v9.08

Thanks to Meteor developers !

Fixes #6307

.meteor/packages

@@ -6,9 +6,9 @@
 meteor-base@1.5.2
 
 # Build system
-ecmascript@0.17.0
+ecmascript@0.18.0
 standard-minifier-js@3.2.0
-rspack@1.0.0
+rspack@1.1.0
 
 blaze@3.0.2
 
@@ -16,10 +16,10 @@ blaze@3.0.2
 aldeed:collection2
 aldeed:schema-index@4.0.0-beta.5
 reywood:publish-composite
-mongo@2.3.0-beta350.7
+mongo@2.4.0-beta350.10
 
 # Account system
-accounts-password@3.2.3-beta350.7
+accounts-password@3.3.0-beta350.10
 communitypackages:core
 communitypackages:unstyled
 communitypackages:flow-routing
@@ -36,7 +36,7 @@ wekan-accounts-oidc
 check@1.5.0
 random@1.2.2
 reactive-dict@1.3.2
-session@1.2.2
+session@1.2.3-beta350.10
 tracker@1.3.4
 audit-argument-checks@1.0.8
 
@@ -44,7 +44,7 @@ audit-argument-checks@1.0.8
 ostrio:i18n
 reactive-var@1.0.13
 shell-server@0.7.0
-email@3.2.0-beta350.7
+email@3.2.0-beta350.10
 dynamic-import@0.7.4
 wekan-markdown
 quave:synced-cron
@@ -54,8 +54,8 @@ ostrio:files
 meteortesting:mocha
 matb33:collection-hooks
 service-configuration@1.3.5
-minifier-css@2.0.1
-ejson@1.2.0-beta350.7
+minifier-css@2.0.2-beta350.10
+ejson@1.2.0-beta350.10
 logging@1.3.6
 wekan-fullcalendar
 wekan-fontawesome

.meteor/release

@@ -1 +1 @@
-METEOR@3.5-beta.7
+METEOR@3.5-beta.10

.meteor/versions

@@ -1,47 +1,47 @@
-accounts-base@3.3.0-beta350.7
-accounts-oauth@1.4.6
-accounts-password@3.2.3-beta350.7
+accounts-base@3.3.0-beta350.10
+accounts-oauth@1.4.7-beta350.10
+accounts-password@3.3.0-beta350.10
 aldeed:collection2@4.1.5
 aldeed:schema-index@4.0.0
 aldeed:simple-schema@1.13.1
 allow-deny@2.1.0
 audit-argument-checks@1.0.8
 autoupdate@2.0.1
-babel-compiler@7.13.0
+babel-compiler@7.14.0
 babel-runtime@1.5.2
-base64@1.0.13
-binary-heap@1.0.12
-blaze@3.0.2
-blaze-tools@2.0.0
+base64@1.0.14-beta350.10
+binary-heap@1.0.13-beta350.10
+blaze@3.0.3
+blaze-tools@2.0.1
 boilerplate-generator@2.1.0
 caching-compiler@2.0.1
-caching-html-compiler@2.0.0
-callback-hook@1.6.1
+caching-html-compiler@2.0.1
+callback-hook@1.8.0-beta350.10
 check@1.5.0
 communitypackages:core@2.0.3
 communitypackages:flow-routing@2.1.0
 communitypackages:unstyled@2.0.1
 core-runtime@1.0.0
 ddp@1.4.2
-ddp-client@3.2.0-beta350.7
-ddp-common@1.4.4
-ddp-rate-limiter@1.3.0-beta350.7
-ddp-server@3.2.0-beta350.7
+ddp-client@3.3.0-beta350.10
+ddp-common@1.4.5-beta350.10
+ddp-rate-limiter@1.3.0-beta350.10
+ddp-server@3.3.0-beta350.10
 diff-sequence@1.1.3
 dynamic-import@0.7.4
-ecmascript@0.17.0
+ecmascript@0.18.0
 ecmascript-runtime@0.8.3
-ecmascript-runtime-client@0.12.3
+ecmascript-runtime-client@0.13.0
 ecmascript-runtime-server@0.11.1
-ejson@1.2.0-beta350.7
-email@3.2.0-beta350.7
+ejson@1.2.0-beta350.10
+email@3.2.0-beta350.10
 es5-shim@4.8.1
 facts-base@1.0.2
-fetch@0.1.6
+fetch@0.2.0-beta350.10
 geojson-utils@1.0.12
 hot-code-push@1.0.5
-html-tools@2.0.0
-htmljs@2.0.1
+html-tools@2.0.1
+htmljs@2.0.2
 http@1.4.4
 id-map@1.2.0
 inter-process-messaging@0.1.2
@@ -53,36 +53,36 @@ lai:collection-extensions@1.0.0
 localstorage@1.2.1
 logging@1.3.6
 matb33:collection-hooks@2.1.0
-meteor@2.2.0
+meteor@2.3.1-beta350.10
 meteor-base@1.5.2
 meteortesting:browser-tests@1.4.2
 meteortesting:mocha@2.1.0
 meteortesting:mocha-core@8.0.1
-minifier-css@2.0.1
-minifier-js@3.1.0
-minimongo@2.1.0-beta350.7
+minifier-css@2.0.2-beta350.10
+minifier-js@3.2.0
+minimongo@2.2.0-beta350.10
 modern-browsers@0.2.3
 modules@0.20.3
 modules-runtime@0.13.2
-mongo@2.3.0-beta350.7
+mongo@2.4.0-beta350.10
 mongo-decimal@0.2.0
 mongo-dev-server@1.1.1
 mongo-id@1.0.9
 npm-mongo@6.16.1
-oauth@3.0.2
+oauth@3.0.4-beta.10
 oauth2@1.3.3
-observe-sequence@2.0.0
+observe-sequence@2.0.1
 ordered-dict@1.2.0
-ostrio:cookies@2.9.1
+ostrio:cookies@2.9.2
 ostrio:cstorage@4.0.1
 ostrio:files@3.0.1
-ostrio:flow-router-extra@3.13.0
+ostrio:flow-router-extra@3.14.0
 ostrio:i18n@3.2.1
 promise@1.0.0
 quave:synced-cron@2.4.0
 raix:eventemitter@1.0.0
 random@1.2.2
-rate-limit@1.2.0-beta350.7
+rate-limit@1.2.0-beta350.10
 react-fast-refresh@0.3.0
 reactive-dict@1.3.2
 reactive-var@1.0.13
@@ -90,24 +90,24 @@ reload@1.3.2
 retry@1.1.1
 reywood:publish-composite@1.9.0
 routepolicy@1.1.2
-rspack@1.0.0
+rspack@1.1.0
 service-configuration@1.3.5
-session@1.2.2
+session@1.2.3-beta350.10
 sha@1.0.10
 shell-server@0.7.0
-socket-stream-client@0.7.0-beta350.7
-spacebars@2.0.0
-spacebars-compiler@2.0.0
+socket-stream-client@0.7.0-beta350.10
+spacebars@2.0.1
+spacebars-compiler@2.0.1
 standard-minifier-js@3.2.0
-templating@1.4.4
-templating-compiler@2.0.0
-templating-runtime@2.0.1
-templating-tools@2.0.0
-tools-core@1.0.0
+templating@1.4.5
+templating-compiler@2.0.1
+templating-runtime@2.0.2
+templating-tools@2.0.1
+tools-core@1.1.0
 tracker@1.3.4
-typescript@5.9.3
-url@1.3.5
-webapp@2.2.0-beta350.7
+typescript@5.10.0
+url@1.3.6-beta350.10
+webapp@2.2.0-beta350.10
 webapp-hashing@1.1.2
 wekan-accounts-cas@0.2.0
 wekan-accounts-lockout@1.1.0

CHANGELOG.md

@@ -26,6 +26,106 @@ Versions:
 - WeKan 8.00-8.06 had wrong raw database directory setting /var/snap/wekan/common/wekan and some cards were not visible,
   it was fixed at WeKan 8.07 where database directory is back to /var/snap/wekan/common and all cards are visible.
 
