Bump versions for v9.97

Every deletion path (admin removeUser method, self-service account
delete, DELETE /api/users/:userId) removed only the users document,
leaving dangling references everywhere: empty-avatar board members that
could not be removed, stale card members/assignees/watchers, orphaned
avatar files - reproducible for 8 years and reopened in 2025. A
server-only Users.after.remove collection hook now prunes
boards.members/watchers (object-shaped, $pull by userId),
cards.members/assignees/watchers and lists.watchers (string arrays), and
the user's Avatars files, on EVERY path that removes a user; a cleanup
failure can never break the deletion itself. Activities and comments are
deliberately preserved for history - their rendering is already
null-guarded (270eacb20, Playwright-verified).

Tests: tests/userDeletionCleanup.test.cjs (6, positive and negative,
end-to-end against a fake database).

Thanks to chotaire and xet7.

.devcontainer/docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.7'
-
 services:
 
   wekandb-dev:

.github/dependabot.yml

@@ -24,7 +24,7 @@ updates:
       #   * The only upgrades Dependabot/npm offer are build-breaking: a
       #     @meteorjs/rspack downgrade, or @rspack/cli 2.0 / Rspack 2.0, which
       #     needs Meteor 3.6 (see https://github.com/meteor/meteor/pull/14360).
-      #     WeKan currently runs METEOR@3.5-rc.1.
+      #     WeKan currently runs METEOR@3.5-rc.2.
       #
       # So pin them here until Meteor 3.6 + Rspack 2.0 land, then revisit.
     - dependency-name: "@meteorjs/rspack"

.github/workflows/depsreview.yaml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@v5

.github/workflows/docker-publish.yml

@@ -32,13 +32,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -48,14 +48,14 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/dockerimage.yml

@@ -15,6 +15,6 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Build the Docker image
       run: docker build . --file Dockerfile --tag wekan:$(date +%s)

.github/workflows/meteor-spk.yml

@@ -0,0 +1,107 @@
+name: Build meteor-spk bundle
+
+# Manually triggered. Assembles WeKan's modernized meteor-spk (the Sandstorm packaging
+# tool + its meteor-spk.deps: Node 24, FerretDB, the Mongo 3.x CLIs and the modern
+# sandstorm-http-bridge) and zips it as meteor-spk-YYYY-MM-DD_HH_MM_SS.zip — the same kind
+# of self-contained meteor-spk bundle that https://github.com/sandstorm-io/meteor-spk
+# releases, but with WeKan's Node 24 / FerretDB deps baked in. Download it to `meteor-spk
+# pack` WeKan (or any Meteor 3.x app) without re-running build-deps.sh each time.
+#
+#   gh workflow run meteor-spk.yml
+#
+# This only assembles + zips the tool; it does NOT pack or sign a WeKan .spk, so it needs
+# no SANDSTORM_KEYRING. The .spk itself is built by sandstorm.yml; the Sandstorm App
+# Market publish is done by sandstorm-store.yml.
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch, tag or SHA to build the meteor-spk deps from (default: main)'
+        required: false
+        default: 'main'
+
+permissions:
+  contents: write
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  meteor-spk:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.ref || 'main' }}
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        # Same as sandstorm.yml: Ubuntu 24.04's AppArmor blocks the unprivileged user
+        # namespaces the Sandstorm install relies on; relax it so the install (whose
+        # sandstorm-http-bridge build-deps.sh copies in) can run on the runner.
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git zip
+
+      - name: Install Sandstorm (dev, unattended)
+        # build-deps.sh's [bridge] step copies the modern
+        # /opt/sandstorm/latest/bin/sandstorm-http-bridge into the deps, so Sandstorm
+        # must be installed first — same ordering as sandstorm.yml.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
+        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io; build-deps.sh swaps in
+        # Node 24, FerretDB, the Mongo 3.x CLIs, the migration launcher/importer, keeps
+        # niscud, and swaps in the modern sandstorm-http-bridge. Produces
+        # $HOME/projects/meteor-spk/meteor-spk-0.6.0 (the meteor-spk tool + deps).
+        run: bash sandstorm-src/build-deps.sh
+
+      - name: Zip the meteor-spk bundle
+        id: zip
+        run: |
+          set -euo pipefail
+          STAMP="$(date +'%Y-%m-%d_%H_%M_%S')"
+          ZIP="meteor-spk-${STAMP}.zip"
+          BUNDLE_DIR="$HOME/projects/meteor-spk"
+          if [ ! -d "$BUNDLE_DIR/meteor-spk-0.6.0" ]; then
+            echo "::error::Expected meteor-spk bundle at $BUNDLE_DIR/meteor-spk-0.6.0 was not produced by build-deps.sh."
+            exit 1
+          fi
+          # Zip so it extracts to a top-level meteor-spk-0.6.0/ directory, like the
+          # upstream meteor-spk release archives. Exclude the base tarball build-deps.sh
+          # downloaded next to it.
+          ( cd "$BUNDLE_DIR" && zip -r -y -q "$GITHUB_WORKSPACE/$ZIP" meteor-spk-0.6.0 -x '*.tar.xz' )
+          ZIP_BYTES=$(stat -c%s "$GITHUB_WORKSPACE/$ZIP")
+          echo "Packed $ZIP: $((ZIP_BYTES/1024/1024)) MiB ($ZIP_BYTES bytes)"
+          ls -la "$GITHUB_WORKSPACE/$ZIP"
+          echo "zip=$ZIP" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.zip.outputs.zip }}
+          path: ${{ steps.zip.outputs.zip }}
+          retention-days: 7
+
+      - name: Upload the meteor-spk bundle to the newest WeKan release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::warning::No existing GitHub Release found; the meteor-spk bundle is available only as a workflow artifact."
+            exit 0
+          fi
+          echo "Uploading ${{ steps.zip.outputs.zip }} to the newest release: $TAG"
+          gh release upload "$TAG" "${{ steps.zip.outputs.zip }}" --clobber

.github/workflows/playwright.yml

@@ -18,7 +18,7 @@ jobs:
     name: Meteor unit tests
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node 24
         uses: actions/setup-node@v6
@@ -27,14 +27,14 @@ jobs:
           cache: 'npm'
 
       - name: Cache Meteor installation
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.meteor
           key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
           restore-keys: meteor-
 
       - name: Cache Meteor build (.meteor/local)
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .meteor/local
           key: meteor-local-unit-${{ hashFiles('.meteor/versions') }}
@@ -62,7 +62,7 @@ jobs:
         run: meteor test --once --driver-package meteortesting:mocha
 
   e2e-tests:
-    name: Playwright E2E (${{ matrix.project }})
+    name: Playwright E2E (${{ matrix.project }} ${{ matrix.shard }}/2)
     runs-on: ubuntu-24.04
     needs: unit-tests
     strategy:
@@ -71,6 +71,12 @@ jobs:
         # Playwright bundles Chromium, Firefox and WebKit builds that all run
         # headless on the Linux runner (installed per-job below with --with-deps).
         project: [chromium, firefox, webkit]
+        # Split each browser's ~245 specs across 2 parallel shards (6 jobs total)
+        # to cut wall-clock time. Each shard job starts its own WeKan + Mongo, so
+        # there is no shared-server contention between shards. Raise the shard
+        # count (here and in the --shard flag below) once the baseline is green
+        # and/or once E2E runs against a prebuilt bundle (cheaper per-job startup).
+        shard: [1, 2]
 
     services:
       mongodb:
@@ -83,7 +89,7 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node 24
         uses: actions/setup-node@v6
@@ -92,14 +98,14 @@ jobs:
           cache: 'npm'
 
       - name: Cache Meteor installation
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.meteor
           key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
           restore-keys: meteor-
 
       - name: Cache Meteor build (.meteor/local)
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .meteor/local
           key: meteor-local-e2e-${{ hashFiles('.meteor/versions') }}
@@ -123,34 +129,54 @@ jobs:
         run: npx playwright install --with-deps ${{ matrix.project }}
         working-directory: tests/playwright
 
-      - name: Start WeKan in background
+      - name: Build and start WeKan (production bundle)
         run: |
+          # Run E2E against a PRODUCTION build instead of `meteor run` (dev mode).
+          # In dev the client JS is served by the rspack dev server, which did not
+          # serve the bundle reliably in headless CI: the browser received HTML for
+          # the bundle ("Unexpected token '<'"), Meteor never initialised, and every
+          # spec timed out. A production build bakes the client JS into the bundle,
+          # served statically by the Meteor server at :3000.
+          meteor build ./output --directory
+          ( cd output/bundle/programs/server && npm install )
+          # WeKan's server/00checkStartup.js refuses to start unless WRITABLE_PATH
+          # (used for attachment/file storage) is set and writable.
+          mkdir -p "$PWD/wekan-writable"
+          # Match the env the dev runner (rebuild-wekan.sh) and the specs expect:
+          # WITH_API enables the REST API (specs 17/23/24/28), comment-editor
+          # flag matches dev.
           MONGO_URL=mongodb://localhost:27017/wekan_test \
           ROOT_URL=http://localhost:3000 \
           PORT=3000 \
-          meteor run --settings settings.json > wekan-run.log 2>&1 &
-          # The first Meteor build is slow, so wait up to 20 minutes for the
-          # server to start responding before giving up.
-          for i in $(seq 1 120); do
+          WRITABLE_PATH="$PWD/wekan-writable" \
+          WITH_API=true \
+          RICHER_CARD_COMMENT_EDITOR=false \
+          node output/bundle/main.js > wekan-run.log 2>&1 &
+          # The production server serves the client JS statically, so once :3000
+          # responds the bundle is being served. Wait up to 10 minutes.
+          for i in $(seq 1 60); do
             if curl -sf http://localhost:3000 > /dev/null; then
               echo "WeKan is up after $((i * 10))s"
               break
             fi
-            echo "Waiting for WeKan... attempt $i/120"
+            echo "Waiting for WeKan... attempt $i/60"
             sleep 10
           done
           if ! curl -sf http://localhost:3000 > /dev/null; then
-            echo "WeKan failed to start. Last 200 log lines:"
-            tail -n 200 wekan-run.log
+            echo "WeKan failed to start. Last 250 log lines:"
+            tail -n 250 wekan-run.log
             exit 1
           fi
         env:
-          DISABLE_CAPTCHA: 'true'
+          TOOL_NODE_FLAGS: --max-old-space-size=8192
+          NODE_OPTIONS: --max-old-space-size=8192
+          DISABLE_CAPTCHA: 'true' 
 
-      - name: Run Playwright tests (${{ matrix.project }})
+      - name: Run Playwright tests (${{ matrix.project }} shard ${{ matrix.shard }}/2)
         run: |
           npx playwright test \
             --project=${{ matrix.project }} \
+            --shard=${{ matrix.shard }}/2 \
             --reporter=github
         working-directory: tests/playwright
         env:
@@ -164,7 +190,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: playwright-report-${{ matrix.project }}
+          name: playwright-report-${{ matrix.project }}-shard${{ matrix.shard }}
           path: tests/playwright/playwright-report/
           retention-days: 14
 
@@ -172,7 +198,7 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: test-results-${{ matrix.project }}
+          name: test-results-${{ matrix.project }}-shard${{ matrix.shard }}
           path: tests/playwright/test-results/
           retention-days: 7
 
@@ -192,7 +218,7 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node 24
         uses: actions/setup-node@v6
@@ -201,14 +227,14 @@ jobs:
           cache: 'npm'
 
       - name: Cache Meteor installation
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.meteor
           key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
           restore-keys: meteor-
 
       - name: Cache Meteor build (.meteor/local)
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .meteor/local
           key: meteor-local-regression-${{ hashFiles('.meteor/versions') }}
@@ -227,27 +253,40 @@ jobs:
       - name: Install Chromium
         run: sudo apt-get install -y chromium-browser
 
-      - name: Start WeKan in background
+      - name: Build and start WeKan (production bundle)
         run: |
+          # Run a PRODUCTION build, not `meteor run` (dev): exactly like the
+          # Playwright e2e job, because the rspack dev server does not serve the
+          # client JS bundle in headless CI, so Meteor never initialises and the
+          # puppeteer regression test times out in waitForMeteorGlobals(). The
+          # production bundle serves the client statically. WRITABLE_PATH is
+          # required by server/00checkStartup.js; WITH_API mirrors the dev runner.
+          meteor build ./output --directory
+          ( cd output/bundle/programs/server && npm install )
+          mkdir -p "$PWD/wekan-writable"
           MONGO_URL=mongodb://localhost:27017/wekan_regression \
           ROOT_URL=http://localhost:3000 \
           PORT=3000 \
-          meteor run > wekan-run.log 2>&1 &
-          # The first Meteor build is slow, so wait up to 20 minutes.
-          for i in $(seq 1 120); do
+          WRITABLE_PATH="$PWD/wekan-writable" \
+          WITH_API=true \
+          RICHER_CARD_COMMENT_EDITOR=false \
+          node output/bundle/main.js > wekan-run.log 2>&1 &
+          for i in $(seq 1 60); do
             if curl -sf http://localhost:3000 > /dev/null; then
               echo "WeKan is up after $((i * 10))s"
               break
             fi
-            echo "Waiting for WeKan... attempt $i/120"
+            echo "Waiting for WeKan... attempt $i/60"
             sleep 10
           done
           if ! curl -sf http://localhost:3000 > /dev/null; then
-            echo "WeKan failed to start. Last 200 log lines:"
-            tail -n 200 wekan-run.log
+            echo "WeKan failed to start. Last 250 log lines:"
+            tail -n 250 wekan-run.log
             exit 1
           fi
         env:
+          TOOL_NODE_FLAGS: --max-old-space-size=8192
+          NODE_OPTIONS: --max-old-space-size=8192
           DISABLE_CAPTCHA: 'true'
 
       - name: Run list-regressions e2e

.github/workflows/release-all.yml

@@ -7,13 +7,20 @@ name: Release All Platforms
 # Or use the convenience script (bumps versions, commits, pushes, then triggers):
 #   ./releases/release-all.sh 9.35 9.36
 #
-# The Docker image and snap cover the platforms MongoDB ships server binaries for
-# (amd64, arm64; win64 + mac bundles too); MongoDB 7.x is the default database.
-# Additionally, WeKan server bundles are built for every other architecture
-# Node.js 24.x publishes binaries for — s390x and ppc64le — and attached to the
-# GitHub Release as extra downloads (run a separate MongoDB for those). These
-# extra-arch bundles are NOT part of the Docker image or snap. (armv7l/32-bit ARM
-# is not built: Node.js 24 ships no armv7l binaries.)
+# WeKan's default database is MongoDB, which ships server binaries only for amd64
+# and arm64 (+ the win64/mac bundles). On every OTHER architecture that has a
+# Node.js 24 build — ppc64le, s390x, riscv64 — there is no MongoDB, so those
+# bundles ship FerretDB v1 instead: the wekan/FerretDB fork with its embedded
+# pure-Go SQLite backend, which speaks the MongoDB wire protocol. FerretDB is
+# built + released SEPARATELY (wekan/FerretDB, its own build.sh) as individual
+# per-arch binaries; each bundle job downloads ONLY the ferretdb-<arch> binary for
+# the platform it targets and bakes it in, so amd64/arm64 users can opt into it
+# too (WEKAN_DB=ferretdb, `snap set wekan
+# database=ferretdb`, or Docker env). Whichever backend is chosen binds the same
+# MongoDB port, so MONGO_URL is unchanged. ppc64le/s390x/riscv64 are now covered
+# by the Docker image as well (self-contained, FerretDB auto-started). riscv64
+# uses unofficial-builds.nodejs.org for Node 24. (armv7l/32-bit ARM is still not
+# built: there is NO Node.js 24 build for it anywhere, so nothing could run it.)
 #
 # This workflow does EVERYTHING for a release remotely (nothing is built or
 # pushed on the maintainer's machine), running jobs in parallel where possible:
@@ -22,19 +29,37 @@ name: Release All Platforms
 #              commits and pushes the bump to wekan/wekan main
 #   - prepare: tags the bumped main as v<new_version> and extracts release notes
 #   - website: updates the wekan/wekan.fi repo (install page + API docs) and pushes
-#   - charts:  updates and publishes the wekan/charts Helm chart and pushes
+#   - charts:  updates and publishes the wekan/charts Helm chart and pushes,
+#              only AFTER the `docker` job has published the image (skipped if
+#              docker fails)
 #   - build-*: builds the amd64 bundle (full Meteor 3 build), then rebuilds native
-#              modules for arm64 from that amd64 base
+#              modules for arm64 from that amd64 base. Each bundle job downloads
+#              only the ferretdb-<arch> binary it needs from the newest wekan/FerretDB
+#              release (FerretDB is built + released separately by its own build.sh —
+#              not compiled here) and embeds it
 #   - release: creates the GitHub Release with the newest CHANGELOG.md notes and
 #              uploads the core wekan-<version>-{amd64,arm64}.zip bundles
 #   - build-win64 / build-mac-arm64 / build-extra-arches: built AFTER release, each
 #              rebuilds the amd64 bundle's native modules for its platform (Windows,
-#              macOS arm64, and QEMU-emulated s390x/ppc64le) and attaches its
-#              .zip to the Release as an extra download. Decoupled from `release` so
-#              a slow/flaky build never blocks it; not in the Docker image or snap
-#   - docker:  builds and pushes the multi-arch image to Docker Hub, Quay.io, GHCR
-#   - snap:    builds the snap on Launchpad (amd64 + arm64), pushes it to the Snap
-#              Store and attaches the .snap files to the GitHub Release
+#              macOS arm64, and QEMU-emulated ppc64le/s390x/riscv64) and attaches
+#              its .zip to the Release. Windows/macOS strip the Linux FerretDB back
+#              out (MongoDB-only). Decoupled from `release` so a slow/flaky build
+#              never blocks it
+#   - build-sandstorm: built AFTER release, builds the Sandstorm .spk package
+#              (same steps as the standalone sandstorm.yml workflow, which still
+#              exists for testing the .spk build on its own) and attaches
+#              wekan-<version>-sandstorm.spk to the Release. Non-blocking: the
+#              Sandstorm build is the experimental/fragile part of CI, so it
+#              never fails the release
+#   - docker:  builds and pushes the multi-arch image (amd64, arm64, ppc64le, s390x,
+#              riscv64) to Docker Hub, Quay.io, GHCR
+#   - snap:    builds the snap on Launchpad from the default core24 snapcraft.yaml
+#              (platforms: amd64, arm64, s390x, ppc64el, riscv64), pushes it to the
+#              Snap Store stable + candidate + beta + edge channels and attaches
+#              the .snap files to the GitHub Release. core24 allows stable and
+#              candidate (core26 does not).
+#              `snap set wekan database=ferretdb` switches the running backend to
+#              FerretDB v1 (snapcraft-core26.yaml is the core26 variant)
 #
 # Required GitHub Secrets:
 #   GHCR_AUTH        - base64("username:token") for ghcr.io
@@ -43,6 +68,8 @@ name: Release All Platforms
 #   SNAP_AUTH        - Snap Store credentials (output of `snapcraft export-login`)
 #   LP_CREDENTIALS   - base64 of the Launchpad credentials file used by
 #                      `snapcraft remote-build` (see releases/snap-build.sh notes)
+#   SANDSTORM_KEYRING - base64 of ~/.sandstorm-keyring; meteor-spk signs the .spk
+#                      with the WeKan Sandstorm app's private key from this keyring
 #   WEKAN_REPO_TOKEN - Personal Access Token with write access to wekan/wekan.fi
 #                      and wekan/charts, used by the website + charts jobs to push
 #                      to those repos (the built-in GITHUB_TOKEN only covers
@@ -64,7 +91,7 @@ permissions:
   contents: write
   packages: write
 
-# Node.js major version that Meteor 3.5-beta bundles. Used for native module
+# Node.js major version that Meteor 3.5 bundles. Used for native module
 # rebuilds on every platform — it must match the amd64 build's Node ABI.
 env:
   NODE_VERSION: '24'
@@ -81,7 +108,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: main
           fetch-depth: 0
@@ -124,7 +151,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       changelog: ${{ steps.changelog.outputs.content }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: main
           fetch-depth: 0
@@ -186,13 +213,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout wekan repo (bumped main, with rebuilt API docs)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: main
           path: wekan
 
       - name: Checkout wekan.fi website repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: wekan/wekan.fi
           token: ${{ secrets.WEKAN_REPO_TOKEN }}
@@ -210,22 +237,24 @@ jobs:
           cd ..
           ./wekan/releases/release-website.sh "${{ inputs.old_version }}" "${{ inputs.new_version }}"
 
-  # ─── 1c. Update and publish the Helm chart repo (parallel) ──────────────────
+  # ─── 1c. Update and publish the Helm chart repo (after docker) ──────────────
   # Bumps the WeKan version in wekan/charts, packages the chart and publishes it
-  # to the gh-pages Helm index, then pushes both branches. Runs in parallel with
-  # the platform builds; packaging the chart does not need the built artifacts.
+  # to the gh-pages Helm index, then pushes both branches. Runs only AFTER the
+  # `docker` job succeeds: the chart points users at the freshly published
+  # multi-arch image, so we don't advertise a new chart version until that image
+  # is actually on the registries. If `docker` fails, this job is skipped.
   charts:
-    needs: bump
+    needs: docker
     runs-on: ubuntu-latest
     steps:
       - name: Checkout wekan repo (for releases/release-charts.sh + version refs)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: main
           path: wekan
 
       - name: Checkout wekan/charts repo (main + gh-pages)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: wekan/charts
           token: ${{ secrets.WEKAN_REPO_TOKEN }}
@@ -250,29 +279,29 @@ jobs:
           ./wekan/releases/release-charts.sh "${{ inputs.new_version }}"
 
   # ─── 2. Build amd64 bundle (full Meteor 3 build) ────────────────────────────
-  # Meteor 3.5-beta installer supports only Linux x86_64/aarch64, macOS, Windows.
+  # Meteor 3.5 installer supports only Linux x86_64/aarch64, macOS, Windows.
   # The full Meteor build always runs here on x86_64; every other platform then
   # only rebuilds the native npm modules from this bundle.
   build-amd64:
-    needs: prepare
+    needs: [prepare]
     runs-on: ubuntu-24.04
     timeout-minutes: 180
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: refs/tags/v${{ needs.prepare.outputs.version }}
 
       - name: Cache Meteor installation
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.meteor
           key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
           restore-keys: meteor-
 
       - name: Cache npm packages
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.npm
           key: npm-${{ hashFiles('package-lock.json') }}
@@ -280,7 +309,7 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y build-essential g++ make python3 curl wget zip unzip
+          sudo apt-get install -y build-essential g++ make python3 curl wget zip unzip qemu-user-static
 
       - uses: actions/setup-node@v6
         with:
@@ -304,6 +333,45 @@ jobs:
           cd .build/bundle/programs/server
           npm install
 
+      - name: Embed Node.js, FerretDB (amd64) and launcher into the bundle
+        # Make the release .zip self-contained (offline): bundle Node.js + FerretDB
+        # + a start-wekan.sh that runs WeKan on the bundled Node against the bundled
+        # FerretDB (SQLite) by default, storing files on the filesystem under
+        # WRITABLE_PATH. This amd64 bundle is the base every other Linux arch is
+        # derived from; those jobs overwrite bundle/node and bundle/ferretdb with
+        # their own arch's binaries and inherit this launcher.
+        run: |
+          # Bundled Node.js: the runner's node (setup-node) is linux-x64 Node 24,
+          # matching this base bundle's arch.
+          cp -L "$(command -v node)" .build/bundle/node
+          chmod +x .build/bundle/node
+          # Bundled FerretDB (amd64): download only this arch's binary from the
+          # newest wekan/FerretDB release (per-arch assets, no ferretdb.zip).
+          curl -fSL --retry 5 --retry-delay 10 -o .build/bundle/ferretdb \
+            "https://github.com/wekan/FerretDB/releases/latest/download/ferretdb-amd64"
+          chmod +x .build/bundle/ferretdb
+          # Bundled MongoDB Database Tools (amd64) from wekan/mongo-tools (per-arch,
+          # no mongodb.com). This base amd64 bundle is inherited by the other Linux
+          # arches, which overwrite these with their own arch's tools below.
+          MT="https://github.com/wekan/mongo-tools/releases/latest/download"
+          for t in bsondump mongodump mongoexport mongofiles mongoimport mongorestore mongostat mongotop; do
+            curl -fSL --retry 5 --retry-delay 10 -o ".build/bundle/$t" "$MT/$t-amd64"
+            chmod +x ".build/bundle/$t"
+          done
+          # Self-contained launcher (defaults to FerretDB SQLite + WRITABLE_PATH).
+          cp releases/ferretdb/start-wekan.sh .build/bundle/
+          chmod +x .build/bundle/start-wekan.sh
+          # #6458: cpu-exec + same-arch qemu-user. cpu-exec runs any bundled
+          # binary that declares required CPU features (e.g. an external
+          # MongoDB 5+: AVX on x86_64) through qemu-user emulation on CPUs
+          # that lack them — including hypervisors that mask AVX. Every Linux
+          # bundle ships its own arch's qemu-user; other arches overwrite
+          # these below.
+          cp snap-src/bin/cpu-exec .build/bundle/cpu-exec
+          chmod +x .build/bundle/cpu-exec
+          cp /usr/bin/qemu-x86_64-static .build/bundle/qemu-x86_64
+          chmod +x .build/bundle/qemu-x86_64
+
       - name: Create amd64 zip
         run: |
           cd .build
@@ -326,7 +394,7 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y build-essential g++ make python3 curl unzip zip
+          sudo apt-get install -y build-essential g++ make python3 curl unzip zip qemu-user-static
 
       - name: Download amd64 bundle
         uses: actions/download-artifact@v8
@@ -356,6 +424,30 @@ jobs:
             node:${NODE_VERSION}-slim \
             sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
 
+      - name: Embed Node.js + FerretDB (arm64) into the bundle
+        # The launcher (start-wekan.sh) is inherited from the amd64 base bundle;
+        # swap bundle/node (runner is arm64 -> linux-arm64 Node 24) and bundle/ferretdb.
+        run: |
+          cp -L "$(command -v node)" bundle/node
+          chmod +x bundle/node
+          # Download only the arm64 FerretDB binary from the newest wekan/FerretDB release.
+          curl -fSL --retry 5 --retry-delay 10 -o bundle/ferretdb \
+            "https://github.com/wekan/FerretDB/releases/latest/download/ferretdb-arm64"
+          chmod +x bundle/ferretdb
+          # Overwrite the inherited amd64 MongoDB Database Tools with arm64 ones.
+          MT="https://github.com/wekan/mongo-tools/releases/latest/download"
+          for t in bsondump mongodump mongoexport mongofiles mongoimport mongorestore mongostat mongotop; do
+            curl -fSL --retry 5 --retry-delay 10 -o "bundle/$t" "$MT/$t-arm64"
+            chmod +x "bundle/$t"
+          done
+          # #6458: replace the inherited amd64 qemu-user with this arch's own
+          # (cpu-exec is a shell script and stays as inherited). qemu-aarch64
+          # lets ARMv8.0 hosts (Raspberry Pi 4 and older) run binaries that
+          # need ARMv8.2-A, like MongoDB 5+.
+          rm -f bundle/qemu-x86_64
+          cp /usr/bin/qemu-aarch64-static bundle/qemu-aarch64
+          chmod +x bundle/qemu-aarch64
+
       - name: Create arm64 zip
         run: |
           zip -r wekan-${VERSION}-arm64.zip bundle
@@ -388,6 +480,11 @@ jobs:
           tag_name: v${{ needs.prepare.outputs.version }}
           name: v${{ needs.prepare.outputs.version }}
           body: ${{ needs.prepare.outputs.changelog }}
+          # FerretDB binaries are NOT attached here: the per-arch ferretdb-<arch>
+          # binaries live on the wekan/FerretDB releases
+          # (https://github.com/wekan/FerretDB/releases), which is where the WeKan
+          # builds fetch them from. Each wekan-<version>-<arch>.zip bundle embeds
+          # its own arch's FerretDB binary.
           files: |
             wekan-${{ needs.prepare.outputs.version }}-amd64.zip
             wekan-${{ needs.prepare.outputs.version }}-arm64.zip
@@ -411,7 +508,7 @@ jobs:
       # Checked out into src/ so start-wekan.bat and snapcraft.yaml (which pins
       # the MongoDB tools/mongosh versions) are available; the downloaded bundle
       # is extracted alongside it in the workspace root.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: refs/tags/v${{ needs.prepare.outputs.version }}
           path: src
@@ -432,6 +529,14 @@ jobs:
         shell: bash
         run: |
           7z x wekan-${VERSION}-amd64.zip
+          # Drop the Linux node + FerretDB binaries + MongoDB Database Tools + POSIX
+          # launcher inherited from the amd64 base bundle; the Windows node.exe,
+          # ferretdb.exe, *.exe tools and start-wekan.bat are added in later steps.
+          rm -f bundle/node bundle/ferretdb bundle/.ferretdb-default bundle/start-wekan.sh
+          rm -f bundle/bsondump bundle/mongodump bundle/mongoexport bundle/mongofiles \
+                bundle/mongoimport bundle/mongorestore bundle/mongostat bundle/mongotop
+          # Linux-only cpu-exec + qemu-user (#6458) make no sense on Windows.
+          rm -f bundle/cpu-exec bundle/qemu-x86_64
           # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
           # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
           BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
@@ -454,40 +559,47 @@ jobs:
           rm -rf node_modules
           npm install
 
-      - name: Add MongoDB tools, mongosh and start-wekan.bat to the bundle
+      - name: Add MongoDB Database Tools to the bundle
         shell: bash
         run: |
           set -euo pipefail
-          # Use the same MongoDB tools/mongosh versions as the snap, which
-          # releases/version.sh keeps at the newest release for each bundle.
-          TOOLS_VER=$(grep -oE 'mongodb-database-tools-ubuntu2204-\$\{TOOLS_ARCH\}-[0-9]+\.[0-9]+\.[0-9]+' src/snapcraft.yaml \
-                       | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-          MONGOSH_VER=$(grep -oE 'mongosh-[0-9]+\.[0-9]+\.[0-9]+-linux' src/snapcraft.yaml \
-                         | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-          echo "MongoDB Database Tools: $TOOLS_VER   mongosh: $MONGOSH_VER"
-
-          # MongoDB Database Tools (Windows): bsondump, mongodump, mongoexport,
-          # mongofiles, mongoimport, mongorestore, mongostat, mongotop.
-          TOOLS_DIR="mongodb-database-tools-windows-x86_64-${TOOLS_VER}"
-          curl -fL -o tools.zip \
-            "https://fastdl.mongodb.org/tools/db/${TOOLS_DIR}.zip"
-          7z x -y tools.zip > /dev/null
-          cp "${TOOLS_DIR}/bin/"*.exe bundle/
-
-          # mongosh (Windows): mongosh.exe + mongosh_crypt_v1.dll.
-          MONGOSH_DIR="mongosh-${MONGOSH_VER}-win32-x64"
-          curl -fL -o mongosh.zip \
-            "https://downloads.mongodb.com/compass/${MONGOSH_DIR}.zip"
-          7z x -y mongosh.zip > /dev/null
-          cp "${MONGOSH_DIR}/bin/mongosh.exe" bundle/
-          cp "${MONGOSH_DIR}/bin/mongosh_crypt_v1.dll" bundle/
-
-          # Windows launcher from the repo root.
-          cp src/start-wekan.bat bundle/
+          # MongoDB Database Tools (Windows) built by wekan/mongo-tools (pure Go),
+          # one <tool>-win64.exe per tool from that repo's newest release — no
+          # mongodb.com dependency. No mongosh: WeKan no longer bundles the MongoDB
+          # Shell; scripted DB access uses the bundled Node.js 24 + `mongodb` driver.
+          # (The Windows launcher, start-wekan.bat, is added by the FerretDB embed
+          # step below from releases/ferretdb/start-wekan.bat.)
+          BASE="https://github.com/wekan/mongo-tools/releases/latest/download"
+          for tool in bsondump mongodump mongoexport mongofiles mongoimport mongorestore mongostat mongotop; do
+            curl -fL --retry 5 --retry-delay 10 -o "bundle/${tool}.exe" "${BASE}/${tool}-win64.exe"
+          done
 
           echo "=== bundle contents ==="
           ls -1 bundle/
 
+      - name: Embed Node.js, FerretDB (win64) and launcher into the bundle
+        shell: bash
+        # Make the Windows .zip self-contained: bundle node.exe (from the runner's
+        # win-x64 Node 24), ferretdb.exe (downloaded per-arch from the newest
+        # wekan/FerretDB release) and start-wekan.bat. FerretDB embedding is
+        # tolerant: if the win64 asset is missing the bundle stays MongoDB-only
+        # (start-wekan.bat then won't find ferretdb.exe).
+        run: |
+          # Bundled Node.js (win-x64 node.exe from setup-node).
+          NODE_SRC="$(command -v node)"
+          [ -f "$NODE_SRC" ] || NODE_SRC="${NODE_SRC}.exe"
+          cp "$NODE_SRC" bundle/node.exe
+          # Bundled FerretDB (win64): download only this arch's binary.
+          if curl -fSL --retry 5 --retry-delay 10 -o bundle/ferretdb.exe \
+               "https://github.com/wekan/FerretDB/releases/latest/download/ferretdb-win64.exe"; then
+            echo "Embedded FerretDB win64 -> bundle/ferretdb.exe"
+          else
+            rm -f bundle/ferretdb.exe
+            echo "No win64 FerretDB asset in the release; Windows bundle stays MongoDB-only."
+          fi
+          # Self-contained Windows launcher (defaults to FerretDB SQLite).
+          cp src/releases/ferretdb/start-wekan.bat bundle/
+
       - name: Create win64 zip
         shell: cmd
         run: 7z a wekan-%VERSION%-win64.zip bundle
@@ -528,6 +640,15 @@ jobs:
       - name: Rebuild native modules for macOS arm64
         run: |
           unzip -q wekan-${VERSION}-amd64.zip
+          # Replace the Linux node + FerretDB binaries + MongoDB Database Tools
+          # inherited from the amd64 base bundle with the macOS builds (added in a
+          # later step). The POSIX launcher start-wekan.sh works on macOS, so keep it.
+          rm -f bundle/node bundle/ferretdb bundle/.ferretdb-default
+          # Linux-only cpu-exec + qemu-user (#6458): qemu-user does not exist for
+          # macOS (Apple Silicon needs no AVX emulation anyway).
+          rm -f bundle/cpu-exec bundle/qemu-x86_64
+          rm -f bundle/bsondump bundle/mongodump bundle/mongoexport bundle/mongofiles \
+                bundle/mongoimport bundle/mongorestore bundle/mongostat bundle/mongotop
           # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
           # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
           BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
@@ -547,6 +668,31 @@ jobs:
           npm install
           cd ../../..
 
