')
+  # Update MongoDB version string (e.g. MongoDB 7.0.31 Ubuntu 2204)
+  sedi "s|MongoDB 7\\.x|MongoDB $MONGODB_VERSION Ubuntu $UBUNTU_VER|g" $WEBDIR/install/index.html
+fi

-# install/index.html
+# Update Meteor, Node.js, and NPM versions in $WEBDIR/install/index.html
+METEOR_VERSION=$(grep -o 'METEOR@[^ "\\]*' $WEKANREPODIR/.meteor/release | head -1)
+NODE_VERSION=$(grep -o 'NODE_VERSION=[^ \\]*' $WEKANREPODIR/Dockerfile | head -1 | cut -d= -f2 | tr -d '"')
+NPM_VERSION=$(grep -o 'NPM_VERSION=[^ \\]*' $WEKANREPODIR/Dockerfile | head -1 | cut -d= -f2 | tr -d '"')
+
+sedi "s|<span id=\"meteor-version\">[^<]*</span>|<span id=\"meteor-version\">$METEOR_VERSION</span>|g" $WEBDIR/install/index.html
+sedi "s|<span id=\"node-version\">[^<]*</span>|<span id=\"node-version\">$NODE_VERSION</span>|g" $WEBDIR/install/index.html
+sedi "s|<span id=\"npm-version\">[^<]*</span>|<span id=\"npm-version\">$NPM_VERSION</span>|g" $WEBDIR/install/index.html
+
+# $WEBDIR/install/index.html
 #   The version appears inside a specific HTML span tag.
 #   This pattern is already precise enough to match only the WeKan version.
-sedi "s|>v$OLD<\/span>|>v$NEW<\/span>|g" install/index.html
+sedi "s|>v$OLD<\/span>|>v$NEW<\/span>|g" $WEBDIR/install/index.html
+
+# Also update Meteor and Node.js versions in the <h2 class="fw-bold"> line
+sedi "s|\(Meteor \)[^,]*,|\1${METEOR_VERSION},|g" $WEBDIR/install/index.html
+sedi "s|\(Node\.js \)[0-9][0-9]*\.[x0-9a-zA-Z.-]*|\1${NODE_VERSION}|g" $WEBDIR/install/index.html
+sedi "s|>v$OLD<\/span>|>v$NEW<\/span>|g" $WEBDIR/install/index.html

 # api/index.html
 #   The version appears in href attributes and as link text, e.g.:
@@ -46,22 +70,20 @@ sedi "s|>v$OLD<\/span>|>v$NEW<\/span>|g" install/index.html
 #   would not be accidentally matched.
 #   The capture group \1 restores the character that follows the version.
 #   A second expression handles the rare case of the version at end of line.
-cd api
-sedi "s|v$OLD\([^0-9]\)|v$NEW\1|g; s|v$OLD$|v$NEW|g" index.html
+sedi "s|v$OLD\([^0-9]\)|v$NEW\1|g; s|v$OLD$|v$NEW|g" $WEBDIR/api/index.html

-# Create directory for new API docs, copy from WeKan repo, rename entry point
-cd ..
-mkdir -p api/v$NEW
+# Create directory for new API $HOME/repos/wekan/docs, copy from WeKan repo, rename entry point
+mkdir -p $WEBDIR/api/v$NEW
 if [ -d "$HOME/repos/wekan" ]; then
-  cp "$HOME/repos/wekan/public/api/"* api/v$NEW/
+  cp "$HOME/repos/wekan/public/api/"* $WEBDIR/api/v$NEW/
 elif [ -d "$HOME/Documents/repos/wekan" ]; then
-  cp "$HOME/Documents/repos/wekan/public/api/"* api/v$NEW/
+  cp "$HOME/Documents/repos/wekan/public/api/"* $WEBDIR/api/v$NEW/
 else
-  cp public/api/* api/v$NEW/ || true
+  cp $WEKANREPODIR/public/api/* $WEBDIR/api/v$NEW/ || true
 fi
-mv api/v$NEW/wekan.html api/v$NEW/index.html
+mv $WEBDIR/api/v$NEW/wekan.html $WEBDIR/api/v$NEW/index.html

 # Commit and push website changes live
-git add --all
-git commit -m "v$NEW"
-git push
+#git add --all
+#git commit -m "v$NEW"
+#git push
@@ -1,74 +0,0 @@
-#!/bin/bash
-
-# Update WeKan version number across release files.
-#
-# Each file uses a context-specific pattern so that only the WeKan version
-# is replaced, leaving unrelated numbers (npm package versions, CSS values,
-# Node.js versions, MongoDB versions, port numbers, etc.) untouched.
-#
-# Usage:
-#   ./releases/sed-release-versions.sh 8.42 8.43
-
-if [ $# -ne 2 ]; then
-  echo "Syntax with Wekan current-version new-version:"
-  echo "  ./releases/sed-release-versions.sh 8.42 8.43"
-  exit 1
-fi
-
-OLD="$1"
-NEW="$2"
-OLD_NO_DOTS=$(echo "$OLD" | tr -d '.')
-NEW_NO_DOTS=$(echo "$NEW" | tr -d '.')
-
-sedi() {
-  if [ "$(uname)" = "Darwin" ]; then
-    sed -i '' "$@"
-  else
-    sed -i "$@"
-  fi
-}
-
-# package.json and package-lock.json
-#   WeKan's own version entry always has a "v" prefix: "version": "v8.42.0"
-#   npm dependency versions never use a "v" prefix, so this pattern is WeKan-specific.
-#   The patch component (\1) is preserved as-is.
-sedi 's|"version": "v'"$OLD"'\.\([0-9]*\)"|"version": "v'"$NEW"'.\1"|g' \
-  package.json package-lock.json
-
-# Stackerfile.yml
-#   appVersion field uses the same "v" prefix format.
-sedi 's|appVersion: "v'"$OLD"'\.\([0-9]*\)"|appVersion: "v'"$NEW"'.\1"|g' \
-  Stackerfile.yml
-
-# Dockerfile
-#   Only the ARG VERSION line is updated. All other ENV values
-#   (Node.js version, npm version, etc.) are left untouched.
-sedi "s|ARG VERSION=$OLD|ARG VERSION=$NEW|g" Dockerfile
-
-# snapcraft.yaml
-#   Three distinct WeKan-specific patterns, each too narrow to match
-#   MongoDB, Node.js, Caddy, or other tool versions present in the file:
-#     1. The snap version: field (anchored to start of line)
-#     2. WeKan bundle filenames: wekan-8.42-<arch>.zip
-#     3. GitHub release URL path: /releases/download/v8.42/
-sedi "s|^version: '$OLD'|version: '$NEW'|" snapcraft.yaml
-sedi "s|wekan-$OLD-|wekan-$NEW-|g" snapcraft.yaml
-sedi "s|/v$OLD/|/v$NEW/|g" snapcraft.yaml
-
-# docs/Platforms/Propietary/Windows/Offline.md
-#   Same URL patterns as snapcraft.yaml. The file also contains
-#   MongoDB (7.0.31) and Node.js (14.x) version numbers which
-#   do not match either pattern.
-sedi "s|wekan-$OLD-|wekan-$NEW-|g" \
-  docs/Platforms/Propietary/Windows/Offline.md
-sedi "s|/v$OLD/|/v$NEW/|g" \
-  docs/Platforms/Propietary/Windows/Offline.md
-
-# sandstorm-pkgdef.capnp
-#   Two separate fields, each with a unique surrounding context:
-#     1. appVersion integer (no dots): "appVersion = 842,"
-#     2. appMarketingVersion string: "8.42.0~<date>" — the tilde is the
-#        Sandstorm date separator and never appears in other version strings.
-sedi "s|appVersion = $OLD_NO_DOTS,|appVersion = $NEW_NO_DOTS,|g" \
-  sandstorm-pkgdef.capnp
-sedi 's|"'"$OLD"'\.0~|"'"$NEW"'.0~|g' sandstorm-pkgdef.capnp
@@ -1,22 +0,0 @@
-#!/bin/bash
-
-# Update WeKan version at snapcraft.yaml
-
-# 1) Check that there is 2 parameters
-#    of Wekan version number:
-
-if [ $# -ne 2 ]; then
-  echo "Syntax with Wekan version number:"
-  echo "  ./releases/sed-snapcraft-version.sh 7.10 7.11"
-  exit 1
-fi
-
-sedi() {
-  if [ "$(uname)" = "Darwin" ]; then
-    sed -i '' "$@"
-  else
-    sed -i "$@"
-  fi
-}
-
-sedi "s|$1|$2|g" snapcraft.yaml docs/Platforms/Propietary/Windows/Offline.md
@@ -58,17 +58,17 @@ check "db-tools 100.13.0  arm64" \
  "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-ubuntu2404-arm64-100.13.0.tgz"
 echo ""