+# v9.08 2026-05-04 WeKan ® release
+
+This release adds the following updates:
+
+- [Release scripts: Add Snap Store scripts to list and publish revisions to channels, because snapcraft.io website currently does not work](https://github.com/wekan/wekan/commit/f7db51b457a771267ce381f294c8163fc0cad406).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Upgrade to Meteor 3.5-beta.10, changeStreams, DDP_TRANSPORT=uws](https://github.com/wekan/wekan/commit/330e0e35707c70a088cd8c452192265ba3df6fbd).
+  Thanks to Meteor developers.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.07 2026-05-02 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY ISSUES of [AvatarBleed](https://wekan.fi/hall-of-fame/avatarbleed/):
+
+- [Fix avatars rce](https://github.com/wekan/wekan/commit/a4c74a5980e9f778eb444fd346f32aa3d16786a9).
+  Thanks to Trung Nguyen from CyStack Security and xet7.
+
+and fixes the following bugs:
+
+- [Fix CleanDark theme](https://github.com/wekan/wekan/pull/6324).
+  Thanks to stegoh.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.06 2026-05-02 WeKan ® release
+
+This release adds the following updates:
+
+- [Docs: Update lxc commands](https://github.com/wekan/wekan/commit/3c8db21d2f56eefe3d8b7f3228b580407a4fe89b).
+  Thanks to xet7.
+- [Docs: Added firewall config for Internet access from LXD Ubuntu container at Fedora Asahi Linux Remix, because building Linux arm64 .zip bundle of WeKan](https://github.com/wekan/wekan/commit/82c78ebd1efb888940ccf64affd23400f5485755).
+  Thanks to xet7.
+- [Docs: Added Manual Parallel Snap](https://github.com/wekan/wekan/commit/eb824938cb750921bec721d80eab2670ba567869).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix Snap Candidate WRITABLE_PATH directory permissions at Parallel Snap file path /var/snap/wekan_SOMENAME/common/files/](https://github.com/wekan/wekan/commit/7556b3ed8e29b9edd074c1dd8c03a9b804787523).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.05 2026-05-02 WeKan ® release
+
+This release adds the following updates:
+
+- [Update version script and dependencies](https://github.com/wekan/wekan/commit/4e77df9ff52ef2aed44e95ad4ef58d0cde6593b7).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- Fix Snap Candidate attachments WRITABLE_PATH for Parallel Snap installs.
+  [Part 1](https://github.com/wekan/wekan/commit/cadd015d20e6b677fefb040ab8c5b1a3e972a394),
+  [Part 2](https://github.com/wekan/wekan/commit/cd2c69f5f05d932074ca80ae569cc8d836770f7b).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.04 2026-05-01 WeKan ® release
+
+This release adds the following updates:
+
+- [Upgrade to MongoDB 7.0.32. Update version script.](https://github.com/wekan/wekan/commit/653c61081a8d9306fb0b152f6a3a497c2607a1cf).
+  Thanks to MongoDB developers and xet7.
+- [Upgrade to MongoDB 7.0.32 at Helm Chart](https://github.com/wekan/charts/commit/c55e9d3a130a7d259681185561b2741a64a8353e).
+  Thanks to MongoDB developers.
+- [Upgrade to MongoDB 7.0.32 at Windows Bundle docs](https://github.com/wekan/wekan/commit/2a3aa981d2ba02ec87981e3af843811e31328fea).
+  Thanks to MongoDB developers.
+
+and fixes the following bugs:
+
+- [Fix can not edit checklist title](https://github.com/wekan/wekan/commit/309b488861c29b4d74262f099ee11329f6d151c7).
+  Thanks to xet7.
+- [Fix Cannot delete card checklist title, by removing "Delete" and "Convert to Card" that belong to Checklist Items only. Checklist Menu already has Delete Checklist](https://github.com/wekan/wekan/commit/9defe9681b8091eec3037872882d0894fbdeeb20).
+  Thanks to rileybroberts and xet7.
+- [Fix: Added space between Card Number and Card Title at Minicard and Opened Card](https://github.com/wekan/wekan/commit/d04beea6f8797856806ee63df6cd30a0c6446bd5).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.03 2026-04-29 WeKan ® release
+
+This release adds the following new features:
+
+- [Add missing board‑attachments API endpoint](https://github.com/wekan/wekan/pull/6321).
+  Thanks to KhaoulaMaleh.
+
+and adds the following updates:
+
+- Update version script.
+  [Part 1](https://github.com/wekan/wekan/commit/e547be9ab81f6a880954b3e34fc3b5e3edc8efc5),
+  [Part 2](https://github.com/wekan/wekan/commit/e22f4226151d54593d11ad8040cd46c39435ce5b).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v9.02 2026-04-28 WeKan ® release
 
 This release fixes the following bugs:
@@ -977,7 +1077,7 @@ Thanks to above GitHub users for their contributions and translators for their t
 
 # v8.36 2026-03-20 WeKan ® release
 
-This release fixes the following CRITICAL SECURITY ISSUES of [IntegrationBleed](https://wekan.fi/hall-of-fame/integrationBleed/):
+This release fixes the following CRITICAL SECURITY ISSUES of [IntegrationBleed](https://wekan.fi/hall-of-fame/integrationbleed/):
 
 - [Fix RebindBleed of IntegrationBleed](https://github.com/wekan/wekan/commit/92beaa313706bc26fbea7e1cc8cfaf836609e038).
   Thanks to Rodolphe GHIO and xet7.

Dockerfile

@@ -7,7 +7,7 @@ LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 # TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=9.02
+ARG VERSION=9.08
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"
@@ -15,7 +15,7 @@ ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essen
 ENV \
     DEBUG=false \
     NODE_VERSION=v24.15.0 \
-    METEOR_RELEASE=METEOR@3.5-beta.7 \
+    METEOR_RELEASE=METEOR@3.5-beta.10 \
     USE_EDGE=false \
     NPM_VERSION=11.11.0 \
     SRC_PATH=./ \

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v9.02.0"
+appVersion: "v9.08.0"
 files:
   userUploads:
     - README.md

client/components/boards/boardColors.css

@@ -3370,18 +3370,19 @@ THEME - Clean Light
 
 .board-color-cleanlight .list,
 .board-color-cleandark .list {
-  background: none;
-  border-left: none;
+  background: none !important;
+  border-left: none !important;
 }
 
 .board-color-cleanlight .list .list-header,
 .board-color-cleandark .list .list-header {
-  border-bottom: none;
-  display: flex;
+  border-bottom: none !important;
+  display: flex !important;
   justify-content: space-between;
   align-items: center;
   font-size: 16px;
-  background: none;
+  background: none !important;
+  background-color: transparent !important;
 }
 
 .board-color-cleanlight .list .list-header div:has(.list-header-name),
@@ -4279,6 +4280,14 @@ THEME - Clean Light
   font-weight: 500;
 }
 
+.board-color-cleandark .pop-over-list li > a {
+  color: rgba(255, 255, 255, 1) !important;
+}
+
+.board-color-cleanlight .pop-over-list li > a {
+  color: rgba(10, 10, 20, 0.85) !important;
+}
+
 .board-color-cleanlight .pop-over-list li > a i,
 .board-color-cleandark .pop-over-list li > a i {
   margin-right: 6px !important;

client/components/cards/cardDetails.jade

@@ -66,7 +66,7 @@ template(name="cardDetails")
             +viewer
               if currentBoard.allowsCardNumber
                 span.card-number
-                  | ##{getCardNumber}
+                  | ##{getCardNumber}  
               = getTitle
             if isWatching
               i.card-details-watch

client/components/cards/checklists.jade

@@ -34,7 +34,7 @@ template(name="checklists")
 template(name="checklistDetail")
   .js-checklist.checklist.nodragscroll
     +inlinedForm(classNames="js-edit-checklist-title" checklist = checklist)
-      +editChecklistItemForm(checklist = checklist)
+      +editChecklistForm(checklist = checklist)
     else
       .checklist-title
         span
@@ -85,6 +85,19 @@ template(name="addChecklistItemForm")
           label.toggle-label(for="toggleNewlineBecomesNewChecklistItemOriginOrder")
           | {{_ 'originOrder'}}
 