+      - name: Embed Node.js + FerretDB (mac-arm64) into the bundle
+        # Bundle the macOS arm64 Node.js (runner's darwin-arm64 Node 24) and the
+        # macOS FerretDB binary, downloaded per-arch from the newest wekan/FerretDB
+        # release. FerretDB is tolerant: if the mac-arm64 asset is missing the
+        # bundle stays MongoDB-only (start-wekan.sh then won't find ferretdb).
+        run: |
+          cp -L "$(command -v node)" bundle/node
+          chmod +x bundle/node
+          if curl -fSL --retry 5 --retry-delay 10 -o bundle/ferretdb \
+               "https://github.com/wekan/FerretDB/releases/latest/download/ferretdb-mac-arm64"; then
+            chmod +x bundle/ferretdb
+            echo "Embedded FerretDB mac-arm64 -> bundle/ferretdb"
+          else
+            rm -f bundle/ferretdb
+            echo "No mac-arm64 FerretDB asset in the release; macOS bundle stays MongoDB-only."
+            rm -f bundle/start-wekan.sh
+          fi
+          # macOS MongoDB Database Tools (mac-arm64) from wekan/mongo-tools; tolerant
+          # (skip any tool not built for macOS).
+          MT="https://github.com/wekan/mongo-tools/releases/latest/download"
+          for t in bsondump mongodump mongoexport mongofiles mongoimport mongorestore mongostat mongotop; do
+            curl -fSL --retry 5 --retry-delay 10 -o "bundle/$t" "$MT/$t-mac-arm64" \
+              && chmod +x "bundle/$t" || { rm -f "bundle/$t"; echo "No $t-mac-arm64; skipping"; }
+          done
+
       - name: Create mac-arm64 zip
         run: zip -r wekan-${VERSION}-mac-arm64.zip bundle
 
@@ -564,11 +710,14 @@ jobs:
           GH_REPO: ${{ github.repository }}
         run: gh release upload "v${VERSION}" "wekan-${VERSION}-mac-arm64.zip" --clobber
 
-  # Extra-architecture Linux bundles (s390x, ppc64le).
-  # armv7l (32-bit ARM) is intentionally excluded: Node.js 24 ships no armv7l
-  # binaries (official or unofficial), so there is no node:24 linux/arm/v7 image
-  # to rebuild native modules against and no Node 24 runtime to run a bundle on
-  # an armv7 device. See https://nodejs.org/dist/latest-v24.x/ (no -linux-armv7l).
+  # Extra-architecture Linux bundles (ppc64le, s390x, riscv64) — the arches that
+  # have a Node.js 24 build but NO MongoDB server, so they ship FerretDB instead.
+  # ppc64le and s390x use official nodejs.org binaries; riscv64 uses the
+  # unofficial-builds.nodejs.org binary (nodejs.org ships no riscv64). armv7l
+  # (32-bit ARM) is intentionally excluded: there is NO Node.js 24 build for it
+  # anywhere (official or unofficial), so there is no runtime to run the bundle on
+  # an armv7 device, regardless of RAM. See https://nodejs.org/dist/latest-v24.x/
+  # (no -linux-armv7l) and https://unofficial-builds.nodejs.org/ (riscv64 only).
   build-extra-arches:
     needs: [prepare, build-amd64, release]
     runs-on: ubuntu-24.04
@@ -579,8 +728,13 @@ jobs:
         include:
           - arch: s390x
             platform: linux/s390x
+            node_base: official
           - arch: ppc64le
             platform: linux/ppc64le
+            node_base: official
+          - arch: riscv64
+            platform: linux/riscv64
+            node_base: unofficial
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
@@ -590,7 +744,7 @@ jobs:
           sudo apt-get install -y curl unzip zip
 
       - name: Set up QEMU for ${{ matrix.arch }} emulation
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Download amd64 bundle
         uses: actions/download-artifact@v8
@@ -616,11 +770,77 @@ jobs:
             popd > /dev/null
             rm -rf "$TMP"
           fi
+          # The official node:${NODE_VERSION} Docker image only publishes amd64,
+          # arm64 and ppc64le manifests — no s390x, no riscv64 — so
+          # `docker run --platform linux/s390x node:24-slim` fails with "no matching
+          # manifest". Instead build on an ubuntu:26.04 base (which publishes every
+          # arch) and install the Node.js binary tarball inside the emulated
+          # container: ppc64le/s390x from nodejs.org (official), riscv64 from
+          # unofficial-builds.nodejs.org (nodejs.org ships no riscv64). Resolve the
+          # exact latest ${NODE_VERSION}.x version on the host (fast, no emulation)
+          # and pass it in along with which mirror to use.
+          NODE_FULL=$(curl -fsSL https://nodejs.org/dist/index.json \
+            | python3 -c "import json,sys; print(next(r['version'] for r in json.load(sys.stdin) if r['version'].startswith('v${NODE_VERSION}.')))")
+          echo "Using Node ${NODE_FULL} (${{ matrix.node_base }}) for ${{ matrix.arch }}"
           docker run --rm --platform ${{ matrix.platform }} \
+            -e NODE_FULL="$NODE_FULL" -e ARCH="${{ matrix.arch }}" \
+            -e NODE_BASE="${{ matrix.node_base }}" \
             -v "$(pwd)/bundle:/bundle" \
             -w /bundle/programs/server \
-            node:${NODE_VERSION}-slim \
-            sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
+            ubuntu:26.04 \
+            bash -c '
+              set -eux
+              apt-get update -qq
+              apt-get install -y -q build-essential python3 curl xz-utils ca-certificates
+              if [ "$NODE_BASE" = unofficial ]; then
+                NODE_URL="https://unofficial-builds.nodejs.org/download/release/${NODE_FULL}/node-${NODE_FULL}-linux-${ARCH}.tar.xz"
+              else
+                NODE_URL="https://nodejs.org/dist/${NODE_FULL}/node-${NODE_FULL}-linux-${ARCH}.tar.xz"
+              fi
+              curl -fsSL -o /tmp/node.tar.xz "$NODE_URL"
+              mkdir -p /opt/node
+              tar -xJf /tmp/node.tar.xz -C /opt/node --strip-components=1
+              export PATH=/opt/node/bin:$PATH
+              node --version
+              npm install
+              # Bundle the target-arch Node.js binary for the self-contained
+              # launcher. /bundle is the host bundle/ dir (see -v mount above).
+              cp /opt/node/bin/node /bundle/node
+              chmod +x /bundle/node
+              # #6458: replace the inherited amd64 qemu-user with THIS arch own
+              # same-arch qemu-user (from the target-arch distro, so it runs on
+              # this arch), used by bundle/cpu-exec to emulate CPU features a
+              # binary needs but the host CPU lacks. Tolerant: if the package
+              # is unavailable on this arch, the bundle just ships without it
+              # (cpu-exec then falls back to a system qemu-user, or reports).
+              rm -f /bundle/qemu-x86_64
+              if apt-get install -y -q qemu-user-static >/dev/null 2>&1 && \
+                 [ -x "/usr/bin/qemu-$(uname -m)-static" ]; then
+                cp "/usr/bin/qemu-$(uname -m)-static" "/bundle/qemu-$(uname -m)"
+                chmod +x "/bundle/qemu-$(uname -m)"
+                echo "Bundled qemu-$(uname -m) for cpu-exec."
+              else
+                echo "qemu-user-static not available for $(uname -m); bundle ships without a bundled qemu-user."
+              fi
+            '
+
+      - name: Embed FerretDB (${{ matrix.arch }}) into the bundle
+        # These arches have no MongoDB server, so FerretDB is their default DB.
+        # The launcher (start-wekan.sh) is inherited from the amd64 base bundle;
+        # download only this arch's binary from the newest wekan/FerretDB release.
+        # A marker file makes FerretDB the default backend at runtime (see the
+        # launcher + Docker entrypoint).
+        run: |
+          curl -fSL --retry 5 --retry-delay 10 -o bundle/ferretdb \
+            "https://github.com/wekan/FerretDB/releases/latest/download/ferretdb-${{ matrix.arch }}"
+          chmod +x bundle/ferretdb
+          # Overwrite the inherited amd64 MongoDB Database Tools with this arch's ones.
+          MT="https://github.com/wekan/mongo-tools/releases/latest/download"
+          for t in bsondump mongodump mongoexport mongofiles mongoimport mongorestore mongostat mongotop; do
+            curl -fSL --retry 5 --retry-delay 10 -o "bundle/$t" "$MT/$t-${{ matrix.arch }}"
+            chmod +x "bundle/$t"
+          done
+          touch bundle/.ferretdb-default
 
       - name: Create ${{ matrix.arch }} zip
         run: zip -r wekan-${VERSION}-${{ matrix.arch }}.zip bundle
@@ -639,18 +859,142 @@ jobs:
           GH_REPO: ${{ github.repository }}
         run: gh release upload "v${VERSION}" "wekan-${VERSION}-${{ matrix.arch }}.zip" --clobber
 
+  # ─── 7c. Build the Sandstorm .spk and attach it to the Release ───────────────
+  # Same steps as the standalone sandstorm.yml workflow (kept for building/testing
+  # the .spk on its own without a full release); here it builds from the release
+  # tag and attaches wekan-<version>-sandstorm.spk to the GitHub Release.
+  #
+  # EXPERIMENTAL in CI (same caveats as sandstorm.yml):
+  #   * Sandstorm needs unprivileged user namespaces; GitHub's Ubuntu runners are VMs
+  #     that allow them, but this is the fragile part.
+  #   * meteor-spk SIGNS the .spk with the app private key from the Sandstorm keyring;
+  #     provide it as the SANDSTORM_KEYRING secret (base64 of ~/.sandstorm-keyring).
+  #
+  # continue-on-error: the experimental Sandstorm build must NOT fail the release;
+  # like the other post-`release` bundle jobs it only attaches its artifact.
+  build-sandstorm:
+    needs: [prepare, release]
+    continue-on-error: true
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: refs/tags/v${{ needs.prepare.outputs.version }}
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        # Ubuntu 24.04's AppArmor defaults kernel.apparmor_restrict_unprivileged_userns=1,
+        # which blocks the unprivileged user namespaces that the Sandstorm install and
+        # the spk supervisor rely on (the "fragile part" noted above). Relax it so
+        # `install.sandstorm.io` and meteor-spk can create sandboxes on the runner.
+        # `|| true`: on kernels/runners without these knobs, setting them is a no-op.
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies and Meteor
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git qemu-user-static
+          if [ ! -f "$HOME/.meteor/meteor" ]; then curl https://install.meteor.com/ | sh; fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install Sandstorm (dev, unattended)
+        # Installed BEFORE assembling the deps: build-deps.sh's [bridge] step copies
+        # the modern /opt/sandstorm/latest/bin/sandstorm-http-bridge over the ancient
+        # bundled one, so the Sandstorm install must be in place first.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
+        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io (has mongod 3.0 +
+        # niscud). build-deps.sh swaps in Node 24, adds FerretDB + the Mongo 3.x
+        # CLIs + the migration launcher/importer, keeps niscud, and swaps in the
+        # modern sandstorm-http-bridge from the Sandstorm install above. No dependency
+        # on the retired releases.wekan.team or the old projects.7z.
+        run: |
+          bash sandstorm-src/build-deps.sh
+          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
+
+      - name: Restore the Sandstorm signing keyring
+        env:
+          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
+        run: |
+          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
+            # meteor-spk / spk read the app signing key from ~/.sandstorm-keyring —
+            # a FILE directly in $HOME (see the pack crash path
+            # "/home/runner/.sandstorm-keyring"). Write it exactly there, NOT to
+            # ~/.sandstorm/sandstorm-keyring, or `meteor-spk pack` aborts with
+            # "open(~/.sandstorm-keyring): No such file or directory".
+            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
+            chmod 600 "$HOME/.sandstorm-keyring"
+            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
+          else
+            echo "::error::SANDSTORM_KEYRING secret is not set. meteor-spk pack signs the .spk with the WeKan Sandstorm app's private key, which lives in this keyring, so packing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
+            exit 1
+          fi
+
+      - name: Install Meteor npm dependencies
+        # PUPPETEER_SKIP_DOWNLOAD: puppeteer is a devDependency used only by tests,
+        # not by the server, so it never belongs in the packed .spk. Skipping its
+        # Chromium download (~150 MB) avoids any risk of it bloating the build and
+        # speeds up CI.
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: |
+          (meteor update --npm 2>/dev/null || true) && meteor npm install
+
+      - name: Build the Sandstorm .spk
+        id: build
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: |
+          set -euo pipefail
+          # Version-named (not timestamped like sandstorm.yml): the release re-runs
+          # idempotently with --clobber replacing the same asset.
+          SPK="wekan-${VERSION}-sandstorm.spk"
+          meteor-spk pack "$SPK"
+          # Report the packed size and warn if it exceeds Cloudflare's 100 MB upload
+          # cap (a proxied browser upload to a Cloudflare-fronted Sandstorm 413s above
+          # this; install via a DNS-only host / SSH tunnel, or trim further).
+          SPK_BYTES=$(stat -c%s "$SPK")
+          echo "Packed $SPK: $((SPK_BYTES/1024/1024)) MiB ($SPK_BYTES bytes)"
+          if [ "$SPK_BYTES" -gt $((100*1024*1024)) ]; then
+            echo "::warning::$SPK is $((SPK_BYTES/1024/1024)) MiB — over Cloudflare's 100 MB upload limit. Upload via a DNS-only host / SSH tunnel to Sandstorm, or trim the bundle further."
+          fi
+          ls -la "$SPK"
+          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.build.outputs.spk }}
+          path: ${{ steps.build.outputs.spk }}
+          retention-days: 7
+
+      - name: Attach the .spk to the GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "v${VERSION}" "${{ steps.build.outputs.spk }}" --clobber
+
   # ─── 8. Build and push the multi-arch Docker image to all registries ────────
   # Mirrors releases/docker-build.sh step 3 (multi-arch buildx --push).
   # Needs `release` because the Dockerfile downloads wekan-<version>-<arch>.zip
   # from the GitHub Release; building before those assets exist 404s and (without
-  # set -e in the Dockerfile) shipped a broken image missing /build/main.js.
+  # set -e in the Dockerfile) shipped a broken image missing /build/main.js. Also
+  # needs `build-extra-arches` because the image now covers ppc64le/s390x/riscv64,
+  # whose zips (with FerretDB baked in) are attached by that job after `release`.
   docker:
-    needs: [prepare, release]
+    needs: [prepare, release, build-extra-arches]
     runs-on: ubuntu-latest
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: refs/tags/v${{ needs.prepare.outputs.version }}
 
@@ -683,14 +1027,14 @@ jobs:
         # Release for each built platform. Even though this job needs `release`
         # (so the assets are uploaded), GitHub's releases/download/<tag>/<asset>
         # URL can briefly 404 right after upload (CDN/propagation lag), which used
-        # to fail the multi-arch build mid-way. Poll here until both the amd64 and
-        # arm64 bundles return 200, so the (expensive, emulated) buildx run only
-        # starts once the assets are actually fetchable. The Dockerfile also
+        # to fail the multi-arch build mid-way. Poll here until every arch bundle
+        # baked into the image returns 200, so the (expensive, emulated) buildx run
+        # only starts once the assets are actually fetchable. The Dockerfile also
         # retries per-arch as a second layer of safety.
         run: |
           set -euo pipefail
           base="https://github.com/wekan/wekan/releases/download/v${VERSION}"
-          for arch in amd64 arm64; do
+          for arch in amd64 arm64 ppc64le s390x riscv64; do
             url="${base}/wekan-${VERSION}-${arch}.zip"
             echo "Waiting for ${url} ..."
             ok=0
@@ -714,33 +1058,49 @@ jobs:
         # Belt-and-suspenders against the "image tagged vX shows vY in the Admin
         # Panel" bug: the image is just the unzipped wekan-<version>-<arch>.zip
         # bundle (Dockerfile moves it to /build), and the Admin Panel shows that
-        # bundle's app package.json version (server/statistics.js reads
-        # require('/package.json').version). Assert the amd64 bundle's WeKan
-        # version equals the release version BEFORE the expensive multi-arch
-        # buildx, so a stale/mismatched bundle fails fast with a clear message
-        # instead of shipping (and pushing to three registries) a mislabeled image.
+        # bundle's WeKan version (server/statistics.js reads
+        # require('/package.json').version). Check the amd64 bundle's WeKan version
+        # equals the release version BEFORE the expensive multi-arch buildx, so a
+        # stale/mismatched bundle fails fast instead of shipping (and pushing to
+        # three registries) a mislabeled image.
+        #
+        # Meteor does NOT ship the app package.json as a standalone file — it
+        # inlines it into the compiled bundle/programs/server/app/app.js as a JSON
+        # module, e.g. {"name":"wekan","version":"v9.63.0",...}. That inlined
+        # module (anchored on "name":"wekan") is exactly what require('/package.json')
+        # resolves to at runtime, so it is the authoritative thing to check.
+        #
+        # IMPORTANT: only a CONFIRMED mismatch fails the release. If the version
+        # cannot be located (bundle layout changed, app.js minified differently),
+        # warn and continue — inability to verify must not block a good release,
+        # since --build-arg VERSION below is the actual guarantee. (An earlier
+        # version of this guard grepped for a v-prefixed *package.json* and made
+        # "not found" fatal, which false-failed the whole v9.63 docker build.)
         run: |
           set -euo pipefail
           url="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-amd64.zip"
           wget -q "$url" -O bundle.zip
           tmp="$(mktemp -d)"
-          # Extract only package.json files (not the whole multi-hundred-MB bundle).
-          unzip -o -q bundle.zip '*package.json' -d "$tmp"
-          # The WeKan app package.json is the only one whose "version" carries a
-          # leading 'v' (e.g. "v9.61.0"); every dependency uses plain semver. So a
-          # v-prefixed "version" uniquely identifies the app's own package.json.
-          found="$(grep -rhoE '"version": "v[0-9][^"]*"' "$tmp" \
-                    | grep -oE 'v[0-9][^"]*' | sort -u | head -1 || true)"
+          # Extract only the compiled app program (not the whole multi-hundred-MB
+          # bundle); the inlined app package.json lives in app/app.js.
+          unzip -o -q bundle.zip 'bundle/programs/server/app/app.js' -d "$tmp" || true
+          appjs="$tmp/bundle/programs/server/app/app.js"
+          found=""
+          if [ -f "$appjs" ]; then
+            match="$(grep -aoE '"name":"wekan","version":"v?[0-9][^"]*"' "$appjs" | head -1 || true)"
+            found="$(printf '%s' "$match" | sed -E 's/.*"version":"([^"]*)".*/\1/')"
+          fi
           rm -rf "$tmp" bundle.zip
           if [ -z "$found" ]; then
-            echo "::error::Could not find a v-prefixed WeKan version in the bundle's package.json files."
+            echo "::warning::Could not locate the WeKan version in the bundle (app.js layout may have changed); skipping the bundle-version check. --build-arg VERSION still guarantees the correct bundle."
+            exit 0
+          fi
+          norm="${found#v}"
+          if [ "$norm" != "${VERSION}.0" ] && [ "$norm" != "${VERSION}" ]; then
+            echo "::error::Bundle reports app version ${found} but the release is v${VERSION}. The bundle baked into the image is stale/mismatched — the Admin Panel would show ${norm}. Aborting before build."
             exit 1
           fi
-          if [ "$found" != "v${VERSION}.0" ] && [ "$found" != "v${VERSION}" ]; then
-            echo "::error::Bundle reports app version $found but the release is v${VERSION}. The bundle baked into the image is stale/mismatched — the Admin Panel would show $found. Aborting before build."
-            exit 1
-          fi
-          echo "Bundle app version $found matches release v${VERSION}."
+          echo "Bundle app version ${found} matches release v${VERSION}."
 
       - name: Build and push multi-arch image
         # Pass VERSION explicitly as a build-arg. The Dockerfile's `ARG VERSION`
@@ -751,7 +1111,7 @@ jobs:
         # report in the Admin Panel — a stale, different version.
         run: |
           docker buildx build \
-            --platform linux/amd64,linux/arm64 \
+            --platform linux/amd64,linux/arm64,linux/ppc64le,linux/s390x,linux/riscv64 \
             --build-arg VERSION=${VERSION} \
             -t wekanteam/wekan:v${VERSION} \
             -t wekanteam/wekan:latest \
@@ -764,23 +1124,107 @@ jobs:
 
   # ─── 9. Build the snap on Launchpad, push to the store, attach to release ────
   # The snap's `wekan` part downloads wekan-<version>-<arch>.zip from the GitHub
-  # Release, so this job runs only after `release` has published those assets.
-  # `snapcraft remote-build` builds every platform listed in snapcraft.yaml
-  # (amd64 + arm64) on Launchpad.
-  snap:
+  # Release, so these jobs run only after `release` has published those assets.
+  #
+  # snap-native + snap-launchpad replace the old single `snap` job. The mainstream
+  # arches (amd64 + arm64) build NATIVELY on GitHub-hosted runners — fast, no
+  # Launchpad queue. The exotic arches (s390x, ppc64el, riscv64) have no native
+  # GitHub runners and snapcraft cannot cross-build, so they stay on Launchpad but
+  # in a NON-BLOCKING, per-arch matrix so a slow/failed arch (riscv64 queues for
+  # hours) never holds up the release or the other arches. Each arch publishes to
+  # the Snap Store (stable + candidate + beta + edge) and attaches to the Release the moment
+  # it finishes — all 5 arches, published independently.
+  snap-native:
     needs: [prepare, release]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: refs/tags/v${{ needs.prepare.outputs.version }}
+
+      - name: Verify snapcraft.yaml version matches the release
+        # snapcraft.yaml's `version:` names the produced file (wekan_<version>_<arch>.snap).
+        # Assert it matches the tag so a stale version fails fast here.
+        run: |
+          set -euo pipefail
+          if ! grep -qxF "version: '${VERSION}'" snapcraft.yaml; then
+            echo "::error::snapcraft.yaml is not at version '${VERSION}' ($(grep -m1 '^version:' snapcraft.yaml)). The bump job (releases/version.sh) did not update the tagged commit."
+            exit 1
+          fi
+          echo "snapcraft.yaml is at version '${VERSION}'."
+
+      - name: Build the ${{ matrix.arch }} snap natively
+        # Runs on a native ${{ matrix.arch }} GitHub runner, so snapcraft builds the
+        # platform whose `build-on` matches this host — no Launchpad, no emulation.
+        id: build
+        uses: snapcore/action-build@v1
+
+      - name: Verify the built snap is ${{ matrix.arch }}
+        run: |
+          set -euo pipefail
+          snap="${{ steps.build.outputs.snap }}"
+          echo "Built: $snap"
+          case "$snap" in
+            *_${{ matrix.arch }}.snap) : ;;
+            *) echo "::error::Built snap '$snap' is not ${{ matrix.arch }}."; exit 1 ;;
+          esac
+
+      - name: Push ${{ matrix.arch }} to the Snap Store (stable + candidate + beta + edge)
+        uses: snapcore/action-publish@v1
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_AUTH }}
+        with:
+          snap: ${{ steps.build.outputs.snap }}
+          release: stable,candidate,beta,edge
+
+      - name: Attach the ${{ matrix.arch }} snap to the GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "v${VERSION}" "${{ steps.build.outputs.snap }}" --clobber
+
+  snap-launchpad:
+    needs: [prepare, release]
+    # continue-on-error: the exotic Launchpad arches must NOT hold up or fail the
+    # release. riscv64 in particular queues for hours / can time out; that must not
+    # turn the whole release red. fail-fast: false so one arch never cancels the
+    # others. Each leg publishes the moment it finishes.
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [s390x, ppc64el, riscv64]
     runs-on: ubuntu-latest
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: refs/tags/v${{ needs.prepare.outputs.version }}
           # remote-build (Launchpad) rejects shallow clones, so fetch full history
           fetch-depth: 0
 
       - name: Install snapcraft
-        run: sudo snap install snapcraft --classic
+        # The Snap Store intermittently rejects the install with a 429-style rate
+        # limit; retry so one transient throttle does not fail the build.
+        run: |
+          set -uo pipefail
+          for i in 1 2 3 4 5; do
+            sudo snap install snapcraft --classic && exit 0
+            echo "snapcraft install attempt $i/5 failed (Snap Store throttle?); retrying in 30s..."
+            sleep 30
+          done
+          echo "::error::snapcraft install failed after 5 attempts (Snap Store rate limit)."
+          exit 1
 
       - name: Provide Launchpad credentials for remote-build
         env:
@@ -791,15 +1235,6 @@ jobs:
           chmod 600 ~/.local/share/snapcraft/launchpad-credentials
 
       - name: Verify snapcraft.yaml version matches the release
-        # The `bump` job (releases/version.sh) is the single source of truth for
-        # the snap version and updates snapcraft.yaml before the tag is created.
-        # snapcraft.yaml's `version:` names the produced files
-        # (wekan_<version>_<arch>.snap), so if a stale tag carried the wrong
-        # version the build would produce wekan_<old>_*.snap and the upload/attach
-        # globs (wekan_${VERSION}_*.snap) would match nothing — passing the literal
-        # glob to `snapcraft upload` ("is not a valid file", exit 64). Assert it
-        # here so that mismatch fails fast (before a ~20 min Launchpad build) with
-        # a clear pointer, instead of re-bumping the version inside this build job.
         run: |
           set -euo pipefail
           if ! grep -qxF "version: '${VERSION}'" snapcraft.yaml; then
@@ -808,31 +1243,26 @@ jobs:
           fi
           echo "snapcraft.yaml is at version '${VERSION}'."
 
-      - name: Build snaps on Launchpad (amd64 + arm64)
-        # `snapcraft remote-build` is experimental and talks to Launchpad over
-        # HTTPS after pushing the whole repo; it intermittently dies with a
-        # transient TLS drop (e.g. "SSLEOFError: EOF occurred in violation of
-        # protocol", exit 70) that has nothing to do with the build itself.
-        # Retry a few times so one network hiccup doesn't fail the release.
+      - name: Build the ${{ matrix.arch }} snap on Launchpad
+        # --build-for ${{ matrix.arch }}: build ONLY this leg's arch so a slow/failed
+        # arch never blocks the others. remote-build can exit 0 without producing a
+        # .snap (it just downloads logs), so require the file. Retry a few times to
+        # survive transient TLS drops to Launchpad.
         run: |
           set -uo pipefail
           shopt -s nullglob
           attempts=3
           for i in $(seq 1 "$attempts"); do
-            echo "::group::Remote build attempt $i/$attempts"
-            snapcraft remote-build --launchpad-accept-public-upload && rc=0 || rc=$?
+            echo "::group::Remote build ${{ matrix.arch }} attempt $i/$attempts"
+            snapcraft remote-build --launchpad-accept-public-upload \
+              --build-for ${{ matrix.arch }} && rc=0 || rc=$?
             echo "::endgroup::"
-            # snapcraft remote-build can exit 0 even when the Launchpad build
-            # FAILED (it just downloads the build logs and produces no .snap), so
-            # don't trust the exit code alone — require that .snap files exist.
-            snaps=( wekan_${VERSION}_*.snap )
+            snaps=( wekan_${VERSION}_${{ matrix.arch }}.snap )
             if [ "$rc" -eq 0 ] && [ "${#snaps[@]}" -gt 0 ]; then
-              echo "Remote build succeeded on attempt $i: ${snaps[*]}"
+              echo "Remote build ${{ matrix.arch }} succeeded on attempt $i: ${snaps[*]}"
               exit 0
             fi
             echo "Attempt $i: snapcraft exit=$rc, .snap files produced=${#snaps[@]}."
-            # Surface the Launchpad build logs so a real build failure is
-            # diagnosable here, instead of as a later cryptic upload error.
             for log in snapcraft-wekan-*.txt; do
               echo "::group::Launchpad build log: $log (last 150 lines)"
               tail -n 150 "$log"
@@ -843,34 +1273,33 @@ jobs:
               sleep 60
             fi
           done
-          echo "::error::Remote build failed after $attempts attempts (no wekan_${VERSION}_*.snap produced)." >&2
+          echo "::error::Remote build ${{ matrix.arch }} failed after $attempts attempts (no wekan_${VERSION}_${{ matrix.arch }}.snap produced)." >&2
           exit 1
 
-      - name: Push snaps to the Snap Store (edge + beta channels)
+      - name: Push ${{ matrix.arch }} to the Snap Store (stable + candidate + beta + edge)
         env:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_AUTH }}
         run: |
           set -euo pipefail
           shopt -s nullglob
-          snaps=( wekan_${VERSION}_*.snap )
+          snaps=( wekan_${VERSION}_${{ matrix.arch }}.snap )
           if [ "${#snaps[@]}" -eq 0 ]; then
-            echo "::error::No wekan_${VERSION}_*.snap files to upload."
+            echo "::error::No wekan_${VERSION}_${{ matrix.arch }}.snap to upload."
             exit 1
           fi
+          # base: core24 allows publishing to stable and candidate (core26 does not).
           for f in "${snaps[@]}"; do
-            echo "Uploading $f to the Snap Store (edge,beta)..."
-            snapcraft upload --release=edge,beta "$f"
+            echo "Uploading $f to the Snap Store (stable,candidate,beta,edge)..."
+            snapcraft upload --release=stable,candidate,beta,edge "$f"
           done
 
-      - name: Attach snaps to the GitHub Release
+      - name: Attach the ${{ matrix.arch }} snap to the GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           shopt -s nullglob
-          snaps=( wekan_${VERSION}_*.snap )
-          if [ "${#snaps[@]}" -eq 0 ]; then
-            echo "::error::No wekan_${VERSION}_*.snap files to attach."
-            exit 1
+          snaps=( wekan_${VERSION}_${{ matrix.arch }}.snap )
+          if [ "${#snaps[@]}" -gt 0 ]; then
+            gh release upload "v${VERSION}" "${snaps[@]}" --clobber
           fi
-          gh release upload "v${VERSION}" "${snaps[@]}" --clobber

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/sandstorm-store.yml

@@ -0,0 +1,145 @@
+name: Publish .spk to Sandstorm App Market
+
+# Manually triggered. Takes the Sandstorm .spk that sandstorm.yml already built and
+# attached to a WeKan GitHub Release, renames it to wekan-<VERSION>.spk (VERSION is the
+# WeKan release version, e.g. 9.88), and publishes it to the Sandstorm App Market with
+#   spk publish wekan-<VERSION>.spk
+# exactly like releases/release-sandstorm.sh does locally.
+#
+#   gh workflow run sandstorm-store.yml
+#   gh workflow run sandstorm-store.yml -f version=9.88
+#   gh workflow run sandstorm-store.yml -f version=9.88 -f tag=v9.88
+#
+# Needs SANDSTORM_KEYRING (base64 of ~/.sandstorm-keyring) — `spk publish` proves app
+# ownership with the WeKan Sandstorm app's private key from that keyring — and installs
+# Sandstorm + assembles meteor-spk the same way sandstorm.yml does, so `spk` is present.
+# It does NOT rebuild the .spk; it publishes the one already on the release.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'WeKan version for the store filename wekan-<VERSION>.spk (e.g. 9.88). Default: derived from the release tag.'
+        required: false
+        default: ''
+      tag:
+        description: 'Release tag whose .spk to publish (default: newest release).'
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  sandstorm-store:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git
+
+      - name: Install Sandstorm (dev, unattended)
+        # Provides the `spk` command used to publish, and the sandstorm-http-bridge that
+        # build-deps.sh copies into the meteor-spk deps.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (same as sandstorm.yml)
+        run: |
+          bash sandstorm-src/build-deps.sh
+          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
+
+      - name: Restore the Sandstorm signing keyring
+        env:
+          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
+        run: |
+          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
+            # spk publish reads the app signing key from ~/.sandstorm-keyring (a FILE in
+            # $HOME), same location meteor-spk pack uses.
+            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
+            chmod 600 "$HOME/.sandstorm-keyring"
+            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
+          else
+            echo "::error::SANDSTORM_KEYRING secret is not set. 'spk publish' proves ownership of the WeKan Sandstorm app with the private key from this keyring, so publishing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
+            exit 1
+          fi
+
+      - name: Download the newest .spk from the WeKan release and name it wekan-<VERSION>.spk
+        id: fetch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          IN_TAG: ${{ github.event.inputs.tag }}
+          IN_VERSION: ${{ github.event.inputs.version }}
+        run: |
+          set -euo pipefail
+
+          # 1) Which release to publish from.
+          TAG="${IN_TAG:-}"
+          if [ -z "$TAG" ]; then
+            TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          fi
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::error::No release found to publish the .spk from."
+            exit 1
+          fi
+
+          # 2) VERSION for the store filename wekan-<VERSION>.spk. Use the input, else
+          #    derive it from the tag (strip a leading 'v', e.g. v9.88 -> 9.88).
+          VERSION="${IN_VERSION:-}"
+          if [ -z "$VERSION" ]; then
+            VERSION="${TAG#v}"
+          fi
+          echo "Release: $TAG  ->  store filename: wekan-${VERSION}.spk"
+
+          # 3) Download the newest .spk asset on that release. sandstorm.yml attaches it
+          #    as wekan-sandstorm-YYYY_MM_DD-HH_MM_SS.spk; if several exist, take the
+          #    lexicographically-newest (the timestamp sorts chronologically).
+          ASSET="$(gh release view "$TAG" --json assets \
+            --jq '[.assets[].name | select(endswith(".spk"))] | sort | last' 2>/dev/null || true)"
+          if [ -z "${ASSET:-}" ] || [ "$ASSET" = "null" ]; then
+            echo "::error::Release $TAG has no .spk asset. Run sandstorm.yml first to build and attach one."
+            exit 1
+          fi
+          echo "Downloading .spk asset: $ASSET"
+          gh release download "$TAG" --pattern "$ASSET" --dir . --clobber
+
+          SPK="wekan-${VERSION}.spk"
+          mv -f "$ASSET" "$SPK"
+          ls -la "$SPK"
+          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to the Sandstorm App Market
+        env:
+          SPK: ${{ steps.fetch.outputs.spk }}
+        run: |
+          set -euo pipefail
+          # Resolve the spk binary: prefer PATH, then the Sandstorm install location.
+          SPK_BIN="$(command -v spk || true)"
+          if [ -z "$SPK_BIN" ]; then
+            for c in /opt/sandstorm/latest/bin/spk /opt/sandstorm/spk /usr/local/bin/spk; do
+              [ -x "$c" ] && SPK_BIN="$c" && break
+            done
+          fi
+          if [ -z "$SPK_BIN" ]; then
+            echo "::error::Could not find the 'spk' command from the Sandstorm install."
+            exit 1
+          fi
+          echo "Publishing $SPK with $SPK_BIN ..."
+          # Same command as releases/release-sandstorm.sh: spk publish wekan-<VERSION>.spk
+          "$SPK_BIN" publish "$SPK"

.github/workflows/sandstorm.yml

@@ -0,0 +1,144 @@
+name: Build Sandstorm .spk
+
+# Manually triggered. Builds ONLY the Sandstorm .spk package (nothing else) and
+# uploads it as wekan-sandstorm-YYYY_MM_DD-HH_MM_SS.spk to the NEWEST WeKan GitHub
+# Release as an attachment, so you can download it, test whether the Sandstorm
+# build works, and see any errors — without running a full release.
+#
+#   gh workflow run sandstorm.yml
+#
+# EXPERIMENTAL in CI (same caveats as the build-sandstorm job in release-all.yml):
+#   * Sandstorm needs unprivileged user namespaces; GitHub's Ubuntu runners are VMs
+#     that allow them, but this is the fragile part.
+#   * meteor-spk SIGNS the .spk with the app private key from the Sandstorm keyring;
+#     provide it as the SANDSTORM_KEYRING secret (base64 of ~/.sandstorm keyring).
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch, tag or SHA to build the .spk from (default: main)'
+        required: false
+        default: 'main'
+
+permissions:
+  contents: write
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  sandstorm:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # Build the dispatched ref so a fix branch can be tested before it is
+          # merged to main; defaults to main for a plain `gh workflow run`.
+          ref: ${{ github.event.inputs.ref || 'main' }}
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        # Ubuntu 24.04's AppArmor defaults kernel.apparmor_restrict_unprivileged_userns=1,
+        # which blocks the unprivileged user namespaces that the Sandstorm install and
+        # the spk supervisor rely on (the "fragile part" noted above). Relax it so
+        # `install.sandstorm.io` and meteor-spk can create sandboxes on the runner.
+        # `|| true`: on kernels/runners without these knobs, setting them is a no-op.
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies and Meteor
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git qemu-user-static
+          if [ ! -f "$HOME/.meteor/meteor" ]; then curl https://install.meteor.com/ | sh; fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install Sandstorm (dev, unattended)
+        # Installed BEFORE assembling the deps: build-deps.sh's [bridge] step copies
+        # the modern /opt/sandstorm/latest/bin/sandstorm-http-bridge over the ancient
+        # bundled one, so the Sandstorm install must be in place first.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
+        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io (has mongod 3.0 +
+        # niscud). build-deps.sh swaps in Node 24, adds FerretDB + the Mongo 3.x
+        # CLIs + the migration launcher/importer, keeps niscud, and swaps in the
+        # modern sandstorm-http-bridge from the Sandstorm install above. No dependency
+        # on the retired releases.wekan.team or the old projects.7z.
+        run: |
+          bash sandstorm-src/build-deps.sh
+          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
+
+      - name: Restore the Sandstorm signing keyring
+        env:
+          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
+        run: |
+          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
+            # meteor-spk / spk read the app signing key from ~/.sandstorm-keyring —
+            # a FILE directly in $HOME (see the pack crash path
+            # "/home/runner/.sandstorm-keyring"). Write it exactly there, NOT to
+            # ~/.sandstorm/sandstorm-keyring, or `meteor-spk pack` aborts with
+            # "open(~/.sandstorm-keyring): No such file or directory".
+            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
+            chmod 600 "$HOME/.sandstorm-keyring"
+            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
+          else
+            echo "::error::SANDSTORM_KEYRING secret is not set. meteor-spk pack signs the .spk with the WeKan Sandstorm app's private key, which lives in this keyring, so packing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
+            exit 1
+          fi
+
+      - name: Install Meteor npm dependencies
+        # PUPPETEER_SKIP_DOWNLOAD: puppeteer is a devDependency used only by tests,
+        # not by the server, so it never belongs in the packed .spk. Skipping its
+        # Chromium download (~150 MB) avoids any risk of it bloating the build and
+        # speeds up CI.
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: |
+          (meteor update --npm 2>/dev/null || true) && meteor npm install
+
+      - name: Build the Sandstorm .spk
+        id: build
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: |
+          set -euo pipefail
+          STAMP="$(date +'%Y_%m_%d-%H_%M_%S')"
+          SPK="wekan-sandstorm-${STAMP}.spk"
+          meteor-spk pack "$SPK"
+          # Report the packed size and warn if it exceeds Cloudflare's 100 MB upload
+          # cap (a proxied browser upload to a Cloudflare-fronted Sandstorm 413s above
+          # this; install via a DNS-only host / SSH tunnel, or trim further).
+          SPK_BYTES=$(stat -c%s "$SPK")
+          echo "Packed $SPK: $((SPK_BYTES/1024/1024)) MiB ($SPK_BYTES bytes)"
+          if [ "$SPK_BYTES" -gt $((100*1024*1024)) ]; then
+            echo "::warning::$SPK is $((SPK_BYTES/1024/1024)) MiB — over Cloudflare's 100 MB upload limit. Upload via a DNS-only host / SSH tunnel to Sandstorm, or trim the bundle further."
+          fi
+          ls -la "$SPK"
+          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.build.outputs.spk }}
+          path: ${{ steps.build.outputs.spk }}
+          retention-days: 7
+
+      - name: Upload the .spk to the newest WeKan release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::error::No existing GitHub Release found to attach the .spk to."
+            exit 1
+          fi
+          echo "Uploading ${{ steps.build.outputs.spk }} to the newest release: $TAG"
+          gh release upload "$TAG" "${{ steps.build.outputs.spk }}" --clobber