-echo "=== Node.js 24.14.1 (all snap architectures) ==="
-check "Node.js 24.14.1  linux-x64     (amd64)" \
-  "https://nodejs.org/dist/v24.14.1/node-v24.14.1-linux-x64.tar.gz"
-check "Node.js 24.14.1  linux-arm64   (arm64)" \
-  "https://nodejs.org/dist/v24.14.1/node-v24.14.1-linux-arm64.tar.gz"
-check "Node.js 24.14.1  linux-armv7l  (armhf)" \
-  "https://nodejs.org/dist/v24.14.1/node-v24.14.1-linux-armv7l.tar.gz"
-check "Node.js 24.14.1  linux-s390x   (s390x)" \
-  "https://nodejs.org/dist/v24.14.1/node-v24.14.1-linux-s390x.tar.gz"
-check "Node.js 24.14.1  linux-ppc64le (ppc64el)" \
-  "https://nodejs.org/dist/v24.14.1/node-v24.14.1-linux-ppc64le.tar.gz"
+echo "=== Node.js 24.15.0 (all snap architectures) ==="
+check "Node.js 24.15.0  linux-x64     (amd64)" \
+  "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-x64.tar.gz"
+check "Node.js 24.15.0  linux-arm64   (arm64)" \
+  "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-arm64.tar.gz"
+check "Node.js 24.15.0  linux-armv7l  (armhf)" \
+  "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-armv7l.tar.gz"
+check "Node.js 24.15.0  linux-s390x   (s390x)" \
+  "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-s390x.tar.gz"
+check "Node.js 24.15.0  linux-ppc64le (ppc64el)" \
+  "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-ppc64le.tar.gz"
 echo ""

 echo "=== Results ==="
@@ -1,102 +0,0 @@
-#!/usr/bin/env bash
-
-# Fetch the latest Node.js 24.x release and update all files that hardcode
-# the version number: Dockerfile, snapcraft.yaml, GitHub Actions workflow,
-# rebuild-wekan.sh, and releases/test-download-urls.sh.
-#
-# Usage (standalone):
-#   ./releases/update-node-version.sh
-#
-# Called automatically by releases/release-all.sh before every release.
-
-set -euo pipefail
-
-REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-cd "$REPO_DIR"
-
-
-# BSD sed (macOS) requires an empty string after -i; GNU sed (Linux) does not.
-if [ "$(uname)" = "Darwin" ]; then
-  if ! command -v brew >/dev/null 2>&1; then
-    echo "Homebrew not found. Installing Homebrew..."
-    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-  fi
-  if ! command -v curl >/dev/null 2>&1; then
-    echo "curl not found. Installing curl with brew..."
-    brew install curl
-  fi
-  sedi() { sed -i '' "$@"; }
-else
-  if ! command -v curl >/dev/null 2>&1; then
-    echo "curl not found. Installing curl with apt-get..."
-    sudo apt-get update && sudo apt-get install -y curl
-  fi
-  sedi() { sed -i "$@"; }
-fi
-
-# ── Fetch latest Node.js 24.x version ────────────────────────────────────────
-echo "  Fetching latest Node.js 24.x version from nodejs.org..."
-
-# The directory listing always contains a line like:
-#   node-v24.14.1-linux-x64.tar.gz
-# Extract the version from the first x64 tarball listed.
-NEW_NODE=$(curl -fsSL https://nodejs.org/dist/latest-v24.x/ \
-  | grep -o 'node-v24\.[0-9][0-9]*\.[0-9][0-9]*-linux-x64\.tar\.gz' \
-  | head -1 \
-  | sed 's/node-v\(.*\)-linux-x64\.tar\.gz/\1/')
-
-if [ -z "$NEW_NODE" ]; then
-  echo "Error: could not determine latest Node.js 24.x version." >&2
-  exit 1
-fi
-
-echo "  Latest Node.js 24.x: $NEW_NODE"
-
-# ── Dockerfile ────────────────────────────────────────────────────────────────
-# Matches:  NODE_VERSION=v24.14.1
-sedi "s|NODE_VERSION=v24\.[0-9][0-9]*\.[0-9][0-9]*|NODE_VERSION=v${NEW_NODE}|g" \
-  Dockerfile
-
-# ── snapcraft.yaml ───────────────────────────────────────────────────────────
-# Matches:  npm-node-version: 24.14.1
-sedi "s|npm-node-version: 24\.[0-9][0-9]*\.[0-9][0-9]*|npm-node-version: ${NEW_NODE}|g" \
-  snapcraft.yaml
-# Matches:  NODE_VERSION="24.14.1"   (in wekan override-build)
-sedi "s|NODE_VERSION=\"24\.[0-9][0-9]*\.[0-9][0-9]*\"|NODE_VERSION=\"${NEW_NODE}\"|g" \
-  snapcraft.yaml
-# Matches comment:  matching Node.js 24.14.1 binary
-sedi "s|Node\.js 24\.[0-9][0-9]*\.[0-9][0-9]* binary|Node.js ${NEW_NODE} binary|g" \
-  snapcraft.yaml
-
-# ── .github/workflows/release-all.yml ────────────────────────────────────────
-WORKFLOW=".github/workflows/release-all.yml"
-# Matches:  node-version: '24.14.1'  (actions/setup-node, windows job)
-sedi "s|node-version: '24\.[0-9][0-9]*\.[0-9][0-9]*'|node-version: '${NEW_NODE}'|g" \
-  "$WORKFLOW"
-# Matches:  node:24.14.1-slim  (docker run commands and comments)
-sedi "s|node:24\.[0-9][0-9]*\.[0-9][0-9]*-slim|node:${NEW_NODE}-slim|g" \
-  "$WORKFLOW"
-# Matches version number in comments:  bundles: 24.14.1 (ABI
-sedi "s|bundles: 24\.[0-9][0-9]*\.[0-9][0-9]* (ABI|bundles: ${NEW_NODE} (ABI|g" \
-  "$WORKFLOW"
-# Matches:  Node 24.14.1 — the exact version bundled
-sedi "s|Node 24\.[0-9][0-9]*\.[0-9][0-9]* —|Node ${NEW_NODE} —|g" \
-  "$WORKFLOW"
-
-# ── rebuild-wekan.sh ──────────────────────────────────────────────────────────
-# Matches:  sudo n 24.14.1
-sedi "s|sudo n 24\.[0-9][0-9]*\.[0-9][0-9]*|sudo n ${NEW_NODE}|g" \
-  rebuild-wekan.sh
-
-# ── releases/test-download-urls.sh ───────────────────────────────────────────
-# Matches URL path:    /v24.14.1/
-sedi "s|/v24\.[0-9][0-9]*\.[0-9][0-9]*/|/v${NEW_NODE}/|g" \
-  releases/test-download-urls.sh
-# Matches tarball name:  node-v24.14.1-
-sedi "s|node-v24\.[0-9][0-9]*\.[0-9][0-9]*-|node-v${NEW_NODE}-|g" \
-  releases/test-download-urls.sh
-# Matches label text:  Node.js 24.14.1
-sedi "s|Node\.js 24\.[0-9][0-9]*\.[0-9][0-9]*|Node.js ${NEW_NODE}|g" \
-  releases/test-download-urls.sh
-
-echo "  Updated all files to Node.js $NEW_NODE."
@@ -1,23 +1,125 @@
 #!/bin/bash
-# Change version.
-# Usage:   ./releases/version.sh old new
-# Example: ./releases/version.sh v3.x v3.x
+# =================================================================
+# WEKAN VERSION UPDATE SCRIPT
+# Supports: Linux (Bash/Zsh) and macOS (Zsh)
+# =================================================================