+template(name="editChecklistForm")
+  a.fa.fa-copy(title="{{_ 'copy-text-to-clipboard'}}")
+  span.copied-tooltip {{_ 'copied'}}
+  textarea.js-edit-checklist-item(rows='1' autofocus dir="auto")
+    if $eq type 'item'
+      = item.title
+    else
+      = checklist.title
+  .edit-controls.clearfix
+    button.primary.confirm.js-submit-edit-checklist-item-form(type="submit") {{_ 'save'}}
+    a.fa.fa-times-thin.js-close-inlined-form(title="{{_ 'close-edit-checklist-item'}}")
+    span(title=createdAt) {{ displayDate createdAt }}
+
 template(name="editChecklistItemForm")
   a.fa.fa-copy(title="{{_ 'copy-text-to-clipboard'}}")
   span.copied-tooltip {{_ 'copied'}}

client/components/cards/checklists.js

@@ -135,8 +135,11 @@ Template.checklists.events({
     event.preventDefault();
     const textarea = tpl.find('textarea.js-edit-checklist-item');
     const title = textarea.value.trim();
-    const checklist = Template.currentData().checklist;
-    checklist.setTitle(title);
+    const formData = Blaze.getData(event.currentTarget) || Blaze.getData(event.target);
+    const checklist = formData?.checklist;
+    if (checklist) {
+      checklist.setTitle(title);
+    }
   },
   'submit .js-add-checklist-item'(event, tpl) {
     event.preventDefault();

client/components/cards/minicard.jade

@@ -74,7 +74,7 @@ template(name="minicard")
       +viewer
         if showCardNumber
           span.card-number
-            | ##{getCardNumber}
+            | ##{getCardNumber}  
         = getTitle
     if showLabels
       if labels

docker-compose.yml

@@ -315,8 +315,8 @@ services:
       # https://github.com/meteor/meteor/blob/release-3.5/v3-docs/docs/performance/change-streams-observer-driver.md#choosing-the-reactivity-driver-order
       # Use oplog,polling to fix performance until changeStreams is fixed at next release of Meteor 3.5 Beta:
       # https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
-      # Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
-      - METEOR_REACTIVITY_ORDER=oplog,polling
+      METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+      DDP_TRANSPORT=uws
       #-----------------------------------------------------------------
       # ==== WRITEABLE PATH FOR FILE UPLOADS ====
       - WRITABLE_PATH=/data

docs/Platforms/FOSS/Snap/Many-Snaps-on-LXC.md

@@ -104,10 +104,20 @@ sudo snap list
 ```
 If not, change to candidate:
 ```
-sudo snap refresh wekan_customer1 --channel=latest/candidate
+sudo snap refresh wekan_customer1 --channel=latest/candidate --amend
+```
+## Manual Parallel Snap
+
+If using manual snap package, with Parallel Snap, that has name wekan_other:
+```
+sudo snap install --dangerous wekan-VERSION.snap --name wekan_other
+```
+Back to channel:
+```
+sudo snap refresh wekan_other --channel=latest/candidate --amend
 ```
 If it complains about old database version (was at stable), stop it, move old files somewhere safe, and start again.
-WARNING: this deletes 
+WARNING: this deletes stuff.
 ```
 sudo su
 mkdir old_customer1_common
@@ -333,16 +343,21 @@ files.company.com {
 
 To server and LXC/LXD containers, install these packages:
 
+Ubuntu:
 ```
 sudo apt install libsquashfuse0 squashfuse fuse
 ```
-
+Fedora
+```
+sudo dnf install squashfuse fuse
+```
 Source: https://forum.snapcraft.io/t/system-does-not-fully-support-snapd/14767/11
 
 ## LXD init CIDR
 
 IPv4 CIDR: 10.1.1.1/24
 
+Ubuntu:
 ```
 sudo apt install snapd
 
@@ -351,7 +366,28 @@ sudo reboot
 sudo snap install lxd
 
 lxd init
+```
+Fedora:
+```
+sudo dnf install snapd
 
+sudo reboot
+
+sudo snap install lxd
+
+# Any Fedora Linux or Fedora Linux Asahi Remix at Apple Silicon:
+# Internet access from LXD container:
+# 1) Allow LXD-bridge:
+sudo firewall-cmd --zone=trusted --add-interface=lxdbr0 --permanent
+sudo firewall-cmd --reload
+# 2) Allow IP Masquerading:
+sudo firewall-cmd --zone=public --add-masquerade --permanent
+sudo firewall-cmd --reload
+
+lxd init
+```
+Answers for lxd init:
+```
 Would you like to use LXD clustering? (yes/no) [default=no]: 
 Do you want to configure a new storage pool? (yes/no) [default=yes]: 
 Name of the new storage pool [default=default]: 
@@ -418,7 +454,7 @@ Ubuntu Touch:
 ```
 sudo su
 
-snap install lxd --channel=5.21/stable
+snap install lxd
 ```
 
 3. From Ubuntu Touch Terminal, lxd init, etc.
@@ -434,17 +470,17 @@ sudo lxc profile set default security.nesting true
 5. Start new lxc container
 
 ```
-# launch-ubu2504.sh
+# launch-ubu2604.sh
 # lxc launch image-name container-name
-lxc launch ubuntu:25.04 ubu2504
+lxc launch ubuntu:26.04 ubu2604
 ```
 
 6. Bash shell to inside of container:
 
 ```
-# into-ubu2504.sh
+# into-ubu2604.sh
 # lxc exec container-name -- /bin/bash
-lxc exec ubu2504 -- /bin/bash
+lxc exec ubu2604 -- /bin/bash
 ```
 
 ## 3) Snapd and Wekan
@@ -471,7 +507,7 @@ You can also add more lxc containers to different subdomains and proxy to them i
 
 ### New Ubuntu container
 ```
-lxc launch images:ubuntu/20.04 lxccontainername
+lxc launch ubuntu:26.04 lxccontainername
 ```
 ### Inside LXC container
 ```

docs/Platforms/Propietary/Windows/Offline.md

@@ -10,18 +10,18 @@ This is without container (without Docker or Snap).
 
 Right click and download files 1-4:
 
-1. [wekan-9.02-win64.zip](https://github.com/wekan/wekan/releases/download/v9.02/wekan-9.02-win64.zip)
+1. [wekan-9.08-win64.zip](https://github.com/wekan/wekan/releases/download/v9.08/wekan-9.08-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
 2. [node.exe](https://nodejs.org/dist/latest-v24.x/win-x64/node.exe)
 
-3. [mongodb-windows-x86_64-7.0.31-signed.msi](https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-7.0.31-signed.msi)
+3. [mongodb-windows-x86_64-7.0.32-signed.msi](https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-7.0.32-signed.msi)
 
 4. [start-wekan.bat](https://raw.githubusercontent.com/wekan/wekan/main/start-wekan.bat)
 
 5. Copy files from steps 1-4 with USB stick or DVD to offline Windows computer
 
-6. Double click `mongodb-windows-x86_64-7.0.31-signed.msi` . In installer, uncheck downloading MongoDB compass.
+6. Double click `mongodb-windows-x86_64-7.0.32-signed.msi` . In installer, uncheck downloading MongoDB compass.
 