.gitignore

@@ -70,3 +70,17 @@ test-results/
 _build-local-test
 */build-assets-local-test
 */build-chunks-local-test
+
+# Local-only working copies: other wekan repos cloned under this repo for editing,
+# and build inputs. These are separate git repos / large machine-specific dirs;
+# never commit them.
+#  - projects/    : unarchived meteor-spk fork (Node/Mongo/FerretDB binaries)
+#  - sandstorm/   : clone of sandstorm-io/sandstorm (platform source, for reference)
+#  - FerretDB/    : clone of wekan/FerretDB
+#  - mongo-tools/ : clone of wekan/mongo-tools
+#  - mongosh/     : clone of wekan/mongosh
+/projects/
+/sandstorm/
+/FerretDB/
+/mongo-tools/
+/mongosh/

.meteor/packages

@@ -6,7 +6,7 @@
 meteor-base@1.5.2
 
 # Build system
-ecmascript@0.18.0
+ecmascript@0.18.1
 standard-minifier-js@3.2.0
 rspack@1.1.0
 
@@ -16,11 +16,11 @@ blaze@3.0.2
 aldeed:collection2
 aldeed:schema-index@4.0.0-beta.5
 reywood:publish-composite
-mongo@2.4.0-rc350.1
+mongo@2.4.0
 
 # Account system
-accounts-password@3.3.0-rc350.1
-accounts-express@1.0.0-rc350.1
+accounts-password@3.3.0
+accounts-express@1.0.0
 communitypackages:core
 communitypackages:unstyled
 communitypackages:flow-routing
@@ -37,7 +37,7 @@ wekan-accounts-oidc
 check@1.5.0
 random@1.2.2
 reactive-dict@1.3.2
-session@1.2.3-rc350.1
+session@1.2.3
 tracker@1.3.4
 audit-argument-checks@1.0.8
 
@@ -45,7 +45,7 @@ audit-argument-checks@1.0.8
 ostrio:i18n
 reactive-var@1.0.13
 shell-server@0.7.0
-email@3.2.0-rc350.1
+email@3.2.0
 dynamic-import@0.7.4
 wekan-markdown
 quave:synced-cron
@@ -55,8 +55,8 @@ ostrio:files
 meteortesting:mocha@3.0.0
 matb33:collection-hooks
 service-configuration@1.3.5
-minifier-css@2.0.2-rc350.1
-ejson@1.2.0-rc350.1
+minifier-css@2.0.2
+ejson@1.2.0
 logging@1.3.6
 wekan-fullcalendar
 wekan-fontawesome

.meteor/release

@@ -1 +1 @@
-METEOR@3.5-rc.1
+METEOR@3.5

.meteor/versions

@@ -1,44 +1,44 @@
-accounts-base@3.3.0-rc350.1
-accounts-express@1.0.0-rc350.1
-accounts-oauth@1.4.7-rc350.1
-accounts-password@3.3.0-rc350.1
+accounts-base@3.3.0
+accounts-express@1.0.0
+accounts-oauth@1.4.7
+accounts-password@3.3.0
 aldeed:collection2@4.2.0
 aldeed:schema-index@4.0.0
 aldeed:simple-schema@1.13.1
 allow-deny@2.1.0
 audit-argument-checks@1.0.8
 autoupdate@2.0.1
-babel-compiler@7.14.0
+babel-compiler@7.14.1
 babel-runtime@1.5.2
-base64@1.0.14-rc350.1
-binary-heap@1.0.13-rc350.1
+base64@1.0.14
+binary-heap@1.0.13
 blaze@3.0.3
 blaze-tools@2.0.1
 boilerplate-generator@2.1.0
 caching-compiler@2.0.1
 caching-html-compiler@2.0.1
-callback-hook@1.8.0-rc350.1
+callback-hook@1.8.0
 check@1.5.0
 communitypackages:core@2.0.3
 communitypackages:flow-routing@2.1.0
 communitypackages:unstyled@2.0.1
 core-runtime@1.0.0
 ddp@1.4.2
-ddp-client@3.3.0-rc350.1
-ddp-common@1.4.5-rc350.1
-ddp-rate-limiter@1.3.0-rc350.1
-ddp-server@3.3.0-rc350.1
+ddp-client@3.3.0
+ddp-common@1.4.5
+ddp-rate-limiter@1.3.0
+ddp-server@3.3.0
 diff-sequence@1.1.3
 dynamic-import@0.7.4
-ecmascript@0.18.0
+ecmascript@0.18.1
 ecmascript-runtime@0.8.3
 ecmascript-runtime-client@0.13.0
 ecmascript-runtime-server@0.11.1
-ejson@1.2.0-rc350.1
-email@3.2.0-rc350.1
+ejson@1.2.0
+email@3.2.0
 es5-shim@4.8.1
 facts-base@1.0.2
-fetch@0.2.0-rc350.1
+fetch@0.2.0
 geojson-utils@1.0.12
 hot-code-push@1.0.5
 html-tools@2.0.1
@@ -53,23 +53,23 @@ lai:collection-extensions@1.0.0
 localstorage@1.2.1
 logging@1.3.6
 matb33:collection-hooks@2.1.0
-meteor@2.3.1-rc350.1
+meteor@2.3.1
 meteor-base@1.5.2
 meteortesting:browser-tests@1.8.0
 meteortesting:mocha@3.3.0
 meteortesting:mocha-core@8.2.0
-minifier-css@2.0.2-rc350.1
-minifier-js@3.2.0
-minimongo@2.2.0-rc350.1
+minifier-css@2.0.2
+minifier-js@3.2.1
+minimongo@2.2.0
 modern-browsers@0.2.3
 modules@0.20.3
 modules-runtime@0.13.2
-mongo@2.4.0-rc350.1
+mongo@2.4.0
 mongo-decimal@0.2.0
 mongo-dev-server@1.1.1
 mongo-id@1.0.9
 npm-mongo@6.16.1
-oauth@3.0.4-rc350.1
+oauth@3.0.4
 oauth2@1.3.3
 observe-sequence@2.0.1
 ordered-dict@1.2.0
@@ -82,7 +82,7 @@ promise@1.0.0
 quave:synced-cron@2.4.0
 raix:eventemitter@1.0.0
 random@1.2.2
-rate-limit@1.2.0-rc350.1
+rate-limit@1.2.0
 react-fast-refresh@0.3.0
 reactive-dict@1.3.2
 reactive-var@1.0.13
@@ -92,10 +92,10 @@ reywood:publish-composite@1.9.0
 routepolicy@1.1.2
 rspack@1.1.0
 service-configuration@1.3.5
-session@1.2.3-rc350.1
+session@1.2.3
 sha@1.0.10
 shell-server@0.7.0
-socket-stream-client@0.7.0-rc350.1
+socket-stream-client@0.7.0
 spacebars@2.0.1
 spacebars-compiler@2.0.1
 standard-minifier-js@3.2.0
@@ -105,9 +105,9 @@ templating-runtime@2.0.2
 templating-tools@2.0.1
 tools-core@1.1.0
 tracker@1.3.4
-typescript@5.10.0
-url@1.3.6-rc350.1
-webapp@2.2.0-rc350.1
+typescript@5.10.1
+url@1.3.6
+webapp@2.2.0
 webapp-hashing@1.1.2
 wekan-accounts-cas@0.2.0
 wekan-accounts-lockout@1.1.0

.meteorignore

@@ -1,2 +1,9 @@
 npm-packages/
-tests/
+# Root tests/ holds Playwright specs, Node E2E and node-based unit tests - none
+# of it is Meteor code, and Meteor's file watcher otherwise churns on the
+# tests/playwright/test-results/ tree (inotify errors). The leading slash anchors
+# this to the repo root only, so it does NOT match server/lib/tests/ or
+# client/lib/tests/ (the Mocha suites, loaded via meteor.testModule in
+# package.json). A naked "tests/" would match a dir named tests at any depth and
+# would hide those suites, making `meteor test` report "0 passing".
+/tests/

.tx/config

@@ -1,6 +1,6 @@
 [main]
 host     = https://www.transifex.com
-lang_map = te_IN: te-IN, es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR, zh_CN.GB2312: zh-GB
+lang_map = te_IN: te-IN, es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja-JP, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR, zh_CN.GB2312: zh-GB
 
 [o:wekan:p:wekan:r:application]
 file_filter = imports/i18n/data/<lang>.i18n.json

CODE_OF_CONDUCT.md

@@ -2,10 +2,10 @@
 
 For all code at WeKan GitHub Organization https://github.com/wekan
 
+- For pull requests, mention only those participants that are **human**.
 - All code in pull requests need to have permission already to add it to WeKan with MIT license, and will become MIT license.
 - For any dependencies, permissive licenses like https://copyfree.org are preferred
 - For anything currently that is non-permissive (like GPL, AGPL, SSPL), those will be replaced with permissive-licensed alternatives
-- Any intelligence allowed: Human, AI or any other. No discrimination, please have world peace. Mentioning participants optional.
 - All code is checked and validated by xet7 and many different security AI. If code is real working fix or feature, it usually will be merged.
 - All known vulnerabilities have been fixed at newest WeKan, please upgrade https://wekan.fi/upgrade/
 - There is no known backdoors. If WeKan is installed by someone else, first registered user is Admin and has Admin Panel access.

Dockerfile

@@ -7,17 +7,17 @@ LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 # TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=9.63
+ARG VERSION=9.97
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"
 
 ENV \
     DEBUG=false \
-    NODE_VERSION=v24.17.0 \
-    METEOR_RELEASE=METEOR@3.5-beta.12 \
+    NODE_VERSION=v24.18.0 \
+    METEOR_RELEASE=METEOR@3.5-rc.2 \
     USE_EDGE=false \
-    NPM_VERSION=11.11.0 \
+    NPM_VERSION=11.12.1 \
     SRC_PATH=./ \
     WITH_API=true \
     MONGO_OPLOG_URL="" \
@@ -67,6 +67,7 @@ ENV \
     OAUTH2_AUTH_ENDPOINT="" \
     OAUTH2_USERINFO_ENDPOINT="" \
     OAUTH2_TOKEN_ENDPOINT="" \
+    OAUTH2_LOGOUT_ENDPOINT="" \
     OAUTH2_ID_MAP="" \
     OAUTH2_USERNAME_MAP="" \
     OAUTH2_AUTO_REGISTRATION="true" \
@@ -184,24 +185,35 @@ apt-get update --assume-yes
 apt-get upgrade --assume-yes
 apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS}
 
-# Multi-arch mapping: Docker TARGETARCH -> Node.js arch name + WeKan bundle name
-# arm/v7 uses TARGETARCH=arm; armhf has no MongoDB Community -> uses FerretDB
+# Multi-arch mapping: Docker TARGETARCH -> Node.js arch name + WeKan bundle name.
+# amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB server
+# and ship FerretDB v1 instead (the ferretdb binary is baked into their .zip and
+# started by wekan-entrypoint.sh). riscv64's Node.js 24 comes from
+# unofficial-builds.nodejs.org (nodejs.org ships no riscv64). armv7l is excluded:
+# there is no Node.js 24 build for it anywhere.
+NODE_BASE="official"
 case "${TARGETARCH}" in
     "amd64")   NODE_ARCH="x64"     WEKAN_ARCH="amd64"   ;;
     "arm64")   NODE_ARCH="arm64"   WEKAN_ARCH="arm64"   ;;
-    "arm")     NODE_ARCH="armv7l"  WEKAN_ARCH="armhf"   ;;
     "ppc64le") NODE_ARCH="ppc64le" WEKAN_ARCH="ppc64le" ;;
     "s390x")   NODE_ARCH="s390x"   WEKAN_ARCH="s390x"   ;;
+    "riscv64") NODE_ARCH="riscv64" WEKAN_ARCH="riscv64" NODE_BASE="unofficial" ;;
     *) echo "Unsupported architecture: ${TARGETARCH}"; exit 1 ;;
 esac
 
-# Node.js Installation (official nodejs.org builds for Node 22)
+# Node.js installation. Official nodejs.org builds for amd64/arm64/ppc64le/s390x;
+# unofficial-builds.nodejs.org for riscv64 (nodejs.org ships no riscv64 binary).
 cd /tmp
-wget "https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz"
-wget "https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc"
-grep "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc | shasum -a 256 -c -
+if [ "${NODE_BASE}" = "unofficial" ]; then
+    NODE_DIST="https://unofficial-builds.nodejs.org/download/release/${NODE_VERSION}"
+else
+    NODE_DIST="https://nodejs.org/dist/${NODE_VERSION}"
+fi
+wget "${NODE_DIST}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz"
+wget "${NODE_DIST}/SHASUMS256.txt"
+grep " node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz\$" SHASUMS256.txt | shasum -a 256 -c -
 tar xzf "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" -C /usr/local --strip-components=1 --no-same-owner
-rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc
+rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt
 ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs"
 
 # NPM configuration
@@ -228,6 +240,14 @@ rm "wekan-${VERSION}-${WEKAN_ARCH}.zip"
 npm install --prefix ./bundle/programs/server
 mv /home/wekan/app/bundle /build
 
+# The .zip bundle now ships a self-contained launcher + its own Node.js for the
+# offline downloads; the Docker image installs its own Node and uses
+# wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps
+# /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools
+# (bsondump, mongodump, mongorestore, … from wekan/mongo-tools, embedded in the
+# bundle) for backup/restore inside the container. Saves ~80 MB per arch.
+rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat
+
 # Restore original tar
 mv $(which tar)~ $(which tar)
 
@@ -246,10 +266,17 @@ mkdir -p /data
 chown wekan:wekan --recursive /data
 EOR
 
+# Database-backend selector entrypoint. Every arch's bundle now ships a FerretDB
+# binary (baked into the .zip and moved to /build/ferretdb above); this script
+# starts FerretDB v1 (SQLite) or leaves the DB external based on WEKAN_DB and the
+# /build/.ferretdb-default marker (present only on MongoDB-less arches). See
+# releases/ferretdb/wekan-entrypoint.sh.
+COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh
+
 USER wekan
 ENV PORT=8080
 EXPOSE $PORT
 STOPSIGNAL SIGKILL
 WORKDIR /build
 
-CMD ["bash", "-c", "ulimit -s 65500; exec node main.js"]
+CMD ["bash", "/build/wekan-entrypoint.sh"]

README.md

@@ -103,10 +103,10 @@ By working directly with WeKan ® you get the benefit of active maintenance and
 
 ## Getting Started with Development
 
-The default branch uses Meteor 3.5-beta.7 with Node.js 24.x.
+The main branch uses Meteor 3.5 with Node.js 24.x.
 See [CHANGELOG.md](https://github.com/wekan/wekan/blob/main/CHANGELOG.md) for the latest runtime updates.
 
-To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./rebuild-wekan.sh` (or `./rebuild-wekan.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-select-option-1-to-install-dependencies-and-then-enter). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
+To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./rebuild-wekan.sh` (or `./rebuild-wekan.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-install-dependencies-build-wekan-and-run-the-dev-server). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
 
 Please refer to the [developer documentation](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Developer-Documentation.md) for more information.
 
@@ -138,11 +138,17 @@ curl https://install.meteor.com/ | sh
 
 ### Building WeKan
 
-The `rebuild-wekan.sh` script guides you through a three-stage process:
+The `rebuild-wekan.sh` script shows a two-level menu. The top level groups options into categories:
 
-1. **Install dependencies (Option 1)** - Downloads all required Meteor packages and npm modules
-2. **Build WeKan (Option 2)** - Compiles the application
-3. **Run WeKan (Option 3)** - Starts the development server at http://localhost:4000
+```
+1) Setup   2) Dev server   3) Tests   4) Docker   5) Tools   6) Quit
+```
+
+You pick a category number, then the item number inside it (each submenu also has a `Back` entry). Building from source is a three-stage process:
+
+1. **Setup -> Install dependencies** - Downloads all required Meteor packages and npm modules
+2. **Setup -> Build WeKan** - Compiles the application
+3. **Dev server -> localhost:3000** - Starts the development server at http://localhost:3000
 
 ```bash
 # Clone your fork
@@ -152,25 +158,27 @@ cd wekan
 # Make the script executable
 chmod +x rebuild-wekan.sh
 
-# Step 1: Install dependencies
+# Step 1: Install dependencies (Setup -> Install dependencies)
 ./rebuild-wekan.sh
-# Press 1 and Enter
+# Press 1 (Setup) and Enter, then 1 (Install dependencies) and Enter
 
-# Step 2: Build WeKan (after dependencies complete)
+# Step 2: Build WeKan (Setup -> Build WeKan, after dependencies complete)
 ./rebuild-wekan.sh
-# Press 2 and Enter
+# Press 1 (Setup) and Enter, then 2 (Build WeKan) and Enter
 
-# Step 3: Run WeKan in development mode
+# Step 3: Run WeKan in development mode (Dev server -> localhost:3000)
 ./rebuild-wekan.sh
-# Press 3 and Enter
+# Press 2 (Dev server) and Enter, then 1 (localhost:3000) and Enter
 ```
+
+If a dev server is already running on that port, the **Dev server** options stop it automatically and start a fresh server on the same port.
  
 
 ### WSL Users
 
 WSL users can use Snap Candidate. See [install docs](https://wekan.fi/install/).
 
-The development server will start at http://localhost:4000. Any changes you make to the source code will automatically trigger a rebuild and refresh your browser.
+The development server will start at http://localhost:3000. Any changes you make to the source code will automatically trigger a rebuild and refresh your browser.
 
 ## Screenshot
 

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v9.63.0"
+appVersion: "v9.97.0"
 files:
   userUploads:
     - README.md

api.py

@@ -37,6 +37,8 @@ If *nix:  chmod +x api.py => ./api.py users
     python3 api.py lists BOARDID        # Lists of BOARDID
     python3 api.py list BOARDID LISTID  # Info of LISTID
     python3 api.py createlist BOARDID LISTTITLE # Create list
+    python3 api.py editlist BOARDID LISTID NEWLISTTITLE # Edit list title
+    python3 api.py editlistcolor BOARDID LISTID COLOR (Color available: `white`, `green`, `yellow`, `orange`, `red`, `purple`, `blue`, `sky`, `lime`, `pink`, `black`, `silver`, `peachpuff`, `crimson`, `plum`, `darkgreen`, `slateblue`, `magenta`, `gold`, `navy`, `gray`, `saddlebrown`, `paleturquoise`, `mistyrose`, `indigo`) # Edit list color
     python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
     python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
         python3 api.py getcard BOARDID LISTID CARDID # Get card info
@@ -77,6 +79,7 @@ If *nix:  chmod +x api.py => ./api.py users
     python3 api.py exportboardpdf BOARDID OUTPUT.pdf # Export a whole board to PDF
     python3 api.py importboardfrom SOURCE EXPORT.json # Import from trello/wekan/csv/jira/kanboard/excel/deck/openproject/github/gitlab/gitea/forgejo/asana/zenkit
     python3 api.py exportboardformat BOARDID FORMAT OUTPUT.json # Export to kanboard/trello/jira/deck/openproject/github/gitlab/gitea/forgejo/asana/zenkit
+    python3 api.py importics BOARDID SWIMLANEID LISTID CALENDAR.ics # Import an iCalendar (.ics) file into a board as cards (one card per VEVENT)
 
         Board Member API (Issue #5998):
     python3 api.py addboardmember BOARDID USERID ROLE # Add/activate board member. ROLE: admin, normal, comment, readonly, worker, normalassignedonly, commentassignedonly, readassignedonly, nocomments
@@ -129,6 +132,16 @@ If *nix:  chmod +x api.py => ./api.py users
     python3 api.py getcardsettings BOARDID # Get board-level card settings (allows* toggles, cardAging, cardAgingDays1/2/3)
     python3 api.py setcardsetting BOARDID KEY VALUE # Set one board card setting, e.g. allowsDueDate true, cardAging true, cardAgingDays1 5
 
+        Board Automation Rules API (IFTTT, Issue #2674):
+    python3 api.py listrules BOARDID # List automation rules of a board
+    python3 api.py getrule BOARDID RULEID # Get one rule with its trigger and action
+    python3 api.py addrule BOARDID TITLE TRIGGER_JSON ACTION_JSON # Add rule. Missing trigger matching fields default to the '*' wildcard
+    python3 api.py editrule BOARDID RULEID PATCH_JSON # Edit rule: {"title":..,"trigger":{..},"action":{..}}
+    python3 api.py removerule BOARDID RULEID # Remove rule (and its trigger + action)
+    # Example (Issue #2674) - add member when card moved TO list, remove member when moved AWAY FROM list:
+    #   python3 api.py addrule BOARDID 'Add on move to Doing' '{"activityType":"moveCard","listName":"Doing"}' '{"actionType":"addMember","username":"someuser"}'
+    #   python3 api.py addrule BOARDID 'Remove on move from Doing' '{"activityType":"moveCard","oldListName":"Doing"}' '{"actionType":"removeMember","username":"someuser"}'
+
   Admin API:
     python3 api.py newuser USERNAME EMAIL PASSWORD
 
@@ -264,10 +277,9 @@ if arguments == 10:
         boardid = sys.argv[3]
         name = sys.argv[4]
         type1 = sys.argv[5]
-        settings = str(json.loads(sys.argv[6]))
-        #  There is error: Settings must be object. So this does not work yet.
-        #settings = {'currencyCode': 'EUR'}
-        print(type(settings))
+        settings_arg = sys.argv[6]
+        # settings is optional; an empty arg -> {} (avoids json.loads('') crashing).
+        settings = json.loads(settings_arg) if settings_arg.strip() else {}
         showoncard = sys.argv[7]
         automaticallyoncard = sys.argv[8]
         showlabelonminicard = sys.argv[9]
@@ -275,7 +287,7 @@ if arguments == 10:
         customfieldtoboard = wekanurl + apiboards + boardid + s + cf
         # Add Custom Field to Board
         headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
-        post_data = {'authorId': '{}'.format(authorid), 'name': '{}'.format(name), 'type': '{}'.format(type1), 'settings': '{}'.format(settings), 'showoncard': '{}'.format(showoncard), 'automaticallyoncard': '{}'.format(automaticallyoncard), 'showlabelonminicard': '{}'.format(showlabelonminicard), 'showsumattopoflist': '{}'.format(showsumattopoflist)}
+        post_data = {'authorId': '{}'.format(authorid), 'name': '{}'.format(name), 'type': '{}'.format(type1), 'settings': json.dumps(settings), 'showoncard': '{}'.format(showoncard), 'automaticallyoncard': '{}'.format(automaticallyoncard), 'showlabelonminicard': '{}'.format(showlabelonminicard), 'showsumattopoflist': '{}'.format(showsumattopoflist)}
         body = requests.post(customfieldtoboard, data=post_data, headers=headers)
         print(body.text)
         # ------- ADD CUSTOM FIELD TO BOARD END -----------
@@ -432,6 +444,49 @@ if arguments == 5:
 
 if arguments >= 4:
 
+    if sys.argv[1] == 'editlist':
+
+        # ------- EDIT LIST START -----------
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        newlisttitle = sys.argv[4]
+        edlist = wekanurl + apiboards + boardid + s + l + s + listid
+        print(edlist)
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        put_data = {'title': '{}'.format(newlisttitle)}
+        body = requests.put(edlist, data=put_data, headers=headers)
+        print("=== EDIT LIST ===\n")
+        body = requests.get(edlist, headers=headers)
+        data2 = body.text.replace('}', "}\n")
+        print(data2)
+        # ------- EDIT LIST END -----------
+
+    if sys.argv[1] == 'editlistcolor':
+
+        # ------- EDIT LIST COLOR START -----------
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        newcolor = sys.argv[4]
+
+        valid_colors = ['white', 'green', 'yellow', 'orange', 'red', 'purple', 'blue', 'sky', 'lime', 'pink', 'black',
+                    'silver', 'peachpuff', 'crimson', 'plum', 'darkgreen', 'slateblue', 'magenta', 'gold', 'navy',
+                    'gray', 'saddlebrown', 'paleturquoise', 'mistyrose', 'indigo']
+
+        if newcolor not in valid_colors:
+            print("Invalid color. Choose a color from the list.")
+            sys.exit(1)
+
+        edlist = wekanurl + apiboards + boardid + s + l + s + listid
+        print(edlist)
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        put_data = {'color': '{}'.format(newcolor)}
+        body = requests.put(edlist, data=put_data, headers=headers)
+        print("=== EDIT LIST COLOR ===\n")
+        body = requests.get(edlist, headers=headers)
+        data2 = body.text.replace('}', "}\n")
+        print(data2)
+        # ------- EDIT LIST COLOR END -----------
+
     if sys.argv[1] == 'newuser':
 
         # ------- CREATE NEW USER START -----------
@@ -1728,6 +1783,18 @@ if arguments >= 1:
 #   python3 api.py addrule BOARDID 'Archive after 90 days' \
 #     '{"activityType":"scheduledTrigger","scheduleKind":"aging","listName":"Completed","days":90,"atTime":"03:00"}' \
 #     '{"actionType":"archive"}'
+#
+# Example (Issue #2674 - add a user to the card when it is moved TO a list, and
+# remove the user again when the card is moved AWAY FROM that list). Trigger
+# matching fields that are omitted (userId, swimlaneName, cardTitle, and the
+# unused one of listName/oldListName) are stored as the '*' wildcard by the
+# server, so the rules fire for any user/swimlane/card title:
+#   python3 api.py addrule BOARDID 'Add member on move to Doing' \
+#     '{"activityType":"moveCard","listName":"Doing"}' \
+#     '{"actionType":"addMember","username":"someuser"}'
+#   python3 api.py addrule BOARDID 'Remove member on move from Doing' \
+#     '{"activityType":"moveCard","oldListName":"Doing"}' \
+#     '{"actionType":"removeMember","username":"someuser"}'
 
 if arguments >= 2 and sys.argv[1] == 'listrules':
     boardid = sys.argv[2]
@@ -2021,4 +2088,21 @@ if arguments >= 4 and sys.argv[1] == 'exportboardformat':
         f.write(response.text)
     print('Board exported ({}) to: {}'.format(fmt, outputpath))
 
+if arguments >= 5 and sys.argv[1] == 'importics':
+    # Usage: python3 api.py importics BOARDID SWIMLANEID LISTID CALENDAR.ics
+    # Imports an iCalendar (.ics) file into the board: one card is created per
+    # VEVENT, with startAt (DTSTART) and dueAt (DTEND, or DTSTART when there is
+    # no DTEND), so the events appear on the Calendar / Gantt views (issue #6323).
+    boardid = sys.argv[2]
+    swimlaneid = sys.argv[3]
+    listid = sys.argv[4]
+    icspath = sys.argv[5]
+    with open(icspath) as f:
+        ics_text = f.read()
+    headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+    url = wekanurl + apiboards + boardid + s + 'swimlanes' + s + swimlaneid + s + l + s + listid + s + 'ics'
+    response = requests.post(url, headers=headers, json={'ics': ics_text})
+    # Response: { "created": <n>, "cardIds": [ ... ] }
+    print(response.text)
+
 # ------- IMPORT/EXPORT TO OTHER TOOLS END -----------

client/00-startup.js

@@ -1,7 +1,13 @@
 // Fix dynamic-import chunk loading when Wekan runs under a sub-path (ROOT_URL includes a pathname,
-// e.g. https://example.com/wekan). Rspack uses __webpack_public_path__ to prefix chunk URLs; by
-// default it is set to /build-chunks/ (no context path). We update it here, at module evaluation
-// time, before any import() expression runs (those are deferred to Meteor.startup callbacks).
+// e.g. https://example.com/wekan). Rspack's runtime builds every chunk URL as
+// __webpack_public_path__ + chunkName, and the chunk name ALREADY includes the "build-chunks/"
+// prefix (its runtime does `u = e => "build-chunks/" + e + "." + hash + ".js"`). The default
+// public path is "/", so at the site root chunks correctly resolve to "/build-chunks/<chunk>".
+// Under a sub-path we must prefix that sub-path — but must NOT re-add "build-chunks/" ourselves,
+// or the URL becomes "/wekan/build-chunks/build-chunks/<chunk>" and 404s (issue #6445, which broke
+// the lazy-loaded language chunks). So set the public path to "<sub-path>/" and let rspack append
+// "build-chunks/" itself. Done here at module evaluation time, before any import() expression runs
+// (those are deferred to Meteor.startup callbacks).
 /* global __webpack_public_path__:writable */
 try {
   const _cfg = typeof window !== 'undefined' && window.__meteor_runtime_config__;
@@ -9,7 +15,7 @@ try {
   if (_rootUrl) {
     const _rootPath = new URL(_rootUrl).pathname.replace(/\/+$/, '');
     if (_rootPath && _rootPath !== '/') {
-      __webpack_public_path__ = _rootPath + '/build-chunks/';
+      __webpack_public_path__ = _rootPath + '/';
     }
   }
 } catch (_) {}

client/components/activities/activities.css

@@ -15,6 +15,20 @@
 .reactions-popup .add-comment-reaction:hover {
   background-color: #b0c4de;
 }
+/* Eye / eye-slash icon toggle for showing/hiding activities. Open eye
+   (.eye-icon) = activities shown; crossed eye (.eye-slash-icon) = hidden.
+   Matches the password-visibility toggle used on the login/register pages. */
+.activities-eye-toggle {
+  cursor: pointer;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4em;
+  text-decoration: none;
+}
+.activities-eye-toggle .eye-icon,
+.activities-eye-toggle .eye-slash-icon {
+  line-height: 1;
+}
 .activities {
   clear: both;
 }

client/components/activities/activities.jade

@@ -106,10 +106,10 @@ template(name="activity")
 
       //- comment activity ----------------------------------------------------
       if($eq activity.activityType 'deleteComment')
-        | {{{_ 'activity-deleteComment' activity.commentId}}}.
+        | {{{_ 'activity-deleteComment' (sanitize activity.commentDisplayText)}}}.
 
       if($eq activity.activityType 'editComment')
-        | {{{_ 'activity-editComment' activity.commentId}}}.
+        | {{{_ 'activity-editComment' (sanitize activity.commentDisplayText)}}}.
 
       if($eq activity.activityType 'addComment')
         | {{{_ 'activity-on' cardLink}}}
@@ -130,6 +130,12 @@ template(name="activity")
       if($eq activity.activityType 'a-endAt')
         | {{{_ 'activity-endDate' (sanitize endDate) cardLink}}}.
 
+      if($eq activity.activityType 'a-changedTitle')
+        | {{{_ 'activity-changedTitle' (sanitize activity.value) cardLink}}}.
+
+      if($eq activity.activityType 'a-changedDescription')
+        | {{{_ 'activity-changedDescription' cardLink}}}.
+
       //- customField activity ------------------------------------------------
       if($eq activity.activityType 'createCustomField')
         | {{_ 'activity-customfield-created' customField}}.

client/components/activities/comments.css

@@ -135,3 +135,49 @@
   font-size: 0.8em;
   color: #999;
 }
+/* Threaded replies (issue #5907): indent replies under their parent. */
+.comments .comment.is-reply {
+  margin-inline-start: 24px;
+  border-inline-start: 2px solid #e0e0e0;
+  padding-inline-start: 8px;
+}
+.comments .comment .comment-desc .comment-in-reply-to {
+  font-size: 0.8em;
+  color: #999;
+  border-inline-start: 2px solid #ccc;
+  padding-inline-start: 6px;
+  margin: 3px 0;
+  display: block;
+}
+.comments .comment .comment-desc .comment-in-reply-to .comment-in-reply-to-label {
+  font-weight: 700;
+  margin-inline-end: 4px;
+}
+.comments .comment .comment-desc .comment-in-reply-to .comment-in-reply-to-text {
+  font-style: italic;
+}
+/* "In reply to" banner above the new-comment form. */
+.new-comment .comment-reply-banner {
+  background: #f4f4f4;
+  border-inline-start: 2px solid #ccc;
+  padding: 4px 6px;
+  margin: 0 4px 6px 0;
+  font-size: 0.85em;
+  color: #666;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+.new-comment .comment-reply-banner .comment-reply-banner-label {
+  font-weight: 700;
+}
+.new-comment .comment-reply-banner .comment-reply-banner-text {
+  flex: 1;
+  font-style: italic;
+  overflow: hidden;
+  white-space: nowrap;
+  text-overflow: ellipsis;
+}
+.new-comment .comment-reply-banner a {
+  cursor: pointer;
+}

client/components/activities/comments.jade

@@ -2,6 +2,14 @@ template(name="commentForm")
   .new-comment.js-new-comment(
     class="{{#if commentFormIsOpen}}is-open{{/if}}")
     +userAvatar(userId=currentUser._id noRemove=true)
+    if replyToComment
+      .comment-reply-banner.js-reply-banner
+        span.comment-reply-banner-label {{_ 'comment-in-reply-to'}}:
+        span.comment-reply-banner-text
+          +viewer
+            = replyToComment.text
+        a.js-cancel-reply(title="{{_ 'close' }}")
+          i.fa.fa-times-thin
     form.js-new-comment-form
       +editor(class="js-new-comment-input")
         | {{getUnsavedValue 'cardComment' currentCard._id}}
@@ -14,12 +22,19 @@ template(name="comments")
       +comment(commentData)
 
 template(name="comment")
-  .comment
+  .comment(class="{{#if parentId}}is-reply{{/if}}")
     +userAvatar(userId=userId)
     p.comment-desc
       span.comment-member
         +memberName(user=user)
 
+      if parentComment
+        .comment-in-reply-to
+          span.comment-in-reply-to-label {{_ 'comment-in-reply-to'}}:
+          span.comment-in-reply-to-text
+            +viewer
+              = parentComment.text
+
       +inlinedForm(classNames='js-edit-comment')
         +editor(autofocus=true)
           = text
@@ -33,9 +48,10 @@ template(name="comment")
             = text
         +commentReactions(reactions=reactions commentId=_id)
         span(title=createdAt).comment-meta {{ displayDate createdAt }}
-          if($eq currentUser._id userId)
-            +editOrDeleteComment
-          else if currentUser.isBoardAdmin
+          if currentUser.isBoardMember
+            = ' - '
+            a.js-reply-comment {{_ "comment-reply"}}
+          if canEditThisComment
             +editOrDeleteComment
 
 template(name="editOrDeleteComment")

client/components/activities/comments.js

@@ -1,13 +1,70 @@
 import { ReactiveCache } from '/imports/reactiveCache';
-import CardComments from '/models/cardComments';
+import CardComments, { canEditComment } from '/models/cardComments';
 import { UnsavedEdits } from '/client/lib/unsavedEdits';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
 import autosize from 'autosize';
 
 const commentFormIsOpen = new ReactiveVar(false);
+// _id of the comment currently being replied to (threaded replies, issue #5907).
+// Empty string means a new top-level comment.
+const replyToCommentId = new ReactiveVar('');
+
+// #5547: persist the comment draft (debounced) into UnsavedEdits while the user
+// types, so a comment in progress survives closing the card, clicking outside
+// it, or navigating away — the form prefills from {{getUnsavedValue
+// 'cardComment' ...}} on the next open. Historical note: the click-open flag
+// that armed the old escape-time draft save was removed in 2019 (3b3950369)
+// because the escape handler CLEARED the visible text; since then nothing saved
+// the draft at all, so any close of the card discarded the comment.
+let commentDraftTimer = null;
+let commentDraftPending = null; // { cardId, value }
+
+function commentDraftWrite({ cardId, value }) {
+  if (!cardId) return;
+  const draftKey = { fieldName: 'cardComment', docId: cardId };
+  if ((value || '').trim()) {
+    UnsavedEdits.set(draftKey, value);
+  } else {
+    UnsavedEdits.reset(draftKey);
+  }
+}
+
+function scheduleCommentDraftSave(cardId, value) {
+  commentDraftPending = { cardId, value };
+  if (commentDraftTimer) clearTimeout(commentDraftTimer);
+  commentDraftTimer = setTimeout(() => {
+    commentDraftTimer = null;
+    const pending = commentDraftPending;
+    commentDraftPending = null;
+    if (pending) commentDraftWrite(pending);
+  }, 300);
+}
+
+// Run a pending (debounced) save immediately — e.g. the card is closing.
+function flushCommentDraftSave() {
+  if (commentDraftTimer) {
+    clearTimeout(commentDraftTimer);
+    commentDraftTimer = null;
+  }
+  const pending = commentDraftPending;
+  commentDraftPending = null;
+  if (pending) commentDraftWrite(pending);
+}
+
+// Drop any pending save — the comment was submitted, so there is no draft.
+function cancelCommentDraftSave() {
+  if (commentDraftTimer) {
+    clearTimeout(commentDraftTimer);
+    commentDraftTimer = null;
+  }
+  commentDraftPending = null;
+}
 
 Template.commentForm.onDestroyed(function () {
+  // #5547: the card can close without the escape handler ever running (the X
+  // button, a route change); make sure the last keystrokes reach the draft.
+  flushCommentDraftSave();
   commentFormIsOpen.set(false);
   $('.note-popover').hide();
 });
@@ -16,9 +73,24 @@ Template.commentForm.helpers({
   commentFormIsOpen() {
     return commentFormIsOpen.get();
   },
+  // The comment being replied to, if any, so the form can show an
+  // "In reply to ..." banner with a way to cancel.
+  replyToComment() {
+    const id = replyToCommentId.get();
+    return id ? ReactiveCache.getCardComment(id) : undefined;
+  },
 });
 