-if [ "$#" -ne 2 ]; then
-  echo "Usage: ./releases/version.sh <old_version> <new_version>"
-  exit 1
-fi
+set -e # Exit on any error

+# Portable sedi function for macOS/Linux compatibility
 sedi() {
  if [ "$(uname)" = "Darwin" ]; then
+    # macOS requires an empty string for the -i flag
    sed -i '' "$@"
  else
+    # Linux GNU sed
    sed -i "$@"
  fi
 }

-sedi "s|API $1|API $2|g" public/api/wekan*
-sedi "s|\"version\": \"$1|\"version\": \"$2|g" .meteor-1.6-snap/package-lock.json .meteor-1.6-snap/package.json package-lock.json package.json
-sedi "s|appVersion: \"$1|appVersion: \"$2|g" Stackerfile.yml
+version_bump_logic() {
+  echo "--- Starting version bump logic ---"
+  echo "New Version: $NEW_VERSION"
+  echo "Old Version: $OLD_VERSION"

-echo "Also change CHANGELOG.md and sandstorm-pkgdef.capnp"
+  # 1. Fetch latest Node.js 24.x version
+  echo "[DEBUG] Fetching Node.js v24.x directory listing..."
+  NODE_HTML=$(curl -fsSL https://nodejs.org/dist/latest-v24.x/)
+  FIRST_MATCH=$(echo "$NODE_HTML" | grep -oE 'node-v24\.[0-9]+\.[0-9]+-linux-x64\.tar\.gz' | head -1)
+  NEW_NODE=$(echo "$FIRST_MATCH" | sed -E 's/node-v([0-9]+\.[0-9]+\.[0-9]+)-linux-x64\.tar\.gz/\1/')
+
+  if [[ -z "$NEW_NODE" ]]; then
+    echo "Error: Could not determine latest Node.js version." >&2
+    exit 1
+  fi
+  echo "Latest Node.js detected: $NEW_NODE"
+
+  # 2. Detect latest MongoDB 7.x
+  # Locked to Ubuntu 22.04 and using sort -V to ensure 7.0.31 > 7.0.9
+  echo "[DEBUG] Detecting latest MongoDB 7.x version for Ubuntu 22.04..."
+  MONGO_LINE=$(curl -fsSL https://www.mongodb.com/try/download/community | grep -o 'mongodb-linux-x86_64-ubuntu2204-7\.[0-9]\+\.[0-9]\+\.tgz' | sort -V | tail -1)
+
+  if [ -z "$MONGO_LINE" ]; then
+    echo "Error: Could not determine latest MongoDB 7.x version." >&2
+    exit 1
+  fi
+
+  MONGO_VER=$(echo "$MONGO_LINE" | sed -E 's/.*-7/7/' | sed 's/\.tgz$//')
+  UBUNTU_VER="2204"
+  echo "Detected MongoDB: $MONGO_VER for Ubuntu $UBUNTU_VER"
+
+  # 3. Update Configuration Files: MongoDB & Tools
+  echo "[DEBUG] Updating snapcraft.yaml and documentation..."
+  sedi "s|mongodb-linux-x86_64-ubuntu[0-9]\+-7\.[0-9][0-9]*\.[0-9][0-9]*|mongodb-linux-x86_64-ubuntu${UBUNTU_VER}-$MONGO_VER|g" snapcraft.yaml
+
+  # Ensure database tools point to the correct Ubuntu version
+  sedi -E "s|mongodb-database-tools-ubuntu[0-9]+-x86_64|mongodb-database-tools-ubuntu2204-x86_64|g" snapcraft.yaml
+
+  # 4. Update Node.js versions
+  sedi "s|NODE_VERSION=v24\.[0-9][0-9]*\.[0-9][0-9]*|NODE_VERSION=v${NEW_NODE}|g" Dockerfile
+  sedi "s|npm-node-version: 24\.[0-9][0-9]*\.[0-9][0-9]*|npm-node-version: ${NEW_NODE}|g" snapcraft.yaml
+  sedi "s|NODE_VERSION=\"24\.[0-9][0-9]*\.[0-9][0-9]*\"|NODE_VERSION=\"${NEW_NODE}\"|g" snapcraft.yaml
+  sedi "s|Node\.js 24\.[0-9][0-9]*\.[0-9][0-9]* binary|Node.js ${NEW_NODE} binary|g" snapcraft.yaml
+
+  # 5. Update Application Versions
+  NEW_NO_DOTS=$(echo "$NEW_VERSION" | tr -d '.')
+  OLD_NO_DOTS=$(echo "$OLD_VERSION" | tr -d '.')
+  TODAY=$(date +%Y-%m-%d)
+
+  # Standardize version to vX.Y.Z
+  if [[ $NEW_VERSION =~ ^[0-9]+\.[0-9]+$ ]]; then PKG_VER="v${NEW_VERSION}.0"; else PKG_VER="v${NEW_VERSION}"; fi
+
+  sedi "0,/\"version\": \"[^\"]*\"/s//\"version\": \"${PKG_VER}\"/" package.json
+  sedi "0,/\"version\": \"[^\"]*\"/s//\"version\": \"${PKG_VER}\"/" package-lock.json
+  sedi "0,/appVersion: \"[^\"]*\"/s/appVersion: \"[^\"]*\"/appVersion: \"${PKG_VER}\"/" Stackerfile.yml
+  sedi "2s/^version: '[^']*'/version: '${NEW_VERSION}'/" snapcraft.yaml
+  sedi "s|v$OLD_VERSION/|v$NEW_VERSION/|g" snapcraft.yaml
+  sedi "s|wekan-$OLD_VERSION-|wekan-$NEW_VERSION-|g" snapcraft.yaml
+
+  # Sandstorm Specifics
+  sedi "0,/appVersion = [0-9]\+/s/appVersion = [0-9]\+/appVersion = ${NEW_NO_DOTS}/" sandstorm-pkgdef.capnp
+  sedi "0,/appMarketingVersion = (defaultText = \"[^\"]*\")/s/appMarketingVersion = (defaultText = \"[^\"]*\")/appMarketingVersion = (defaultText = \"${NEW_VERSION}~${TODAY}\")/" sandstorm-pkgdef.capnp
+  sedi "s|appVersion = $OLD_NO_DOTS,|appVersion = $NEW_NO_DOTS,|g" sandstorm-pkgdef.capnp
+
+  # Docker and Documentation
+  sedi "s|ARG VERSION=$OLD_VERSION|ARG VERSION=$NEW_VERSION|g" Dockerfile
+  sedi "s|wekan-$OLD_VERSION|wekan-$NEW_VERSION|g" docs/Platforms/Propietary/Windows/Offline.md
+  sedi "s|/v$OLD_VERSION/|/v$NEW_VERSION/|g" docs/Platforms/Propietary/Windows/Offline.md
+
+  # 6. Update Wekan website (if applicable)
+  if [ -d "../w/wekan.fi" ]; then
+    INSTALL_PAGE="../w/wekan.fi/install/index.html"
+    METEOR_VER=$(grep -o 'METEOR@[^ "\\]*' .meteor/release | head -1 | sed 's/.*@//')
+    NPM_VER=$(grep -o 'NPM_VERSION=[^ "\\]*' Dockerfile | head -1 | cut -d= -f2 | tr -d '"')
+
+    (cd ../w/wekan.fi && git pull)
+    #sedi "s|MongoDB 7\\.x|MongoDB $MONGO_VER|g" "$INSTALL_PAGE"
+    sedi "s|<span id=\"meteor-version\">[^<]*</span>|<span id=\"meteor-version\">$METEOR_VER</span>|g" "$INSTALL_PAGE"
+    #sedi "s|<span id=\"node-version\">[^<]*</span>|<span id=\"node-version\">v$NEW_NODE</span>|g" "$INSTALL_PAGE"
+    #sedi "s|<span id=\"npm-version\">[^<]*</span>|<span id=\"npm-version\">$NPM_VER</span>|g" "$INSTALL_PAGE"
+    sedi "s|<span class=\"version-number\">v${OLD_VERSION}</span>|<span class=\"version-number\">v${NEW_VERSION}</span>|g" "$INSTALL_PAGE"
+    (cd ../w/wekan.fi && git add --all && git commit -m "Updates" && git push)
+  fi
+
+  echo "--- Version bump complete ---"
+}
+
+# --- MAIN BLOCK ---
+
+# If manual arguments are missing, parse CHANGELOG.md
+if [ -z "$1" ] || [ -z "$2" ]; then
+  echo "No arguments. Detecting versions from CHANGELOG.md..."
+  mapfile -t RELEASE_LINES < <(grep -E '^# v[0-9]+\.[0-9]+(\.[0-9]+)?[ -]+[0-9]{4}-[0-9]{2}-[0-9]{2}' CHANGELOG.md | head -2)
+  NEW_VERSION=$(echo "${RELEASE_LINES[0]}" | grep -oE 'v[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1 | sed 's/^v//')
+  OLD_VERSION=$(echo "${RELEASE_LINES[1]}" | grep -oE 'v[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1 | sed 's/^v//')
+  if [ -z "$NEW_VERSION" ] || [ -z "$OLD_VERSION" ]; then
+    echo "Error: Automatics detection failed." >&2
+    exit 1
+  fi
+else
+  OLD_VERSION="$1"
+  NEW_VERSION="$2"
+fi
+
+version_bump_logic
+exit 0
@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
    appTitle = (defaultText = "Wekan"),
    # The name of the app as it is displayed to the user.