-7. Unzip `wekan-9.02-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-9.08-win64.zip` , inside it is directory `bundle`, to it copy other files:
 
 ```
 bundle (directory)

models/avatars.js

@@ -52,13 +52,17 @@ const Avatars = new FilesCollection({
       filenameWithoutExtension = Math.random().toString(36).slice(2);
       fileId = Math.random().toString(36).slice(2);
     }
-    const ret = fileId + "-original-" + filenameWithoutExtension;
-    // remove fileId from meta, it was only stored there to have this information here in the namingFunction function
+    // Strip shell metacharacters and path-traversal sequences from the
+    // user-supplied portion of the filename.  The result is used as part of
+    // the on-disk path passed to external commands, so only safe characters
+    // (alphanumerics, hyphens, underscores, and dots) are kept.
+    const safeName = filenameWithoutExtension.replace(/[^a-zA-Z0-9_.\-]/g, '_');
+    const ret = fileId + "-original-" + safeName;
     return ret;
   },
   sanitize(str, max, replacement) {
-    // keep the original filename
-    return str;
+    // Strip characters that are dangerous in shell contexts and filesystem paths.
+    return str.replace(/[^a-zA-Z0-9_.\-]/g, '_');
   },
   onBeforeUpload(file) {
     // Block SVG files for avatars to prevent XSS attacks

models/fileValidation.js

@@ -1,20 +1,21 @@
 import { Meteor } from 'meteor/meteor';
-import { exec } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'fs';
 
-let asyncExec;
+let asyncExecFile;
 
 if (Meteor.isServer) {
-  asyncExec = promisify(exec);
+  asyncExecFile = promisify(execFile);
 }
 
 async function detectMimeFromFile(filePath) {
   if (!Meteor.isServer) return undefined;
 
   try {
-    const escapedPath = String(filePath).replace(/"/g, '\\"');
-    const { stdout } = await asyncExec(`file --mime-type -b "${escapedPath}"`);
+    // Use execFile instead of exec so no shell is spawned and the path is
+    // passed as a direct argument — this eliminates shell injection entirely.
+    const { stdout } = await asyncExecFile('file', ['--mime-type', '-b', String(filePath)]);
     const mime = (stdout || '').trim().toLowerCase();
     if (!mime) return undefined;
     return { mime };

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v9.02.0",
+  "version": "v9.08.0",
   "description": "Open-Source kanban",
   "private": true,
   "repository": {
@@ -20,8 +20,8 @@
     "modern": true
   },
   "devDependencies": {
-    "@meteorjs/rspack": "^1.0.2",
-    "@rsdoctor/rspack-plugin": "^1.2.3",
+    "@meteorjs/rspack": "^2.0.1",
+    "@rsdoctor/rspack-plugin": "^1.5.7",
     "@rspack/cli": "^1.7.11",
     "@rspack/core": "^1.7.11",
     "chai": "^6.2.2",

rebuild-wekan.sh

@@ -81,7 +81,7 @@ do
 		#---------------------------------------------------------------------
 		# Logging of terminal output to console and to ../wekan-log.txt at end of this line: 2>&1 | tee ../wekan-log.txt
 		#WARN_WHEN_USING_OLD_API=true NODE_OPTIONS="--trace-warnings"
-		WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://localhost:4000 meteor run --port 4000 2>&1 | tee ../wekan-log.txt
+		DEFAULT_METEOR_REACTIVITY_ORDER="changeStreams,oplog,polling" DDP_TRANSPORT=uws DEBUG=true WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://localhost:4000 meteor run --port 4000 2>&1 | tee ../wekan-log.txt
 		#---------------------------------------------------------------------
 		break
 		;;
@@ -91,7 +91,7 @@ do
                 #Not in use, could increase RAM usage: NODE_OPTIONS="--max_old_space_size=4096"
                 #---------------------------------------------------------------------
                 # Logging of terminal output to console and to ../wekan-log.txt at end of this line: 2>&1 | tee ../wekan-log.txt
-                WARN_WHEN_USING_OLD_API=true NODE_OPTIONS="--trace-warnings" WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://localhost:4000 meteor run --port 4000 2>&1 | tee ../wekan-log.txt
+                DEFAULT_METEOR_REACTIVITY_ORDER="changeStreams,oplog,polling" DDP_TRANSPORT=uws DEBUG=true WARN_WHEN_USING_OLD_API=true NODE_OPTIONS="--trace-warnings" WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://localhost:4000 meteor run --port 4000 2>&1 | tee ../wekan-log.txt
                 #---------------------------------------------------------------------
                 break
                 ;;
@@ -101,7 +101,7 @@ do
 		#---------------------------------------------------------------------
 		#Logging of terminal output to console and to ../wekan-log.txt at end of this line: 2>&1 | tee ../wekan-log.txt
 		#WARN_WHEN_USING_OLD_API=true NODE_OPTIONS="--trace-warnings"
-		WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://localhost:4000 meteor run --port 4000 --extra-packages bundle-visualizer --production  2>&1 | tee ../wekan-log.txt
+		DEFAULT_METEOR_REACTIVITY_ORDER="changeStreams,oplog,polling" DDP_TRANSPORT=uws DEBUG=true WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://localhost:4000 meteor run --port 4000 --extra-packages bundle-visualizer --production  2>&1 | tee ../wekan-log.txt
 		#---------------------------------------------------------------------
 		break
 		;;
@@ -118,7 +118,7 @@ do
 		#---------------------------------------------------------------------
 		#Logging of terminal output to console and to ../wekan-log.txt at end of this line: 2>&1 | tee ../wekan-log.txt
 		#WARN_WHEN_USING_OLD_API=true NODE_OPTIONS="--trace-warnings"
-		DEBUG=true WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://$IPADDRESS:4000 meteor run --port 4000 2>&1 | tee ../wekan-log.txt
+		DEFAULT_METEOR_REACTIVITY_ORDER="changeStreams,oplog,polling" DDP_TRANSPORT=uws DEBUG=true WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://$IPADDRESS:4000 meteor run --port 4000 2>&1 | tee ../wekan-log.txt
 		#---------------------------------------------------------------------
 		break
 		;;
@@ -135,7 +135,7 @@ do
                 #---------------------------------------------------------------------
                 #Logging of terminal output to console and to ../wekan-log.txt at end of this line: 2>&1 | tee ../wekan-log.txt
                 #WARN_WHEN_USING_OLD_API=true NODE_OPTIONS="--trace-warnings"
-                MONGO_URL=mongodb://127.0.0.1:27019/wekan WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://$IPADDRESS:4000 meteor run --port 4000 2>&1 | tee ../wekan-log.txt