 Template.commentForm.events({
+  // #5547: arm the escape handler below (it saves the draft and closes the
+  // form); this flag had no setter since 2019, so the handler never ran.
+  'focus .js-new-comment-input'() {
+    commentFormIsOpen.set(true);
+  },
+  // #5547: keep the draft continuously saved (debounced) while typing.
+  'input .js-new-comment-input'(evt) {
+    scheduleCommentDraftSave(Utils.getCurrentCardId(), evt.currentTarget.value);
+  },
   'submit .js-new-comment-form'(evt, tpl) {
     const input = tpl.$('.js-new-comment-input');
     const text = input.val().trim();
@@ -32,11 +104,21 @@ Template.commentForm.events({
       boardId = card.linkedId;
     }
     if (text) {
+      const parentId = replyToCommentId.get();
       CardComments.insert({
         text,
         boardId,
         cardId,
+        parentId: parentId || '',
       });
+      // #5547: the comment is saved — cancel any debounced draft save still in
+      // flight and remove the stored draft so it does not resurface next open.
+      cancelCommentDraftSave();
+      UnsavedEdits.reset({
+        fieldName: 'cardComment',
+        docId: Utils.getCurrentCardId(),
+      });
+      replyToCommentId.set('');
       resetCommentInput(input);
       Tracker.flush();
       autosize.update(input);
@@ -44,6 +126,10 @@ Template.commentForm.events({
     }
     evt.preventDefault();
   },
+  'click .js-cancel-reply'(evt) {
+    evt.preventDefault();
+    replyToCommentId.set('');
+  },
   // Pressing Ctrl+Enter should submit the form
   'keydown form textarea'(evt, tpl) {
     if (evt.keyCode === 13 && (evt.metaKey || evt.ctrlKey)) {
@@ -60,10 +146,45 @@ Template.comments.helpers({
   },
 });
 
+Template.comment.helpers({
+  // Whether the current user may edit/delete this comment, honouring the
+  // board's restrictCommentEditing setting (issue #5906). Mirrors the
+  // server-side enforcement so the UI hides buttons the server would reject.
+  canEditThisComment() {
+    const user = ReactiveCache.getCurrentUser();
+    if (!user) return false;
+    const isAuthor = user._id === this.userId;
+    const board = ReactiveCache.getBoard(this.boardId);
+    const isBoardAdmin = !!board && board.hasAdmin(user._id);
+    const restrictCommentEditing = !!board && !!board.restrictCommentEditing;
+    return canEditComment({ isAuthor, isBoardAdmin, restrictCommentEditing });
+  },
+  // The parent comment this one replies to, or undefined.
+  parentComment() {
+    return this.parentId ? ReactiveCache.getCardComment(this.parentId) : undefined;
+  },
+});
+
 Template.comment.events({
+  'click .js-reply-comment'(evt) {
+    evt.preventDefault();
+    replyToCommentId.set(this._id);
+    // Open and focus the new-comment form.
+    const input = $('.js-new-comment-input');
+    input.click();
+    Tracker.afterFlush(() => {
+      $('.js-new-comment-input').focus();
+    });
+  },
   'click .js-delete-comment': Popup.afterConfirm('deleteComment', function () {
     const commentId = this._id;
-    CardComments.remove(commentId);
+    // #3252: only remove if the doc is still in the local cache. Under heavy
+    // archive/delete churn the comment can already be evicted from Minimongo,
+    // and CardComments.remove() of a missing _id throws "Removed nonexistent
+    // document" on the client.
+    if (commentId && CardComments.findOne(commentId)) {
+      CardComments.remove(commentId);
+    }
     Popup.back();
   }),
   'submit .js-edit-comment'(evt, tpl) {
@@ -108,13 +229,20 @@ EscapeActions.register(
       docId: Utils.getCurrentCardId(),
     };
     const commentInput = $('.js-new-comment-input');
-    const draft = commentInput.val().trim();
+    const draft = (commentInput.val() || '').trim();
+    cancelCommentDraftSave();
     if (draft) {
       UnsavedEdits.set(draftKey, draft);
     } else {
       UnsavedEdits.reset(draftKey);
     }
-    resetCommentInput(commentInput);
+    // #5547: do NOT clear the input — clearing it on every click outside the
+    // comment box is exactly the "comment text disappearing" bug that got this
+    // handler disarmed in 2019 (3b3950369). The draft is saved above; if the
+    // card stays open, the text stays visible; if the card closes, the next
+    // open prefills the form from the draft.
+    commentInput.blur();
+    commentFormIsOpen.set(false);
   },
   () => {
     return commentFormIsOpen.get();

client/components/boards/boardArchive.js

@@ -9,7 +9,7 @@ Template.archivedBoards.onCreated(function () {
 
 Template.archivedBoards.helpers({
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
 
   archivedBoards() {

client/components/boards/boardBody.css

@@ -107,17 +107,17 @@
       overflow-y: scroll !important;
     }
 
-    /* Mobile - make all text 2x bigger inside #content by default (icons stay same size) */
+    /* Mobile - keep #content text at normal size (reverted #6426 oversizing) */
     @media screen and (max-width: 800px),
            screen and (max-device-width: 800px),
            screen and (-webkit-min-device-pixel-ratio: 2) and (max-width: 800px),
            screen and (max-width: 800px) and (orientation: portrait),
            screen and (max-width: 800px) and (orientation: landscape) {
       #content {
-        font-size: 2em !important; /* 2x bigger base font size for content area */
+        font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
       }
 
-      /* Make all text elements 2x bigger */
+      /* Keep all text elements at normal size */
       #content h1, #content h2, #content h3, #content h4, #content h5, #content h6,
       #content p, #content span, #content div, #content a, #content button,
       #content .minicard, #content .list-header-name, #content .board-header-btn,
@@ -186,7 +186,7 @@
 
     /* Fallback for iPhone devices using JavaScript detection */
     .iphone-device #content {
-      font-size: 2em !important; /* 2x bigger base font size for content area */
+      font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
     }
 
     .iphone-device #content h1, .iphone-device #content h2, .iphone-device #content h3, .iphone-device #content h4, .iphone-device #content h5, .iphone-device #content h6,
@@ -231,9 +231,9 @@
       font-size: 1em !important; /* Keep original icon size */
     }
 
-/* Mobile iPhone: scale card details text and icons to 2x */
+/* Mobile iPhone: keep card details text/icons at normal size (reverted #6426 oversizing) */
 body.mobile-mode.iphone-device .card-details {
-  font-size: 2em !important;
+  font-size: 1em !important;
 }
 body.mobile-mode.iphone-device .card-details .fa,
 body.mobile-mode.iphone-device .card-details .icon,
@@ -316,7 +316,19 @@ body.desktop-mode .board-wrapper .board-canvas .board-overlay {
   display: none !important;
   pointer-events: none !important;
 }
-.board-wrapper .board-canvas.is-dragging-active .open-minicard-composer,
+/* #2877 "Wekan swimlane jumps when moving card": while a card is dragged the
+   "+ Add Card" composer link is hidden, but hiding it with `display: none`
+   collapsed the bottom row of EVERY list at drag start (and restored it on
+   drop). With auto-height swimlanes the whole swimlane shrank/grew by the
+   composer's height, so all swimlanes below visibly jumped up and back down.
+   `visibility: hidden` hides the link just the same but keeps its box in the
+   layout, so nothing moves when a drag starts or ends. */
+.board-wrapper .board-canvas.is-dragging-active .open-minicard-composer {
+  visibility: hidden;
+}
+/* Checked cards of a multi-selection ARE the payload being dragged, so
+   removing them from the flow (showing the list as it will look after the
+   drop) is intentional — keep display: none here. */
 .board-wrapper .board-canvas.is-dragging-active .minicard-wrapper.is-checked {
   display: none;
 }

client/components/boards/boardBody.js

@@ -5,11 +5,14 @@ import dragscroll from '@wekanteam/dragscroll';
 import '/client/lib/dragscrollTouch';
 import { boardConverter } from '/client/lib/boardConverter';
 import { formatDateByUserPreference } from '/imports/lib/dateUtils';
+import { toFullCalendarFirstDay } from '/client/lib/calendarFirstDay';
+import { weekNumberByFirstDay } from '/models/lib/weekStart';
 import Swimlanes from '/models/swimlanes';
 import Lists from '/models/lists';
 import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
+import { Filter } from '/client/lib/filter';
 
 // SubsManager removed for Meteor 3 migration
 const { calculateIndex } = Utils;
@@ -567,17 +570,32 @@ Template.boardBody.onRendered(function () {
         $swimlanesDom.sortable('option', 'handle', '.swimlane-header');
       }
 
-      // Disable drag-dropping if the current user is not a board member
+      // #6446: enable swimlane drag-drop — which also carries moving cards BETWEEN
+      // swimlanes — for any board member with write access, not only board admins.
+      // The old !isBoardAdmin() check disabled this sortable for every non-admin, so
+      // a normal member could still move a card WITHIN a swimlane but not BETWEEN
+      // swimlanes (a card crossing swimlanes is received across this sortable), and
+      // could not reorder swimlanes. canModifyCard() is the client write-access
+      // predicate (board member, not comment-only / worker / read-only), matching
+      // the server's allowIsBoardMemberWithWriteAccess.
       $swimlanesDom.sortable(
         'option',
         'disabled',
-        !ReactiveCache.getCurrentUser()?.isBoardAdmin(),
+        !Utils.canModifyCard(),
       );
     }
   });
 
   dragscroll.reset();
-  Utils.setBackgroundImage();
+  // #4978: apply the board background inside a reactive autorun instead of a
+  // one-shot call. Switching directly between boards (e.g. the favorites bar)
+  // reuses this template instance and never re-fires onRendered, so the
+  // background used to stay on the previously shown board. Reading the current
+  // board inside setBackgroundImage() tracks both board switches and background
+  // edits; it performs no DB writes, so there is no autorun write loop.
+  this.autorun(() => {
+    Utils.setBackgroundImage();
+  });
 });
 
 Template.boardBody.onDestroyed(function () {
@@ -928,6 +946,11 @@ Template.calendarView.onRendered(function () {
   document.documentElement.dir = TAPi18n.getLanguageDirection();
 
   this.autorun(function () {
+    // #5656: refetch calendar events whenever the active board Filter changes
+    // so the Calendar view stays in sync with the other views. Reading the
+    // Filter's reactive state here establishes the dependency; the events()
+    // callback below applies the actual selector.
+    Filter.isActive();
     const calendarEl = document.getElementById('calendar-view');
     if (calendarEl && calendarEl._wekanCalendar) {
       calendarEl._wekanCalendar.refetchEvents();
@@ -942,12 +965,28 @@ Template.calendarView.helpers({
       return translated && translated !== key ? translated : fallback;
     };
 
+    // #5521: respect the user's "start day of week" setting instead of the
+    // FullCalendar locale default. getStartDayOfWeek() returns a zero-based day
+    // index (0=Sunday..6=Saturday), the same convention FullCalendar's firstDay
+    // uses; toFullCalendarFirstDay() validates it and falls back to Monday (1).
+    const currentUser = ReactiveCache.getCurrentUser();
+    const firstDay = toFullCalendarFirstDay(
+      currentUser ? currentUser.getStartDayOfWeek() : 1,
+    );
+
     return {
       id: 'calendar-view',
       initialView: 'dayGridMonth',
+      firstDay,
       editable: true,
       selectable: true,
       weekNumbers: true,
+      // #4946: FullCalendar's default weekNumberCalculation is locale-based
+      // (Sunday-anchored for many locales), so the week-number column ignored
+      // the user's start-day-of-week setting even though `firstDay` moved the
+      // grid. Compute the number from the SAME firstDay so the label matches the
+      // way the week is laid out.
+      weekNumberCalculation: date => weekNumberByFirstDay(date, firstDay),
       // Use non-localized AM/PM time format to avoid confusing notations like 上/下/中
       // Use full 'am'/'pm' instead of single-letter 'a'/'p' for clarity
       eventTimeFormat: {
@@ -991,6 +1030,12 @@ Template.calendarView.helpers({
       isRTL: TAPi18n.isRTL(),
       events(fetchInfo, callback) {
         const currentBoard = Utils.getCurrentBoard();
+        // #5656: apply the active board Filter (member / assignee / due-date /
+        // label / custom-field) so the Calendar view shows the same scoped set
+        // of cards as the Board / Lists / Swimlanes views.
+        const filterSelector = Filter.isActive()
+          ? Filter._getMongoSelector()
+          : undefined;
         const events = [];
         const pushEvent = function (card, title, start, end, extraCls) {
           start = start || card.startAt;
@@ -1015,12 +1060,12 @@ Template.calendarView.helpers({
           });
         };
         currentBoard
-          .cardsInInterval(fetchInfo.start, fetchInfo.end)
+          .cardsInInterval(fetchInfo.start, fetchInfo.end, filterSelector)
           .forEach(function (card) {
             pushEvent(card);
           });
         currentBoard
-          .cardsDueInBetween(fetchInfo.start, fetchInfo.end)
+          .cardsDueInBetween(fetchInfo.start, fetchInfo.end, filterSelector)
           .forEach(function (card) {
             pushEvent(
               card,

client/components/boards/boardHeader.css

@@ -937,3 +937,20 @@
 .desktop-mode .board-header .board-header-btn i {
   font-size: clamp(12px, 2.5vw, 16px) !important;
 }
+
+/* #6419: make the board-header action buttons touch-friendly by VIEWPORT WIDTH,
+   not only when the mobile-mode class is toggled. The measured default at a phone
+   width was 28px tall / 13px font (too small to tap reliably). Enlarge vertically
+   + bump the icon/font; width is left to flex so the existing horizontal layout
+   is unchanged. Applies on real phones whether or not mobile-mode auto-applied. */
+@media screen and (max-width: 800px) {
+  .board-header-btns .board-header-btn {
+    min-height: 40px;
+    padding-top: 8px;
+    padding-bottom: 8px;
+    font-size: 15px;
+  }
+  .board-header-btns .board-header-btn i.fa {
+    font-size: 16px;
+  }
+}

client/components/boards/boardHeader.jade

@@ -23,21 +23,22 @@ template(name="boardHeaderBar")
                 i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
                 span {{_ currentBoard.permission}}
 
-              a.board-header-btn.js-watch-board(
-                title="{{_ watchLevel }}")
-                if $eq watchLevel "watching"
-                  i.fa.fa-eye
-                if $eq watchLevel "tracking"
-                  i.fa.fa-bell
-                if $eq watchLevel "muted"
-                  i.fa.fa-bell-slash
-                span {{_ watchLevel}}
+              unless watchDisabled
+                a.board-header-btn.js-watch-board(
+                  title="{{_ watchLevel }}")
+                  if $eq watchLevel "watching"
+                    i.fa.fa-eye
+                  if $eq watchLevel "tracking"
+                    i.fa.fa-bell
+                  if $eq watchLevel "muted"
+                    i.fa.fa-bell-slash
+                  span {{_ watchLevel}}
               a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
                 title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
                 i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
                 if showStarCounter
                   span.board-star-counter {{currentBoard.stars}}
-              a.board-header-btn(title="{{_ 'sort-cards'}}" class="{{#if isSortActive }}emphasis{{else}} js-sort-cards {{/if}}")
+              a.board-header-btn(title="{{_ 'sort-cards'}}" class="js-sort-cards {{#if isSortActive }}emphasis{{/if}}")
                 i.fa.fa-sort
                 span {{#if isSortActive }}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
               if isSortActive
@@ -67,18 +68,19 @@ template(name="boardHeaderBar")
                 title="{{_ currentBoard.permission}}")
                 i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
 
-              a.board-header-btn.js-watch-board(
-                title="{{_ watchLevel }}")
-                if $eq watchLevel "watching"
-                  i.fa.fa-eye
-                if $eq watchLevel "tracking"
-                  i.fa.fa-bell
-                if $eq watchLevel "muted"
-                  i.fa.fa-bell-slash
+              unless watchDisabled
+                a.board-header-btn.js-watch-board(
+                  title="{{_ watchLevel }}")
+                  if $eq watchLevel "watching"
+                    i.fa.fa-eye
+                  if $eq watchLevel "tracking"
+                    i.fa.fa-bell
+                  if $eq watchLevel "muted"
+                    i.fa.fa-bell-slash
               a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
                 title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
                 i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
-              a.board-header-btn(title="{{_ 'sort-cards'}}" class="{{#if isSortActive }}emphasis{{else}} js-sort-cards {{/if}}")
+              a.board-header-btn(title="{{_ 'sort-cards'}}" class="js-sort-cards {{#if isSortActive }}emphasis{{/if}}")
                 i.fa.fa-sort
                 span {{#if isSortActive }}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
               if isSortActive
@@ -157,6 +159,12 @@ template(name="boardHeaderBar")
                 i.fa.fa-times-thin
 
         .separator
+        //- #6465: one-click board settings — the boardMenu popup used to need
+        //- two clicks (open sidebar, then Boardeinstellungen). The click
+        //- handler already exists in boardHeader.js ('click .js-open-board-menu').
+        if currentUser.isBoardMember
+          a.board-header-btn.js-open-board-menu(title="{{_ 'boardMenuPopup-title'}}")
+            i.fa.fa-cog
         a.board-header-btn.js-toggle-sidebar(title="{{_ 'sidebar-open'}} {{_ 'or'}} {{_ 'sidebar-close'}}")
           i.fa.fa-bars
 
@@ -267,9 +275,10 @@ template(name="createBoard")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}
@@ -293,9 +302,10 @@ template(name="createBoardPopup")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}
@@ -319,9 +329,10 @@ template(name="headerBarCreateBoardPopup")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}
@@ -346,9 +357,10 @@ template(name="createTemplateContainerPopup")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}

client/components/boards/boardHeader.js

@@ -17,6 +17,21 @@ const UPCLS = 'fa-sort-up';
 */
 const sortCardsBy = new ReactiveVar('');
 
+// Persist the card sort so it survives a page reload. Session is in-memory and
+// is reset on reload, which is why "sort by due date" kept reverting to the
+// default. See https://github.com/wekan/wekan/issues/5886
+const CARDS_SORT_BY_STORAGE_KEY = 'wekan-cards-sortBy';
+function setCardsSortBy(sortBy) {
+  Session.set('sortBy', sortBy);
+  try {
+    if (sortBy) {
+      window.localStorage.setItem(CARDS_SORT_BY_STORAGE_KEY, JSON.stringify(sortBy));
+    } else {
+      window.localStorage.removeItem(CARDS_SORT_BY_STORAGE_KEY);
+    }
+  } catch (e) {}
+}
+
 Template.boardChangeTitlePopup.events({
   async submit(event, templateInstance) {
     event.preventDefault();
@@ -41,6 +56,16 @@ Template.boardChangeTitlePopup.events({
 
 Template.boardHeaderBar.onCreated(function () {
   Meteor.subscribe('tableVisibilityModeSettings');
+  // Restore the persisted card sort after a reload (Session is in-memory), so
+  // both the sorting and the sort icon are remembered. See #5886.
+  if (!Session.get('sortBy')) {
+    try {
+      const stored = window.localStorage.getItem(CARDS_SORT_BY_STORAGE_KEY);
+      if (stored) {
+        Session.set('sortBy', JSON.parse(stored));
+      }
+    } catch (e) {}
+  }
 });
 
 Template.boardHeaderBar.helpers({
@@ -171,7 +196,7 @@ Template.boardHeaderBar.events({
     Filter.reset();
   },
   'click .js-sort-reset'() {
-    Session.set('sortBy', '');
+    setCardsSortBy('');
   },
   'click .js-open-search-view'() {
     const sidebar = getSidebarInstance();
@@ -529,7 +554,7 @@ Template.cardsSortPopup.events({
     const sortBy = {
       dueAt: 1,
     };
-    Session.set('sortBy', sortBy);
+    setCardsSortBy(sortBy);
     sortCardsBy.set(TAPi18n.__('due-date'));
     Popup.back();
   },
@@ -537,7 +562,7 @@ Template.cardsSortPopup.events({
     const sortBy = {
       title: 1,
     };
-    Session.set('sortBy', sortBy);
+    setCardsSortBy(sortBy);
     sortCardsBy.set(TAPi18n.__('title'));
     Popup.back();
   },
@@ -545,7 +570,7 @@ Template.cardsSortPopup.events({
     const sortBy = {
       createdAt: 1,
     };
-    Session.set('sortBy', sortBy);
+    setCardsSortBy(sortBy);
     sortCardsBy.set(TAPi18n.__('date-created-newest-first'));
     Popup.back();
   },
@@ -553,7 +578,7 @@ Template.cardsSortPopup.events({
     const sortBy = {
       createdAt: -1,
     };
-    Session.set('sortBy', sortBy);
+    setCardsSortBy(sortBy);
     sortCardsBy.set(TAPi18n.__('date-created-oldest-first'));
     Popup.back();
   },

client/components/boards/boardLabelHelpers.js

@@ -0,0 +1,42 @@
+/**
+ * Pure helpers for building the option labels shown in board / list /
+ * swimlane selectors (e.g. the move-card and copy-card popups).
+ *
+ * Regression #6135 ("numbering boards, list, swim caused some issues"):
+ * a previous change prepended a sequential number to every option label
+ * (e.g. "3. My Board"). That broke two things:
+ *
+ *   1. Boards whose name itself starts with a digit became hard to read.
+ *   2. First-letter keyboard navigation in the native <select> dropdown
+ *      stopped working, because every option started with a number instead
+ *      of the board name.
+ *
+ * The fix: numbering is OPTIONAL and OFF by default. By default the label is
+ * exactly the entity name, so its first character is the name's first
+ * character and first-letter navigation works again. When numbering is
+ * explicitly enabled, the number is appended as a trailing visual suffix so
+ * the label still STARTS with the name.
+ */
+
+/**
+ * Build the label for a selectable board/list/swimlane option.
+ *
+ * @param {string} name   The entity (board/list/swimlane) name/title.
+ * @param {number} index  Zero-based position in the list.
+ * @param {Object} [opts]
+ * @param {boolean} [opts.numbered=false] When true, append the 1-based
+ *        number as a trailing suffix. When false (default), return the bare
+ *        name so first-letter keyboard navigation keeps working.
+ * @returns {string} The option label.
+ */
+export function boardOptionLabel(name, index, { numbered = false } = {}) {
+  const label = name == null ? '' : String(name);
+  if (!numbered) {
+    return label;
+  }
+  const position = Number(index);
+  const number = Number.isFinite(position) ? position + 1 : index;
+  return `${label} (${number})`;
+}
+
+export default boardOptionLabel;

client/components/boards/boardsList.css

@@ -297,6 +297,62 @@
   gap: 8px;
 }
 
+/* #5799: board-name search box in the All Boards header */
+.boards-path-header .board-search {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 4px 8px;
+  background: #fff;
+  border: 1px solid #ddd;
+  border-radius: 4px;
+}
+
+.boards-path-header .board-search input {
+  border: none;
+  outline: none;
+  background: transparent;
+  font-size: 14px;
+  min-width: 140px;
+}
+
+.boards-path-header .board-search .board-search-clear {
+  cursor: pointer;
+  color: #999;
+}
+
+.boards-path-header .board-search .board-search-clear:hover {
+  color: #333;
+}
+
+/* #5799: board grid pagination controls, mirroring Admin Panel > People */
+.boards-pagination {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-bottom: 12px;
+}
+
+.boards-pagination button {
+  min-width: 32px;
+  height: 30px;
+  border: 1px solid #bbb;
+  background: #fff;
+  border-radius: 0.4vw;
+  cursor: pointer;
+}
+
+.boards-pagination button.disabled {
+  opacity: 0.5;
+  pointer-events: none;
+}
+
+.boards-page-info {
+  min-width: 72px;
+  text-align: center;
+  color: #333;
+}
+
 .boards-path-header .path-icon {
   font-size: 18px;
 }
@@ -946,21 +1002,13 @@ body.grey-icons-enabled .checkmark-no-grey {
   }
 }
 
-/* Mobile - make all text and icons 2x bigger above #content on All Boards page */
+/* Mobile All Boards layout fixes */
 @media screen and (max-width: 800px),
        screen and (max-device-width: 800px),
        screen and (-webkit-min-device-pixel-ratio: 2) and (max-width: 800px),
        screen and (max-width: 800px) and (orientation: portrait),
        screen and (max-width: 800px) and (orientation: landscape),
        screen and (max-device-width: 932px) and (-webkit-min-device-pixel-ratio: 3) {
-  .wrapper {
-    font-size: 2em !important; /* 2x bigger base font size for All Boards page */
-  }
-
-  .wrapper * {
-    font-size: inherit !important; /* Inherit the 2x scaling */
-  }
-
   /* Stack the two-column All Boards layout on small screens. The fixed
      "260px 1fr" grid had no mobile collapse, so on narrow non-iPhone browsers
      (Fairphone Firefox ESR / Ubuntu Touch Morph, narrow desktop) it overflowed
@@ -976,243 +1024,6 @@ body.grey-icons-enabled .checkmark-no-grey {
     padding-inline-end: 0 !important;
     padding-bottom: 12px;
   }
-
-  .wrapper .fa, .wrapper .icon {
-    font-size: 2em !important; /* 2x bigger icons */
-  }
-
-  .board-list-header {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list-header h1 {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .AllBoardTeamsOrgs {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .AllBoardTeamsOrgs select {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .AllBoardTeamsOrgs input {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .AllBoardTeamsOrgs .fa {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list .board-list-item {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list .board-list-item-name {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list .board-list-item-desc {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list .minicard-members {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list .minicard-lists {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list .fa {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-
-  .board-list .board-handle {
-    font-size: 1em !important; /* Use inherited 2x scaling */
-  }
-}
-
-/* Fallback for iPhone devices using JavaScript detection - All Boards page */
-.iphone-device .wrapper {
-  font-size: 2em !important; /* 2x bigger base font size for All Boards page */
-}
-
-.iphone-device .wrapper * {
-  font-size: inherit !important; /* Inherit the 2x scaling */
-}
-
-.iphone-device .wrapper .fa, .iphone-device .wrapper .icon {
-  font-size: 2em !important; /* 2x bigger icons */
-}
-
-.iphone-device .board-list-header {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list-header h1 {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .AllBoardTeamsOrgs {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .AllBoardTeamsOrgs select {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .AllBoardTeamsOrgs input {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .AllBoardTeamsOrgs .fa {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list .board-list-item {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list .board-list-item-name {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list .board-list-item-desc {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list .minicard-members {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list .minicard-lists {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list .fa {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-.iphone-device .board-list .board-handle {
-  font-size: 1em !important; /* Use inherited 2x scaling */
-}
-
-/* iPhone 12 Mini and very small screens - make everything much larger */
-@media screen and (max-width: 400px) and (max-height: 900px) {
-  .board-list {
-    height: calc(100vh - 120px) !important;
-    overflow-y: scroll !important;
-    overflow-x: hidden !important;
-    -webkit-overflow-scrolling: touch;
-    padding: 0 0.5rem;
-  }
-
-  .board-list li {
-    width: 100% !important;
-    float: none !important;
-    display: block !important;
-    margin-bottom: 1.5rem !important;
-  }
-
-  .board-list .board-list-item {
-    height: 12rem !important; /* Much taller */
-    width: 100% !important;
-    margin: 0 !important;
-    padding: 1rem !important; /* More padding */
-    font-size: 18px !important; /* Much larger text */
-    line-height: 1.4 !important;
-  }
-
-  .board-list .board-list-item .board-list-item-name {
-    font-size: 20px !important; /* Larger board names */
-    font-weight: bold !important;
-    margin-bottom: 0.5rem !important;
-  }
-
-  .board-list .board-list-item .board-list-item-desc {
-    font-size: 16px !important; /* Larger descriptions */
-    line-height: 1.3 !important;
-  }
-
-  .board-list .board-list-item .minicard-members {
-    font-size: 14px !important; /* Larger member avatars */
-  }
-
-  .board-list .board-list-item .minicard-lists {
-    font-size: 14px !important; /* Larger list counters */
-  }
-
-  .board-list .board-handle {
-    position: absolute;
-    padding: 10px !important;
-    top: 50%;
-    transform: translateY(-50%);
-    inset-inline-end: 15px !important;
-    font-size: 28px !important; /* Much larger drag handle */
-    color: #fff;
-    background: rgba(0,0,0,0.4) !important;
-    border-radius: 50%;
-    width: 50px !important; /* Larger handle */
-    height: 50px !important;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    z-index: 10;
-    transition: background-color 0.2s ease;
-  }
-
-  .board-list .board-handle:hover {
-    background: rgba(255, 255, 0, 0.8) !important; /* Yellow hover */
-  }
-
-  /* Force scrollbar to be visible and larger */
-  .board-list::-webkit-scrollbar {
-    width: 16px !important; /* Much wider scrollbar */
-    display: block !important;
-    visibility: visible !important;
-  }
-
-  .board-list::-webkit-scrollbar-track {
-    background: #f1f1f1 !important;
-    border-radius: 8px !important;
-    display: block !important;
-    visibility: visible !important;
-  }
-
-  .board-list::-webkit-scrollbar-thumb {
-    background: #666 !important; /* Darker for better visibility */
-    border-radius: 8px !important;
-    display: block !important;
-    visibility: visible !important;
-    min-height: 50px !important; /* Minimum thumb size */
-  }
-
-  .board-list::-webkit-scrollbar-thumb:hover {
-    background: #333 !important;
-  }
-
-  /* Ensure scrollbar is always visible */
-  .board-list {
-    scrollbar-gutter: stable;
-    scrollbar-width: auto !important;
-    min-height: 100vh !important;
-  }
-
-  .board-list::after {
-    content: '';
-    display: block;
-    height: 200px !important; /* More space to ensure scrolling */
-  }
 }
 .AllBoardTeamsOrgs {
   list-style-type: none;
@@ -1267,6 +1078,13 @@ body.grey-icons-enabled .checkmark-no-grey {
   margin: 8px; /* Space between board items */
 }
 
+/* #6439: highlight the board a dragged board will be dropped before, when
+   reordering in the Custom (drag order) sort mode. */
+.js-board.board-reorder-over {
+  outline: 2px dashed #3498db;
+  outline-offset: 2px;
+}
+
 /* Reset background for add-board button */
 .js-add-board {
   background-color: transparent !important;

client/components/boards/boardsList.jade

@@ -85,6 +85,18 @@ template(name="boardList")
                   i.fa.fa-thumb-tack
                 |  {{_ 'multi-selection-active'}}
           .path-right
+            .board-search
+              span.emoji-icon
+                i.fa.fa-search
+              input.js-board-search-input(type="text" placeholder="{{_ 'search-boards'}}" value="{{boardSearch}}" autocomplete="off")
+              if boardSearch
+                a.board-search-clear.js-board-search-clear(title="{{_ 'filter-clear'}}")
+                  span.emoji-icon
+                    i.fa.fa-times
+            a.board-header-btn.js-open-boards-sort(title="{{_ 'sort-boards'}}" class="{{#unless isBoardsSort 'custom'}}emphasis{{/unless}}")
+              span.emoji-icon
+                i.fa.fa-sort-alpha-asc
+              span {{_ 'sort'}}
             if canModifyBoards
               if hasBoardsSelected
                 button.js-archive-selected-boards.board-header-btn
@@ -104,6 +116,13 @@ template(name="boardList")
                 a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
                   span.emoji-icon
                     i.fa.fa-times
+        if boardsPaginationActive
+          .boards-pagination
+            button.js-boards-prev-page(class="{{#if hasBoardsPrevPage}}{{else}}disabled{{/if}}")
+              | <
+            span.boards-page-info {{boardsCurrentPage}} / {{boardsTotalPages}}
+            button.js-boards-next-page(class="{{#if hasBoardsNextPage}}{{else}}disabled{{/if}}")
+              | >
         ul.board-list.clearfix.js-boards.dragscroll(class="{{#if isMiniScreen}}mobile-view{{/if}} {{#if BoardMultiSelection.isActive}}is-multiselection-active{{/if}}")
           li.js-add-board
             if isSelectedMenu 'templates'
@@ -178,14 +197,19 @@ template(name="boardList")
                         span.board-list-item-name(title="{{boardOpenAndMoveHint}}")
                           +viewer
                             = title
+                        //- #5174 / #4825: the per-board allows* flags are
+                        //- resolved server-side into the one-shot tile data
+                        //- (the raw fields are not even published to this
+                        //- page), so the show* helpers below gate the whole
+                        //- block consistently for every board.
                         unless currentSetting.hideBoardMemberList
-                          if allowsBoardMemberList
+                          if showBoardMemberList _id
                             .minicard-members
                               each member in boardMembers _id
                                 a.name
                                   +userAvatar(userId=member noRemove=true)
                         unless currentSetting.hideCardCounterList
-                          if allowsCardCounterList
+                          if showCardCounterList _id
                             .minicard-lists.flex.flex-wrap
                               each list in boardLists _id
                                 .item
@@ -205,6 +229,24 @@ template(name="boardList")
                       span.emoji-icon
                         i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
 
+template(name="boardsSortPopup")
+  ul.pop-over-list
+    li
+      a.js-boards-sort(data-sort="custom" class="{{#if isBoardsSort 'custom'}}active{{/if}}")
+        span.emoji-icon
+          i.fa.fa-arrows
+        |  {{_ 'sort-boards-custom'}}
+    li
+      a.js-boards-sort(data-sort="title-asc" class="{{#if isBoardsSort 'title-asc'}}active{{/if}}")
+        span.emoji-icon
+          i.fa.fa-sort-alpha-asc
+        |  {{_ 'sort-boards-title-asc'}}
+    li
+      a.js-boards-sort(data-sort="title-desc" class="{{#if isBoardsSort 'title-desc'}}active{{/if}}")
+        span.emoji-icon
+          i.fa.fa-sort-alpha-desc
+        |  {{_ 'sort-boards-title-desc'}}
+
 template(name="boardListHeaderBar")
   h1 {{_ title }}
   //.board-header-btns.right

client/components/boards/boardsList.js

@@ -2,12 +2,14 @@ import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import getSlug from 'limax';
-import '/client/lib/dragscrollTouch';
-import { enablePageDragscroll, disablePageDragscroll } from '/client/lib/pageDragscroll';
 import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
 import { BoardMultiSelection } from '/client/lib/boardMultiSelection';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
+import {
+  isDragReorderEnabled,
+  computeReorderedSortIndex,
+} from '/models/lib/boardSortReorder';
 
 // SubsManager removed for Meteor 3 migration
 
@@ -57,6 +59,19 @@ function shareBoardWith(boardId, shareType, name, id) {
 
 const DEFAULT_WORKSPACE_ICON = '📁';
 
+// #5799: how many board icons to show per page in the sorted (non-custom) modes.
+// Matches the Admin Panel > People page size.
+const BOARDS_PER_PAGE = 25;
+
+// #6439: the effective All Boards sort mode for the current user, defaulting to
+// 'custom' (manual drag order) when unknown. Used to gate board drag-reordering.
+function currentAllBoardsSortBy() {
+  const cu = ReactiveCache.getCurrentUser();
+  return cu && typeof cu.getAllBoardsSortBy === 'function'
+    ? cu.getAllBoardsSortBy()
+    : 'custom';
+}
+
 function getCurrentWorkspacesTree() {
   const currentUser = ReactiveCache.getCurrentUser();
   const tree =
@@ -117,16 +132,6 @@ function saveWorkspace(workspaceId, { name, icon }) {
 }
 
 Template.boardList.helpers({
-  hideCardCounterList() {
-    /* Bug Board icons random dance https://github.com/wekan/wekan/issues/4214
-       return Utils.isMiniScreen() && Session.get('currentBoard'); */
-    return true;
-  },
-  hideBoardMemberList() {
-    /* Bug Board icons random dance https://github.com/wekan/wekan/issues/4214
-       return Utils.isMiniScreen() && Session.get('currentBoard'); */
-    return true;
-  },
   BoardMultiSelection() {
     return BoardMultiSelection;
   },
@@ -164,6 +169,13 @@ Template.boardList.onCreated(function () {
   this.selectedMenu = new ReactiveVar(Session.get('boardListMenu') || 'starred');
   this.selectedWorkspaceIdVar = new ReactiveVar(null);
   this.workspacesTreeVar = new ReactiveVar([]);
+  // #5799: free-text search by board name. When non-empty it searches across
+  // ALL the user's boards (Starred, Templates, Remaining and every workspace),
+  // ignoring the selected-menu filter.
+  this.boardSearchVar = new ReactiveVar('');
+  // #5799: server-side pagination state for the sorted (non-custom) modes.
+  this.boardsPageVar = new ReactiveVar(1);
+  this.pagedBoardsVar = new ReactiveVar({ ids: [], total: 0 });
   // #5850: the user's orgs/teams that have the per-org/team Shared Templates
   // flag set (plus email domains), fetched via a non-admin server method since
   // the org/team publications are admin-only. Gates the drag-to-share targets.
@@ -171,6 +183,15 @@ Template.boardList.onCreated(function () {
   Meteor.call('getMyShareableGroups', (err, res) => {
     if (!err && res) this.shareableGroups.set(res);
   });
+  // #5174 / #4825: per-board tile data (per-list card counts + member ids) for
+  // the All Boards tiles, computed server-side and fetched exactly ONCE here —
+  // deliberately NOT inside an autorun and NOT from reactive getLists/getCards
+  // cursors, so the #4214 "icons random dance" (a reactive re-render loop on
+  // this page, which is why the old helpers were stubbed out) cannot return.
+  this.boardTileDataVar = new ReactiveVar({});
+  Meteor.call('getAllBoardsTileData', (err, res) => {
+    if (!err && res) this.boardTileDataVar.set(res);
+  });
   let currUser = ReactiveCache.getCurrentUser();
   let userLanguage;
   if (currUser && currUser.profile) {
@@ -262,6 +283,50 @@ Template.boardList.onCreated(function () {
     }
   });
 
+  // #5799: reset to the first page whenever the active filter changes (search
+  // text, selected menu/workspace or sort mode). Depends only on those signals,
+  // not on boardsPageVar, so paging next/prev does not reset itself.
+  this.autorun(() => {
+    this.boardSearchVar.get();
+    this.selectedMenu.get();
+    const cu = ReactiveCache.getCurrentUser();
+    if (cu && typeof cu.getAllBoardsSortBy === 'function') {
+      cu.getAllBoardsSortBy();
+    }
+    this.boardsPageVar.set(1);
+  });
+
+  // #5799: fetch the current page of boards from the server for the sorted
+  // (non-custom) modes, so only that page of icons is rendered. Custom (manual
+  // drag order) stays unpaginated client-side so drag-reordering keeps working.
+  // Uses the effective current user server-side, so it also works under
+  // GlobalAdmin impersonation.
+  this.autorun(() => {
+    const cu = ReactiveCache.getCurrentUser();
+    const sortBy =
+      cu && typeof cu.getAllBoardsSortBy === 'function'
+        ? cu.getAllBoardsSortBy()
+        : 'custom';
+    if (sortBy === 'custom') {
+      this.pagedBoardsVar.set({ ids: [], total: 0 });
+      return;
+    }
+    const search = (this.boardSearchVar.get() || '').trim();
+    const menu = this.selectedMenu.get();
+    const page = this.boardsPageVar.get();
+    Meteor.call(
+      'getAllBoardsPage',
+      { search, sortBy, menu, page, perPage: BOARDS_PER_PAGE },
+      (err, res) => {
+        if (err) {
+          console.error('getAllBoardsPage failed:', err);
+          return;
+        }
+        if (res) this.pagedBoardsVar.set(res);
+      },
+    );
+  });
+
   // The templates-container board is no longer auto-created at signup (#2339,
   // #5850), and it is no longer auto-created when the user merely opens the
   // Templates sub-view either: opening the view must not leave behind an empty
@@ -274,12 +339,9 @@ Template.boardList.onCreated(function () {
 });
 
 Template.boardList.onRendered(function () {
-  // Enable drag-to-scroll on the All Boards page the same way the board
-  // canvas/swimlanes do. On desktop the page scroll container is <body>, so we
-  // tag it via enablePageDragscroll(); the .board-list.dragscroll element only
-  // becomes a scroll container in mobile view, where its own class handles it.
-  // Finger drag-scrolling is handled by dragscrollTouch.js.
-  enablePageDragscroll();
+  // Drag-to-scroll on the All Boards page is handled centrally for all
+  // non-board pages by defaultLayout's route-aware autorun
+  // (see client/components/main/layouts.js).
 