-    appVersion = 883,
+    appVersion = 906,
    # Increment this for every release.

-    appMarketingVersion = (defaultText = "8.83.0~2026-03-23"),
+    appMarketingVersion = (defaultText = "9.06~2026-05-02"),
    # Human-readable presentation of the app version.

    minUpgradableAppVersion = 0,
@@ -332,14 +332,21 @@ Meteor.methods({
    (await ReactiveCache.getCurrentUser()).setDateFormat(dateFormat);
  },

-  async applyListWidth(boardId, listId, width, constraint) {
+  applyListWidth(boardId, listId, width, constraint) {
    check(boardId, String);
    check(listId, String);
    check(width, Number);
    check(constraint, Number);
-    const user = await ReactiveCache.getCurrentUser();
-    user.setListWidth(boardId, listId, width);
-    user.setListConstraint(boardId, listId, constraint);
+    if (!this.userId) {
+      throw new Meteor.Error('not-logged-in', 'User must be logged in');
+    }
+    try {
+      Lists.updateAsync(listId, { $set: { width: width, constraint: constraint } });
+      return true;
+    } catch (error) {
+      console.error('Error updating list width:', error);
+      throw new Meteor.Error('update-failed', error.message);
+    }
  },

  async setListCollapsedState(boardId, listId, collapsed) {
@@ -784,21 +791,22 @@ Accounts.onCreateUser(async (options, user) => {
    if (Array.isArray(email)) {
      email = email.shift();
    }
-    email = email.toLowerCase();
-    user.username = user.services.oidc.username;
+    email = (email || '').toLowerCase();
+    user.username = user.services.oidc.username || user.services.oidc.id || email.split('@')[0] || Random.id();
    user.emails = [{ address: email, verified: true }];

    if (user.username.includes('/') || email.includes('/')) {
      return false;
    }

-    const initials = user.services.oidc.fullname
+    const fullname = user.services.oidc.fullname || user.username;
+    const initials = fullname
      .split(/\s+/)
      .reduce((memo, word) => memo + word[0], '')
      .toUpperCase();
    user.profile = {
      initials,
-      fullname: user.services.oidc.fullname,
+      fullname,
      boardView: 'board-view-swimlanes',
    };
    user.authenticationMethod = 'oauth2';
@@ -228,19 +228,25 @@ Meteor.publish('archiveSidebar', async function(boardId, activeTab = 'cards', ca
 Meteor.publish('myCards', async function(sessionId) {
  check(sessionId, String);

+  if (!this.userId) return this.ready();
+
+  const currentUser = await ReactiveCache.getCurrentUser();
+  if (!currentUser) return this.ready();
+
  const queryParams = new QueryParams();
-  queryParams.addPredicate(OPERATOR_USER, (await ReactiveCache.getCurrentUser()).username);
+  queryParams.addPredicate(OPERATOR_USER, currentUser.username);
  queryParams.setPredicate(OPERATOR_LIMIT, 200);

-  const query = Promise.await(buildQuery(queryParams, this.userId));
+  const query = await buildQuery(queryParams, this.userId);
  query.projection.sort = {
    boardId: 1,
    swimlaneId: 1,
    listId: 1,
  };

-  const ret = await findCards(sessionId, query, this.userId);
-  return ret;
+  const { cursors, sessionData } = await findCards(sessionId, query, this.userId);
+  if (sessionData) this.added('sessiondata', sessionData._id, sessionData);
+  return cursors;
 });

 // Optimized due cards publication for better performance
@@ -308,25 +314,14 @@ Meteor.publish('globalSearch', async function(sessionId, params, text) {
  check(params, Object);
  check(text, String);

-  const ret = await findCards(sessionId, await buildQuery(new QueryParams(params, text), this.userId), this.userId);
-
-  if (!Array.isArray(ret)) {
-    return ret;
-  }
-
-  // Check if last item is the sessiondata marker
-  let sessionDataToPublish = null;
-  if (ret.length > 0 && ret[ret.length - 1] && ret[ret.length - 1]._sessionDataToFetch) {
-    sessionDataToPublish = ret[ret.length - 1]._sessionDataToFetch;
-    ret.pop(); // Remove the marker
-  }
-
-  // Manually publish sessiondata if it exists
-  if (sessionDataToPublish) {
-    this.added('sessiondata', sessionDataToPublish._id, sessionDataToPublish);
-  }
-
-  return ret;
+  
+  const { cursors, sessionData } = await findCards(
+    sessionId,
+    await buildQuery(new QueryParams(params, text), this.userId),
+    this.userId,
+  );
+  if (sessionData) this.added('sessiondata', sessionData._id, sessionData);
+  return cursors;
 });