+                DEFAULT_METEOR_REACTIVITY_ORDER="changeStreams,oplog,polling" DDP_TRANSPORT=uws DEBUG=true MONGO_URL=mongodb://127.0.0.1:27019/wekan WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://$IPADDRESS:4000 meteor run --port 4000 2>&1 | tee ../wekan-log.txt
                 #---------------------------------------------------------------------
                 break
                 ;;
@@ -152,7 +152,7 @@ do
 		#---------------------------------------------------------------------
 		#Logging of terminal output to console and to ../wekan-log.txt at end of this line: 2>&1 | tee ../wekan-log.txt
 		#WARN_WHEN_USING_OLD_API=true NODE_OPTIONS="--trace-warnings"
-		WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://$IPADDRESS:$PORT meteor run --port $PORT 2>&1 | tee ../wekan-log.txt
+		DEFAULT_METEOR_REACTIVITY_ORDER="changeStreams,oplog,polling" DDP_TRANSPORT=uws DEBUG=true WRITABLE_PATH=.. WITH_API=true RICHER_CARD_COMMENT_EDITOR=false ROOT_URL=http://$IPADDRESS:$PORT meteor run --port $PORT 2>&1 | tee ../wekan-log.txt
 		#---------------------------------------------------------------------
 		break
 		;;

releases/snap-store-release-revision-to-channels.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [ $# -ne 1 ]
+  then
+    echo "Syntax with Wekan revision number:"
+    echo "./releases/snap-store-release-revision-to-channels.sh 9.10"
+    exit 1
+fi
+
+snapcraft release wekan $1 edge,beta,candidate

releases/snap-store-revisions.sh

@@ -0,0 +1 @@
+snapcraft revisions wekan | head -7

releases/version.sh

@@ -51,7 +51,6 @@ version_bump_logic() {
   # 3. Update Configuration Files: MongoDB & Tools
   echo "[DEBUG] Updating snapcraft.yaml and documentation..."
   sedi "s|mongodb-linux-x86_64-ubuntu[0-9]\+-7\.[0-9][0-9]*\.[0-9][0-9]*|mongodb-linux-x86_64-ubuntu${UBUNTU_VER}-$MONGO_VER|g" snapcraft.yaml
-  sedi "s|mongodb-linux-x86_64-ubuntu[0-9]\+-7\.[0-9][0-9]*\.[0-9][0-9]*|mongodb-linux-x86_64-ubuntu${UBUNTU_VER}-$MONGO_VER|g" docs/Platforms/Propietary/Windows/Offline.md
 
   # Ensure database tools point to the correct Ubuntu version
   sedi -E "s|mongodb-database-tools-ubuntu[0-9]+-x86_64|mongodb-database-tools-ubuntu2204-x86_64|g" snapcraft.yaml
@@ -74,6 +73,8 @@ version_bump_logic() {
   sedi "0,/\"version\": \"[^\"]*\"/s//\"version\": \"${PKG_VER}\"/" package-lock.json
   sedi "0,/appVersion: \"[^\"]*\"/s/appVersion: \"[^\"]*\"/appVersion: \"${PKG_VER}\"/" Stackerfile.yml
   sedi "2s/^version: '[^']*'/version: '${NEW_VERSION}'/" snapcraft.yaml
+  sedi "s|v$OLD_VERSION/|v$NEW_VERSION/|g" snapcraft.yaml
+  sedi "s|wekan-$OLD_VERSION-|wekan-$NEW_VERSION-|g" snapcraft.yaml
 
   # Sandstorm Specifics
   sedi "0,/appVersion = [0-9]\+/s/appVersion = [0-9]\+/appVersion = ${NEW_NO_DOTS}/" sandstorm-pkgdef.capnp
@@ -82,20 +83,22 @@ version_bump_logic() {
 
   # Docker and Documentation
   sedi "s|ARG VERSION=$OLD_VERSION|ARG VERSION=$NEW_VERSION|g" Dockerfile
-  sedi "s|wekan-$OLD_VERSION-|wekan-$NEW_VERSION-|g" docs/Platforms/Propietary/Windows/Offline.md
+  sedi "s|wekan-$OLD_VERSION|wekan-$NEW_VERSION|g" docs/Platforms/Propietary/Windows/Offline.md
   sedi "s|/v$OLD_VERSION/|/v$NEW_VERSION/|g" docs/Platforms/Propietary/Windows/Offline.md
 
   # 6. Update Wekan website (if applicable)
   if [ -d "../w/wekan.fi" ]; then
     INSTALL_PAGE="../w/wekan.fi/install/index.html"
-    METEOR_VER=$(grep -o 'METEOR@[^ "\\]*' .meteor/release | head -1)
+    METEOR_VER=$(grep -o 'METEOR@[^ "\\]*' .meteor/release | head -1 | sed 's/.*@//')
     NPM_VER=$(grep -o 'NPM_VERSION=[^ "\\]*' Dockerfile | head -1 | cut -d= -f2 | tr -d '"')
 
-    sedi "s|MongoDB 7\\.x|MongoDB $MONGO_VER Ubuntu $UBUNTU_VER|g" "$INSTALL_PAGE"
+    (cd ../w/wekan.fi && git pull)
+    #sedi "s|MongoDB 7\\.x|MongoDB $MONGO_VER|g" "$INSTALL_PAGE"
     sedi "s|<span id=\"meteor-version\">[^<]*</span>|<span id=\"meteor-version\">$METEOR_VER</span>|g" "$INSTALL_PAGE"
-    sedi "s|<span id=\"node-version\">[^<]*</span>|<span id=\"node-version\">v$NEW_NODE</span>|g" "$INSTALL_PAGE"
-    sedi "s|<span id=\"npm-version\">[^<]*</span>|<span id=\"npm-version\">$NPM_VER</span>|g" "$INSTALL_PAGE"
+    #sedi "s|<span id=\"node-version\">[^<]*</span>|<span id=\"node-version\">v$NEW_NODE</span>|g" "$INSTALL_PAGE"
+    #sedi "s|<span id=\"npm-version\">[^<]*</span>|<span id=\"npm-version\">$NPM_VER</span>|g" "$INSTALL_PAGE"
     sedi "s|<span class=\"version-number\">v${OLD_VERSION}</span>|<span class=\"version-number\">v${NEW_VERSION}</span>|g" "$INSTALL_PAGE"
+    (cd ../w/wekan.fi && git add --all && git commit -m "Updates" && git push)
   fi
 
   echo "--- Version bump complete ---"

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 902,
+    appVersion = 908,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "9.02~2026-04-28"),
+    appMarketingVersion = (defaultText = "9.08~2026-05-04"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

server/routes/attachmentApi.js

@@ -335,6 +335,41 @@ WebApp.handlers.use('/api/attachment/upload', async (req, res, next) => {
       sendErrorResponse(res, 401, error.message);
     }
   });
+// Board attachments endpoint (legacy)
+WebApp.handlers.use('/api/boards/:boardId/attachments', async (req, res, next) => {
+  if (req.method !== 'GET') {
+    return next();
+  }
+  try {
+    const userId = await authenticateApiRequest(req);
+    const boardId = req.params.boardId;
+    const board = await ReactiveCache.getBoard(boardId);
+    if (!board || !board.isBoardMember(userId)) {
+      return sendErrorResponse(res, 403, 'You do not have permission to access this board');
+    }
+    const query = { 'meta.boardId': boardId };
+    const attachments = await ReactiveCache.getAttachments(query);
+    const attachmentList = attachments.map(attachment => {
+      const strategy = fileStoreStrategyFactory.getFileStrategy(attachment, 'original');
+      return {
+        attachmentId: attachment._id,
+        fileName: attachment.name,
+        fileSize: attachment.size,
+        fileType: attachment.type,
+        storageBackend: strategy.getStorageName(),
+        boardId: attachment.meta.boardId,
+        swimlaneId: attachment.meta.swimlaneId,
+        listId: attachment.meta.listId,
+        cardId: attachment.meta.cardId,
+        createdAt: attachment.uploadedAt,