   // jQuery sortable is disabled in favor of HTML5 drag-and-drop for space management
   // The old sortable code has been removed to prevent conflicts
@@ -325,13 +387,6 @@ Template.boardList.onRendered(function () {
   */
 });
 
-Template.boardList.onDestroyed(function () {
-  // Stop tagging <body> as drag-scrollable when leaving the All Boards page so
-  // other layouts (e.g. a board view, whose canvas does its own dragscroll) are
-  // not affected.
-  disablePageDragscroll();
-});
-
 Template.boardList.helpers({
   userHasTeams() {
     if (ReactiveCache.getCurrentUser()?.teams?.length > 0) return true;
@@ -486,27 +541,53 @@ Template.boardList.helpers({
 
     const boards = ReactiveCache.getBoards(query, {});
     const currentUser = ReactiveCache.getCurrentUser();
+
+    // #5799: in a sorted (non-custom) mode the server already computed the
+    // current page (filtered by menu/search and sorted), so render exactly that
+    // ordered page of board icons. Custom (manual drag order) falls through to
+    // the unpaginated client-side path below so drag-reordering keeps working.
+    const sortMode =
+      currentUser && typeof currentUser.getAllBoardsSortBy === 'function'
+        ? currentUser.getAllBoardsSortBy()
+        : 'custom';
+    if (sortMode !== 'custom') {
+      const paged = tpl.pagedBoardsVar.get();
+      return (paged.ids || [])
+        .map((id) => ReactiveCache.getBoard(id))
+        .filter(Boolean);
+    }
+
     let list = boards;
-    // Apply left menu filtering
-    const sel = tpl.selectedMenu.get();
     const assignments =
       (currentUser &&
         currentUser.profile &&
         currentUser.profile.boardWorkspaceAssignments) ||
       {};
-    if (sel === 'starred') {
-      // Starred boards are always visible in Starred.
-      list = list.filter((b) => currentUser && currentUser.hasStarred(b._id));
-    } else if (sel === 'templates') {
-      list = list.filter((b) => b.type === 'template-container');
-    } else if (sel === 'remaining') {
-      // Remaining only shows boards not assigned to any workspace.
-      list = list.filter(
-        (b) => !assignments[b._id] && b.type !== 'template-container',
-      );
+
+    // #5799: when a board-name search is active, search across ALL the user's
+    // boards (every menu/workspace) by title and skip the menu filter, so a
+    // board in any category — Starred, Templates, Remaining or a (sub)workspace
+    // — is found from a single search box.
+    const search = (tpl.boardSearchVar.get() || '').trim().toLowerCase();
+    if (search) {
+      list = list.filter((b) => (b.title || '').toLowerCase().includes(search));
     } else {
-      // Workspace view includes all boards in that workspace, including starred.
-      list = list.filter((b) => assignments[b._id] === sel);
+      // Apply left menu filtering
+      const sel = tpl.selectedMenu.get();
+      if (sel === 'starred') {
+        // Starred boards are always visible in Starred.
+        list = list.filter((b) => currentUser && currentUser.hasStarred(b._id));
+      } else if (sel === 'templates') {
+        list = list.filter((b) => b.type === 'template-container');
+      } else if (sel === 'remaining') {
+        // Remaining only shows boards not assigned to any workspace.
+        list = list.filter(
+          (b) => !assignments[b._id] && b.type !== 'template-container',
+        );
+      } else {
+        // Workspace view includes all boards in that workspace, including starred.
+        list = list.filter((b) => assignments[b._id] === sel);
+      }
     }
 
     if (currentUser && typeof currentUser.sortBoardsForUser === 'function') {
@@ -516,25 +597,32 @@ Template.boardList.helpers({
       .slice()
       .sort((a, b) => (a.title || '').localeCompare(b.title || ''));
   },
+  // #5174 / #4825: the board tiles' per-list card-count line and member avatar
+  // row. Data comes from the one-shot getAllBoardsTileData method fetch in
+  // onCreated (see there) — NOT from reactive getLists/getCards cursors, which
+  // caused the #4214 "icons random dance" and got these helpers stubbed to []
+  // (hiding the counters/avatars for everyone). The show* helpers resolve the
+  // per-board opt-in flags (allowsCardCounterList / allowsBoardMemberList,
+  // board sidebar "Show at All Boards page"), strictly, server-side — so a
+  // board with the checkbox off (or never set) consistently shows nothing.
   boardLists(boardId) {
-    /* Bug Board icons random dance https://github.com/wekan/wekan/issues/4214
-    const lists = ReactiveCache.getLists({ 'boardId': boardId, 'archived': false },{sort: ['sort','asc']});
-    const ret = lists.map(list => {
-      let cardCount = ReactiveCache.getCards({ 'boardId': boardId, 'listId': list._id }).length;
-      return `${list.title}: ${cardCount}`;
-    });
-    return ret;
-    */
-    return [];
+    const tile = (Template.instance().boardTileDataVar.get() || {})[boardId];
+    return (tile && tile.showLists && tile.lists) || [];
   },
 
   boardMembers(boardId) {
-    /* Bug Board icons random dance https://github.com/wekan/wekan/issues/4214
-    const lists = ReactiveCache.getBoard(boardId)
-    const boardMembers = lists?.members.map(member => member.userId);
-    return boardMembers;
-    */
-    return [];
+    const tile = (Template.instance().boardTileDataVar.get() || {})[boardId];
+    return (tile && tile.showMembers && tile.memberIds) || [];
+  },
+
+  showCardCounterList(boardId) {
+    const tile = (Template.instance().boardTileDataVar.get() || {})[boardId];
+    return !!(tile && tile.showLists && tile.lists && tile.lists.length);
+  },
+
+  showBoardMemberList(boardId) {
+    const tile = (Template.instance().boardTileDataVar.get() || {})[boardId];
+    return !!(tile && tile.showMembers && tile.memberIds && tile.memberIds.length);
   },
 
   isStarred() {
@@ -650,6 +738,46 @@ Template.boardList.helpers({
     const currentUser = ReactiveCache.getCurrentUser();
     return currentUser && !currentUser.isCommentOnly();
   },
+  // #5799: current board-name search text (for the input value and the clear button).
+  boardSearch() {
+    return Template.instance().boardSearchVar.get();
+  },
+  // #5799: pagination controls (only shown in the sorted, non-custom modes).
+  boardsPaginationActive() {
+    const currentUser = ReactiveCache.getCurrentUser();
+    const sortMode =
+      currentUser && typeof currentUser.getAllBoardsSortBy === 'function'
+        ? currentUser.getAllBoardsSortBy()
+        : 'custom';
+    if (sortMode === 'custom') return false;
+    const total = Template.instance().pagedBoardsVar.get().total || 0;
+    return total > BOARDS_PER_PAGE;
+  },
+  boardsCurrentPage() {
+    return Template.instance().boardsPageVar.get();
+  },
+  boardsTotalPages() {
+    const total = Template.instance().pagedBoardsVar.get().total || 0;
+    return Math.max(1, Math.ceil(total / BOARDS_PER_PAGE));
+  },
+  hasBoardsPrevPage() {
+    return Template.instance().boardsPageVar.get() > 1;
+  },
+  hasBoardsNextPage() {
+    const tpl = Template.instance();
+    const total = tpl.pagedBoardsVar.get().total || 0;
+    const totalPages = Math.max(1, Math.ceil(total / BOARDS_PER_PAGE));
+    return tpl.boardsPageVar.get() < totalPages;
+  },
+  // #5799: current All Boards sort mode ('custom' | 'title-asc' | 'title-desc').
+  isBoardsSort(mode) {
+    const currentUser = ReactiveCache.getCurrentUser();
+    const current =
+      currentUser && typeof currentUser.getAllBoardsSortBy === 'function'
+        ? currentUser.getAllBoardsSortBy()
+        : 'custom';
+    return current === mode;
+  },
   hasBoardsSelected() {
     return BoardMultiSelection.count() > 0;
   },
@@ -745,6 +873,41 @@ Template.boardList.events({
       Popup.open('createBoard')(evt);
     }
   },
+  // #5799: choose how the All Boards page is sorted.
+  'click .js-open-boards-sort': Popup.open('boardsSort'),
+  // #5799: search boards by name across all categories.
+  'input .js-board-search-input'(evt, tpl) {
+    tpl.boardSearchVar.set(evt.currentTarget.value);
+  },
+  'keydown .js-board-search-input'(evt, tpl) {
+    // Esc clears the search.
+    if (evt.keyCode === 27) {
+      tpl.boardSearchVar.set('');
+      evt.currentTarget.value = '';
+    }
+  },
+  'click .js-board-search-clear'(evt, tpl) {
+    evt.preventDefault();
+    tpl.boardSearchVar.set('');
+    const input = tpl.find('.js-board-search-input');
+    if (input) {
+      input.value = '';
+      input.focus();
+    }
+  },
+  // #5799: board grid pagination (sorted modes only).
+  'click .js-boards-prev-page'(evt, tpl) {
+    evt.preventDefault();
+    const page = tpl.boardsPageVar.get();
+    if (page > 1) tpl.boardsPageVar.set(page - 1);
+  },
+  'click .js-boards-next-page'(evt, tpl) {
+    evt.preventDefault();
+    const total = tpl.pagedBoardsVar.get().total || 0;
+    const totalPages = Math.max(1, Math.ceil(total / BOARDS_PER_PAGE));
+    const page = tpl.boardsPageVar.get();
+    if (page < totalPages) tpl.boardsPageVar.set(page + 1);
+  },
   'click .js-star-board'(evt) {
     evt.preventDefault();
     evt.stopPropagation();
@@ -829,6 +992,55 @@ Template.boardList.events({
     document.querySelectorAll('.workspace-node.board-drag-hint, .js-select-menu.board-drag-hint').forEach((el) => {
       el.classList.remove('board-drag-hint');
     });
+    document.querySelectorAll('.js-board.board-reorder-over').forEach((el) => {
+      el.classList.remove('board-reorder-over');
+    });
+  },
+  // #6439: reorder boards on the All Boards page by dropping one board onto
+  // another. Only active in the "custom" (manual drag order) sort mode — in the
+  // sorted modes the order comes from the title, so a board is not a valid drop
+  // target (which is why, before this, the browser showed the not-allowed cursor
+  // and nothing persisted). The reorder decision/index math lives in the pure,
+  // unit-tested models/lib/boardSortReorder.js.
+  'dragover .js-board'(evt, tpl) {
+    if (!isDragReorderEnabled(currentAllBoardsSortBy())) return;
+    // A multi-board drag is a share/assign gesture, not a reorder.
+    const dt = evt.originalEvent.dataTransfer;
+    if (dt && dt.getData('application/x-board-multi') === 'true') return;
+    evt.preventDefault();
+    evt.stopPropagation();
+    if (dt) dt.dropEffect = 'move';
+    evt.currentTarget.classList.add('board-reorder-over');
+  },
+  'dragleave .js-board'(evt) {
+    evt.currentTarget.classList.remove('board-reorder-over');
+  },
+  'drop .js-board'(evt, tpl) {
+    if (!isDragReorderEnabled(currentAllBoardsSortBy())) return;
+    const dt = evt.originalEvent.dataTransfer;
+    if (dt && dt.getData('application/x-board-multi') === 'true') return;
+    const draggedId = dt ? dt.getData('text/plain') : '';
+    if (!draggedId) return;
+    evt.preventDefault();
+    evt.stopPropagation();
+    evt.currentTarget.classList.remove('board-reorder-over');
+    const targetId = this._id;
+    // #6442: current display order of the board grid. Read each board's _id from
+    // its Blaze data context (the same source dragstart uses via `this._id`) —
+    // NOT el.classList[0]. On `li.js-board(class="{{_id}} …")` Jade emits the
+    // literal `js-board` class FIRST, so classList[0] is the string "js-board"
+    // for every board; the old code therefore produced ['js-board','js-board',…],
+    // computeReorderedSortIndex could not find the dragged/target ids among them,
+    // returned null, and the drop silently did nothing (board snapped back).
+    const orderedIds = Array.from(tpl.findAll('.js-board'))
+      .map((el) => Blaze.getData(el)?._id)
+      .filter(Boolean);
+    const mapping = computeReorderedSortIndex(orderedIds, draggedId, targetId);
+    if (!mapping) return;
+    const currentUser = ReactiveCache.getCurrentUser();
+    if (currentUser && typeof currentUser.setBoardSortIndexes === 'function') {
+      currentUser.setBoardSortIndexes(mapping);
+    }
   },
   'click .js-clone-board'(evt) {
     if (confirm(TAPi18n.__('duplicate-board-confirm'))) {
@@ -1157,6 +1369,30 @@ Template.boardList.events({
   },
 });
 
+// #5799: All Boards sort popup — pick custom (manual drag order) or
+// alphabetical A→Z / Z→A. The choice is stored per user.
+Template.boardsSortPopup.helpers({
+  isBoardsSort(mode) {
+    const currentUser = ReactiveCache.getCurrentUser();
+    const current =
+      currentUser && typeof currentUser.getAllBoardsSortBy === 'function'
+        ? currentUser.getAllBoardsSortBy()
+        : 'custom';
+    return current === mode;
+  },
+});
+
+Template.boardsSortPopup.events({
+  'click .js-boards-sort'(evt) {
+    evt.preventDefault();
+    const mode = evt.currentTarget.getAttribute('data-sort');
+    if (mode) {
+      Meteor.call('setAllBoardsSortBy', mode);
+    }
+    Popup.back();
+  },
+});
+
 Template.workspaceActionsPopup.helpers({
   workspaceName() {
     return this.name || '';

client/components/boards/tableView.jade

@@ -66,7 +66,7 @@ template(name="tableView")
                 td.table-view-cell-labels
                   .div
                     each label in row.labels
-                      span.card-label(class="card-label-{{label.color}}" title="{{label.name}}")
+                      span.card-label(class="{{labelColorClass label.color}}" style="{{labelColorStyle label.color}}" title="{{label.name}}")
                         +viewer
                           = label.name
                 if showReceivedColumn

client/components/cards/attachments.js

@@ -49,7 +49,14 @@ Template.attachmentGallery.events({
       if (card && card.coverId === this._id) {
         await card.unsetCover();
       }
-      await Attachments.removeAsync(this._id);
+      // #5282 (same class as #3252 for comments/checklists): only remove if the
+      // doc is still in the local cache. Under publication churn the attachment
+      // can already be evicted from Minimongo, and removing a missing _id
+      // throws "Removed nonexistent document" even though the delete itself
+      // succeeded on the server.
+      if (this._id && ReactiveCache.getAttachment(this._id)) {
+        await Attachments.removeAsync(this._id);
+      }
       Popup.back();
   }),
 });
@@ -290,7 +297,7 @@ Template.attachmentGallery.helpers({
     return filesCursor.each();
   },
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
   fileSize(size) {
     const ret = filesize(size);
@@ -432,11 +439,16 @@ export async function handleFileUpload(card, files) {
       fileName: fileName,
       meta: Utils.getCommonAttachmentMetaFrom(card),
       chunkSize: 'dynamic',
-      // Use HTTP transport instead of DDP so file chunks go over a dedicated
-      // fetch POST rather than flooding the WebSocket/DDP channel.  DDP
-      // upload causes repeated DDP reconnects in Safari, showing the
-      // "Loading, please wait" offline banner and stalling progress at ~95%.
-      transport: 'http',
+      // Use HTTP transport (a dedicated fetch POST per chunk) rather than DDP,
+      // which floods the WebSocket channel and causes repeated reconnects in
+      // Safari (the "Loading, please wait" offline banner, stalling at ~95%).
+      // EXCEPT on Sandstorm: the grain's sandstorm-http-bridge strips Meteor-Files'
+      // custom upload headers — x-start/x-mtok/x-chunkid/x-fileid/x-eof are not on
+      // Sandstorm's request-header whitelist — so the server never sees x-start,
+      // treats every request as a chunk continuation, and fails with "Can't
+      // continue upload, session expired" [408]. DDP uploads go over method calls
+      // (no custom HTTP headers), so they work through the bridge.
+      transport: Meteor.settings?.public?.sandstorm ? 'ddp' : 'http',
     };
     config.meta.fileId = fileId;
 
@@ -528,7 +540,9 @@ Template.previewClipboardImagePopup.events({
         meta: Utils.getCommonAttachmentMetaFrom(card),
         fileName: file.name || file.type.replace('image/', 'clipboard.'),
         chunkSize: 'dynamic',
-        transport: 'http',
+        // DDP on Sandstorm (its bridge strips Meteor-Files' x-* upload headers),
+        // HTTP elsewhere — see the note in the other upload handler above.
+        transport: Meteor.settings?.public?.sandstorm ? 'ddp' : 'http',
       };
       config.meta.fileId = fileId;
       const uploader = await Attachments.insertAsync(

client/components/cards/cardCustomFields.jade

@@ -44,13 +44,13 @@ template(name="cardCustomField-number")
                 a.js-close-inlined-form
         else
             a.js-open-inlined-form
-                if value
-                    = value
+                if formattedValue
+                    = formattedValue
                 else
                     | {{_ 'edit'}}
     else
-        if value
-            = value
+        if formattedValue
+            = formattedValue
 
 template(name="cardCustomField-checkbox")
   .js-checklist-item.checklist-item(class="{{#if data.value }}is-checked{{/if}}")

client/components/cards/cardCustomFields.js

@@ -29,6 +29,7 @@ import {
 } from '/imports/lib/dateUtils';
 import { CustomFieldStringTemplate } from '/client/lib/customFields'
 import { getCurrentCardFromContext } from '/client/lib/currentCard';
+import { formatNumberValue } from '/imports/lib/customNumberFormat';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { getSidebarInstance } from '/client/features/sidebar/service';
 
@@ -91,10 +92,21 @@ Template['cardCustomField-number'].onCreated(function () {
   this.customFieldId = Template.currentData()._id;
 });
 
+Template['cardCustomField-number'].helpers({
+  // Render blank / cleared / non-numeric values as empty instead of "NaN" (#2091).
+  formattedValue() {
+    return formatNumberValue(this.value);
+  },
+});
+
 Template['cardCustomField-number'].events({
   'submit .js-card-customfield-number'(event, tpl) {
     event.preventDefault();
-    const value = parseInt(tpl.find('input').value, 10);
+    const rawValue = tpl.find('input').value;
+    // A cleared/blank input parses to NaN; store '' instead so it renders empty
+    // rather than as "NaN" (#2091).
+    const parsed = parseInt(rawValue, 10);
+    const value = Number.isNaN(parsed) ? '' : parsed;
     tpl.card.setCustomField(tpl.customFieldId, value);
   },
 });

client/components/cards/cardDate.css

@@ -8,23 +8,27 @@
 .card-date.is-active {
   background-color: #b3b3b3;
 }
-/* Date status colors - red = overdue, amber = due soon, no shade = not due */
+/* Date status colors - red = overdue, amber = due soon, no shade = not due.
+ * These status rules use !important so they override the date-type base
+ * colours below (e.g. .card-date.due-date yellow). Without this, an overdue
+ * due-date badge in the card detail showed yellow/amber instead of red, while
+ * the minicard (which already used !important) showed red - issue #5965. */
 .card-date.overdue {
-  background-color: #ff4444; /* Red for overdue */
-  color: #fff;
+  background-color: #ff4444 !important; /* Red for overdue */
+  color: #fff !important;
 }
 .card-date.overdue:hover,
 .card-date.overdue.is-active {
-  background-color: #cc3333;
+  background-color: #cc3333 !important;
 }
 
 .card-date.due-soon {
-  background-color: #ffaa00; /* Amber for due soon */
-  color: #000;
+  background-color: #ffaa00 !important; /* Amber for due soon */
+  color: #000 !important;
 }
 .card-date.due-soon:hover,
 .card-date.due-soon.is-active {
-  background-color: #e69900;
+  background-color: #e69900 !important;
 }
 
 .card-date.not-due {
@@ -32,48 +36,48 @@
 }
 
 .card-date.current {
-  background-color: #5ba639; /* Green for current/active */
-  color: #fff;
+  background-color: #5ba639 !important; /* Green for current/active */
+  color: #fff !important;
 }
 .card-date.current:hover,
 .card-date.current.is-active {
-  background-color: #46802c;
+  background-color: #46802c !important;
 }
 
 .card-date.completed {
-  background-color: #90ee90; /* Light green for completed */
-  color: #000;
+  background-color: #90ee90 !important; /* Light green for completed */
+  color: #000 !important;
 }
 .card-date.completed:hover,
 .card-date.completed.is-active {
-  background-color: #7dd87d;
+  background-color: #7dd87d !important;
 }
 
 .card-date.completed-early {
-  background-color: #4caf50; /* Green for completed early */
-  color: #fff;
+  background-color: #4caf50 !important; /* Green for completed early */
+  color: #fff !important;
 }
 .card-date.completed-early:hover,
 .card-date.completed-early.is-active {
-  background-color: #45a049;
+  background-color: #45a049 !important;
 }
 
 .card-date.completed-late {
-  background-color: #ff9800; /* Orange for completed late */
-  color: #fff;
+  background-color: #ff9800 !important; /* Orange for completed late */
+  color: #fff !important;
 }
 .card-date.completed-late:hover,
 .card-date.completed-late.is-active {
-  background-color: #f57c00;
+  background-color: #f57c00 !important;
 }
 
 .card-date.completed-on-time {
-  background-color: #2196f3; /* Blue for completed on time */
-  color: #fff;
+  background-color: #2196f3 !important; /* Blue for completed on time */
+  color: #fff !important;
 }
 .card-date.completed-on-time:hover,
 .card-date.completed-on-time.is-active {
-  background-color: #1976d2;
+  background-color: #1976d2 !important;
 }
 
 /* Date type specific colors */

client/components/cards/cardDate.js

@@ -25,9 +25,9 @@ import {
   now,
   createDate,
   fromNow,
-  calendar,
-  diff
+  calendar
 } from '/imports/lib/dateUtils';
+import { dueDateClass } from '/client/lib/dueDateColor';
 
 // --- DatePicker popups (edit date forms) ---
 
@@ -257,29 +257,12 @@ Template.cardDueDate.onCreated(function () {
 Template.cardDueDate.helpers(cardDateHelpers({
   classes() {
     const tpl = Template.instance();
-    let classes = 'due-date ';
     const data = Template.currentData();
     const endAt = data.getEnd();
     const theDate = tpl.date.get();
     const nowVal = tpl.now.get();
 
-    if (endAt && isBefore(endAt, theDate)) {
-      classes += 'completed-early';
-    } else if (endAt) {
-      classes += 'completed';
-    } else {
-      const daysDiff = diff(theDate, nowVal, 'days');
-
-      if (daysDiff < 0) {
-        classes += 'overdue';
-      } else if (daysDiff <= 1) {
-        classes += 'due-soon';
-      } else {
-        classes += 'not-due';
-      }
-    }
-
-    return classes;
+    return `due-date ${dueDateClass(theDate, nowVal, endAt)}`;
   },
   showTitle() {
     const tpl = Template.instance();
@@ -471,29 +454,12 @@ Template.minicardDueDate.onCreated(function () {
 Template.minicardDueDate.helpers(cardDateHelpers({
   classes() {
     const tpl = Template.instance();
-    let classes = 'due-date ';
     const data = Template.currentData();
     const endAt = data.getEnd();
     const theDate = tpl.date.get();
     const nowVal = tpl.now.get();
 
-    if (endAt && isBefore(endAt, theDate)) {
-      classes += 'completed-early';
-    } else if (endAt) {
-      classes += 'completed';
-    } else {
-      const daysDiff = diff(theDate, nowVal, 'days');
-
-      if (daysDiff < 0) {
-        classes += 'overdue';
-      } else if (daysDiff <= 1) {
-        classes += 'due-soon';
-      } else {
-        classes += 'not-due';
-      }
-    }
-
-    return classes;
+    return `due-date ${dueDateClass(theDate, nowVal, endAt)}`;
   },
   showTitle() {
     const tpl = Template.instance();

client/components/cards/cardDescription.js

@@ -1,3 +1,5 @@
+import { UnsavedEdits } from '/client/lib/unsavedEdits';
+
 const descriptionFormIsOpen = new ReactiveVar(false);
 
 Template.descriptionForm.onDestroyed(function () {
@@ -16,6 +18,10 @@ Template.descriptionForm.events({
     event.preventDefault();
     const description = tpl.currentComponent ? tpl.currentComponent().getValue() : tpl.$('textarea').val();
     await this.setDescription(description);
+    // #6455: a successful save means there is no unsaved draft anymore; clear
+    // any pre-existing draft record so the "You have an unsaved description"
+    // warning does not stick around after saving.
+    UnsavedEdits.reset({ fieldName: 'cardDescription', docId: this._id });
   },
   // Pressing Ctrl+Enter should submit the form
   'keydown form textarea'(evt, tpl) {

client/components/cards/cardDetails.css

@@ -129,50 +129,82 @@
   box-sizing: border-box;
 }
 
-/* Desktop mode: position card below board header */
+/* Desktop mode: position card below board header.
+   #6465: the floating window used to span nearly the whole board (insets
+   20px/20px from BOTH edges, top-left anchored) — right on top of the card it
+   belongs to, with big rounded borders. Dock it to the END edge (right in LTR)
+   like the classic 6.09 side panel instead: the board and the card stay
+   visible, and the drag handle still moves it anywhere. */
 body.desktop-mode .card-details:not(.card-details-popup) {
   position: fixed;
   width: auto;
   max-width: 800px;
   flex-basis: auto;
-  border-radius: 8px;
+  border-radius: 3px;
   z-index: 2001;
 }
 
 /* Default position for first card or when dragged */
 body.desktop-mode .card-details:not(.card-details-popup):not([style*="left"]):not([style*="top"]) {
   top: 8px;
-  inset-inline-start: 20px;
-  inset-inline-end: 20px;
-  bottom: 20px;
+  inset-inline-start: auto;
+  inset-inline-end: 8px;
+  width: min(650px, 90vw);
+  bottom: 8px;
 }
 
-/* Stagger positions for multiple cards using nth-of-type */
+/* Stagger positions for multiple cards using nth-of-type (from the end edge) */
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(1) {
   top: 8px;
-  inset-inline-start: 20px;
+  inset-inline-end: 8px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(2) {
   top: 38px;
-  inset-inline-start: 50px;
+  inset-inline-end: 38px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(3) {
   top: 68px;
-  inset-inline-start: 80px;
+  inset-inline-end: 68px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(4) {
   top: 98px;
-  inset-inline-start: 110px;
+  inset-inline-end: 98px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(5) {
   top: 128px;
-  inset-inline-start: 140px;
+  inset-inline-end: 128px;
 }
 
 /* For expanded cards, set dimensions */
 body.desktop-mode .card-details:not(.card-details-popup):not(.card-details-collapsed) {
-  inset-inline-end: 20px;
-  bottom: 20px;
+  bottom: 8px;
+}
+
+/* #4822: the MAXIMIZED card must be anchored to the VIEWPORT (position: fixed
+   with viewport insets), never laid out inside — or measured from — the
+   scrolled swimlane/board container. Historically the maximized pane was an
+   in-flow flex/float item of its swimlane, so after scrolling down in the
+   swimlanes view it rendered at the swimlane's position in the tall scrolled
+   canvas (off-screen) instead of over the viewport.
+   All four insets are !important for two reasons:
+   1. The floating-window rules above (top: 8px / inset-inline-end: 8px /
+      width: min(650px, 90vw), specificity up to 0,5,1) otherwise override the
+      lower-specificity .card-details-maximized geometry entirely, leaving the
+      Maximize button a no-op.
+   2. The drag handle writes inline left/top styles onto the card; a card that
+      was dragged and then maximized must not keep the stale dragged offsets
+      (an off-viewport inline top is exactly the "wrong place" of #4822).
+      Only !important declarations beat inline styles. */
+body.desktop-mode .card-details.card-details-maximized:not(.card-details-popup):not(.card-details-collapsed) {
+  position: fixed !important;
+  top: 8px !important;
+  inset-inline-start: 8px !important;
+  inset-inline-end: 8px !important;
+  bottom: 8px !important;
+  width: auto !important;
+  height: auto !important;
+  max-width: none !important;
+  resize: none;
 }
 
 /* Collapsed card state - hide content and set height to title row only */
@@ -192,7 +224,9 @@ body.desktop-mode .card-details.card-details-collapsed {
 }
 .card-details .card-details-canvas {
   width: auto;
-  padding: 0 2.5vw;
+  /* #6465: fixed 20px as in 6.09 — 2.5vw was ~48px of white border per side
+     on a FullHD screen. */
+  padding: 0 20px;
 }
 .card-details .card-details-header {
   margin: 0 -20px 5px;
@@ -300,25 +334,14 @@ body.desktop-mode .card-details.card-details-collapsed {
   float: inline-end;
 }
 
-/* Unify all card text to match title size */
+/* #6465: the "unify all card text to match title size" block (v8.18) forced
+   EVERY element in card details to the base font size with line-height 1.5,
+   flattening the 6.09 hierarchy where labels/metadata were smaller than body
+   text — a big part of the "card window is WAAAY too big" complaint. Removed:
+   components keep their own sizes again. */
 .card-details {
   font-size: 1em;
 }
-.card-details p,
-.card-details span,
-.card-details div,
-.card-details a,
-.card-details label,
-.card-details input,
-.card-details textarea,
-.card-details select,
-.card-details button,
-.card-details .card-details-item-title,
-.card-details .card-label,
-.card-details .viewer {
-  font-size: inherit;
-  line-height: 1.5;
-}
 .card-details .card-details-header .card-details-watch {
   font-size: 17px;
   padding-inline-start: 7px;
@@ -446,6 +469,12 @@ body.desktop-mode .card-details.card-details-collapsed {
     flex-shrink: 0;
     flex-basis: calc(100% - 20px);
     will-change: flex-basis;
+    /* #4822: declare the position strategy explicitly. The maximized pane must
+       be fixed to the viewport in its own right — never an in-flow flex/float
+       item of the scrolled swimlane container, and never dependent on the
+       sibling .card-details rule (or the body.desktop-mode rules) happening to
+       supply position: fixed. */
+    position: fixed;
     overflow-y: auto;
     overflow-x: auto;
     background: #f7f7f7;
@@ -504,16 +533,21 @@ input[type="submit"].attachment-add-link-submit {
     inset-inline-start: 0 !important;
     inset-inline-end: 0 !important;
     bottom: 0 !important;
-    z-index: 100 !important;
+    /* #6419: the open card is a full-screen takeover on mobile, so it must sit
+       ABOVE the app header bar (#header-main-bar is z-index 1000) — otherwise the
+       header overlaps the top of the card and hides the close (X) button, making
+       it impossible to close the card. Kept below popups (z-index 2000+) so card
+       menus / date pickers still open over the card. */
+    z-index: 1100 !important;
     height: 100vh !important;
     max-height: 100vh !important;
     border-radius: 0 !important;
     box-shadow: none !important;
   }
 
-  /* Ensure card details are above everything on mobile */
+  /* Ensure card details are above the app header on mobile (#6419) */
   body.mobile-mode .card-details {
-    z-index: 100 !important;
+    z-index: 1100 !important;
     width: 100vw !important;
     inset-inline-start: 0 !important;
     inset-inline-end: 0 !important;
@@ -601,7 +635,8 @@ body.mobile-mode .card-details {
   inset-inline-start: 0 !important;
   inset-inline-end: 0 !important;
   bottom: 0 !important;
-  z-index: 100 !important;
+  /* #6419: above the app header (#header-main-bar z-index 1000), below popups. */
+  z-index: 1100 !important;
   height: 100vh !important;
   max-height: 100vh !important;
   border-radius: 0 !important;
@@ -1081,3 +1116,14 @@ body.mobile-mode .card-details .card-details-header .close-card-details-mobile-w
   line-height: 1;
   box-sizing: border-box;
 }
+
+/* #6431 follow-up: cover image on the opened card (Card Settings > Cover image
+   on card, opt-in). Mirrors the minicard cover but taller. */
+.card-details-cover {
+  background-position: center;
+  background-repeat: no-repeat;
+  background-size: contain;
+  height: 200px;
+  user-select: none;
+  margin: 8px 0;
+}

client/components/cards/cardDetails.jade

@@ -6,7 +6,7 @@ template(name="cardDetails")
   +attachmentViewer
 
   section.card-details.js-card-details.nodragscroll(class='{{#if cardMaximized}}card-details-maximized{{/if}}' class='{{#if isPopup}}card-details-popup{{/if}}' class='{{#unless isVerticalScrollbars}}no-scrollbars{{/unless}}' class='{{#if cardCollapsed}}card-details-collapsed{{/if}}'): .card-details-canvas
-    .card-details-header(class='{{#if colorClass}}card-details-{{colorClass}}{{/if}}')
+    .card-details-header(class='{{#if colorClass}}card-details-{{colorClass}}{{/if}}' style='{{colorStyle}}')
       +inlinedForm(classNames="js-card-details-title")
         +editCardTitleForm
       else
@@ -112,6 +112,11 @@ template(name="cardDetails")
                 i.fa.fa-check
                 span {{_ 'upload-completed'}}
 
+    //- #6431 follow-up: cover image on the opened card (opt-in, OFF by default).
+    if currentBoard.allowsCoverAttachmentOnCard
+      if cover
+        .card-details-cover(style="background-image: url('{{cover.link 'original'}}');")
+
     .card-details-left
 