 Meteor.publish('sessionData', async function(sessionId) {
@@ -1047,31 +1042,26 @@ async function findCards(sessionId, query, userId) {
      sort: 1,
      type: 1,
    };
-
    // Return all cursors except sessiondata - we'll add sessiondata separately after fetch
-    return [
-      cards,
-      await ReactiveCache.getBoards(
-        { _id: { $in: boards } },
-        { fields: { ...fields, labels: 1, color: 1 } },
-        true,
-      ),
-      await ReactiveCache.getSwimlanes(
-        { _id: { $in: swimlanes } },
-        { fields: { ...fields, color: 1 } },
-        true,
-      ),
-      await ReactiveCache.getLists({ _id: { $in: lists } }, { fields: { ...fields, color: 1 } }, true),
-      await ReactiveCache.getCustomFields({ _id: { $in: customFieldIds } }, {}, true),
-      await ReactiveCache.getUsers({ _id: { $in: users } }, { fields: Users.safeFields }, true),
-      await ReactiveCache.getChecklists({ cardId: { $in: cardIds } }, {}, true),
-      await ReactiveCache.getChecklistItems({ cardId: { $in: cardIds } }, {}, true),
-      (await ReactiveCache.getAttachments({ 'meta.cardId': { $in: cardIds } }, {}, true)).cursor,
-      await ReactiveCache.getCardComments({ cardId: { $in: cardIds } }, {}, true),
-      { _sessionDataToFetch: storedSessionData }, // Pass sessiondata separately
-    ];
+    return {
+      cursors: [
+        cards,
+        await ReactiveCache.getBoards({ _id: { $in: boards } }, { fields: { ...fields, labels: 1, color: 1 } }, true),
+        await ReactiveCache.getSwimlanes({ _id: { $in: swimlanes } }, { fields: { ...fields, color: 1 } }, true),
+        await ReactiveCache.getLists({ _id: { $in: lists } }, { fields: { ...fields, color: 1 } }, true),
+        await ReactiveCache.getCustomFields({ _id: { $in: customFieldIds } }, {}, true),
+        await ReactiveCache.getUsers({ _id: { $in: users } }, { fields: Users.safeFields }, true),
+        await ReactiveCache.getChecklists({ cardId: { $in: cardIds } }, {}, true),
+        await ReactiveCache.getChecklistItems({ cardId: { $in: cardIds } }, {}, true),
+        (await ReactiveCache.getAttachments({ 'meta.cardId': { $in: cardIds } }, {}, true)).cursor,
+        await ReactiveCache.getCardComments({ cardId: { $in: cardIds } }, {}, true),
+      ],
+      sessionData: storedSessionData,
+    };
  } else {
-    // Return just a marker for sessiondata
-    return [{ _sessionDataToFetch: storedSessionData }];
+    return {
+      cursors: [],
+      sessionData: storedSessionData,
+    };
  }
 }
@@ -335,6 +335,41 @@ WebApp.handlers.use('/api/attachment/upload', async (req, res, next) => {
      sendErrorResponse(res, 401, error.message);
    }
  });
+// Board attachments endpoint (legacy)
+WebApp.handlers.use('/api/boards/:boardId/attachments', async (req, res, next) => {
+  if (req.method !== 'GET') {
+    return next();
+  }
+  try {
+    const userId = await authenticateApiRequest(req);
+    const boardId = req.params.boardId;
+    const board = await ReactiveCache.getBoard(boardId);
+    if (!board || !board.isBoardMember(userId)) {
+      return sendErrorResponse(res, 403, 'You do not have permission to access this board');
+    }
+    const query = { 'meta.boardId': boardId };
+    const attachments = await ReactiveCache.getAttachments(query);
+    const attachmentList = attachments.map(attachment => {
+      const strategy = fileStoreStrategyFactory.getFileStrategy(attachment, 'original');
+      return {
+        attachmentId: attachment._id,
+        fileName: attachment.name,
+        fileSize: attachment.size,
+        fileType: attachment.type,
+        storageBackend: strategy.getStorageName(),
+        boardId: attachment.meta.boardId,
+        swimlaneId: attachment.meta.swimlaneId,
+        listId: attachment.meta.listId,
+        cardId: attachment.meta.cardId,
+        createdAt: attachment.uploadedAt,
+        isImage: attachment.isImage
+      };
+    });
+    sendJsonResponse(res, 200, { success: true, attachments: attachmentList, count: attachmentList.length });
+  } catch (error) {
+    sendErrorResponse(res, 401, error.message);
+  }
+});

  // Copy attachment endpoint
  WebApp.handlers.use('/api/attachment/copy', async (req, res, next) => {
@@ -3,17 +3,16 @@
 # All supported keys are defined here together with descriptions and default values