+        isImage: attachment.isImage
+      };
+    });
+    sendJsonResponse(res, 200, { success: true, attachments: attachmentList, count: attachmentList.length });
+  } catch (error) {
+    sendErrorResponse(res, 401, error.message);
+  }
+});
 
   // Copy attachment endpoint
   WebApp.handlers.use('/api/attachment/copy', async (req, res, next) => {

snap-src/bin/config

@@ -3,11 +3,7 @@
 # All supported keys are defined here together with descriptions and default values
 
 # list of supported keys
-keys="DEBUG S3 METEOR_REACTIVITY_ORDER MONGO_LOG_DESTINATION MONGO_URL MONGO_OPLOG_URL MONGODB_BIND_UNIX_SOCKET MONGO_URL MONGODB_BIND_IP MONGODB_PORT MAIL_URL MAIL_FROM MAIL_SERVICE MAIL_SERVICE_USER MAIL_SERVICE_PASSWORD ROOT_URL PORT DISABLE_MONGODB CADDY_ENABLED CADDY_BIND_PORT WITH_API RICHER_CARD_COMMENT_EDITOR CARD_OPENED_WEBHOOK_ENABLED ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM ATTACHMENTS_UPLOAD_MIME_TYPES ATTACHMENTS_UPLOAD_MAX_SIZE AVATARS_UPLOAD_EXTERNAL_PROGRAM AVATARS_UPLOAD_MIME_TYPES AVATARS_UPLOAD_MAX_SIZE MAX_IMAGE_PIXEL IMAGE_COMPRESS_RATIO BIGEVENTS_PATTERN NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE NOTIFY_DUE_DAYS_BEFORE_AND_AFTER NOTIFY_DUE_AT_HOUR_OF_DAY DEFAULT_BOARD_ID EMAIL_NOTIFICATION_TIMEOUT CORS CORS_ALLOW_HEADERS CORS_EXPOSE_HEADERS MATOMO_ADDRESS MATOMO_SITE_ID MATOMO_DO_NOT_TRACK MATOMO_WITH_USERNAME METRICS_ALLOWED_IP_ADDRESSES BROWSER_POLICY_ENABLED TRUSTED_URL WEBHOOKS_ATTRIBUTES OAUTH2_ENABLED OIDC_REDIRECTION_ENABLED OAUTH2_CA_CERT OAUTH2_LOGIN_STYLE OAUTH2_CLIENT_ID OAUTH2_SECRET OAUTH2_SERVER_URL OAUTH2_AUTH_ENDPOINT OAUTH2_USERINFO_ENDPOINT OAUTH2_TOKEN_ENDPOINT OAUTH2_ID_MAP OAUTH2_USERNAME_MAP OAUTH2_FULLNAME_MAP OAUTH2_ID_TOKEN_WHITELIST_FIELDS OAUTH2_EMAIL_MAP OAUTH2_REQUEST_PERMISSIONS OAUTH2_ADFS_ENABLED OAUTH2_B2C_ENABLED LDAP_ENABLE LDAP_PORT LDAP_HOST LDAP_AD_SIMPLE_AUTH LDAP_BASEDN LDAP_LOGIN_FALLBACK LDAP_RECONNECT LDAP_TIMEOUT LDAP_IDLE_TIMEOUT LDAP_CONNECT_TIMEOUT LDAP_AUTHENTIFICATION LDAP_AUTHENTIFICATION_USERDN LDAP_AUTHENTIFICATION_PASSWORD LDAP_LOG_ENABLED LDAP_BACKGROUND_SYNC LDAP_BACKGROUND_SYNC_INTERVAL LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS LDAP_ENCRYPTION LDAP_CA_CERT LDAP_REJECT_UNAUTHORIZED LDAP_USER_AUTHENTICATION LDAP_USER_AUTHENTICATION_FIELD LDAP_USER_SEARCH_FILTER LDAP_USER_SEARCH_SCOPE LDAP_USER_SEARCH_FIELD LDAP_SEARCH_PAGE_SIZE LDAP_SEARCH_SIZE_LIMIT LDAP_GROUP_FILTER_ENABLE LDAP_GROUP_FILTER_OBJECTCLASS LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT LDAP_GROUP_FILTER_GROUP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD LDAP_UTF8_NAMES_SLUGIFY LDAP_USERNAME_FIELD LDAP_FULLNAME_FIELD LDAP_MERGE_EXISTING_USERS LDAP_SYNC_USER_DATA LDAP_SYNC_USER_DATA_FIELDMAP LDAP_SYNC_GROUP_ROLES LDAP_DEFAULT_DOMAIN LDAP_EMAIL_MATCH_ENABLE LDAP_EMAIL_MATCH_REQUIRE LDAP_EMAIL_MATCH_VERIFIED LDAP_EMAIL_FIELD LDAP_SYNC_ADMIN_STATUS LDAP_SYNC_ADMIN_GROUPS HEADER_LOGIN_ID HEADER_LOGIN_FIRSTNAME HEADER_LOGIN_LASTNAME HEADER_LOGIN_EMAIL LOGOUT_WITH_TIMER LOGOUT_IN LOGOUT_ON_HOURS LOGOUT_ON_MINUTES DEFAULT_AUTHENTICATION_METHOD PASSWORD_LOGIN_ENABLED CAS_ENABLED CAS_BASE_URL CAS_LOGIN_URL CAS_VALIDATE_URL SAML_ENABLED SAML_PROVIDER SAML_ENTRYPOINT SAML_ISSUER SAML_CERT SAML_IDPSLO_REDIRECTURL SAML_PRIVATE_KEYFILE SAML_PUBLIC_CERTFILE SAML_IDENTIFIER_FORMAT SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE SAML_ATTRIBUTES ORACLE_OIM_ENABLED RESULTS_PER_PAGE WAIT_SPINNER NODE_OPTIONS LDAP_AUTHENTIFICATION_PASSWORD_FILE OAUTH2_SECRET_FILE MAIL_SERVICE_PASSWORD_FILE MONGO_PASSWORD_FILE S3_SECRET_FILE"
-
-DESCRIPTION_S3='AWS S3 for files. Example: {"s3":{"key": "xxx", "secret": "xxx", "bucket": "xxx", "region": "eu-west-1"}}'
-DEFAULT_S3=""
-KEY_S3="s3"
+keys="DEBUG DDP_TRANSPORT METEOR_REACTIVITY_ORDER MONGO_LOG_DESTINATION MONGO_URL MONGO_OPLOG_URL MONGODB_BIND_UNIX_SOCKET MONGODB_BIND_IP MONGODB_PORT MAIL_URL MAIL_FROM MAIL_SERVICE MAIL_SERVICE_USER MAIL_SERVICE_PASSWORD ROOT_URL PORT DISABLE_MONGODB CADDY_ENABLED CADDY_BIND_PORT WITH_API RICHER_CARD_COMMENT_EDITOR CARD_OPENED_WEBHOOK_ENABLED ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM ATTACHMENTS_UPLOAD_MIME_TYPES ATTACHMENTS_UPLOAD_MAX_SIZE AVATARS_UPLOAD_EXTERNAL_PROGRAM AVATARS_UPLOAD_MIME_TYPES AVATARS_UPLOAD_MAX_SIZE MAX_IMAGE_PIXEL IMAGE_COMPRESS_RATIO BIGEVENTS_PATTERN NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE NOTIFY_DUE_DAYS_BEFORE_AND_AFTER NOTIFY_DUE_AT_HOUR_OF_DAY DEFAULT_BOARD_ID EMAIL_NOTIFICATION_TIMEOUT CORS CORS_ALLOW_HEADERS CORS_EXPOSE_HEADERS MATOMO_ADDRESS MATOMO_SITE_ID MATOMO_DO_NOT_TRACK MATOMO_WITH_USERNAME METRICS_ALLOWED_IP_ADDRESSES BROWSER_POLICY_ENABLED TRUSTED_URL WEBHOOKS_ATTRIBUTES OAUTH2_ENABLED OIDC_REDIRECTION_ENABLED OAUTH2_CA_CERT OAUTH2_LOGIN_STYLE OAUTH2_CLIENT_ID OAUTH2_SECRET OAUTH2_SERVER_URL OAUTH2_AUTH_ENDPOINT OAUTH2_USERINFO_ENDPOINT OAUTH2_TOKEN_ENDPOINT OAUTH2_ID_MAP OAUTH2_USERNAME_MAP OAUTH2_FULLNAME_MAP OAUTH2_ID_TOKEN_WHITELIST_FIELDS OAUTH2_EMAIL_MAP OAUTH2_REQUEST_PERMISSIONS OAUTH2_ADFS_ENABLED OAUTH2_B2C_ENABLED LDAP_ENABLE LDAP_PORT LDAP_HOST LDAP_AD_SIMPLE_AUTH LDAP_BASEDN LDAP_LOGIN_FALLBACK LDAP_RECONNECT LDAP_TIMEOUT LDAP_IDLE_TIMEOUT LDAP_CONNECT_TIMEOUT LDAP_AUTHENTIFICATION LDAP_AUTHENTIFICATION_USERDN LDAP_AUTHENTIFICATION_PASSWORD LDAP_LOG_ENABLED LDAP_BACKGROUND_SYNC LDAP_BACKGROUND_SYNC_INTERVAL LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS LDAP_ENCRYPTION LDAP_CA_CERT LDAP_REJECT_UNAUTHORIZED LDAP_USER_AUTHENTICATION LDAP_USER_AUTHENTICATION_FIELD LDAP_USER_SEARCH_FILTER LDAP_USER_SEARCH_SCOPE LDAP_USER_SEARCH_FIELD LDAP_SEARCH_PAGE_SIZE LDAP_SEARCH_SIZE_LIMIT LDAP_GROUP_FILTER_ENABLE LDAP_GROUP_FILTER_OBJECTCLASS LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT LDAP_GROUP_FILTER_GROUP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD LDAP_UTF8_NAMES_SLUGIFY LDAP_USERNAME_FIELD LDAP_FULLNAME_FIELD LDAP_MERGE_EXISTING_USERS LDAP_SYNC_USER_DATA LDAP_SYNC_USER_DATA_FIELDMAP LDAP_SYNC_GROUP_ROLES LDAP_DEFAULT_DOMAIN LDAP_EMAIL_MATCH_ENABLE LDAP_EMAIL_MATCH_REQUIRE LDAP_EMAIL_MATCH_VERIFIED LDAP_EMAIL_FIELD LDAP_SYNC_ADMIN_STATUS LDAP_SYNC_ADMIN_GROUPS HEADER_LOGIN_ID HEADER_LOGIN_FIRSTNAME HEADER_LOGIN_LASTNAME HEADER_LOGIN_EMAIL LOGOUT_WITH_TIMER LOGOUT_IN LOGOUT_ON_HOURS LOGOUT_ON_MINUTES DEFAULT_AUTHENTICATION_METHOD PASSWORD_LOGIN_ENABLED CAS_ENABLED CAS_BASE_URL CAS_LOGIN_URL CAS_VALIDATE_URL SAML_ENABLED SAML_PROVIDER SAML_ENTRYPOINT SAML_ISSUER SAML_CERT SAML_IDPSLO_REDIRECTURL SAML_PRIVATE_KEYFILE SAML_PUBLIC_CERTFILE SAML_IDENTIFIER_FORMAT SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE SAML_ATTRIBUTES ORACLE_OIM_ENABLED RESULTS_PER_PAGE WAIT_SPINNER NODE_OPTIONS LDAP_AUTHENTIFICATION_PASSWORD_FILE OAUTH2_SECRET_FILE MAIL_SERVICE_PASSWORD_FILE MONGO_PASSWORD_FILE S3 S3_SECRET_FILE"
 