       .card-details-items
@@ -122,7 +127,7 @@ template(name="cardDetails")
               | {{_ 'labels'}}
             a(class="{{#if canModifyCard}}js-add-labels{{else}}is-disabled{{/if}}" title="{{_ 'card-labels-title'}}")
               each labels
-                span.card-label(class="card-label-{{color}}" title=name)
+                span.card-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title=name)
                   +viewer
                     = name
             if canModifyCard
@@ -224,6 +229,9 @@ template(name="cardDetails")
                 unless currentUser.isWorker
                   a.card-label.add-label.js-due-date
                     i.fa.fa-plus
+            if dueDateChangeCount
+              .card-details-due-date-changes(title="{{_ 'due-date-changes'}}")
+                | {{_ 'due-date-changed-times' dueDateChangeCount}}
 
         if currentBoard.allowsEndDate
           .card-details-item.card-details-item-end
@@ -681,6 +689,14 @@ template(name="cardDetails")
         .card-checklist-attachmentGallery.card-checklists
           if currentBoard.allowsChecklists
             hr
+            //- Total checklist item count (finished/total) shown above all
+              checklists. The board flag is a cheap boolean, so when it is off
+              the checklist counting below is never evaluated.
+            if currentBoard.allowsChecklistCountBadgeOnCard
+              if checklists.length
+                h3.card-details-item-title
+                  i.fa.fa-check-square-o
+                  |  {{checklistFinishedCount}}/{{checklistItemCount}}
             +checklists(cardId = _id card = this)
           if currentBoard.allowsSubtasks
             hr
@@ -690,6 +706,8 @@ template(name="cardDetails")
           h3.card-details-item-title
             i.fa.fa-paperclip
             | {{_ 'attachments'}}
+            if currentBoard.allowsAttachmentCountOnCard
+              |  ({{attachments.length}})
           if Meteor.settings.public.attachmentsUploadMaxSize
             | {{_ 'max-upload-filesize'}} {{Meteor.settings.public.attachmentsUploadMaxSize}}
             br
@@ -723,12 +741,12 @@ template(name="cardDetails")
             i.fa.fa-history
             | {{ _ 'activities'}}
           if currentUser.isBoardMember
-            .material-toggle-switch(title="{{_ 'show-activities'}}")
-              if showActivities
-                input.toggle-switch(type="checkbox" id="toggleShowActivitiesCard" checked="checked")
-              else
-                input.toggle-switch(type="checkbox" id="toggleShowActivitiesCard")
-              label.toggle-label(for="toggleShowActivitiesCard")
+            if showActivities
+              a.activities-eye-toggle.js-toggle-show-activities-card(title="{{_ 'hide-activities'}}" aria-label="{{_ 'hide-activities'}}")
+                i.fa.fa-eye.eye-icon
+            else
+              a.activities-eye-toggle.js-toggle-show-activities-card(title="{{_ 'show-activities'}}" aria-label="{{_ 'show-activities'}}")
+                i.fa.fa-eye-slash.eye-slash-icon
 
       if currentUser.isBoardAdmin
         if isLoaded.get
@@ -945,22 +963,22 @@ template(name="moveCardPopup")
     label {{_ 'boards'}}:
     select.js-select-boards(autofocus)
       each boards
-        option(value="{{_id}}" selected="{{#if isSelectedBoardId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+        option(value="{{_id}}" selected="{{#if isSelectedBoardId _id}}selected{{/if}}") {{title}}
 
   label {{_ 'swimlanes'}}:
   select.js-select-swimlanes
     each swimlanes
-      option(value="{{_id}}" selected="{{#if isSelectedSwimlaneId _id}}selected{{/if}}") {{add @index 1}}. {{isTitleDefault title}}
+      option(value="{{_id}}" selected="{{#if isSelectedSwimlaneId _id}}selected{{/if}}") {{isTitleDefault title}}
 
   label {{_ 'lists'}}:
   select.js-select-lists
     each lists
-      option(value="{{_id}}" selected="{{#if isSelectedListId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+      option(value="{{_id}}" selected="{{#if isSelectedListId _id}}selected{{/if}}") {{title}}
 
   label {{_ 'cards'}}:
   select.js-select-cards
     each cards
-      option(value="{{_id}}" selected="{{#if isDialogOptionCardId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+      option(value="{{_id}}" selected="{{#if isDialogOptionCardId _id}}selected{{/if}}") {{title}}
 
   div
     input(type="radio" name="position" value="above" checked id="position-above" style="display: inline")
@@ -980,22 +998,22 @@ template(name="copyCardPopup")
     label {{_ 'boards'}}:
     select.js-select-boards(autofocus)
       each boards
-        option(value="{{_id}}" selected="{{#if isSelectedBoardId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+        option(value="{{_id}}" selected="{{#if isSelectedBoardId _id}}selected{{/if}}") {{title}}
 
   label {{_ 'swimlanes'}}:
   select.js-select-swimlanes
     each swimlanes
-      option(value="{{_id}}" selected="{{#if isSelectedSwimlaneId _id}}selected{{/if}}") {{add @index 1}}. {{isTitleDefault title}}
+      option(value="{{_id}}" selected="{{#if isSelectedSwimlaneId _id}}selected{{/if}}") {{isTitleDefault title}}
 
   label {{_ 'lists'}}:
   select.js-select-lists
     each lists
-      option(value="{{_id}}" selected="{{#if isSelectedListId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+      option(value="{{_id}}" selected="{{#if isSelectedListId _id}}selected{{/if}}") {{title}}
 
   label {{_ 'cards'}}:
   select.js-select-cards
     each cards
-      option(value="{{_id}}" selected="{{#if isDialogOptionCardId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+      option(value="{{_id}}" selected="{{#if isDialogOptionCardId _id}}selected{{/if}}") {{title}}
 
   div
     input(type="radio" name="position" value="above" checked id="position-above" style="display: inline")
@@ -1015,22 +1033,22 @@ template(name="copyManyCardsPopup")
     label {{_ 'boards'}}:
     select.js-select-boards(autofocus)
       each boards
-        option(value="{{_id}}" selected="{{#if isSelectedBoardId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+        option(value="{{_id}}" selected="{{#if isSelectedBoardId _id}}selected{{/if}}") {{title}}
 
   label {{_ 'swimlanes'}}:
   select.js-select-swimlanes
     each swimlanes
-      option(value="{{_id}}" selected="{{#if isSelectedSwimlaneId _id}}selected{{/if}}") {{add @index 1}}. {{isTitleDefault title}}
+      option(value="{{_id}}" selected="{{#if isSelectedSwimlaneId _id}}selected{{/if}}") {{isTitleDefault title}}
 
   label {{_ 'lists'}}:
   select.js-select-lists
     each lists
-      option(value="{{_id}}" selected="{{#if isSelectedListId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+      option(value="{{_id}}" selected="{{#if isSelectedListId _id}}selected{{/if}}") {{title}}
 
   label {{_ 'cards'}}:
   select.js-select-cards
     each cards
-      option(value="{{_id}}" selected="{{#if isDialogOptionCardId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+      option(value="{{_id}}" selected="{{#if isDialogOptionCardId _id}}selected{{/if}}") {{title}}
 
   div
     input(type="radio" name="position" value="above" checked id="position-above" style="display: inline")
@@ -1050,22 +1068,22 @@ template(name="convertChecklistItemToCardPopup")
     label {{_ 'boards'}}:
     select.js-select-boards(autofocus)
       each boards
-        option(value="{{_id}}" selected="{{#if isSelectedBoardId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+        option(value="{{_id}}" selected="{{#if isSelectedBoardId _id}}selected{{/if}}") {{title}}
 
   label {{_ 'swimlanes'}}:
   select.js-select-swimlanes
     each swimlanes
-      option(value="{{_id}}" selected="{{#if isSelectedSwimlaneId _id}}selected{{/if}}") {{add @index 1}}. {{isTitleDefault title}}
+      option(value="{{_id}}" selected="{{#if isSelectedSwimlaneId _id}}selected{{/if}}") {{isTitleDefault title}}
 
   label {{_ 'lists'}}:
   select.js-select-lists
     each lists
-      option(value="{{_id}}" selected="{{#if isSelectedListId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+      option(value="{{_id}}" selected="{{#if isSelectedListId _id}}selected{{/if}}") {{title}}
 
   label {{_ 'cards'}}:
   select.js-select-cards
     each cards
-      option(value="{{_id}}" selected="{{#if isDialogOptionCardId _id}}selected{{/if}}") {{add @index 1}}. {{title}}
+      option(value="{{_id}}" selected="{{#if isDialogOptionCardId _id}}selected{{/if}}") {{title}}
 
   div
     input(type="radio" name="position" value="above" checked id="position-above" style="display: inline")
@@ -1181,6 +1199,10 @@ template(name="setCardColorPopup")
           span.card-label.palette-color.js-palette-color(class="card-details-{{color}}")
             if(isSelected color)
               i.fa.fa-check
+    // #5514: native color wheel for picking a custom RGB / hex color
+    .color-wheel-wrap
+      label(for="cardColorWheel") {{_ 'custom-color'}}
+      input.js-card-color-wheel#cardColorWheel(type="color" value=currentColorHex title="{{_ 'custom-color'}}")
   button.primary.confirm.js-submit {{_ 'save'}}
   button.js-remove-color.negate.wide.right {{_ 'unset-color'}}
 

client/components/cards/cardDetails.js

@@ -8,6 +8,8 @@ import {
   DEFAULT_DEPENDENCY_COLOR,
   DEFAULT_DEPENDENCY_ICON,
 } from '/models/metadata/dependencies';
+import { canArchiveCard } from '/client/lib/archivePermission';
+import { isTextSelectionInsideCard } from '/client/lib/cardCloseGuard';
 
 // Which dependency the icon picker should apply its choice to. The icon popup's
 // own data context is the dependency row (not the source card), so we capture
@@ -48,7 +50,10 @@ import Users from '/models/users';
 import Lists from '/models/lists';
 import CardComments from '/models/cardComments';
 import { ALLOWED_COLORS } from '/config/const';
+import { isHexColor, toHex } from '/models/lib/contrastColor';
 import { uniqBy } from '/imports/lib/collectionHelpers';
+import { memberTargetBoardId } from '/models/lib/linkedCardMembers';
+import { isSubmitKey } from '/models/lib/editorSubmitKey';
 import { UserAvatar } from '../users/userAvatar';
 import { Filter } from '/client/lib/filter';
 import { BoardSwimlaneListCardDialog } from '/client/lib/dialogWithBoardSwimlaneListCard';
@@ -516,6 +521,14 @@ Template.cardDetails.helpers({
     return card.findWatcher(Meteor.userId());
   },
 
+  // #6081: number of times this card's due date has been changed, for
+  // accountability. Returns 0 when unavailable so the template can hide it.
+  dueDateChangeCount() {
+    const card = Template.currentData();
+    if (!card || typeof card.getDueDateChangeCount !== 'function') return 0;
+    return card.getDueDateChangeCount();
+  },
+
   // Returns the card's locations (multiple supported), each enriched with the
   // coordinate flag and OpenStreetMap link used by the template.
   getLocations() {
@@ -617,18 +630,24 @@ Template.cardDetails.helpers({
 
   showVotingButtons() {
     const card = Template.currentData();
+    // #6420: currentUser was referenced but never defined here, so the helper
+    // threw "ReferenceError: currentUser is not defined" on every card render and
+    // the voting buttons disappeared. Define it and guard the board-member call.
+    const currentUser = ReactiveCache.getCurrentUser();
     return (
-      (currentUser.isBoardMember() ||
-        (currentUser && card.voteAllowNonBoardMembers())) &&
+      currentUser &&
+      (currentUser.isBoardMember() || card.voteAllowNonBoardMembers()) &&
       !card.expiredVote()
     );
   },
 
   showPlanningPokerButtons() {
     const card = Template.currentData();
+    // #6420: same as showVotingButtons — currentUser was undefined here.
+    const currentUser = ReactiveCache.getCurrentUser();
     return (
-      (currentUser.isBoardMember() ||
-        (currentUser && card.pokerAllowNonBoardMembers())) &&
+      currentUser &&
+      (currentUser.isBoardMember() || card.pokerAllowNonBoardMembers()) &&
       !card.expiredPoker()
     );
   },
@@ -843,17 +862,31 @@ Template.cardDetails.events({
     event.preventDefault();
     const description = tpl.find('.js-new-description-input').value;
     const card = Template.currentData();
-    await card.setDescription(description);
+    // #5809: surface a visible error instead of failing silently — e.g. editing
+    // a linked card whose target is on a board the user cannot write to gets a
+    // permission denial that otherwise vanished with no feedback.
+    try {
+      await card.setDescription(description);
+      // #6455: a successful save means there is no unsaved draft anymore.
+      // Clear the record explicitly instead of relying on the inlined form's
+      // close-time draft/description comparison, which can run before the
+      // updated description is visible and leave a stale "You have an unsaved
+      // description" warning behind.
+      UnsavedEdits.reset({ fieldName: 'cardDescription', docId: card._id });
+    } catch (error) {
+      alert(error?.reason || error?.message || 'Failed to save description');
+    }
   },
   async 'submit .js-card-details-title'(event, tpl) {
     event.preventDefault();
     const titleInput = tpl.find('.js-edit-card-title');
     const title = titleInput ? titleInput.value.trim() : '';
     const card = Template.currentData();
-    if (title) {
-      await card.setTitle(title);
-    } else {
-      await card.setTitle('');
+    // #5809: surface a visible error instead of failing silently (see above).
+    try {
+      await card.setTitle(title || '');
+    } catch (error) {
+      alert(error?.reason || error?.message || 'Failed to save title');
     }
   },
   'submit .js-card-details-assigner'(event, tpl) {
@@ -1021,7 +1054,7 @@ Template.cardDetails.events({
     const card = Template.currentData();
     await card.toggleHideCheckedChecklistItems();
   },
-  async 'change #toggleShowActivitiesCard'() {
+  async 'click .js-toggle-show-activities-card'() {
     const card = Template.currentData();
     await card.toggleShowActivities();
   },
@@ -1340,10 +1373,24 @@ Template.inlinedCardDescription.onCreated(function () {
 
   this._close = (isReset = false) => {
     if (this.isOpen.get() && !isReset) {
-      const draft = (this._getValue() || '').trim();
+      // #6455: normalize BOTH sides the same way before comparing. The textarea
+      // value has per-line trailing whitespace stripped (_getValue), while
+      // getDescription() returns the raw stored text — or null for an empty
+      // description. Comparing them raw made the comparison permanently unequal
+      // for descriptions containing Markdown "  \n" hard breaks (or after
+      // emptying the description), re-creating the phantom draft on every save.
+      const normalize = (s) => (s || '').replaceAll(/[ \f\r\t\v]+$/gm, '').trim();
+      const draft = normalize(this._getValue());
       const card = getCurrentCardFromContext();
-      if (card && draft !== card.getDescription()) {
+      if (card && draft !== normalize(card.getDescription())) {
         UnsavedEdits.set(this._getUnsavedEditKey(), this._getValue());
+      } else {
+        // #6455: closing with the draft equal to the saved description must
+        // REMOVE any pre-existing unsaved-edits record. Previously this branch
+        // did nothing, so once a draft record existed, pressing Save ("View it"
+        // -> Save) could never clear the "You have an unsaved description"
+        // warning — only Discard could.
+        UnsavedEdits.reset(this._getUnsavedEditKey());
       }
     }
     this.isOpen.set(false);
@@ -1392,7 +1439,7 @@ Template.cardDetailsActionsPopup.helpers({
   },
 
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
 
   showListOnMinicard() {
@@ -1435,10 +1482,20 @@ Template.cardDetailsActionsPopup.events({
     Popup.back();
   },
   'click .js-archive': Popup.afterConfirm('cardArchive', async function () {
+    if (!canArchiveCard({ canModifyCard: Utils.canModifyCard() })) return;
     const card = Cards.findOne(getCardId());
     Popup.close();
     if (!card) return;
     await card.archive();
+    // #6465 follow-up: archiving must also CLOSE the card's details window.
+    // The card id stayed in the openCards session list, so the floating window
+    // kept rendering above the board — and, docked to the right edge, exactly
+    // over the archives sidebar someone restoring the card would open next,
+    // intercepting its Restore/Delete clicks.
+    Session.set('openCards', (Session.get('openCards') || []).filter((id) => id !== card._id));
+    if (Session.get('currentCard') === card._id) {
+      Session.set('currentCard', null);
+    }
     Utils.goBoardId(card.boardId);
   }),
   'click .js-more': Popup.open('cardMore'),
@@ -1472,18 +1529,24 @@ Template.editCardTitleForm.events({
     Utils.showCopied(promise, $tooltip);
   },
   'keydown .js-edit-card-title'(event) {
-    // If enter key was pressed, submit the data
-    // Unless the shift key is also being pressed
-    if (event.keyCode === 13 && !event.shiftKey) {
+    // #4236: match the card description field — Ctrl/Cmd+Enter saves; plain
+    // Enter (and Shift+Enter) insert a new line instead of submitting. The old
+    // handler submitted on any Enter without Shift, so Enter could not add a
+    // newline in the title.
+    if (isSubmitKey(event)) {
       $('.js-submit-edit-card-title-form').click();
     }
   },
 });
 
 Template.cardMembersPopup.onCreated(function () {
-  let currBoard = Utils.getCurrentBoard();
-  let members = currBoard.activeMembers();
-  this.members = new ReactiveVar(members);
+  // #4965: only the filter term is stored reactively; the candidate list is
+  // derived reactively in the members() helper (via filterMembers, which reads
+  // board.activeMembers() on each call). Previously the list was snapshotted
+  // once here, so a member added to the board after the popup opened — or whose
+  // user document finished loading after open — was missing until the popup was
+  // reopened.
+  this.filterTerm = new ReactiveVar('');
 });
 
 Template.cardMembersPopup.events({
@@ -1495,8 +1558,7 @@ Template.cardMembersPopup.events({
     event.preventDefault();
   },
   'keyup .card-members-filter'(event) {
-    const members = filterMembers(event.target.value);
-    Template.instance().members.set(members);
+    Template.instance().filterTerm.set(event.target.value);
   }
 });
 
@@ -1510,7 +1572,7 @@ Template.cardMembersPopup.helpers({
   },
 
   members() {
-    const members = Template.instance().members.get();
+    const members = filterMembers(Template.instance().filterTerm.get());
     const uniqueMembers = uniqBy(members, 'userId');
     return [...uniqueMembers].sort((a, b) => {
       const userA = ReactiveCache.getUser(a.userId);
@@ -1629,7 +1691,25 @@ Template.cardLocationsPopup.events({
 });
 
 const filterMembers = (filterTerm) => {
-  let currBoard = Utils.getCurrentBoard();
+  // #5676: for a linked card the members live on the REAL card it points at,
+  // which may be on another board (that is what getMembers()/toggleMember() act
+  // on). Offer that board's members instead of the viewing board's, so the
+  // picker is consistent with where membership is actually stored. Falls back to
+  // the current board for normal cards or when the real card isn't loaded yet.
+  const card = getCurrentCardFromContext();
+  let currBoard = null;
+  if (card) {
+    const boardId = memberTargetBoardId(card, id => ReactiveCache.getCard(id));
+    if (boardId) {
+      currBoard = ReactiveCache.getBoard(boardId);
+    }
+  }
+  if (!currBoard) {
+    currBoard = Utils.getCurrentBoard();
+  }
+  if (!currBoard) {
+    return [];
+  }
   let members = currBoard.activeMembers();
 
   if (filterTerm) {
@@ -1985,6 +2065,10 @@ Template.setCardColorPopup.helpers({
     }
     return tpl.currentColor.get() === color;
   },
+  // #5514: current color as a '#rrggbb' hex for the native color wheel <input>.
+  currentColorHex() {
+    return toHex(Template.instance().currentColor.get()) || '#0079bf';
+  },
 });
 
 Template.setCardColorPopup.events({
@@ -1992,6 +2076,13 @@ Template.setCardColorPopup.events({
     const paletteData = Blaze.getData(event.currentTarget);
     tpl.currentColor.set(paletteData?.color);
   },
+  // #5514: picking from the native color wheel stores a custom hex.
+  'input .js-card-color-wheel'(event, tpl) {
+    const value = event.currentTarget.value;
+    if (isHexColor(value)) {
+      tpl.currentColor.set(value);
+    }
+  },
   async 'click .js-submit'(event, tpl) {
     event.preventDefault();
     const card = Cards.findOne(getCardId());
@@ -2065,6 +2156,11 @@ Template.cardMorePopup.onCreated(function () {
   const cardId = getCardId();
   this.currentCard = Cards.findOne(cardId);
   this.parentBoard = new ReactiveVar(null);
+  // #3745: tracks whether the selected parent board's cards have finished
+  // loading. The card list stays empty until the subscription is ready, so it
+  // is no longer blank the first time another board is picked (the cards()
+  // helper queries minimongo, which was empty before the subscription arrived).
+  this.parentBoardReady = new ReactiveVar(true);
   this.parentCard = this.currentCard?.parentCard();
   if (this.parentCard) {
     const list = $('.js-field-parent-card');
@@ -2103,7 +2199,10 @@ Template.cardMorePopup.helpers({
   cards() {
     const tpl = Template.instance();
     const currentId = getCardId();
-    if (tpl.parentBoard.get()) {
+    // #3745: don't list cards until the selected board's subscription is ready,
+    // otherwise the first open shows an empty list. Depending on parentBoardReady
+    // also re-runs this helper once the data has arrived.
+    if (tpl.parentBoard.get() && tpl.parentBoardReady.get()) {
       const ret = ReactiveCache.getCards({
         boardId: tpl.parentBoard.get(),
         _id: { $ne: currentId },
@@ -2147,6 +2246,12 @@ Template.cardMorePopup.events({
     // verify that there are no linked cards
     if (ReactiveCache.getCards({ linkedId: card._id }).length === 0) {
       Cards.remove(card._id);
+      // #6465 follow-up: like archiving, deleting must close the card's
+      // details window (drop it from the openCards session list).
+      Session.set('openCards', (Session.get('openCards') || []).filter((id) => id !== card._id));
+      if (Session.get('currentCard') === card._id) {
+        Session.set('currentCard', null);
+      }
     } else {
       // TODO: Maybe later we can list where the linked cards are.
       // Now here is popup with a hint that the card cannot be deleted
@@ -2168,7 +2273,14 @@ Template.cardMorePopup.events({
     if (selection === 'none') {
       tpl.parentBoard.set(null);
     } else {
-      Meteor.subscribe('board', $(event.currentTarget).val(), false);
+      // #3745: wait for the board subscription to be ready before showing its
+      // cards, so the parent-card list is populated on the first selection.
+      tpl.parentBoardReady.set(false);
+      Meteor.subscribe('board', selection, false, {
+        onReady() {
+          tpl.parentBoardReady.set(true);
+        },
+      });
       tpl.parentBoard.set(selection);
       list.prop('disabled', false);
     }
@@ -2392,7 +2504,17 @@ EscapeActions.register(
         }
       }
     }
-    if (Session.get('cardDetailsIsDragging')) {
+    // #5686: selecting the text of a checklist item (whose mousedown stops
+    // propagation, so cardDetailsIsDragging is never set) and releasing the
+    // mouse outside the card must NOT close the card. Treat a live text
+    // selection anchored inside the card pane the same as an in-card drag.
+    const selectingInsideCard = isTextSelectionInsideCard(
+      typeof window !== 'undefined' && window.getSelection
+        ? window.getSelection()
+        : null,
+      getCardDetailsElement(getCurrentCardFromContext()?._id),
+    );
+    if (Session.get('cardDetailsIsDragging') || selectingInsideCard) {
       // Reset dragging status as the mouse landed outside the cardDetails template area and this will prevent a mousedown event from firing
       Session.set('cardDetailsIsDragging', false);
       Session.set('cardDetailsIsMouseDown', false);

client/components/cards/checklists.jade

@@ -138,7 +138,7 @@ template(name="checklistItems")
           i.fa.fa-plus
 
 template(name='checklistItemDetail')
-  .js-checklist-item.checklist-item(class="{{#if item.isFinished }}is-checked{{#if checklist.hideCheckedChecklistItems}} invisible{{/if}}{{/if}}{{#if checklist.hideAllChecklistItems}} is-checked invisible{{/if}}"
+  .js-checklist-item.checklist-item(class="{{#if item.isFinished }}is-checked{{#if checklist.isItemHidden item.isFinished}} invisible{{/if}}{{/if}}{{#if checklist.hideAllChecklistItems}} is-checked invisible{{/if}}"
     role="checkbox" aria-checked="{{#if item.isFinished }}true{{else}}false{{/if}}" tabindex="0")
     if canModifyCard
       .check-box-container
@@ -170,7 +170,7 @@ template(name="checklistActionsPopup")
         i.fa.fa-eye-slash
         | {{_ "hideCheckedChecklistItems"}} ...
         .material-toggle-switch(title="{{_ 'hide-checked-items'}}")
-          if checklist.hideCheckedChecklistItems
+          if checklist.hideCheckedState
             input.toggle-switch(type="checkbox" id="toggleHideCheckedChecklistItems_{{checklist._id}}" checked="checked")
           else
             input.toggle-switch(type="checkbox" id="toggleHideCheckedChecklistItems_{{checklist._id}}")

client/components/cards/checklists.js

@@ -214,7 +214,9 @@ Template.checklists.events({
   'click .js-delete-checklist-item': Popup.afterConfirm('checklistItemDelete', function () {
     Popup.back();
     const item = this?.item || this;
-    if (item && item._id) {
+    // #3252: guard against removing a doc already evicted from Minimongo (heavy
+    // archive/delete churn), which throws "Removed nonexistent document".
+    if (item && item._id && ChecklistItems.findOne(item._id)) {
       ChecklistItems.remove(item._id);
     }
   }),
@@ -258,7 +260,8 @@ Template.checklistActionsPopup.events({
   'click .js-delete-checklist': Popup.afterConfirm('checklistDelete', function () {
     Popup.back(2);
     const checklist = this.checklist;
-    if (checklist && checklist._id) {
+    // #3252: see js-delete-checklist-item — avoid "Removed nonexistent document".
+    if (checklist && checklist._id && Checklists.findOne(checklist._id)) {
       Checklists.remove(checklist._id);
     }
   }),

client/components/cards/labels.css

@@ -1,3 +1,24 @@
+/* #5514: native color-wheel (custom RGB / hex) picker wrapper, shared by the
+   label / list / swimlane / card color popups. */
+.color-wheel-wrap {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin: 6px 0 10px 0;
+}
+.color-wheel-wrap label {
+  margin: 0;
+}
+.color-wheel-wrap input[type="color"] {
+  width: 44px;
+  height: 28px;
+  padding: 0;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  cursor: pointer;
+  background: none;
+}
+
 .card-label {
   border: 1px solid #000;
   border-radius: 4px;

client/components/cards/labels.jade

@@ -4,9 +4,12 @@ template(name="formLabel")
 
   label {{_ "select-color"}}
   .palette-colors: each labels
-    span.card-label.palette-color.js-palette-color(class="card-label-{{color}}")
+    span.card-label.palette-color.js-palette-color(class="{{labelColorClass color}}" style="{{labelColorStyle color}}")
       if(isSelected color)
         i.fa.fa-check
+  .color-wheel-wrap
+    label(for="labelColorWheel") {{_ 'custom-color'}}
+    input.js-label-color-wheel#labelColorWheel(type="color" value=currentColorHex title="{{_ 'custom-color'}}")
 
 template(name="createLabelPopup")
   form.create-label
@@ -31,8 +34,8 @@ template(name="cardLabelsPopup")
         a.card-label-edit-button.fa.fa-pencil.js-edit-label
         if isTouchScreenOrShowDesktopDragHandles
           span.fa.label-handle(class="fa-arrows" title="{{_ 'dragLabel'}}")
-        span.card-label.card-label-selectable.js-select-label.card-label-wrapper(class="card-label-{{color}}"
-          class="{{# if isLabelSelected ../_id }}active{{/if}}")
+        span.card-label.card-label-selectable.js-select-label.card-label-wrapper(class="{{labelColorClass color}}"
+          class="{{# if isLabelSelected ../_id }}active{{/if}}" style="{{labelColorStyle color}}")
             +viewer
               = name
             if(isLabelSelected ../_id)

client/components/cards/labels.js

@@ -1,5 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { LABEL_COLORS } from '/models/metadata/colors';
+import { isHexColor, toHex } from '/models/lib/contrastColor';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
 
@@ -28,6 +29,11 @@ Template.formLabel.helpers({
   isSelected(color) {
     return Template.instance().currentColor.get() === color;
   },
+  // #5514: current color as a '#rrggbb' hex for the color-wheel <input>, which
+  // only accepts hex. Named colors map to their palette hex; fall back to green.
+  currentColorHex() {
+    return toHex(Template.instance().currentColor.get()) || '#3cb500';
+  },
 });
 
 Template.formLabel.events({
@@ -36,6 +42,13 @@ Template.formLabel.events({
     const selectedColor = paletteData?.color || Template.currentData()?.color || getFallbackLabelColor();
     tpl.currentColor.set(selectedColor);
   },
+  // #5514: picking a color from the native color wheel stores a custom hex.
+  'input .js-label-color-wheel'(event, tpl) {
+    const value = event.currentTarget.value;
+    if (isHexColor(value)) {
+      tpl.currentColor.set(value);
+    }
+  },
 });
 
 Template.createLabelPopup.helpers({
@@ -131,7 +144,16 @@ Template.createLabelPopup.events({
       ? selectedColorIcon.closest('.js-palette-color')
       : null;
     const selectedColorData = selectedPaletteNode && Blaze.getData(selectedPaletteNode);
-    const color = selectedColorData?.color || getFallbackLabelColor();
+    // #5514: a named swatch (has the check icon) wins; otherwise fall back to
+    // the custom color-wheel hex, then to the default palette color.
+    let color = selectedColorData?.color;
+    if (!color) {
+      const wheel = templateInstance.find('.js-label-color-wheel');
+      if (wheel && isHexColor(wheel.value)) {
+        color = wheel.value;
+      }
+    }
+    color = color || getFallbackLabelColor();
     board.addLabel(name, color);
     Popup.back();
   },
@@ -158,7 +180,16 @@ Template.editLabelPopup.events({
       ? selectedColorIcon.closest('.js-palette-color')
       : null;
     const selectedColorData = selectedPaletteNode && Blaze.getData(selectedPaletteNode);
-    const color = selectedColorData?.color || getFallbackLabelColor();
+    // #5514: a named swatch (has the check icon) wins; otherwise fall back to
+    // the custom color-wheel hex, then to the default palette color.
+    let color = selectedColorData?.color;
+    if (!color) {
+      const wheel = templateInstance.find('.js-label-color-wheel');
+      if (wheel && isHexColor(wheel.value)) {
+        color = wheel.value;
+      }
+    }
+    color = color || getFallbackLabelColor();
     board.editLabel(this._id, name, color);
     Popup.back();
   },

client/components/cards/minicard.css

@@ -119,6 +119,22 @@
   margin-inline-end: 0.4vw;
   margin-bottom: 4px;
 }
+/* Keep text labels on a single compact line. The label name is rendered
+   inside a `.viewer`, whose global `min-height: 2.5vh` otherwise forces every
+   label to roughly double height on the minicard. */
+.minicard .minicard-labels .card-label {
+  min-height: 0;
+  padding: 1px 6px;
+  line-height: 1.3;
+  white-space: nowrap;
+}
+.minicard .minicard-labels .card-label .viewer {
+  min-height: 0;
+  display: inline;
+}
+.minicard .minicard-labels .card-label .viewer p {
+  display: inline;
+}
 .minicard .minicard-labels-no-text {
   display: flex;
   flex-wrap: wrap;
@@ -167,6 +183,13 @@
 }
 .minicard .minicard-title {
   margin-inline-end: 1.5vw;
+  /* #6444: isolate each title's bidirectional context. The title is a
+     dir="auto" .viewer; under a global dir="rtl" document, non-isolated
+     dir="auto" runs share bidi state, so typing a strong RTL (e.g. Arabic)
+     character into another list's dir="auto" composer re-resolved the shared
+     context and visibly reflowed OTHER lists' minicard titles (no data change,
+     reverts on refresh). Isolation makes each title a self-contained run. */
+  unicode-bidi: isolate;
 }
 .minicard .minicard-title .card-number {
   color: #b3b3b3;
@@ -432,6 +455,10 @@
   min-height: 50px;
   margin-bottom: 20px;
   overflow-y: auto;
+  /* #6444: isolate the composer's dir="auto" bidi run so typing a strong RTL
+     character here cannot perturb the rendering of the surrounding minicard
+     titles under a dir="rtl" document. */
+  unicode-bidi: isolate;
 }
 .parent-prefix {
   color: #b3b3b3;

client/components/cards/minicard.jade

@@ -3,7 +3,8 @@ template(name="minicard")
     class="{{#if isLinkedCard}}linked-card{{/if}}"
     class="{{#if isLinkedBoard}}linked-board{{/if}}"
     class="{{agingClass}}"
-    class="{{#if colorClass}}minicard-{{colorClass}}{{/if}}")
+    class="{{#if colorClass}}minicard-{{colorClass}}{{/if}}"
+    style="{{colorStyle}}")
     if canMoveCard
       if isTouchScreenOrShowDesktopDragHandles
         .handle
@@ -93,11 +94,11 @@ template(name="minicard")
         .minicard-labels(class="{{#if hiddenMinicardLabelText}}minicard-labels-no-text{{/if}}")
           each labels
             unless hiddenMinicardLabelText
-              span.js-card-label.card-label(class="card-label-{{color}}" title=name)
+              span.js-card-label.card-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title=name)
                 +viewer
                   = name
             if hiddenMinicardLabelText
-              .minicard-label(class="card-label-{{color}}" title="{{name}}")
+              .minicard-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title="{{name}}")
 
     .minicard-custom-fields
       each customFieldsWD
@@ -215,6 +216,15 @@ template(name="minicard")
               i.fa.fa-globe
             span.badge-text.check-list-text {{subtasksFinishedCount}}/{{allSubtasksCount}}
             //{{subtasksFinishedCount}}/{{subtasksCount}} does not work because when a subtaks is archived, the count goes down
+      //- #6431: compact checklist item-count badge (finished/total). The outer
+        guard is a cheap boolean, so when the setting is off the checklist
+        counting below never runs.
+      if showChecklistCountBadge
+        if checklists.length
+          .badge(class="{{#if checklistFinished}}is-finished{{/if}}" title="{{_ 'checklists'}}")
+            span.badge-icon
+              i.fa.fa-check-square-o
+            span.badge-text.check-list-text {{checklistFinishedCount}}/{{checklistItemCount}}
       if currentBoard.allowsCardSortingByNumber
         if currentBoard.allowsCardSortingByNumberOnMinicard
           .badge

client/components/cards/minicard.js

@@ -6,6 +6,11 @@ import uploadProgressManager from '../../lib/uploadProgressManager';
 import { Utils } from '/client/lib/utils';
 import ChecklistItems from '/models/checklistItems';
 import Cards from '/models/cards';
+import { resolveCoverId } from '/models/lib/linkedCardCover';
+import {
+  parseChecklistItemTitles,
+  buildChecklistItemPayload,
+} from '/models/lib/checklistItemTitles';
 import { normalizeDependencies } from '/models/metadata/dependencies';
 
 function getMinicardFlag(board, onMinicardField, legacyField, defaultValue) {
@@ -144,6 +149,14 @@ Template.minicard.helpers({
     const board = this.board();
     return getMinicardFlag(board, 'allowsSubtasksOnMinicard', 'allowsSubtasks', true);
   },
+  // #6431: compact checklist item-count badge (finished/total) on the minicard.
+  // Opt-in, OFF by default. Only a cheap boolean read here; the actual checklist
+  // counting (checklistFinishedCount/checklistItemCount) is gated behind this in
+  // the template, so a board with the badge off spends no resources counting.
+  showChecklistCountBadge() {
+    const board = this.board();
+    return !!(board && board.allowsChecklistCountBadgeOnMinicard);
+  },
 
   hiddenMinicardLabelText() {
     const currentUser = ReactiveCache.getCurrentUser();
@@ -156,8 +169,12 @@ Template.minicard.helpers({
     }
   },
   cover() {
-    if (!this.coverId) return null;
-    const attachment = ReactiveCache.getAttachment(this.coverId);
+    // #5666: for a linked card the cover lives on the real card it points at, so
+    // resolve the cover id through it (mirroring getTitle/getDue/...); a plain
+    // card resolves to its own coverId.
+    const coverId = resolveCoverId(this, id => ReactiveCache.getCard(id));
+    if (!coverId) return null;
+    const attachment = ReactiveCache.getAttachment(coverId);
     if (!attachment) return null;
     const coverLink = typeof attachment.link === 'function' ? attachment.link() : '';
     if (!coverLink) return null;
@@ -209,7 +226,11 @@ Template.minicard.helpers({
       // Show checklist if either:
       // 1. Board-wide setting is enabled, OR
       // 2. This specific checklist has the setting enabled
-      if (currentBoard.allowsChecklistAtMinicard || checklist.showChecklistAtMinicard) {
+      // #5565: use the same board field the sidebar toggle writes
+      // (`allowsChecklistsOnMinicard`); this previously checked a different,
+      // UI-less field (`allowsChecklistAtMinicard`), so the board toggle to show
+      // checklists on minicards had no effect.
+      if (currentBoard.allowsChecklistsOnMinicard || checklist.showChecklistAtMinicard) {
         visibleChecklists.push(checklist);
       }
     });
@@ -364,6 +385,28 @@ Template.minicardChecklist.helpers({
   },
 });
 