 # list of supported keys
-keys="DEBUG S3 METEOR_REACTIVITY_ORDER MONGO_LOG_DESTINATION MONGO_URL MONGO_OPLOG_URL MONGODB_BIND_UNIX_SOCKET MONGO_URL MONGODB_BIND_IP MONGODB_PORT MAIL_URL MAIL_FROM MAIL_SERVICE MAIL_SERVICE_USER MAIL_SERVICE_PASSWORD ROOT_URL PORT DISABLE_MONGODB CADDY_ENABLED CADDY_BIND_PORT WITH_API RICHER_CARD_COMMENT_EDITOR CARD_OPENED_WEBHOOK_ENABLED ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM ATTACHMENTS_UPLOAD_MIME_TYPES ATTACHMENTS_UPLOAD_MAX_SIZE AVATARS_UPLOAD_EXTERNAL_PROGRAM AVATARS_UPLOAD_MIME_TYPES AVATARS_UPLOAD_MAX_SIZE MAX_IMAGE_PIXEL IMAGE_COMPRESS_RATIO BIGEVENTS_PATTERN NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE NOTIFY_DUE_DAYS_BEFORE_AND_AFTER NOTIFY_DUE_AT_HOUR_OF_DAY DEFAULT_BOARD_ID EMAIL_NOTIFICATION_TIMEOUT CORS CORS_ALLOW_HEADERS CORS_EXPOSE_HEADERS MATOMO_ADDRESS MATOMO_SITE_ID MATOMO_DO_NOT_TRACK MATOMO_WITH_USERNAME METRICS_ALLOWED_IP_ADDRESSES BROWSER_POLICY_ENABLED TRUSTED_URL WEBHOOKS_ATTRIBUTES OAUTH2_ENABLED OIDC_REDIRECTION_ENABLED OAUTH2_CA_CERT OAUTH2_LOGIN_STYLE OAUTH2_CLIENT_ID OAUTH2_SECRET OAUTH2_SERVER_URL OAUTH2_AUTH_ENDPOINT OAUTH2_USERINFO_ENDPOINT OAUTH2_TOKEN_ENDPOINT OAUTH2_ID_MAP OAUTH2_USERNAME_MAP OAUTH2_FULLNAME_MAP OAUTH2_ID_TOKEN_WHITELIST_FIELDS OAUTH2_EMAIL_MAP OAUTH2_REQUEST_PERMISSIONS OAUTH2_ADFS_ENABLED OAUTH2_B2C_ENABLED LDAP_ENABLE LDAP_PORT LDAP_HOST LDAP_AD_SIMPLE_AUTH LDAP_BASEDN LDAP_LOGIN_FALLBACK LDAP_RECONNECT LDAP_TIMEOUT LDAP_IDLE_TIMEOUT LDAP_CONNECT_TIMEOUT LDAP_AUTHENTIFICATION LDAP_AUTHENTIFICATION_USERDN LDAP_AUTHENTIFICATION_PASSWORD LDAP_LOG_ENABLED LDAP_BACKGROUND_SYNC LDAP_BACKGROUND_SYNC_INTERVAL LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS LDAP_ENCRYPTION LDAP_CA_CERT LDAP_REJECT_UNAUTHORIZED LDAP_USER_AUTHENTICATION LDAP_USER_AUTHENTICATION_FIELD LDAP_USER_SEARCH_FILTER LDAP_USER_SEARCH_SCOPE LDAP_USER_SEARCH_FIELD LDAP_SEARCH_PAGE_SIZE LDAP_SEARCH_SIZE_LIMIT LDAP_GROUP_FILTER_ENABLE LDAP_GROUP_FILTER_OBJECTCLASS LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT LDAP_GROUP_FILTER_GROUP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD LDAP_UTF8_NAMES_SLUGIFY LDAP_USERNAME_FIELD LDAP_FULLNAME_FIELD LDAP_MERGE_EXISTING_USERS LDAP_SYNC_USER_DATA LDAP_SYNC_USER_DATA_FIELDMAP LDAP_SYNC_GROUP_ROLES LDAP_DEFAULT_DOMAIN LDAP_EMAIL_MATCH_ENABLE LDAP_EMAIL_MATCH_REQUIRE LDAP_EMAIL_MATCH_VERIFIED LDAP_EMAIL_FIELD LDAP_SYNC_ADMIN_STATUS LDAP_SYNC_ADMIN_GROUPS HEADER_LOGIN_ID HEADER_LOGIN_FIRSTNAME HEADER_LOGIN_LASTNAME HEADER_LOGIN_EMAIL LOGOUT_WITH_TIMER LOGOUT_IN LOGOUT_ON_HOURS LOGOUT_ON_MINUTES DEFAULT_AUTHENTICATION_METHOD PASSWORD_LOGIN_ENABLED CAS_ENABLED CAS_BASE_URL CAS_LOGIN_URL CAS_VALIDATE_URL SAML_ENABLED SAML_PROVIDER SAML_ENTRYPOINT SAML_ISSUER SAML_CERT SAML_IDPSLO_REDIRECTURL SAML_PRIVATE_KEYFILE SAML_PUBLIC_CERTFILE SAML_IDENTIFIER_FORMAT SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE SAML_ATTRIBUTES ORACLE_OIM_ENABLED RESULTS_PER_PAGE WAIT_SPINNER NODE_OPTIONS LDAP_AUTHENTIFICATION_PASSWORD_FILE OAUTH2_SECRET_FILE MAIL_SERVICE_PASSWORD_FILE MONGO_PASSWORD_FILE S3_SECRET_FILE"
-
-DESCRIPTION_S3='AWS S3 for files. Example: {"s3":{"key": "xxx", "secret": "xxx", "bucket": "xxx", "region": "eu-west-1"}}'
-DEFAULT_S3=""
-KEY_S3="s3"
+keys="DEBUG METEOR_REACTIVITY_ORDER MONGO_LOG_DESTINATION MONGO_URL MONGO_OPLOG_URL MONGODB_BIND_UNIX_SOCKET MONGODB_BIND_IP MONGODB_PORT MAIL_URL MAIL_FROM MAIL_SERVICE MAIL_SERVICE_USER MAIL_SERVICE_PASSWORD ROOT_URL PORT DISABLE_MONGODB CADDY_ENABLED CADDY_BIND_PORT WITH_API RICHER_CARD_COMMENT_EDITOR CARD_OPENED_WEBHOOK_ENABLED ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM ATTACHMENTS_UPLOAD_MIME_TYPES ATTACHMENTS_UPLOAD_MAX_SIZE AVATARS_UPLOAD_EXTERNAL_PROGRAM AVATARS_UPLOAD_MIME_TYPES AVATARS_UPLOAD_MAX_SIZE MAX_IMAGE_PIXEL IMAGE_COMPRESS_RATIO BIGEVENTS_PATTERN NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE NOTIFY_DUE_DAYS_BEFORE_AND_AFTER NOTIFY_DUE_AT_HOUR_OF_DAY DEFAULT_BOARD_ID EMAIL_NOTIFICATION_TIMEOUT CORS CORS_ALLOW_HEADERS CORS_EXPOSE_HEADERS MATOMO_ADDRESS MATOMO_SITE_ID MATOMO_DO_NOT_TRACK MATOMO_WITH_USERNAME METRICS_ALLOWED_IP_ADDRESSES BROWSER_POLICY_ENABLED TRUSTED_URL WEBHOOKS_ATTRIBUTES OAUTH2_ENABLED OIDC_REDIRECTION_ENABLED OAUTH2_CA_CERT OAUTH2_LOGIN_STYLE OAUTH2_CLIENT_ID OAUTH2_SECRET OAUTH2_SERVER_URL OAUTH2_AUTH_ENDPOINT OAUTH2_USERINFO_ENDPOINT OAUTH2_TOKEN_ENDPOINT OAUTH2_ID_MAP OAUTH2_USERNAME_MAP OAUTH2_FULLNAME_MAP OAUTH2_ID_TOKEN_WHITELIST_FIELDS OAUTH2_EMAIL_MAP OAUTH2_REQUEST_PERMISSIONS OAUTH2_ADFS_ENABLED OAUTH2_B2C_ENABLED LDAP_ENABLE LDAP_PORT LDAP_HOST LDAP_AD_SIMPLE_AUTH LDAP_BASEDN LDAP_LOGIN_FALLBACK LDAP_RECONNECT LDAP_TIMEOUT LDAP_IDLE_TIMEOUT LDAP_CONNECT_TIMEOUT LDAP_AUTHENTIFICATION LDAP_AUTHENTIFICATION_USERDN LDAP_AUTHENTIFICATION_PASSWORD LDAP_LOG_ENABLED LDAP_BACKGROUND_SYNC LDAP_BACKGROUND_SYNC_INTERVAL LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS LDAP_ENCRYPTION LDAP_CA_CERT LDAP_REJECT_UNAUTHORIZED LDAP_USER_AUTHENTICATION LDAP_USER_AUTHENTICATION_FIELD LDAP_USER_SEARCH_FILTER LDAP_USER_SEARCH_SCOPE LDAP_USER_SEARCH_FIELD LDAP_SEARCH_PAGE_SIZE LDAP_SEARCH_SIZE_LIMIT LDAP_GROUP_FILTER_ENABLE LDAP_GROUP_FILTER_OBJECTCLASS LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT LDAP_GROUP_FILTER_GROUP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD LDAP_UTF8_NAMES_SLUGIFY LDAP_USERNAME_FIELD LDAP_FULLNAME_FIELD LDAP_MERGE_EXISTING_USERS LDAP_SYNC_USER_DATA LDAP_SYNC_USER_DATA_FIELDMAP LDAP_SYNC_GROUP_ROLES LDAP_DEFAULT_DOMAIN LDAP_EMAIL_MATCH_ENABLE LDAP_EMAIL_MATCH_REQUIRE LDAP_EMAIL_MATCH_VERIFIED LDAP_EMAIL_FIELD LDAP_SYNC_ADMIN_STATUS LDAP_SYNC_ADMIN_GROUPS HEADER_LOGIN_ID HEADER_LOGIN_FIRSTNAME HEADER_LOGIN_LASTNAME HEADER_LOGIN_EMAIL LOGOUT_WITH_TIMER LOGOUT_IN LOGOUT_ON_HOURS LOGOUT_ON_MINUTES DEFAULT_AUTHENTICATION_METHOD PASSWORD_LOGIN_ENABLED CAS_ENABLED CAS_BASE_URL CAS_LOGIN_URL CAS_VALIDATE_URL SAML_ENABLED SAML_PROVIDER SAML_ENTRYPOINT SAML_ISSUER SAML_CERT SAML_IDPSLO_REDIRECTURL SAML_PRIVATE_KEYFILE SAML_PUBLIC_CERTFILE SAML_IDENTIFIER_FORMAT SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE SAML_ATTRIBUTES ORACLE_OIM_ENABLED RESULTS_PER_PAGE WAIT_SPINNER NODE_OPTIONS LDAP_AUTHENTIFICATION_PASSWORD_FILE OAUTH2_SECRET_FILE MAIL_SERVICE_PASSWORD_FILE MONGO_PASSWORD_FILE S3 S3_SECRET_FILE"