 #-------------------- CHANGE STREAMS --------------------
 # https://forums.meteor.com/t/meteor-3-5-beta-change-streams-performance-improvements/64461#change-streams-setup-3
@@ -16,9 +12,12 @@ KEY_S3="s3"
 # https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
 # Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
 DESCRIPTION_METEOR_REACTIVITY_ORDER="METEOR_REACTIVITY_ORDER. Default: 'changeStreams,oplog,polling'"
-DEFAULT_METEOR_REACTIVITY_ORDER="oplog,polling"
+DEFAULT_METEOR_REACTIVITY_ORDER="changeStreams,oplog,polling"
 KEY_METEOR_REACTIVITY_ORDER='meteor-reactivity-order'
 
+DESCRIPTION_DDP_TRANSPORT="DDP_TRANSPORT. Default: 'uws'"
+DEFAULT_DDP_TRANSPORT="uws"
+KEY_DDP_TRANSPORT='ddp-transport'
 #-----------------------------------------------------------------
 # ==== AWS S3 FOR FILES ====
 # Any region. For example:
@@ -29,8 +28,10 @@ KEY_METEOR_REACTIVITY_ORDER='meteor-reactivity-order'
 #- S3='{"s3":{"key": "xxx", "secret": "xxx", "bucket": "xxx", "region": "eu-west-1"}}'
 #-----------------------------------------------------------------
 
+# This is not set here, because it can be set only at config files
+# snap/hooks/install and snap/hooks/post-refresh
 #DESCRIPTION_WRITABLE_PATH="Writable path. Default: $SNAP_COMMON/files"
-#DEFAULT_WRITABLE_PATH="$SNAP_COMMON/files"
+#DEFAULT_WRITABLE_PATH=""
 #KEY_WRITABLE_PATH="writable-path"
 
 #---------------------------------------------------------------------
@@ -59,7 +60,7 @@ DESCRIPTION_MONGO_URL="MONGO_URL. Default: ''"
 DEFAULT_MONGO_URL=""
 KEY_MONGO_URL='mongo-url'
 
-DESCRIPTION_MONGO_OPLOG_URL="MongoDB Oplog URL. Default: 'mongodb://127.0.0.1:27017/local?replicaSet=rs0'"
+DESCRIPTION_MONGO_OPLOG_URL="MongoDB Oplog URL. Default: 'mongodb://127.0.0.1:mongodb-port/local?replicaSet=rs0'"
 DEFAULT_MONGO_OPLOG_URL=""
 KEY_MONGO_OPLOG_URL="mongo-oplog-url"
 
@@ -670,6 +671,10 @@ DESCRIPTION_MONGO_PASSWORD_FILE="MongoDB password file (Docker secrets). Example
 DEFAULT_MONGO_PASSWORD_FILE=""
 KEY_MONGO_PASSWORD_FILE="mongo-password-file"
 
+DESCRIPTION_S3='AWS S3 for files. Example: {"s3":{"key": "xxx", "secret": "xxx", "bucket": "xxx", "region": "eu-west-1"}}'
+DEFAULT_S3=""
+KEY_S3="s3"
+
 DESCRIPTION_S3_SECRET_FILE="S3 secret file (Docker secrets). Example: /run/secrets/s3_secret"
 DEFAULT_S3_SECRET_FILE=""
 KEY_S3_SECRET_FILE="s3-secret-file"

snap-src/bin/wekan-control

@@ -15,18 +15,21 @@ elif [ "nill" != "$MONGODB_BIND_UNIX_SOCKET" ] && [ "x" != "x$MONGODB_BIND_UNIX_
     fi
 else
     [ "x" == "x$MONGODB_BIND_IP" ] && MONGODB_BIND_IP="127.0.0.1"
-    export MONGO_URL="mongodb://$MONGODB_BIND_IP:$MONGODB_PORT/wekan?tls=false"
+    export MONGO_URL="mongodb://$MONGODB_BIND_IP:$MONGODB_PORT/wekan"
     if [ -z "$MONGO_OPLOG_URL" ]; then
-        export MONGO_OPLOG_URL="mongodb://$MONGODB_BIND_IP:$MONGODB_PORT/local?replicaSet=rs0&tls=false"
+        export MONGO_OPLOG_URL="mongodb://$MONGODB_BIND_IP:$MONGODB_PORT/local?replicaSet=rs0"
     fi
 fi
 
-# If uploads directory does not exist, create it.
+# If WRITABLE_PATH is not set, use $SNAP_COMMON/files
 # Wekan will store attachments there.
-export WRITABLE_PATH=$SNAP_COMMON/files
-if [ ! -d $WRITABLE_PATH ]; then
-  mkdir $WRITABLE_PATH
+if [ -z "$WRITABLE_PATH" ]; then
+    export WRITABLE_PATH="$SNAP_COMMON/files"
 fi
+# Create attachments and avatars directories
+mkdir -p "$WRITABLE_PATH/attachments"
+mkdir -p "$WRITABLE_PATH/avatars"
+echo -e "Using WRITABLE_PATH: $WRITABLE_PATH"
 
 echo -e "MONGO_URL=$MONGO_URL"
 APPLICATION_DIRECTORY=$SNAP

snap/hooks/install

@@ -3,10 +3,15 @@
 exec >> $SNAP_DATA/hook.log 2>&1
 echo "$(date '+%Y-%m-%d %H:%M:%S') $0: Entering hook"
 
-# coppy caddy file in place
+# copy caddy file in place
 [ ! -e $SNAP_COMMON/Caddyfile ] && cp $SNAP/Caddyfile $SNAP_COMMON/Caddyfile
 
 # create run dir, we're going to use it for unix socket
 mkdir -p $SNAP_DATA/share
 mkdir -p $SNAP_DATA/shared
 
+# attachments
+WRITABLE_PATH="$SNAP_COMMON/files"
+mkdir -p "$WRITABLE_PATH/attachments"
+mkdir -p "$WRITABLE_PATH/avatars"
+chmod -R 777 "$WRITABLE_PATH"

snap/hooks/post-refresh

@@ -3,10 +3,15 @@
 exec >> $SNAP_DATA/hook.log 2>&1
 echo "$(date '+%Y-%m-%d %H:%M:%S') $0: Entering hook"
 
-# coppy caddy file in place
+# copy caddy file in place
 [ ! -e $SNAP_COMMON/Caddyfile ] && cp $SNAP/Caddyfile $SNAP_COMMON/Caddyfile
 
 # create run dir, we're going to use it for unix socket
 mkdir -p $SNAP_DATA/share
 mkdir -p $SNAP_DATA/shared
 
+# attachments
+WRITABLE_PATH="$SNAP_COMMON/files"
+mkdir -p "$WRITABLE_PATH/attachments"
+mkdir -p "$WRITABLE_PATH/avatars"
+chmod -R 777 "$WRITABLE_PATH"

snapcraft.yaml

@@ -1,5 +1,5 @@
 name: wekan
-version: '9.02'
+version: '9.08'
 base: core24
 summary: Open Source kanban
 description: |
@@ -78,7 +78,7 @@ apps:
 
 parts:
     mongodb:
-        source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-7.0.31.tgz
+        source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-7.0.32.tgz
         plugin: dump
         stage-packages:
             - libssl3
@@ -135,9 +135,9 @@ parts:
             rm -rf .build
             mkdir .build
             cd .build
-            wget https://github.com/wekan/wekan/releases/download/v9.02/wekan-9.02-amd64.zip
-            unzip wekan-9.02-amd64.zip
-            rm wekan-9.02-amd64.zip
+            wget https://github.com/wekan/wekan/releases/download/v9.08/wekan-9.08-amd64.zip
+            unzip wekan-9.08-amd64.zip
+            rm wekan-9.08-amd64.zip
             # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
             # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
             BCRYPT_DIR="bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"

start-wekan.bat

@@ -8,40 +8,38 @@ REM # Change Streams require MongoDB to run as a replica set.
 REM # This checks if the replica set is already initialized, and if not, initializes it.
 REM # MongoDB must already be running at 127.0.0.1:27017.