+// #6440: create the checklist item(s) for the minicard add-item form. Shared by
+// the Save-button click handler and the (rarely reached) form-submit handler.
+// The Save button needs an explicit click handler because the minicard — and so
+// the add-item <form> — is rendered inside the `a.minicard-wrapper` anchor, where
+// the native form `submit` event never reaches the Blaze event map; without this
+// the "+" add-item on the minicard did nothing. The blank-input guard and the
+// title parsing live in the pure, unit-tested models/lib/checklistItemTitles.js.
+function addMinicardChecklistItems(textarea, checklist) {
+  if (!textarea || !checklist) return;
+  const titles = parseChecklistItemTitles(textarea.value);
+  if (titles.length === 0) return;
+  const items = checklist.items();
+  const lastItem = items[items.length - 1] || null;
+  let sortIndex = Utils.calculateIndexData(lastItem, null).base;
+  titles.forEach(title => {
+    ChecklistItems.insert(buildChecklistItemPayload(title, checklist, sortIndex));
+    sortIndex += 1;
+  });
+  textarea.value = '';
+  textarea.focus();
+}
+
 Template.minicardChecklist.events({
   'click .js-convert-checklist-item-to-card'(event) {
     event.stopPropagation();
@@ -405,25 +448,26 @@ Template.minicardChecklist.events({
     }
     $form.find('.js-close-inlined-form').trigger('click');
   },
+  // #6440: explicit click handler for the minicard "+" add-item Save button.
+  // The native form `submit` event does not fire on the minicard (the form is
+  // inside the `a.minicard-wrapper` anchor), so — unlike card-detail — we cannot
+  // rely on `submit .js-add-checklist-item`. This mirrors the already-working
+  // `click .js-submit-edit-checklist-item-form` above.
+  'click .js-submit-add-checklist-item-form'(event) {
+    event.preventDefault();
+    event.stopPropagation();
+    const $form = $(event.currentTarget).closest('form');
+    const textarea = $form.find('textarea.js-add-checklist-item')[0];
+    const formData = Blaze.getData($form[0]) || Template.currentData() || {};
+    addMinicardChecklistItems(textarea, formData.checklist);
+  },
+  // Kept for completeness (e.g. card-detail-style contexts); on the minicard this
+  // rarely fires, so the click handler above is the real path. See #6440.
   'submit .js-add-checklist-item'(event, tpl) {
     event.preventDefault();
     const textarea = tpl.find('textarea.js-add-checklist-item');
-    if (!textarea) return;
-    const title = textarea.value.trim();
     const data = Template.currentData() || {};
-    const checklist = data.checklist;
-    if (!checklist || !title) return;
-    const items = checklist.items();
-    const lastItem = items[items.length - 1] || null;
-    const sortIndex = Utils.calculateIndexData(lastItem, null).base;
-    ChecklistItems.insert({
-      title,
-      checklistId: checklist._id,
-      cardId: checklist.cardId,
-      sort: sortIndex,
-    });
-    textarea.value = '';
-    textarea.focus();
+    addMinicardChecklistItems(textarea, data.checklist);
   },
   'click .js-delete-checklist-item': Popup.afterConfirm('checklistItemDelete', function () {
     Popup.back();

client/components/cards/subtaskStatusHelpers.js

@@ -0,0 +1,38 @@
+/**
+ * Pure helpers for displaying the status (current list / board) of a subtask.
+ *
+ * Issue #6091 "Visible status of sub-tasks": when viewing a card's subtasks,
+ * show each subtask's current list name (and board, when the subtask lives on a
+ * different board than the parent card).
+ *
+ * Kept dependency-free so it can be unit tested in isolation (mocha + chai).
+ */
+
+/**
+ * Build the human readable status label for a subtask.
+ *
+ * @param {Object} args
+ * @param {string} [args.listTitle] - Title of the list the subtask resides in.
+ * @param {string} [args.boardTitle] - Title of the board the subtask resides in.
+ * @param {boolean} [args.sameBoard=true] - Whether the subtask is on the same
+ *   board as the parent card. When false, the board title is prefixed.
+ * @returns {string} The display string:
+ *   - `listTitle` when the subtask is on the same board,
+ *   - `boardTitle / listTitle` when it is on a different board,
+ *   - a graceful fallback (whichever part is available) when one is missing,
+ *   - empty string when nothing is known.
+ */
+export function subtaskStatusLabel({ listTitle, boardTitle, sameBoard = true } = {}) {
+  const list = (listTitle || '').trim();
+  const board = (boardTitle || '').trim();
+
+  if (sameBoard) {
+    return list;
+  }
+
+  // Different board: prefix with the board title when available.
+  if (board && list) {
+    return `${board} / ${list}`;
+  }
+  return board || list;
+}

client/components/cards/subtaskViewHelpers.js

@@ -0,0 +1,85 @@
+// Pure helpers for subtask navigation guards.
+//
+// #4762: "Subtask board is not accessible until reload".
+// When a subtask lives on another board, that board may not yet be loaded in
+// the ReactiveCache when the popup handler runs. Dereferencing the missing
+// board (e.g. board._id) throws and the navigation silently fails until a
+// reload populates the cache. Use this guard before navigating, mirroring the
+// existing `if (board)` check in the js-go-to-subtask-board handler.
+export function canNavigateToSubtaskBoard(board) {
+  return Boolean(board && board._id);
+}
+
+// #3743: "Subtask 'View it' button opens the parent card instead of the
+// subtask". The navigation target must be derived from the SUBTASK card
+// itself (its own board, slug and id) and never from the parent/current
+// card. Centralise that here so the handler cannot accidentally reference
+// the parent card again, and so the behaviour is unit-testable.
+//
+// Returns the FlowRouter 'card' route params taken from the subtask, or
+// undefined for a malformed subtask (no usable card id / board id).
+//
+// #1853: "Subtask board id missing: cannot read property _id of undefined".
+// The subtask often lives on ANOTHER board (the deposit/target board) whose
+// document is not in minimongo while the parent card's board is open. In that
+// case subtask.board() yields nothing; instead of crashing (the original
+// TypeError) or silently doing nothing (the post-#4762 behaviour), fall back
+// to the subtask's own boardId and the default 'board' slug — the 'card'
+// route action only uses :boardId/:cardId (config/router.js) and its
+// subscriptions load the board, so navigation succeeds without a reload.
+// 'board' is the model's own default slug (models/boards.js).
+export function subtaskNavTarget(subtask) {
+  if (!subtask) {
+    return undefined;
+  }
+  // Prefer the real card id (resolves linked subtask cards to their source);
+  // fall back to the plain _id when getRealId is unavailable (e.g. in tests).
+  const cardId =
+    (typeof subtask.getRealId === 'function' ? subtask.getRealId() : undefined) ||
+    subtask._id;
+  if (!cardId) {
+    // Malformed subtask document: nothing sane to navigate to.
+    return undefined;
+  }
+  const board = typeof subtask.board === 'function' ? subtask.board() : undefined;
+  if (canNavigateToSubtaskBoard(board)) {
+    return {
+      boardId: board._id,
+      slug: board.slug,
+      cardId,
+      swimlaneId: subtask.swimlaneId,
+      listId: subtask.listId,
+    };
+  }
+  if (subtask.boardId) {
+    // Board doc missing locally (#1853 / #4762): navigate by id and let the
+    // route load the board. The slug segment is cosmetic for the card route.
+    return {
+      boardId: subtask.boardId,
+      slug: 'board',
+      cardId,
+      swimlaneId: subtask.swimlaneId,
+      listId: subtask.listId,
+    };
+  }
+  // No board reference at all: broken subtask, don't navigate (and don't
+  // throw — the caller shows a warning instead).
+  return undefined;
+}
+
+// Same idea for the "Go to board" popup entry (js-go-to-subtask-board):
+// prefer the loaded board's id/slug, fall back to the subtask's boardId so a
+// not-yet-subscribed deposit board is still reachable (#1853).
+export function subtaskBoardNavTarget(subtask) {
+  if (!subtask) {
+    return undefined;
+  }
+  const board = typeof subtask.board === 'function' ? subtask.board() : undefined;
+  if (canNavigateToSubtaskBoard(board)) {
+    return { id: board._id, slug: board.slug };
+  }
+  if (subtask.boardId) {
+    return { id: subtask.boardId, slug: 'board' };
+  }
+  return undefined;
+}

client/components/cards/subtasks.css

@@ -192,3 +192,19 @@ body.grey-icons-enabled .subtasks-item .check-box-unicode {
   padding: 6px 10px 6px 10px;
   order: 2;
 }
+/* #6091: read-only status (current list / board) of a subtask */
+.subtask-title .subtask-status {
+  order: 1;
+  flex-shrink: 0;
+  margin: 0 0.5em;
+  padding-top: 6px;
+  color: #8c8c8c;
+  font-size: 0.85em;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  max-width: 40%;
+}
+.subtask-title .subtask-status i.fa {
+  margin-inline-end: 4px;
+}

client/components/cards/subtasks.jade

@@ -35,6 +35,10 @@ template(name="subtaskDetail")
           h2.title
             +viewer
                 = subtask.title
+        if subtaskStatus
+          span.subtask-status(title="{{_ 'list'}}")
+            i.fa.fa-list-ul
+            | {{ subtaskStatus }}
 
 template(name="addSubtaskItemForm")
   textarea.js-add-subtask-item(rows='1' autofocus dir="auto")

client/components/cards/subtasks.js

@@ -2,6 +2,12 @@ import { ReactiveCache } from '/imports/reactiveCache';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import Cards from '/models/cards';
 import { Filter } from '/client/lib/filter';
+import { subtaskStatusLabel } from './subtaskStatusHelpers';
+import {
+  subtaskNavTarget,
+  subtaskBoardNavTarget,
+} from './subtaskViewHelpers';
+import { Utils } from '/client/lib/utils';
 
 Template.subtasks.events({
   'click .js-open-subtask-details-menu'(event) {
@@ -17,66 +23,30 @@ Template.subtasks.events({
     const textarea = tpl.find('textarea.js-add-subtask-item');
     const title = textarea.value.trim();
     const cardId = Template.currentData().cardId;
-    const card = ReactiveCache.getCard(cardId);
-    const sortIndex = -1;
-    const crtBoard = ReactiveCache.getBoard(card.boardId);
-    const targetBoard = await crtBoard.getDefaultSubtasksBoardAsync();
-    if (!targetBoard) {
-      return;
-    }
-
-    const targetList = await targetBoard.getDefaultSubtasksListAsync();
-    if (!targetList) {
-      return;
-    }
-    const listId = targetList._id;
-
-    //Get the full swimlane data for the parent task.
-    const parentSwimlane = ReactiveCache.getSwimlane({
-      boardId: crtBoard._id,
-      _id: card.swimlaneId,
-    });
-    //find the swimlane of the same name in the target board.
-    const targetSwimlane = parentSwimlane
-      ? ReactiveCache.getSwimlane({
-          boardId: targetBoard._id,
-          title: parentSwimlane.title,
-        })
-      : undefined;
-    //If no swimlane with a matching title exists in the target board, fall back to the default swimlane.
-    const swimlaneId =
-      targetSwimlane === undefined
-        ? targetBoard.getDefaultSwimline()._id
-        : targetSwimlane._id;
-
-    const nextCardNumber = await targetBoard.getNextCardNumber();
 
     if (title) {
-      const _id = await Cards.insertAsync({
-        title,
-        parentId: cardId,
-        members: [],
-        labelIds: [],
-        customFields: [],
-        listId,
-        boardId: targetBoard._id,
-        sort: sortIndex,
-        swimlaneId,
-        type: 'cardType-card',
-        cardNumber: nextCardNumber,
-      });
+      // Subtask creation is performed server-side by the `addSubtaskCard` Meteor
+      // method, so the default subtasks board/list/swimlane are resolved (and
+      // lazily created exactly once) on the server. This prevents the client
+      // from creating duplicate subtasks boards / swimlanes / columns
+      // (#3868 / #5788 / #2256) and lets multiple subtasks be created reliably
+      // (#4782), and the method applies the destination board's automatic
+      // custom fields to the new subtask (#4037 / #3562).
+      const _id = await Meteor.callAsync('addSubtaskCard', cardId, title);
 
-      // In case the filter is active we need to add the newly inserted card in
-      // the list of exceptions -- cards that are not filtered. Otherwise the
-      // card will disappear instantly.
-      // See https://github.com/wekan/wekan/issues/80
-      Filter.addException(_id);
+      if (_id) {
+        // In case the filter is active we need to add the newly inserted card in
+        // the list of exceptions -- cards that are not filtered. Otherwise the
+        // card will disappear instantly.
+        // See https://github.com/wekan/wekan/issues/80
+        Filter.addException(_id);
 
-      setTimeout(() => {
-        tpl.$('.add-subtask-item')
-          .last()
-          .click();
-      }, 100);
+        setTimeout(() => {
+          tpl.$('.add-subtask-item')
+            .last()
+            .click();
+        }, 100);
+      }
     }
     textarea.value = '';
     textarea.focus();
@@ -111,13 +81,32 @@ Template.subtasks.onCreated(function () {
 
 Template.subtasks.helpers({
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
   toggleDeleteDialog() {
     return Template.instance().toggleDeleteDialog;
   },
 });
 
+Template.subtaskDetail.helpers({
+  // #6091: show the subtask's current status, i.e. the list it resides in
+  // (prefixed with the board title when the subtask lives on another board
+  // than the parent card).
+  subtaskStatus() {
+    const subtask = this.subtask;
+    if (!subtask) {
+      return '';
+    }
+    const list = subtask.list && subtask.list();
+    const listTitle = list ? list.title : '';
+    const board = subtask.board && subtask.board();
+    const boardTitle = board ? board.title : '';
+    const parentCard = Utils.getCurrentCard();
+    const sameBoard = !!parentCard && parentCard.boardId === subtask.boardId;
+    return subtaskStatusLabel({ listTitle, boardTitle, sameBoard });
+  },
+});
+
 Template.subtaskItemDetail.events({
   async 'click .js-subtasks-item .check-box-container'() {
     const item = Template.currentData().item;
@@ -129,7 +118,7 @@ Template.subtaskItemDetail.events({
 
 Template.subtaskActionsPopup.helpers({
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
 });
 
@@ -137,22 +126,36 @@ Template.subtaskActionsPopup.events({
   'click .js-view-subtask'(event) {
     if ($(event.target).hasClass('js-view-subtask')) {
       const subtask = Template.currentData().subtask;
-      const board = subtask.board();
-      FlowRouter.go('card', {
-        boardId: board._id,
-        slug: board.slug,
-        cardId: subtask._id,
-        swimlaneId: subtask.swimlaneId,
-        listId: subtask.listId,
-      });
+      // #3743: open the SUBTASK card itself, not the parent/current card.
+      // subtaskNavTarget derives boardId/slug/cardId from the subtask only.
+      // #1853 / #4762: when the subtask's board (often a DIFFERENT deposit
+      // board) is not in minimongo yet, it falls back to the subtask's own
+      // boardId so the route loads the board — no TypeError, no dead button.
+      // It only returns undefined for a truly broken subtask document.
+      const target = subtaskNavTarget(subtask);
+      if (target) {
+        FlowRouter.go('card', target);
+      } else {
+        // Broken subtask (no card id / board id): warn instead of throwing.
+        console.warn(
+          'Cannot view subtask: missing board/card id on subtask',
+          subtask && subtask._id,
+        );
+      }
     }
   },
   'click .js-go-to-subtask-board'() {
     const subtask = Template.currentData().subtask;
-    const board = subtask.board();
-    if (board) {
+    // #1853: fall back to subtask.boardId when the board doc is not loaded.
+    const target = subtaskBoardNavTarget(subtask);
+    if (target) {
       Popup.close();
-      FlowRouter.go('board', { id: board._id, slug: board.slug });
+      FlowRouter.go('board', target);
+    } else {
+      console.warn(
+        'Cannot go to subtask board: missing board id on subtask',
+        subtask && subtask._id,
+      );
     }
   },
   'click .js-delete-subtask' : Popup.afterConfirm('subtaskDelete', async function () {
@@ -169,6 +172,6 @@ Template.editSubtaskItemForm.helpers({
     return ReactiveCache.getUser(this.userId);
   },
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
 });

client/components/forms/forms.css

@@ -298,6 +298,25 @@ textarea::-moz-placeholder {
   font-size: clamp(20px, 4vw, 26px);
   margin: 0.5vh 1.5vw;
 }
+/* CJK (Japanese/Chinese/Korean) labels contain no spaces, so browsers may
+   insert a line break between any two characters. In the narrow add-card /
+   edit footers this made short labels such as "追加" (Add) and "リンク"
+   (Link) wrap mid-word. `word-break: keep-all` forbids breaks inside CJK
+   words while leaving Latin wrapping behavior unchanged, and `flex-wrap`
+   lets the footer wrap between its links instead of inside them.
+   See https://github.com/wekan/wekan/issues/4023 */
+.edit-controls,
+.add-controls {
+  flex-wrap: wrap;
+  word-break: keep-all;
+}
+.edit-controls button[type=submit],
+.add-controls button[type=submit] {
+  white-space: nowrap;
+}
+.add-controls .quiet {
+  white-space: nowrap;
+}
 [type="checkbox"]:not(:checked),
 [type="checkbox"]:checked {
   position: absolute;

client/components/lists/list.css

@@ -135,10 +135,14 @@ body.list-resizing-active * {
   flex-direction: column !important;
 }
 
-/* Ensure the width persists after resize is complete */
-.js-swimlane .list[style*="--list-width"],
-.dragscroll .list[style*="--list-width"],
-[id^="swimlane-"] .list[style*="--list-width"] {
+/* Ensure the width persists after resize is complete.
+   Exclude collapsed lists: a collapsed list keeps its inline --list-width custom
+   property, and without :not() this !important rule overrode the 30px collapsed
+   width, so collapsing a list that had a custom width left it full width.
+   See https://github.com/wekan/wekan/issues/5892 */
+.js-swimlane .list[style*="--list-width"]:not(.list-collapsed),
+.dragscroll .list[style*="--list-width"]:not(.list-collapsed),
+[id^="swimlane-"] .list[style*="--list-width"]:not(.list-collapsed) {
   /* Maintain the width after resize */
   width: var(--list-width, auto) !important;
   min-width: var(--list-width, auto) !important;
@@ -253,10 +257,12 @@ body.list-resizing-active * {
   height: 15vh;
 }
 .list.list-collapsed {
-  flex: none;
-  min-width: 30px;
-  max-width: 30px;
-  width: 30px;
+  flex: none !important;
+  /* !important so a custom per-list --list-width never keeps a collapsed list
+     full width (see https://github.com/wekan/wekan/issues/5892) */
+  min-width: 30px !important;
+  max-width: 30px !important;
+  width: 30px !important;
   min-height: 60vh;
   height: 60vh;
   overflow: visible;
@@ -730,9 +736,28 @@ form.inlined-form .list-composer {
   flex: 1 1 auto;
   flex-direction: column;
   display: flex;
-  overflow-y: auto;
+  /* #5439: always show a scrollbar on the list body across desktop and mobile
+     browsers (overlay scrollbars on macOS/iOS/Android/Firefox otherwise auto-
+     hide it). Keep these declarations in sync with models/lib/scrollbarCss.js
+     (alwaysVisibleScrollbarCss), which is unit tested. */
+  overflow-y: scroll;
+  scrollbar-width: thin;
+  scrollbar-color: rgba(0, 0, 0, 0.35) rgba(0, 0, 0, 0.08);
+  scrollbar-gutter: stable;
   padding: 5px 11px;
 }
+.list-body::-webkit-scrollbar {
+  width: 10px;
+  height: 10px;
+  -webkit-appearance: none;
+}
+.list-body::-webkit-scrollbar-track {
+  background: rgba(0, 0, 0, 0.08);
+}
+.list-body::-webkit-scrollbar-thumb {
+  background: rgba(0, 0, 0, 0.35);
+  border-radius: 5px;
+}
 .list-body .minicards {
   flex-grow: 1;
   flex-shrink: 0;

client/components/lists/list.jade

@@ -1,11 +1,12 @@
 template(name='list')
   .list.js-list(id="js-list-{{_id}}"
-                style="{{#unless collapsed}}min-width:{{listWidth}}px;max-width:{{listConstraint}}px;{{/unless}}"
+                style="{{#unless collapsed}}{{#unless autoWidth}}--list-width:{{listWidth}}px;{{/unless}}{{/unless}}"
                 class="{{#if collapsed}}list-collapsed{{/if}} {{#if autoWidth}}list-auto-width{{/if}} {{#if isMiniScreen}}mobile-view{{/if}}")
     +listHeader
     unless collapsed
       +listBody
-      .list-resize-handle.js-list-resize-handle.nodragscroll
+      if canResizeList
+        .list-resize-handle.js-list-resize-handle.nodragscroll
 
 template(name='miniList')
   a.mini-list.js-select-list.js-list(id="js-list-{{_id}}" class="{{#if isMiniScreen}}mobile-view{{/if}}")

client/components/lists/list.js

@@ -3,10 +3,216 @@ import { TAPi18n } from '/imports/i18n';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { MultiSelection } from '/client/lib/multiSelection';
 import { Utils } from '/client/lib/utils';
+import Cards from '/models/cards';
+import {
+  isDegenerateSortGap,
+  computeRepairedDropIndex,
+} from '/models/lib/cardSortRepair';
 require('/client/lib/jquery-ui.js')
 
 const { calculateIndex } = Utils;
 
+// ---------------------------------------------------------------------------
+// #6409 List width: a single, simple model.
+//
+//   * Each list has ONE fixed width.
+//   * SHARED mode (board default): width lives in `lists.width` and is the same
+//     for everyone; only members with board write access can change it.
+//   * PERSONAL mode (board setting `allowsPersonalListWidth`): each user keeps
+//     their own width in their profile (or localStorage when not logged in),
+//     falling back to the shared width and then the default.
+//
+// The old per-list "min width / max width / automatic" knobs are gone — the
+// rendered width is now a single hard value (see list.jade).
+//
+// #5659: the default/minimum width and the resolution order live in ONE
+// Meteor-free module shared with models/users.js, so every path (member,
+// anonymous public-board visitor, fixed mode) falls back to the SAME default
+// and all lists render the same width when nothing is customized.
+// ---------------------------------------------------------------------------
+import {
+  DEFAULT_LIST_WIDTH,
+  MIN_LIST_WIDTH,
+  resolveListWidth,
+} from '/models/lib/listWidth';
+
+function isPersonalListWidth(boardId) {
+  const board = ReactiveCache.getBoard(boardId);
+  return !!(board && board.allowsPersonalListWidth);
+}
+
+// #6409 Auto-width follows the same scope as fixed widths:
+//   * personal mode -> the user's own profile.autoWidthBoards
+//   * shared mode   -> the board's `autoWidth` (same for everyone)
+function effectiveAutoWidth(boardId) {
+  if (isPersonalListWidth(boardId)) {
+    const user = ReactiveCache.getCurrentUser();
+    return !!(user && user.isAutoWidth(boardId));
+  }
+  const board = ReactiveCache.getBoard(boardId);
+  return !!(board && board.autoWidth);
+}
+
+function readAnonListWidth(boardId, listId) {
+  try {
+    const stored = localStorage.getItem('wekan-list-widths');
+    if (stored) {
+      const widths = JSON.parse(stored);
+      const w = widths[boardId] && widths[boardId][listId];
+      if (typeof w === 'number' && w >= MIN_LIST_WIDTH) return w;
+    }
+  } catch (e) {
+    console.warn('Error reading list width from localStorage:', e);
+  }
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// #5729 Fixed (same) width for all lists.
+//
+// A per-viewer, per-board toggle that makes EVERY list render at a single
+// shared value, and makes dragging any list update that one value (so all lists
+// change together). Stored exactly like the personal width:
+//   * logged-in -> profile.fixedListWidthBoards / profile.fixedListWidths
+//   * anonymous  -> localStorage (mirrors readAnonListWidth)
+// ---------------------------------------------------------------------------
+function readAnonFixedListWidthEnabled(boardId) {
+  try {
+    const stored = localStorage.getItem('wekan-fixed-list-width-enabled');
+    if (stored) {
+      const flags = JSON.parse(stored);
+      return flags[boardId] === true;
+    }
+  } catch (e) {
+    console.warn('Error reading fixed list width flag from localStorage:', e);
+  }
+  return false;
+}
+
+function readAnonFixedListWidth(boardId) {
+  try {
+    const stored = localStorage.getItem('wekan-fixed-list-width');
+    if (stored) {
+      const widths = JSON.parse(stored);
+      const w = widths[boardId];
+      if (typeof w === 'number' && w >= MIN_LIST_WIDTH) return w;
+    }
+  } catch (e) {
+    console.warn('Error reading fixed list width from localStorage:', e);
+  }
+  return DEFAULT_LIST_WIDTH;
+}
+
+// Whether the current viewer has fixed width mode enabled for this board.
+function isFixedListWidth(boardId) {
+  const user = ReactiveCache.getCurrentUser();
+  if (user) {
+    return !!user.isFixedListWidth(boardId);
+  }
+  return readAnonFixedListWidthEnabled(boardId);
+}
+
+// The single width every list should use when fixed width mode is enabled.
+function fixedListWidthValue(boardId) {
+  const user = ReactiveCache.getCurrentUser();
+  if (user) {
+    return user.getFixedListWidth(boardId);
+  }
+  return readAnonFixedListWidth(boardId);
+}
+
+// Persist the single fixed width for the whole board (anon localStorage).
+function saveAnonFixedListWidth(boardId, width) {
+  try {
+    const stored = localStorage.getItem('wekan-fixed-list-width');
+    const widths = stored ? JSON.parse(stored) : {};
+    widths[boardId] = width;
+    localStorage.setItem('wekan-fixed-list-width', JSON.stringify(widths));
+  } catch (e) {
+    console.warn('Error saving fixed list width to localStorage:', e);
+  }
+}
+
+function effectiveListWidth(list) {
+  if (!list) return DEFAULT_LIST_WIDTH;
+  // #5659: all inputs are gathered here, but the fallback order and the ONE
+  // default width live in models/lib/listWidth.js (shared + unit tested).
+  const fixedEnabled = isFixedListWidth(list.boardId);
+  const personalMode = isPersonalListWidth(list.boardId);
+  let personalWidth = null;
+  if (personalMode) {
+    const user = ReactiveCache.getCurrentUser();
+    if (user) {
+      const widths = user.getListWidths();
+      personalWidth = widths[list.boardId] && widths[list.boardId][list._id];
+    } else {
+      personalWidth = readAnonListWidth(list.boardId, list._id);
+    }
+  }
+  return resolveListWidth({
+    // #5729 In fixed width mode every list renders at the single shared value.
+    fixedEnabled,
+    fixedWidth: fixedEnabled ? fixedListWidthValue(list.boardId) : null,
+    sharedWidth: list.width,
+    personalMode,
+    personalWidth,
+  });
+}
+
+// Can the current user change THIS list's width by dragging?
+//  - never while the board/list is in auto-width mode (the width is computed)
+//  - personal mode: always (it only affects their own view)
+//  - shared mode: only with board write access
+function canResizeList(list) {
+  if (!list) return false;
+  if (effectiveAutoWidth(list.boardId)) return false;
+  // #5729 Fixed width is the viewer's own per-board setting, so any viewer
+  // (logged-in or anonymous) may drag-resize; the change applies to all lists.
+  if (isFixedListWidth(list.boardId)) return true;
+  if (isPersonalListWidth(list.boardId)) return true;
+  return Utils.canModifyBoard();
+}
+
+// Persist a new width to the place that matches the current board mode.
+function saveListWidth(list, width) {
+  if (!list) return;
+  const boardId = list.boardId;
+  const listId = list._id;
+  const user = ReactiveCache.getCurrentUser();
+  // #5729 In fixed width mode, persist to the single per-board value instead of
+  // the per-list width, so EVERY list re-renders at the new width.
+  if (isFixedListWidth(boardId)) {
+    if (user) {
+      Meteor.call('setFixedListWidth', boardId, width, error => {
+        if (error) console.error('Error saving fixed list width:', error);
+      });
+    } else {
+      saveAnonFixedListWidth(boardId, width);
+    }
+    return;
+  }
+  if (isPersonalListWidth(boardId)) {
+    if (user) {
+      Meteor.call('applyListWidthToStorage', boardId, listId, width, width);
+    } else {
+      try {
+        const stored = localStorage.getItem('wekan-list-widths');
+        const widths = stored ? JSON.parse(stored) : {};
+        if (!widths[boardId]) widths[boardId] = {};
+        widths[boardId][listId] = width;
+        localStorage.setItem('wekan-list-widths', JSON.stringify(widths));
+      } catch (e) {
+        console.warn('Error saving personal list width to localStorage:', e);
+      }
+    }
+  } else if (user) {
+    // Shared width: server also enforces board membership.
+    Meteor.call('applyListWidth', boardId, listId, width, width, error => {
+      if (error) console.error('Error saving shared list width:', error);
+    });
+  }
+}
+
 Template.list.onCreated(function () {
   this.newCardFormIsVisible = new ReactiveVar(true);
 
@@ -86,7 +292,35 @@ Template.list.onRendered(function () {
       const prevCardDom = ui.item.prev('.js-minicard').get(0);
       const nextCardDom = ui.item.next('.js-minicard').get(0);
       const nCards = MultiSelection.isActive() ? MultiSelection.count() : 1;
-      const sortIndex = calculateIndex(prevCardDom, nextCardDom, nCards);
+      let sortIndex = calculateIndex(prevCardDom, nextCardDom, nCards);
+
+      // #3826: cards created by the "add subtask" flow were all inserted with
+      // a constant sort of -1, so a list full of subtask cards contains only
+      // ties. No number lies strictly between two equal sorts, so
+      // calculateIndex returns base === neighbour sort with increment 0: the
+      // write is then discarded by Card.move()'s no-op guard and the card
+      // snaps back (and a multi-selection drop would give every selected card
+      // the SAME sort, losing their relative order). When the drop landed in
+      // such a degenerate gap, capture the target list's sibling cards in
+      // their current visual order (before sortable('cancel') reshuffles the
+      // DOM) so their sorts can be repaired below.
+      const prevCardData = prevCardDom ? Blaze.getData(prevCardDom) : null;
+      const nextCardData = nextCardDom ? Blaze.getData(nextCardDom) : null;
+      let orderedSiblingCards = null;
+      if (
+        isDegenerateSortGap(
+          prevCardData ? prevCardData.sort : null,
+          nextCardData ? nextCardData.sort : null,
+        )
+      ) {
+        orderedSiblingCards = ui.item
+          .parent()
+          .children(itemsSelector)
+          .not(ui.item)
+          .toArray()
+          .map(el => Blaze.getData(el))
+          .filter(Boolean);
+      }
       const listData = Blaze.getData(ui.item.parents('.list').get(0));
       const listId = listData._id;
       const currentBoard = Utils.getCurrentBoard();
@@ -113,6 +347,25 @@ Template.list.onRendered(function () {
       // Blaze with the below query.
       $cards.sortable('cancel');
 
+      // #3826: the drop landed between two cards whose sorts do not strictly
+      // increase (duplicate -1 sorts from subtask creation, or legacy data).
+      // Repair the sibling sorts with the minimal bumps that make the visible
+      // order strictly increasing, then recompute the drop index from the
+      // repaired neighbours: base now falls strictly between them and the
+      // increment is strictly positive (distinct sorts for a multi-selection).
+      if (orderedSiblingCards && prevCardData && nextCardData) {
+        const repairedDrop = computeRepairedDropIndex(
+          orderedSiblingCards,
+          prevCardData,
+          nextCardData,
+          nCards,
+        );
+        repairedDrop.updates.forEach(u => {
+          Cards.update(u._id, { $set: { sort: u.sort } });
+        });
+        sortIndex = { base: repairedDrop.base, increment: repairedDrop.increment };
+      }
+
       if (MultiSelection.isActive()) {
         ReactiveCache.getCards(MultiSelection.getMongoSelector(), { sort: ['sort'] }).forEach((card, i) => {
           const newSwimlaneId = targetSwimlaneId
@@ -136,37 +389,39 @@ Template.list.onRendered(function () {
       if (boardComponent) boardComponent.setIsDragging(false);
     },
     sort(event, ui) {
-      const $boardCanvas = $('.board-canvas');
-      const boardCanvas = $boardCanvas[0];
-
-      if (event.pageX < 10) { // scroll to the left
-        boardCanvas.scrollLeft -= 15;
-        ui.helper[0].offsetLeft -= 15;
+      // #443: the HORIZONTAL scroller is the .js-lists lane (.swimlane has
+      // overflow: auto), NOT .board-canvas, which only overflows vertically —
+      // the old code compared against a scrollLeftMax of 0 and never fired, so
+      // dragging a card toward an off-screen list never auto-scrolled the board.
+      const { computeEdgeScroll, findLaneUnderPointer } = require('/imports/lib/boardAutoScroll');
+      const lanes = document.querySelectorAll('.js-lists');
+      const rects = Array.prototype.map.call(lanes, el => el.getBoundingClientRect());
+      const laneIndex = findLaneUnderPointer(rects, event.clientX, event.clientY);
+      if (laneIndex !== -1) {
+        const nextLeft = computeEdgeScroll({
+          pointer: event.clientX,
+          lowEdge: rects[laneIndex].left,
+          highEdge: rects[laneIndex].right,
+          scrollPos: lanes[laneIndex].scrollLeft,
+          scrollSize: lanes[laneIndex].scrollWidth,
+          clientSize: lanes[laneIndex].clientWidth,
+        });
+        if (nextLeft !== null) lanes[laneIndex].scrollLeft = nextLeft;
       }
-      if (
-        event.pageX > boardCanvas.offsetWidth - 10 &&
-        boardCanvas.scrollLeft < $boardCanvas.data('scrollLeftMax') // don't scroll more than possible
-      ) { // scroll to the right
-        boardCanvas.scrollLeft += 15;
+      // vertical auto-scroll stays on the board canvas
+      const canvas = document.querySelector('.board-canvas');
+      if (canvas) {
+        const crect = canvas.getBoundingClientRect();
+        const nextTop = computeEdgeScroll({
+          pointer: event.clientY,
+          lowEdge: crect.top,
+          highEdge: crect.bottom,
+          scrollPos: canvas.scrollTop,
+          scrollSize: canvas.scrollHeight,
+          clientSize: canvas.clientHeight,
+        });
+        if (nextTop !== null) canvas.scrollTop = nextTop;
       }
-      if (
-        event.pageY > boardCanvas.offsetHeight - 10 &&
-        event.pageY + boardCanvas.scrollTop < $boardCanvas.data('scrollTopMax') // don't scroll more than possible
-      ) { // scroll to the bottom
-        boardCanvas.scrollTop += 15;
-      }
-      if (event.pageY < 10) { // scroll to the top
-        boardCanvas.scrollTop -= 15;
-      }
-    },
-    activate(event, ui) {
-      const $boardCanvas = $('.board-canvas');
-      const boardCanvas = $boardCanvas[0];
-      // scrollTopMax and scrollLeftMax only available at Firefox (https://developer.mozilla.org/en-US/docs/Web/API/Element/scrollTopMax)
-      // https://www.it-swarm.com.de/de/javascript/so-erhalten-sie-den-maximalen-dokument-scrolltop-wert/1069126844/
-      $boardCanvas.data('scrollTopMax', boardCanvas.scrollHeight - boardCanvas.clientTop);
-      // https://stackoverflow.com/questions/5138373/how-do-i-get-the-max-value-of-scrollleft/5704386#5704386
-      $boardCanvas.data('scrollLeftMax', boardCanvas.scrollWidth - boardCanvas.clientWidth);
     },
   });
 
@@ -194,6 +449,13 @@ Template.list.onRendered(function () {
     const currentBoardId = Tracker.nonreactive(() => {
       return Session.get('currentBoard');
     });
+    // #1554: reactive dependency so newly added / re-rendered minicards are
+    // (re)initialized as droppable for label/member drags. The dependency
+    // (Cards.find(...).fetch()) was dropped in 7673c77c5, so the autorun ran
+    // ONCE per list render and cards added afterwards silently rejected
+    // sidebar label/member drops until the board was re-entered. Re-running
+    // .droppable() on initialized elements is an idempotent option refresh.
+    ReactiveCache.getCards({ boardId: currentBoardId });
     Tracker.afterFlush(() => {
       $cards.find(itemsSelector).droppable({
         hoverClass: 'draggable-hover-card',
@@ -217,63 +479,17 @@ Template.list.onRendered(function () {
 
 Template.list.helpers({
   listWidth() {
-    const user = ReactiveCache.getCurrentUser();
-    const list = Template.currentData();
-    if (!list) return 270; // Return default width if list is not available
-
-    if (user) {
-      // For logged-in users, get from user profile
-      return user.getListWidthFromStorage(list.boardId, list._id);
-    } else {
-      // For non-logged-in users, get from localStorage
-      try {
-        const stored = localStorage.getItem('wekan-list-widths');
-        if (stored) {
-          const widths = JSON.parse(stored);
-          if (widths[list.boardId] && widths[list.boardId][list._id]) {
-            return widths[list.boardId][list._id];
-          }
-        }
-      } catch (e) {
-        console.warn('Error reading list width from localStorage:', e);
-      }
-      return 270; // Return default width if not found
-    }
+    return effectiveListWidth(Template.currentData());
   },
 