 #-------------------- CHANGE STREAMS --------------------
 # https://forums.meteor.com/t/meteor-3-5-beta-change-streams-performance-improvements/64461#change-streams-setup-3
 # https://github.com/meteor/meteor/blob/release-3.5/v3-docs/docs/performance/change-streams-observer-driver.md#choosing-the-reactivity-driver-order
+# Use oplog,polling to fix performance until changeStreams is fixed at next release of Meteor 3.5 Beta:
+# https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
+# Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
 DESCRIPTION_METEOR_REACTIVITY_ORDER="METEOR_REACTIVITY_ORDER. Default: 'changeStreams,oplog,polling'"
-DEFAULT_METEOR_REACTIVITY_ORDER="changeStreams,oplog,polling"
+DEFAULT_METEOR_REACTIVITY_ORDER="oplog,polling"
 KEY_METEOR_REACTIVITY_ORDER='meteor-reactivity-order'

 #-----------------------------------------------------------------
@@ -26,8 +25,10 @@ KEY_METEOR_REACTIVITY_ORDER='meteor-reactivity-order'
 #- S3='{"s3":{"key": "xxx", "secret": "xxx", "bucket": "xxx", "region": "eu-west-1"}}'
 #-----------------------------------------------------------------

+# This is not set here, because it can be set only at config files
+# snap/hooks/install and snap/hooks/post-refresh
 #DESCRIPTION_WRITABLE_PATH="Writable path. Default: $SNAP_COMMON/files"
-#DEFAULT_WRITABLE_PATH="$SNAP_COMMON/files"
+#DEFAULT_WRITABLE_PATH=""
 #KEY_WRITABLE_PATH="writable-path"

 #---------------------------------------------------------------------
@@ -56,7 +57,7 @@ DESCRIPTION_MONGO_URL="MONGO_URL. Default: ''"
 DEFAULT_MONGO_URL=""
 KEY_MONGO_URL='mongo-url'

-DESCRIPTION_MONGO_OPLOG_URL="MongoDB Oplog URL. Default: 'mongodb://127.0.0.1:27017/local?replicaSet=rs0'"
+DESCRIPTION_MONGO_OPLOG_URL="MongoDB Oplog URL. Default: 'mongodb://127.0.0.1:mongodb-port/local?replicaSet=rs0'"
 DEFAULT_MONGO_OPLOG_URL=""
 KEY_MONGO_OPLOG_URL="mongo-oplog-url"

@@ -667,6 +668,10 @@ DESCRIPTION_MONGO_PASSWORD_FILE="MongoDB password file (Docker secrets). Example
 DEFAULT_MONGO_PASSWORD_FILE=""
 KEY_MONGO_PASSWORD_FILE="mongo-password-file"

+DESCRIPTION_S3='AWS S3 for files. Example: {"s3":{"key": "xxx", "secret": "xxx", "bucket": "xxx", "region": "eu-west-1"}}'
+DEFAULT_S3=""
+KEY_S3="s3"
+
 DESCRIPTION_S3_SECRET_FILE="S3 secret file (Docker secrets). Example: /run/secrets/s3_secret"
 DEFAULT_S3_SECRET_FILE=""
 KEY_S3_SECRET_FILE="s3-secret-file"
@@ -69,20 +69,18 @@ else
 fi
 if [ -n "${MONGODB_PORT}" ]; then
    BIND_OPTIONS+=" --port ${MONGODB_PORT}"
-else
-    BIND_OPTIONS+=" --port 27019"
 fi

 # Debug: Show what settings we're using
 echo "MongoDB settings:"
 echo "  MONGODB_BIND_IP: ${MONGODB_BIND_IP:-127.0.0.1}"
-echo "  MONGODB_PORT: ${MONGODB_PORT:-27017}"
+echo "  MONGODB_PORT: ${MONGODB_PORT}"
 echo "  MONGODB_BIND_UNIX_SOCKET: ${MONGODB_BIND_UNIX_SOCKET:-not set}"
 echo "  BIND_OPTIONS: ${BIND_OPTIONS}"

 # Check if MongoDB is already running
 check_mongodb_running() {
-    local port="${MONGODB_PORT:-27017}"
+    local port="${MONGODB_PORT}"

    # Check if MongoDB is already running on the configured port
    if netstat -tuln 2>/dev/null | grep -q ":${port} "; then
@@ -149,18 +147,18 @@ if [ ! -f "$INIT_MARKER" ]; then
    sleep 5

    # Initialize replica set
-    /snap/${SNAP_NAME}/current/bin/mongosh --port ${MONGODB_PORT:-27019} --eval "rs.initiate({_id: 'rs0', members: [{_id: 0, host: '127.0.0.1:${MONGODB_PORT:-27019}'}]})" 2>/dev/null || true
+    /snap/${SNAP_NAME}/current/bin/mongosh --port ${MONGODB_PORT} --eval "rs.initiate({_id: 'rs0', members: [{_id: 0, host: '127.0.0.1:${MONGODB_PORT}'}]})" 2>/dev/null || true

    # Mark initialization as done
    touch "$INIT_MARKER"

    # Kill the forked process gracefully
    echo "Stopping temporary MongoDB process..."
-    /snap/${SNAP_NAME}/current/bin/mongosh --port ${MONGODB_PORT:-27019} --eval "db.getSiblingDB('admin').shutdownServer()" 2>/dev/null || true
+    /snap/${SNAP_NAME}/current/bin/mongosh --port ${MONGODB_PORT} --eval "db.getSiblingDB('admin').shutdownServer()" 2>/dev/null || true
    sleep 2

    # Clean up any remaining process
-    pkill -f "mongod.*${MONGODB_PORT:-27019}" 2>/dev/null || true
+    pkill -f "mongod.*${MONGODB_PORT}" 2>/dev/null || true
    sleep 1
 fi

@@ -4,8 +4,10 @@
 source $SNAP/bin/wekan-read-settings

 export NODE_PATH=$SNAP/bin
-# if possible we prefer to bind over unix socket
-if [ "nill" != "$MONGODB_BIND_UNIX_SOCKET" ] && [ "x" != "x$MONGODB_BIND_UNIX_SOCKET" ]; then
+# Use user-provided MONGO_URL if set, otherwise build from components
+if [ -n "$MONGO_URL" ]; then
+    echo "Using user-provided MONGO_URL"
+elif [ "nill" != "$MONGODB_BIND_UNIX_SOCKET" ] && [ "x" != "x$MONGODB_BIND_UNIX_SOCKET" ]; then
    if [ -d $MONGODB_BIND_UNIX_SOCKET ]; then
        export MONGO_URL="mongodb://$MONGODB_BIND_UNIX_SOCKET/mongodb-${MONGODB_PORT}.sock/wekan"
    else
@@ -19,12 +21,15 @@ else
    fi
 fi

-# If uploads directory does not exist, create it.
+# If WRITABLE_PATH is not set, use $SNAP_COMMON/files
 # Wekan will store attachments there.
-export WRITABLE_PATH=$SNAP_COMMON/files
-if [ ! -d $WRITABLE_PATH ]; then
-  mkdir $WRITABLE_PATH
+if [ -z "$WRITABLE_PATH" ]; then
+    export WRITABLE_PATH="$SNAP_COMMON/files"
 fi
+# Create attachments and avatars directories
+mkdir -p "$WRITABLE_PATH/attachments"
+mkdir -p "$WRITABLE_PATH/avatars"
+echo -e "Using WRITABLE_PATH: $WRITABLE_PATH"

 echo -e "MONGO_URL=$MONGO_URL"
 APPLICATION_DIRECTORY=$SNAP
@@ -3,10 +3,15 @@
 exec >> $SNAP_DATA/hook.log 2>&1
 echo "$(date '+%Y-%m-%d %H:%M:%S') $0: Entering hook"