 REM # where mongosh >NUL 2>NUL
-REM #IF %ERRORLEVEL% NEQ 0 (
-REM #   ECHO mongosh not found. Skipping replica set initialization. Using polling.
-REM #    SET USE_CHANGE_STREAMS=false
-REM #) ELSE (
-REM #    ECHO Checking MongoDB replica set status...
-REM #    mongosh --port 27017 --quiet --eval "if (rs.status().ok === 1) { print('REPSET_OK'); }" 2>NUL | find "REPSET_OK" >NUL
-REM #    IF %ERRORLEVEL% NEQ 0 (
-REM #        ECHO Initializing replica set rs0...
-REM #        mongosh --port 27017 --eval "rs.initiate({_id: 'rs0', members: [{_id: 0, host: '127.0.0.1:27017'}]})"
-REM #        timeout /t 3 /nobreak >NUL
-REM #        ECHO Replica set rs0 initialized.
-REM #    ) ELSE (
-REM #        ECHO Replica set already initialized.
-REM #    )
-REM #    SET USE_CHANGE_STREAMS=true
-REM #)
-    SET USE_CHANGE_STREAMS=false
+IF %ERRORLEVEL% NEQ 0 (
+   ECHO mongosh not found. Skipping replica set initialization. Using polling.
+   SET USE_CHANGE_STREAMS=false
+) ELSE (
+   ECHO Checking MongoDB replica set status...
+   mongosh --port 27017 --quiet --eval "if (rs.status().ok === 1) { print('REPSET_OK'); }" 2>NUL | find "REPSET_OK" >NUL
+IF %ERRORLEVEL% NEQ 0 (
+   ECHO Initializing replica set rs0...
+   mongosh --port 27017 --eval "rs.initiate({_id: 'rs0', members: [{_id: 0, host: '127.0.0.1:27017'}]})"
+   timeout /t 3 /nobreak >NUL
+   ECHO Replica set rs0 initialized.
+) ELSE (
+   ECHO Replica set already initialized.
+)
+   SET USE_CHANGE_STREAMS=true
+)
+SET USE_CHANGE_STREAMS=false
 REM #----------------------------------------------------------------------
 
 REM #-------------------- REQUIRED SETTINGS START --------------------
 
 REM #-------------------- USING MONGODB CHANGE STREAMS WITH REPLICA SETS AT CURRENT DATABASE --------------------
 REM # If you would not like to use Change Streams and replica set for improving speed, change to use polling:
-REM #SET METEOR_REACTIVITY_ORDER=polling
 REM # https://forums.meteor.com/t/meteor-3-5-beta-change-streams-performance-improvements/64461#change-streams-setup-3
 REM # https://github.com/meteor/meteor/blob/release-3.5/v3-docs/docs/performance/change-streams-observer-driver.md#choosing-the-reactivity-driver-order
-REM # Use oplog,polling to fix performance until changeStreams is fixed at next release of Meteor 3.5 Beta:
 REM # https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
-REM # Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
-REM #IF "%USE_CHANGE_STREAMS%"=="true" (
-REM #    SET METEOR_REACTIVITY_ORDER=oplog,polling
-REM #) ELSE (
-    SET METEOR_REACTIVITY_ORDER=polling
-REM #)
+IF "%USE_CHANGE_STREAMS%"=="true" (
+   SET METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+   SET DDP_TRANSPORT=uws
+) ELSE (
+   SET METEOR_REACTIVITY_ORDER=polling
+)
 
 REM # Writable path required to exist and be writable for attachments to migrate and work correctly
 SET WRITABLE_PATH=..
@@ -55,11 +53,11 @@ REM SET MONGO_PASSWORD_FILE=
 REM # MONGO_OPLOG_URL: MongoDB oplog connection for real-time reactivity
 REM # Required for Change Streams and OpLog tailing to work.
 REM # For local MongoDB replica set named 'rs0':
-REM #IF "%USE_CHANGE_STREAMS%"=="true" (
-REM #    SET MONGO_OPLOG_URL=mongodb://127.0.0.1:27017/local?replicaSet=rs0
-REM #)
-REM # For production with credentials and remote MongoDB:
-REM #   SET MONGO_OPLOG_URL=mongodb://<user>:<password>@<host>:<port>/local?authSource=admin&replicaSet=rsWekan
+IF "%USE_CHANGE_STREAMS%"=="true" (
+   SET MONGO_OPLOG_URL=mongodb://127.0.0.1:27017/local?replicaSet=rs0
+)
+# For production with credentials and remote MongoDB:
+#SET MONGO_OPLOG_URL=mongodb://<user>:<password>@<host>:<port>/local?authSource=admin&replicaSet=rsWekan
 
 REM # If port is 80, must change ROOT_URL to: http://YOUR-WEKAN-SERVER-IPv4-ADDRESS , like http://192.168.0.100
 REM # If port is not 80, must change ROOT_URL to: http://YOUR-WEKAN-SERVER-IPv4-ADDRESS:YOUR-PORT-NUMBER , like http://192.168.0.100:2000

start-wekan.sh

@@ -6,21 +6,21 @@
       # Change Streams require MongoDB to run as a replica set.
       # This checks if the replica set is already initialized, and if not, initializes it.
       # MongoDB must already be running at 127.0.0.1:27017.
-      #if command -v mongosh > /dev/null 2>&1; then
-      #    echo "Checking MongoDB replica set status..."
-      #    if mongosh --port 27017 --quiet --eval 'rs.status().ok' 2>/dev/null | grep -q 1; then
-      #        echo "Replica set already initialized."
-      #    else
-      #        echo "Initializing replica set rs0..."
-      #        mongosh --port 27017 --eval 'rs.initiate({_id: "rs0", members: [{_id: 0, host: "127.0.0.1:27017"}]})'
-      #        sleep 3
-      ##        echo "Replica set rs0 initialized."
-      #    fi
-      #    USE_CHANGE_STREAMS=true
-      #else
-      #    echo "mongosh not found. Skipping replica set initialization. Using polling."
+      if command -v mongosh > /dev/null 2>&1; then
+          echo "Checking MongoDB replica set status..."
+          if mongosh --port 27017 --quiet --eval 'rs.status().ok' 2>/dev/null | grep -q 1; then
+              echo "Replica set already initialized."
+          else
+              echo "Initializing replica set rs0..."
+              mongosh --port 27017 --eval 'rs.initiate({_id: "rs0", members: [{_id: 0, host: "127.0.0.1:27017"}]})'
+              sleep 3
+              echo "Replica set rs0 initialized."
+          fi
+          USE_CHANGE_STREAMS=true
+      else
+          echo "mongosh not found. Skipping replica set initialization. Using polling."
           USE_CHANGE_STREAMS=false
-      #fi
+      fi
       #----------------------------------------------------------------------
       cd .build/bundle
       #-------------------- USING MONGODB CHANGE STREAMS WITH REPLICA SETS AT CURRENT DATABASE --------------------
@@ -32,8 +32,8 @@
       # https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
       # Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
       if [ "$USE_CHANGE_STREAMS" = "true" ]; then
-          #export METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
-          export METEOR_REACTIVITY_ORDER=oplog,polling
+          export METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+          export DDP_TRANSPORT=uws
       else
           export METEOR_REACTIVITY_ORDER=polling
       fi