-# coppy caddy file in place
+# copy caddy file in place
 [ ! -e $SNAP_COMMON/Caddyfile ] && cp $SNAP/Caddyfile $SNAP_COMMON/Caddyfile

 # create run dir, we're going to use it for unix socket
 mkdir -p $SNAP_DATA/share
 mkdir -p $SNAP_DATA/shared

+# attachments
+WRITABLE_PATH="$SNAP_COMMON/files"
+mkdir -p "$WRITABLE_PATH/attachments"
+mkdir -p "$WRITABLE_PATH/avatars"
+chmod -R 777 "$WRITABLE_PATH"
@@ -3,10 +3,15 @@
 exec >> $SNAP_DATA/hook.log 2>&1
 echo "$(date '+%Y-%m-%d %H:%M:%S') $0: Entering hook"

-# coppy caddy file in place
+# copy caddy file in place
 [ ! -e $SNAP_COMMON/Caddyfile ] && cp $SNAP/Caddyfile $SNAP_COMMON/Caddyfile

 # create run dir, we're going to use it for unix socket
 mkdir -p $SNAP_DATA/share
 mkdir -p $SNAP_DATA/shared

+# attachments
+WRITABLE_PATH="$SNAP_COMMON/files"
+mkdir -p "$WRITABLE_PATH/attachments"
+mkdir -p "$WRITABLE_PATH/avatars"
+chmod -R 777 "$WRITABLE_PATH"
@@ -1,5 +1,5 @@
 name: wekan
-version: '8.83'
+version: '9.06'
 base: core24
 summary: Open Source kanban
 description: |
@@ -78,7 +78,7 @@ apps:

 parts:
    mongodb:
-        source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-7.0.31.tgz
+        source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-7.0.32.tgz
        plugin: dump
        stage-packages:
            - libssl3
@@ -106,14 +106,14 @@ parts:
        plugin: dump

    mongotools:
-        source: https://fastdl.mongodb.org/tools/db/mongodb-database-tools-ubuntu2404-x86_64-100.16.0.tgz
+        source: https://fastdl.mongodb.org/tools/db/mongodb-database-tools-ubuntu2204-x86_64-100.16.0.tgz
        plugin: dump


    wekan:
        source: .
        plugin: npm
-        npm-node-version: 24.14.1
+        npm-node-version: 24.15.0
        npm-include-node: true
        build-packages:
            - build-essential
@@ -135,17 +135,34 @@ parts:
            rm -rf .build
            mkdir .build
            cd .build
-            wget https://github.com/wekan/wekan/releases/download/v8.83/wekan-8.83-amd64.zip
-            unzip wekan-8.83-amd64.zip
-            rm wekan-8.83-amd64.zip
-            cd ..
+            wget https://github.com/wekan/wekan/releases/download/v9.06/wekan-9.06-amd64.zip
+            unzip wekan-9.06-amd64.zip
+            rm wekan-9.06-amd64.zip
+            # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+            # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+            BCRYPT_DIR="bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+            if [ -d "$BCRYPT_DIR" ]; then
+              rm -rf "$BCRYPT_DIR"
+              TMP=$(mktemp -d)
+              pushd "$TMP" > /dev/null
+              npm pack bcrypt@6.0.0
+              mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+              cd bcrypt && npm install --ignore-scripts && cd ..
+              popd > /dev/null
+              cp -a "$TMP/bcrypt" "$BCRYPT_DIR"
+              rm -rf "$TMP"
+            fi
+            cd bundle/programs/server
+            rm -rf node_modules
+            npm install
+            cd ../../../..
            # Copy to Snap
-            wget https://nodejs.org/dist/latest-v24.x/node-v24.14.1-linux-x64.tar.xz
-            tar -xf node-v24.14.1-linux-x64.tar.xz node-v24.14.1-linux-x64/bin/node
-            rm node-v24.14.1-linux-x64.tar.xz
+            wget https://nodejs.org/dist/latest-v24.x/node-v24.15.0-linux-x64.tar.xz
+            tar -xf node-v24.15.0-linux-x64.tar.xz node-v24.15.0-linux-x64/bin/node
+            rm node-v24.15.0-linux-x64.tar.xz
            mkdir $SNAPCRAFT_PART_INSTALL/bin
-            cp -p node-v24.14.1-linux-x64/bin/node $SNAPCRAFT_PART_INSTALL/bin/
-            rm -rf node-v24.14.1-linux-x64
+            cp -p node-v24.15.0-linux-x64/bin/node $SNAPCRAFT_PART_INSTALL/bin/
+            rm -rf node-v24.15.0-linux-x64
            cp -r .build/bundle/* $SNAPCRAFT_PART_INSTALL/
            cp .build/bundle/.node_version.txt $SNAPCRAFT_PART_INSTALL/
            rm -f $SNAPCRAFT_PART_INSTALL/lib/node_modules/wekan
@@ -34,8 +34,11 @@ REM # If you would not like to use Change Streams and replica set for improving
 REM #SET METEOR_REACTIVITY_ORDER=polling
 REM # https://forums.meteor.com/t/meteor-3-5-beta-change-streams-performance-improvements/64461#change-streams-setup-3
 REM # https://github.com/meteor/meteor/blob/release-3.5/v3-docs/docs/performance/change-streams-observer-driver.md#choosing-the-reactivity-driver-order
+REM # Use oplog,polling to fix performance until changeStreams is fixed at next release of Meteor 3.5 Beta:
+REM # https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
+REM # Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
 REM #IF "%USE_CHANGE_STREAMS%"=="true" (
-REM #    SET METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+REM #    SET METEOR_REACTIVITY_ORDER=oplog,polling
 REM #) ELSE (
    SET METEOR_REACTIVITY_ORDER=polling
 REM #)
@@ -28,8 +28,12 @@
      #export METEOR_REACTIVITY_ORDER=polling
      # https://forums.meteor.com/t/meteor-3-5-beta-change-streams-performance-improvements/64461#change-streams-setup-3
      # https://github.com/meteor/meteor/blob/release-3.5/v3-docs/docs/performance/change-streams-observer-driver.md#choosing-the-reactivity-driver-order
+      # Use oplog,polling to fix performance until changeStreams is fixed at next release of Meteor 3.5 Beta:
+      # https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
+      # Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
      if [ "$USE_CHANGE_STREAMS" = "true" ]; then
-          export METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+          #export METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+          export METEOR_REACTIVITY_ORDER=oplog,polling
      else
          export METEOR_REACTIVITY_ORDER=polling
      fi
@@ -55,7 +59,7 @@
      # If port is 80, must change ROOT_URL to: http://YOUR-WEKAN-SERVER-IPv4-ADDRESS , like http://192.168.0.100
      # If port is not 80, must change ROOT_URL to: http://YOUR-WEKAN-SERVER-IPv4-ADDRESS:YOUR-PORT-NUMBER , like http://192.168.0.100:2000
      # If ROOT_URL is not correct, these do not work: translations, uploading attachments.
-      export ROOT_URL=http://localhost:2000
+      export ROOT_URL=${ROOT_URL:-http://localhost:2000}
      # If at public Internet, required different SSL/TLS settings:
      # - https://github.com/wekan/wekan/wiki/Settings
      # - Also at wiki: SSL/TLS config for Caddy/Nginx/Apache