-  listConstraint() {
-    const user = ReactiveCache.getCurrentUser();
-    const list = Template.currentData();
-    if (!list) return 550; // Return default constraint if list is not available
-
-    if (user) {
-      // For logged-in users, get from user profile
-      return user.getListConstraintFromStorage(list.boardId, list._id);
-    } else {
-      // For non-logged-in users, get from localStorage
-      try {
-        const stored = localStorage.getItem('wekan-list-constraints');
-        if (stored) {
-          const constraints = JSON.parse(stored);
-          if (constraints[list.boardId] && constraints[list.boardId][list._id]) {
-            return constraints[list.boardId][list._id];
-          }
-        }
-      } catch (e) {
-        console.warn('Error reading list constraint from localStorage:', e);
-      }
-      return 550; // Return default constraint if not found
-    }
+  // Whether to show the drag-resize handle for this list.
+  canResizeList() {
+    return canResizeList(Template.currentData());
   },
 
   autoWidth() {
-    const user = ReactiveCache.getCurrentUser();
     const list = Template.currentData();
-    if (!user) {
-      // For non-logged-in users, auto-width is disabled
-      return false;
-    }
-    return user.isAutoWidth(list.boardId);
+    return !!list && effectiveAutoWidth(list.boardId);
   },
 
   collapsed() {
@@ -313,18 +529,12 @@ Template.list.onCreated(function () {
       return;
     }
 
-    // Helper to get autoWidth state
-    const getAutoWidth = () => {
-      const user = ReactiveCache.getCurrentUser();
-      if (!user) return false;
-      return user.isAutoWidth(list.boardId);
-    };
-
-    // Reactively show/hide resize handle based on collapse and auto-width state
+    // #6409: show the resize handle only when the list is not collapsed and the
+    // user is allowed to change this list's width (always in personal mode; only
+    // with board write access in shared mode).
     tpl.autorun(() => {
-      const isAutoWidth = getAutoWidth();
       const isCollapsed = Utils.getListCollapseState(list);
-      if (isCollapsed || isAutoWidth) {
+      if (isCollapsed || !canResizeList(list)) {
         $resizeHandle.hide();
       } else {
         $resizeHandle.show();
@@ -334,25 +544,7 @@ Template.list.onCreated(function () {
     let isResizing = false;
     let startX = 0;
     let startWidth = 0;
-    let minWidth = 270; // Minimum width matching system default
-
-    // Get listConstraint value
-    const getListConstraint = () => {
-      const user = ReactiveCache.getCurrentUser();
-      if (user) {
-        return user.getListConstraintFromStorage(list.boardId, list._id);
-      }
-      try {
-        const stored = localStorage.getItem('wekan-list-constraints');
-        if (stored) {
-          const constraints = JSON.parse(stored);
-          if (constraints[list.boardId] && constraints[list.boardId][list._id]) {
-            return constraints[list.boardId][list._id];
-          }
-        }
-      } catch (e) {}
-      return 550;
-    };
+    let minWidth = MIN_LIST_WIDTH; // Minimum width matching system default
 
     // Read the horizontal page coordinate from either a jQuery mouse event
     // or a native touch event (touchstart/move expose `touches`, touchend
@@ -412,7 +604,6 @@ Template.list.onCreated(function () {
       const currentX = getEventPageX(e);
       const deltaX = currentX - startX;
       const finalWidth = Math.max(minWidth, startWidth + deltaX);
-      const listConstraint = getListConstraint();
 
       // Ensure the final width is applied
       $list[0].style.setProperty('--list-width', `${finalWidth}px`);
@@ -429,55 +620,9 @@ Template.list.onCreated(function () {
       $('body').removeClass('list-resizing-active');
       $('body').css('user-select', '');
 
-      // Save the new width using the existing system
-      const boardId = list.boardId;
-      const listId = list._id;
-
-      if (process.env.DEBUG === 'true') {
-      }
-
-      const currentUser = ReactiveCache.getCurrentUser();
-      if (currentUser) {
-        // For logged-in users, use server method
-        Meteor.call('applyListWidthToStorage', boardId, listId, finalWidth, listConstraint, (error, result) => {
-          if (error) {
-            console.error('Error saving list width:', error);
-          } else {
-            if (process.env.DEBUG === 'true') {
-            }
-          }
-        });
-      } else {
-        // For non-logged-in users, save to localStorage directly
-        try {
-          // Save list width
-          const storedWidths = localStorage.getItem('wekan-list-widths');
-          let widths = storedWidths ? JSON.parse(storedWidths) : {};
-
-          if (!widths[boardId]) {
-            widths[boardId] = {};
-          }
-          widths[boardId][listId] = finalWidth;
-
-          localStorage.setItem('wekan-list-widths', JSON.stringify(widths));
-
-          // Save list constraint
-          const storedConstraints = localStorage.getItem('wekan-list-constraints');
-          let constraints = storedConstraints ? JSON.parse(storedConstraints) : {};
-
-          if (!constraints[boardId]) {
-            constraints[boardId] = {};
-          }
-          constraints[boardId][listId] = listConstraint;
-
-          localStorage.setItem('wekan-list-constraints', JSON.stringify(constraints));
-
-          if (process.env.DEBUG === 'true') {
-          }
-        } catch (e) {
-          console.warn('Error saving list width/constraint to localStorage:', e);
-        }
-      }
+      // #6409: persist to the shared list width or the user's personal width,
+      // depending on the board's mode.
+      saveListWidth(list, finalWidth);
 
       e.preventDefault();
     };
@@ -502,16 +647,6 @@ Template.list.onCreated(function () {
       e.stopPropagation();
     });
 
-    // Reactively update resize handle visibility when auto-width or collapse changes
-    tpl.autorun(() => {
-      const collapsed = Utils.getListCollapseState(list);
-      if (getAutoWidth() || collapsed) {
-        $resizeHandle.hide();
-      } else {
-        $resizeHandle.show();
-      }
-    });
-
     // Clean up on component destruction
     tpl.view.onViewDestroyed(() => {
       $(document).off('mousemove', doResize);

client/components/lists/listAddHelpers.js

@@ -0,0 +1,36 @@
+// Pure helpers for the "add list" affordance.
+//
+// Issue #6142: In "Lists" board-view mode there was no UI affordance to add a
+// new list — only the "Swimlanes" mode rendered the trailing add-list composer.
+// These helpers keep the (testable) decision logic out of the Blaze templates.
+
+// Board-view modes in which an "add list" composer should be offered.
+// Both the swimlanes view and the lists view let the user create a list; the
+// other views (calendar, gantt, table) do not render the list composer.
+export const ADD_LIST_VIEW_MODES = ['board-view-swimlanes', 'board-view-lists'];
+
+// Returns true when the given board-view mode should show the add-list
+// composer. Used so Lists mode gets the same affordance as Swimlanes mode.
+export function canAddListInView(viewMode) {
+  return ADD_LIST_VIEW_MODES.indexOf(viewMode) !== -1;
+}
+
+// Decide which swimlane a newly created list should belong to when the user
+// adds a list from a view that is not bound to a specific swimlane (e.g. the
+// Lists view). Prefer an explicitly provided swimlane id, otherwise fall back
+// to the board's default swimlane id.
+//
+// `board` only needs to expose a `getDefaultSwimline()` method (the WeKan
+// Board model does); it may also be a plain object for testing.
+export function defaultSwimlaneIdForBoard(board, explicitSwimlaneId) {
+  if (explicitSwimlaneId) {
+    return explicitSwimlaneId;
+  }
+  if (board && typeof board.getDefaultSwimline === 'function') {
+    const swimlane = board.getDefaultSwimline();
+    if (swimlane && swimlane._id) {
+      return swimlane._id;
+    }
+  }
+  return null;
+}

client/components/lists/listBody.jade

@@ -46,7 +46,7 @@ template(name="addCardForm")
     if getLabels
       .minicard-labels
         each getLabels
-          .minicard-label(class="card-label-{{color}}" title="{{name}}")
+          .minicard-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title="{{name}}")
     textarea.minicard-composer-textarea.js-card-title(autofocus dir="auto")
     if members.get
       .minicard-members.js-minicard-composer-members

client/components/lists/listBody.js

@@ -9,6 +9,14 @@ import Swimlanes from '/models/swimlanes';
 import { Filter } from '/client/lib/filter';
 import { MultiSelection } from '/client/lib/multiSelection';
 import { Utils } from '/client/lib/utils';
+import { isLinkableCardTarget } from '/models/lib/linkedCardTarget';
+import { listCardsSelector } from '/models/lib/swimlaneFilter';
+import { sortCardsByTitle } from '/models/lib/sortCardsByTitle';
+import { isLazyCards, BoardListCardCounts, windowCountId } from '/client/lib/lazyCards';
+import {
+  mutationsChangeDragGeometry,
+  findActiveCardDrag,
+} from '/client/lib/cardDragGeometry';
 import autosize from 'autosize';
 
 // SubsManager removed for Meteor 3 migration
@@ -324,21 +332,50 @@ Template.listBody.helpers({
     const tpl = Template.instance();
     const limit = tpl.cardlimit.get();
     const defaultSort = { sort: 1 };
-    const sortBy = Session.get('sortBy') ? Session.get('sortBy') : defaultSort;
-    const selector = {
-      listId: Template.currentData()._id,
-      archived: false,
-    };
-    if (swimlaneId) {
-      // Fallback: also show cards with no swimlaneId (null/empty) so that
-      // pre-migration / orphaned cards are always visible without a DB migration.
-      selector.$or = [
-        { swimlaneId },
-        { swimlaneId: null },  // null covers null AND missing field
-        { swimlaneId: '' },    // empty string from shared-lists era
-      ];
+    // Session is reset on page reload; fall back to the persisted card sort so a
+    // chosen sort (e.g. by due date) is remembered across reloads (#5886).
+    let sortBy = Session.get('sortBy');
+    if (!sortBy) {
+      try {
+        const stored = window.localStorage.getItem('wekan-cards-sortBy');
+        if (stored) {
+          sortBy = JSON.parse(stored);
+        }
+      } catch (e) {}
     }
-    const ret = ReactiveCache.getCards(Filter.mongoSelector(selector), {
+    if (!sortBy) {
+      sortBy = defaultSort;
+    }
+    // #6441: build the swimlane-membership fallback as a single `swimlaneId:
+    // { $in: [...] }` clause (via the shared, unit-tested helper) instead of a
+    // bare top-level `$or`, so it never competes with the board Filter's own
+    // top-level `$or` (labels/members/exceptions) and the label filter applies
+    // board-wide across every swimlane.
+    // #6443: in the first swimlane also surface orphaned cards (a swimlaneId
+    // pointing at a deleted swimlane) so they are not invisible in swimlane view.
+    const list = Template.currentData();
+    const selector = listCardsSelector(
+      list._id,
+      swimlaneId,
+      list.orphanedCardsSwimlaneIds
+        ? list.orphanedCardsSwimlaneIds(swimlaneId)
+        : undefined,
+    );
+    const mongoSelector = Filter.mongoSelector(selector);
+    // Lazy card loading: the board publication ships no cards, so subscribe to
+    // just this list/swimlane window (grows with `limit` as the user scrolls)
+    // plus its reactive total count. Default mode keeps everything in minimongo
+    // already, so these subscriptions are skipped.
+    if (isLazyCards() && list.boardId) {
+      tpl.subscribe('boardCardsWindow', list.boardId, mongoSelector, sortBy, limit);
+      tpl.subscribe(
+        'boardListCardCount',
+        windowCountId(list._id, swimlaneId),
+        list.boardId,
+        mongoSelector,
+      );
+    }
+    const ret = ReactiveCache.getCards(mongoSelector, {
       // sort: ['sort'],
       sort: sortBy,
       limit,
@@ -349,6 +386,13 @@ Template.listBody.helpers({
   showSpinner(swimlaneId) {
     const tpl = Template.instance();
     const list = Template.currentData();
+    if (isLazyCards()) {
+      // In lazy mode minimongo only holds the loaded window, so the total comes
+      // from the server count published into BoardListCardCounts.
+      const countDoc = BoardListCardCounts.findOne(windowCountId(list._id, swimlaneId));
+      const total = countDoc ? countDoc.count : 0;
+      return total > tpl.cardlimit.get();
+    }
     return list.cards(swimlaneId).length > tpl.cardlimit.get();
   },
 
@@ -413,6 +457,80 @@ Template.listBody.events({
   },
 });
 
+// #2769 Card lands in the WRONG swimlane when it is dropped while a connected
+// list's layout changed mid-drag. jQuery UI sortable snapshots the geometry
+// of every connected `.js-minicards` container once at drag start
+// (_mouseStart runs refreshPositions() BEFORE the `start` callback) and only
+// re-snapshots after its own placeholder moves — never when Blaze mutates the
+// DOM. Two such mutations routinely happen during a drag: another user's
+// newly added card is reactively inserted into the target list (the issue's
+// "target column where a new card is being added"), and the dragging user's
+// own open add-card composer is closed by the `start` callback's
+// EscapeActions call, AFTER the snapshot. Every list/swimlane below the
+// change then shifts vertically while the cached rectangles stay put, so the
+// drop resolves against a stale map: the placeholder is parked in the
+// neighbouring swimlane's copy of the list (hence the reporter's "no drop
+// shadow in the target column") and the stop handler's
+// ui.item.parents('.swimlane') (client/components/lists/list.js) faithfully
+// persists that wrong swimlane.
+// Fix: watch each list's minicards for REAL DOM changes (Blaze insertions and
+// removals — not jQuery UI's own placeholder/helper churn, which the library
+// already follows with its own refresh) and re-cache the active drag's
+// geometry with sortable('refresh'). The decision helpers are pure and unit
+// tested in tests/cardDragGeometry.test.cjs.
+Template.listBody.onRendered(function () {
+  const minicardsEl = this.find('.js-minicards');
+  if (!minicardsEl || typeof MutationObserver === 'undefined') {
+    return;
+  }
+  this.dragGeometryRefreshQueued = false;
+  this.dragGeometryObserver = new MutationObserver(mutations => {
+    // Cheapest gate first: no drag helper on the page means no drag at all
+    // (this observer also fires on every ordinary reactive card update).
+    if (!document.getElementsByClassName('ui-sortable-helper').length) {
+      return;
+    }
+    if (!mutationsChangeDragGeometry(mutations)) {
+      return;
+    }
+    if (this.dragGeometryRefreshQueued) {
+      return;
+    }
+    this.dragGeometryRefreshQueued = true;
+    // Coalesce bursts (Blaze can insert several nodes per flush); by the time
+    // the timeout runs, this tick's layout is final and measurable.
+    setTimeout(() => {
+      this.dragGeometryRefreshQueued = false;
+      const active = findActiveCardDrag(
+        $('.js-minicards')
+          .toArray()
+          .map(el => $.data(el, 'ui-sortable')),
+      );
+      if (active) {
+        try {
+          // Re-collects the items of every connected container and re-measures
+          // all container rectangles, so the pointer is matched against the
+          // CURRENT layout for the rest of the drag.
+          active.refresh();
+        } catch (e) {
+          // A failed re-measure must never break the drag itself.
+        }
+      }
+    }, 0);
+  });
+  this.dragGeometryObserver.observe(minicardsEl, {
+    childList: true,
+    subtree: true,
+  });
+});
+
+Template.listBody.onDestroyed(function () {
+  if (this.dragGeometryObserver) {
+    this.dragGeometryObserver.disconnect();
+    this.dragGeometryObserver = null;
+  }
+});
+
 function toggleValueInReactiveArray(reactiveValue, value) {
   const array = reactiveValue.get();
   const valueIndex = array.indexOf(value);
@@ -693,14 +811,19 @@ Template.linkCardPopup.helpers({
       archived: false,
       linkedId: { $nin: ownCardsIds },
       _id: { $nin: ownCardsIds },
-      type: { $nin: ['template-card'] },
+      // #5808: never offer an existing linked card/board as a link target —
+      // linking to one builds a chain of linkedId pointers that renders the
+      // card inaccessible. Only real cards may be linked.
+      type: { $nin: ['template-card', 'cardType-linkedCard', 'cardType-linkedBoard'] },
     };
     if (tpl.selectedBoardId.get()) selector.boardId = tpl.selectedBoardId.get();
     if (tpl.selectedSwimlaneId.get()) selector.swimlaneId = tpl.selectedSwimlaneId.get();
     if (tpl.selectedListId.get()) selector.listId = tpl.selectedListId.get();
 
     const ret = ReactiveCache.getCards(selector, { sort: { sort: 1 } });
-    return ret;
+    // #5394: sort the Cards dropdown alphabetically by title
+    // (case-insensitive) so a card can be found on boards with many cards.
+    return sortCardsByTitle(ret);
   },
 
   isTitleDefault(title) {
@@ -743,11 +866,48 @@ Template.linkCardPopup.events({
     tpl.selectedListId.set($(evt.currentTarget).val());
   },
   async 'click .js-done'(evt, tpl) {
-    // LINK CARD
+    // LINK CARD (or, when no card is chosen, fall back to a board-level link
+    // so a whole board can be linked even when that board already has cards).
+    // https://github.com/wekan/wekan/issues/5715
     evt.stopPropagation();
     evt.preventDefault();
     const linkedId = $('.js-select-cards option:selected').val();
     if (!linkedId) {
+      const boardId = $('.js-select-boards option:selected').val();
+      // No board and no card selected: nothing to link.
+      if (!boardId) {
+        Popup.back();
+        return;
+      }
+      // A linkedBoard card for this board already exists; avoid duplicates.
+      if (ReactiveCache.getCard({ linkedId: boardId, archived: false })) {
+        Popup.back();
+        return;
+      }
+      const boardCardNumber = await tpl.board.getNextCardNumber();
+      const boardSortIndex = tpl.getSortIndex();
+      const boardCardId = Cards.insert({
+        title: $('.js-select-boards option:selected').text(), //dummy
+        listId: tpl.listId,
+        swimlaneId: tpl.swimlaneId,
+        boardId: tpl.boardId,
+        sort: boardSortIndex,
+        type: 'cardType-linkedBoard',
+        linkedId: boardId,
+        cardNumber: boardCardNumber,
+      });
+      Filter.addException(boardCardId);
+      Popup.back();
+      return;
+    }
+    // #5808: refuse to link to a linked card/board or to a card that links back
+    // to this board — those build a chain/cycle of linkedId pointers that renders
+    // the cards inaccessible. The <select> already filters these out, but its
+    // options can be stale, so re-check the resolved target here.
+    const targetCard = ReactiveCache.getCard(linkedId);
+    const ownCardsIds = tpl.board.cards().map(card => card.getRealId());
+    if (!isLinkableCardTarget(targetCard, ownCardsIds)) {
+      alert(TAPi18n.__('error-linked-card-not-allowed'));
       Popup.back();
       return;
     }
@@ -924,13 +1084,37 @@ Template.searchElementPopup.events({
     if (!tpl.isTemplateSearch || tpl.isCardTemplateSearch) {
       // Card insertion
       // 1. Common
+      // Compute the sort index BEFORE the first await: getSortIndex() reads
+      // Template.currentData(), and Blaze's current-view context is lost across
+      // an await, so calling it afterwards threw "There is no current view" and
+      // no card was created from the template. Capture it while still in the
+      // synchronous event/view context.
+      const sortIndex = tpl.getSortIndex();
       element.cardNumber = await tpl.board.getNextCardNumber();
-      element.sort = tpl.getSortIndex();
+      element.sort = sortIndex;
       // 1.A From template
       if (tpl.isTemplateSearch) {
         element.type = 'cardType-card';
         element.linkedId = '';
-        _id = await element.copy(tpl.boardId, tpl.swimlaneId, tpl.listId);
+        // #5798: instantiate the template into the CURRENT board, not the
+        // templates board. For a template search tpl.boardId is the templates
+        // board (it is the search source), so copying with it created the card
+        // with boardId = templates board. The card still showed in the target
+        // list (the list query is by listId and the templates board is
+        // subscribed), but clicking it navigated to the templates board instead
+        // of opening the card. The target list/swimlane were already resolved on
+        // the current board.
+        // Instantiate into the board that OWNS the target list (where the user
+        // clicked "add card"). Deriving it from tpl.listId is reliable even when
+        // Utils.getCurrentBoard() (route/session state) has not settled yet — as
+        // on the slower CI production bundle, where falling back to tpl.boardId
+        // wrongly created the card on the templates board.
+        const targetList = ReactiveCache.getList(tpl.listId);
+        const targetBoardId =
+          (targetList || {}).boardId ||
+          (Utils.getCurrentBoard() || {})._id ||
+          tpl.boardId;
+        _id = await element.copy(targetBoardId, tpl.swimlaneId, tpl.listId);
         // 1.B Linked card
       } else {
         _id = element.link(tpl.boardId, tpl.swimlaneId, tpl.listId);

client/components/lists/listHeader.jade

@@ -1,7 +1,8 @@
 template(name="listHeader")
   .list-header.js-list-header.nodragscroll(
     class="{{#if limitToShowCardsCount}}list-header-card-count{{/if}}"
-    class=colorClass)
+    class=colorClass
+    style=colorStyle)
     //- #459: keyboard/screen-reader list reordering (visually hidden, focusable).
     .list-move-buttons.sr-only
       a.js-list-move-left(href="#" role="button" aria-label="{{_ 'move-list-left'}}") {{_ 'move-list-left'}}
@@ -15,7 +16,7 @@ template(name="listHeader")
             i.fa.fa-caret-left
       else
         if collapsed
-          if showCardsCountForList cards.length
+          if showCardsCountForList cardsCountWhole
             br
             span.cardCount {{cardsCount}}
       if isMiniScreen
@@ -26,10 +27,10 @@ template(name="listHeader")
             = title
           if wipLimit.enabled
            | (
-           span(class="{{#if exceededWipLimit}}highlight{{/if}}") {{cards.length}}
+           span(class="{{#if exceededWipLimit}}highlight{{/if}}") {{cardsCountWhole}}
            |/#{wipLimit.value})
-        if showCardsCountForList cards.length
-          span.cardCount {{cardsCount}} {{cardsCountForListIsOne cards.length}}
+        if showCardsCountForList cardsCountWhole
+          span.cardCount {{cardsCount}} {{cardsCountForListIsOne cardsCountWhole}}
           if hasNumberFieldsSum
             |  
             span.list-sum-badge(title="{{_ 'sum-of-number-fields'}}") ∑ {{numberFieldsSum}}
@@ -47,11 +48,11 @@ template(name="listHeader")
               = title
             if wipLimit.enabled
              | (
-             span(class="{{#if exceededWipLimit}}highlight{{/if}}") {{cards.length}}
+             span(class="{{#if exceededWipLimit}}highlight{{/if}}") {{cardsCountWhole}}
              |/#{wipLimit.value})
         unless collapsed
-          if showCardsCountForList cards.length
-            span.cardCount {{cardsCount}} {{cardsCountForListIsOne cards.length}}
+          if showCardsCountForList cardsCountWhole
+            span.cardCount {{cardsCount}} {{cardsCountForListIsOne cardsCountWhole}}
             if hasNumberFieldsSum
               |  
               span.list-sum-badge(title="{{_ 'sum-of-number-fields'}}") ∑ {{numberFieldsSum}}
@@ -207,7 +208,10 @@ template(name="listMorePopup")
       span {{_ 'link-list'}}
       = ' '
       i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
-      input.inline-input(type="text" readonly value="{{ rootUrl }}")
+      //- #6459: was {{ rootUrl }}, a helper that does not exist anywhere, so the
+      //- link input was always empty. absoluteUrl resolves a URL via a card on
+      //- this list.
+      input.inline-input(type="text" readonly value="{{ absoluteUrl }}")
     | {{_ 'added'}}
     span.date(title=list.createdAt) {{ displayDate createdAt 'LLL' }}
     //unless currentUser.isWorker
@@ -252,17 +256,20 @@ template(name="wipLimitErrorPopup")
 
 template(name="setListWidthPopup")
   #js-list-width-edit
-    label {{_ 'set-list-width-value'}}
-      p
-        input.list-width-value(type="number" value="{{ listWidthValue }}" min="270")
-        input.list-constraint-value(type="number" value="{{ listConstraintValue }}" min="270")
-        input.list-width-apply(type="submit" value="{{_ 'apply'}}")
-        input.list-width-error
-        br
-        a.js-auto-width-board(
-          title="{{#if isAutoWidth}}{{_ 'click-to-disable-auto-width'}}{{else}}{{_ 'click-to-enable-auto-width'}}{{/if}}")
-          | {{#if isAutoWidth}}🗜️{{else}}📏{{/if}}
-          span {{_ 'auto-list-width'}}
+    unless isAutoWidth
+      label {{_ 'set-list-width-value'}}
+        p
+          input.list-width-value(type="number" value="{{ listWidthValue }}" min="270")
+          input.list-width-apply(type="submit" value="{{_ 'apply'}}")
+          input.list-width-error
+    if canChangeAutoWidth
+      a.js-toggle-auto-width(title="{{#if isAutoWidth}}{{_ 'click-to-disable-auto-width'}}{{else}}{{_ 'click-to-enable-auto-width'}}{{/if}}")
+        | {{#if isAutoWidth}}🗜️{{else}}📏{{/if}}
+        span {{_ 'auto-list-width'}}
+    a.js-toggle-fixed-list-width(title="{{#if isFixedListWidth}}{{_ 'click-to-disable-fixed-list-width'}}{{else}}{{_ 'click-to-enable-fixed-list-width'}}{{/if}}")
+      | {{#if isFixedListWidth}}✅{{else}}⬜{{/if}}
+      span {{_ 'fixed-list-width'}}
+    p.list-width-scope-note {{ listWidthScopeNote }}
 
 template(name="listWidthErrorPopup")
   .list-width-invalid
@@ -276,6 +283,10 @@ template(name="setListColorPopup")
       span.card-label.palette-color.js-palette-color(class="card-details-{{color}}")
         if(isSelected color)
           i.fa.fa-check
+    // #5514: native color wheel for picking a custom RGB / hex color
+    .color-wheel-wrap
+      label(for="listColorWheel") {{_ 'custom-color'}}
+      input.js-list-color-wheel#listColorWheel(type="color" value=currentColorHex title="{{_ 'custom-color'}}")
     button.primary.confirm.js-submit {{_ 'save'}}
     button.js-remove-color.negate.wide.right {{_ 'unset-color'}}
 

client/components/lists/listHeader.js

@@ -5,8 +5,17 @@ import dragscroll from '@wekanteam/dragscroll';
 import { BoardSwimlaneListDialog } from '/client/lib/dialogWithBoardSwimlaneList';
 import Cards from '/models/cards';
 import { LIST_COLORS } from '/models/metadata/colors';
+import { isHexColor, toHex } from '/models/lib/contrastColor';
 import { MultiSelection } from '/client/lib/multiSelection';
 import { Utils } from '/client/lib/utils';
+import { lazyListCardCount } from '/client/lib/lazyCards';
+// #5659: single source of truth for the default/minimum list width, shared
+// with client/components/lists/list.js and models/users.js.
+import {
+  DEFAULT_LIST_WIDTH,
+  MIN_LIST_WIDTH,
+  normalizeListWidth,
+} from '/models/lib/listWidth';
 
 let listsColors;
 Meteor.startup(() => {
@@ -20,12 +29,12 @@ Template.listHeader.helpers({
       (!list.getWipLimit('enabled') ||
         list.getWipLimit('soft') ||
         !Template.instance().reachedWipLimit()) &&
-      !ReactiveCache.getCurrentUser().isWorker()
+      !ReactiveCache.getCurrentUser()?.isWorker()
     );
   },
 
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
 
   starred() {
@@ -59,24 +68,33 @@ Template.listHeader.helpers({
       swimlaneId = list.swimlaneId || '';
     }
 
-    const ret = list.cards(swimlaneId).length;
-    return ret;
+    // In lazy mode minimongo holds only the loaded window, so use the accurate
+    // server count for the same selector; fall back to the loaded length.
+    const lazyCount = lazyListCardCount(list, swimlaneId);
+    return lazyCount !== null ? lazyCount : list.cards(swimlaneId).length;
   },
 
   reachedWipLimit() {
     const list = Template.currentData();
-    return (
-      list.getWipLimit('enabled') &&
-      list.getWipLimit('value') <= list.cards().length
-    );
+    const lazyCount = lazyListCardCount(list, undefined);
+    const count = lazyCount !== null ? lazyCount : list.cards().length;
+    return list.getWipLimit('enabled') && list.getWipLimit('value') <= count;
   },
 
   exceededWipLimit() {
     const list = Template.currentData();
-    return (
-      list.getWipLimit('enabled') &&
-      list.getWipLimit('value') < list.cards().length
-    );
+    const lazyCount = lazyListCardCount(list, undefined);
+    const count = lazyCount !== null ? lazyCount : list.cards().length;
+    return list.getWipLimit('enabled') && list.getWipLimit('value') < count;
+  },
+
+  // Accurate whole-list card count (used by the badge visibility, WIP-limit
+  // number and pluralization in the template). In lazy mode `cards.length`
+  // (= list.cards().length) is only the loaded window, so prefer the server count.
+  cardsCountWhole() {
+    const list = Template.currentData();
+    const lazyCount = lazyListCardCount(list, undefined);
+    return lazyCount !== null ? lazyCount : list.cards().length;
   },
 
   showCardsCountForList(count) {
@@ -141,10 +159,9 @@ Template.listHeader.helpers({
 Template.listHeader.onCreated(function () {
   this.reachedWipLimit = function () {
     const list = Template.currentData();
-    return (
-      list.getWipLimit('enabled') &&
-      list.getWipLimit('value') <= list.cards().length
-    );
+    const lazyCount = lazyListCardCount(list, undefined);
+    const count = lazyCount !== null ? lazyCount : list.cards().length;
+    return list.getWipLimit('enabled') && list.getWipLimit('value') <= count;
   };
 });
 
@@ -218,7 +235,7 @@ Template.listHeader.events({
 
 Template.listActionPopup.helpers({
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
 
   isWipLimitEnabled() {
@@ -258,7 +275,15 @@ Template.listActionPopup.events({
   'click .js-set-list-width': Popup.open('setListWidth'),
   'click .js-set-color-list': Popup.open('setListColor'),
   'click .js-select-cards'() {
-    const cardIds = this.allCards().map(card => card._id);
+    // Scope "select all cards" to the current swimlane when invoked from a
+    // swimlane context (#5623). In swimlanes board view the list carries its
+    // swimlaneId; otherwise there is genuinely no swimlane context and we keep
+    // the historical list-wide selection (swimlaneId stays undefined).
+    let swimlaneId;
+    if (Utils.boardView() === 'board-view-swimlanes' && this.swimlaneId) {
+      swimlaneId = this.swimlaneId;
+    }
+    const cardIds = this.allCards(swimlaneId).map(card => card._id);
     MultiSelection.add(cardIds);
     Popup.back();
   },
@@ -297,11 +322,10 @@ Template.setWipLimitPopup.events({
   async 'click .js-enable-wip-limit'() {
     const list = Template.currentData();
     // Prevent user from using previously stored wipLimit.value if it is less than the current number of cards in the list
-    if (
-      !list.getWipLimit('enabled') &&
-      list.getWipLimit('value') < list.cards().length
-    ) {
-      await list.setWipLimit(list.cards().length);
+    const lazyCount = lazyListCardCount(list, undefined);
+    const count = lazyCount !== null ? lazyCount : list.cards().length;
+    if (!list.getWipLimit('enabled') && list.getWipLimit('value') < count) {
+      await list.setWipLimit(count);
     }
     Meteor.call('enableWipLimit', list._id);
   },
@@ -468,6 +492,10 @@ Template.setListColorPopup.helpers({
       return tpl.currentColor.get() === color;
     }
   },
+  // #5514: current color as a '#rrggbb' hex for the native color wheel <input>.
+  currentColorHex() {
+    return toHex(Template.instance().currentColor.get()) || '#0079bf';
+  },
 });
 
 Template.setListColorPopup.events({
@@ -475,12 +503,17 @@ Template.setListColorPopup.events({
     const paletteData = Blaze.getData(event.currentTarget);
     tpl.currentColor.set(paletteData?.color);
   },
+  // #5514: picking from the native color wheel stores a custom hex.
+  'input .js-list-color-wheel'(event, tpl) {
+    const value = event.currentTarget.value;
+    if (isHexColor(value)) {
+      tpl.currentColor.set(value);
+    }
+  },
   async 'submit form'(event, tpl) {
     event.preventDefault();
-    console.log('[ListColor] submit form, color:', tpl.currentColor.get(), 'listId:', tpl.currentList?._id, 'setColor type:', typeof tpl.currentList?.setColor);
     try {
-      const result = await tpl.currentList.setColor(tpl.currentColor.get());
-      console.log('[ListColor] submit form setColor result:', result);
+      await tpl.currentList.setColor(tpl.currentColor.get());
     } catch (err) {
       console.error('[ListColor] submit form setColor error:', err);
     }
@@ -488,10 +521,8 @@ Template.setListColorPopup.events({
   },
   async 'click .js-submit'(event, tpl) {
     event.preventDefault();
-    console.log('[ListColor] click submit, color:', tpl.currentColor.get(), 'listId:', tpl.currentList?._id, 'setColor type:', typeof tpl.currentList?.setColor);
     try {
-      const result = await tpl.currentList.setColor(tpl.currentColor.get());
-      console.log('[ListColor] click submit setColor result:', result);
+      await tpl.currentList.setColor(tpl.currentColor.get());
     } catch (err) {
       console.error('[ListColor] click submit setColor error:', err);
     }
@@ -499,7 +530,6 @@ Template.setListColorPopup.events({
   },
   async 'click .js-remove-color'(event, tpl) {
     event.preventDefault();
-    console.log('[ListColor] remove color, listId:', tpl.currentList?._id);
     try {
       await tpl.currentList.setColor(null);
     } catch (err) {
@@ -509,50 +539,198 @@ Template.setListColorPopup.events({
   },
 });
 
+// #6409: the per-list width popup is now a single fixed-width value. Whether it
+// affects everyone (shared) or just the current user (personal) follows the
+// board setting `allowsPersonalListWidth`.
+function isPersonalListWidth(boardId) {
+  const board = ReactiveCache.getBoard(boardId);
+  return !!(board && board.allowsPersonalListWidth);
+}
+
+// #5729 Fixed (same) width for all lists is a per-viewer/per-board setting.
+// Logged-in users store it in their profile; anonymous (public board) users in
+// localStorage (mirrors the per-list anon storage in list.js).
+function readAnonFixedListWidthEnabled(boardId) {
+  try {
+    const stored = localStorage.getItem('wekan-fixed-list-width-enabled');
+    if (stored) {
+      const flags = JSON.parse(stored);
+      return flags[boardId] === true;
+    }
+  } catch (e) {
+    console.warn('Error reading fixed list width flag from localStorage:', e);
+  }
+  return false;
+}
+
+function readAnonFixedListWidth(boardId) {
+  try {
+    const stored = localStorage.getItem('wekan-fixed-list-width');
+    if (stored) {
+      const widths = JSON.parse(stored);
+      const w = widths[boardId];
+      if (typeof w === 'number' && w >= MIN_LIST_WIDTH) return w;
+    }
+  } catch (e) {
+    console.warn('Error reading fixed list width from localStorage:', e);
+  }
+  return DEFAULT_LIST_WIDTH;
+}
+
+function isFixedListWidth(boardId) {
+  const user = ReactiveCache.getCurrentUser();
+  if (user) return !!user.isFixedListWidth(boardId);
+  return readAnonFixedListWidthEnabled(boardId);
+}
+
+function fixedListWidthValue(boardId) {
+  const user = ReactiveCache.getCurrentUser();
+  if (user) return user.getFixedListWidth(boardId);
+  return readAnonFixedListWidth(boardId);
+}
+
+function setAnonFixedListWidthEnabled(boardId, enabled) {
+  try {
+    const stored = localStorage.getItem('wekan-fixed-list-width-enabled');
+    const flags = stored ? JSON.parse(stored) : {};
+    flags[boardId] = !!enabled;
+    localStorage.setItem('wekan-fixed-list-width-enabled', JSON.stringify(flags));
+  } catch (e) {
+    console.warn('Error saving fixed list width flag to localStorage:', e);
+  }
+}
+
+function setAnonFixedListWidth(boardId, width) {
+  try {
+    const stored = localStorage.getItem('wekan-fixed-list-width');
+    const widths = stored ? JSON.parse(stored) : {};
+    widths[boardId] = width;
+    localStorage.setItem('wekan-fixed-list-width', JSON.stringify(widths));
+  } catch (e) {
+    console.warn('Error saving fixed list width to localStorage:', e);
+  }
+}
+
 Template.setListWidthPopup.helpers({
   listWidthValue() {
     const list = Template.currentData();
-    const board = list.boardId;
-    return ReactiveCache.getCurrentUser().getListWidth(board, list._id);
-  },
-
-  listConstraintValue() {
-    const list = Template.currentData();
-    const board = list.boardId;
-    return ReactiveCache.getCurrentUser().getListConstraint(board, list._id);
-  },
-
-  isAutoWidth() {
-    const boardId = Utils.getCurrentBoardId();
+    // #5729 In fixed width mode the input edits the single per-board value.
+    if (isFixedListWidth(list.boardId)) {
+      return fixedListWidthValue(list.boardId);
+    }
+    const shared = normalizeListWidth(list.width);
+    if (!isPersonalListWidth(list.boardId)) {
+      return shared;
+    }
     const user = ReactiveCache.getCurrentUser();
-    return user && user.isAutoWidth(boardId);
+    if (user) {
+      const widths = user.getListWidths();
+      const w = widths[list.boardId] && widths[list.boardId][list._id];
+      return normalizeListWidth(w, shared);
+    }
+    return shared;
+  },
+
+  listWidthScopeNote() {
+    const list = Template.currentData();
+    // #5729 In fixed width mode the note explains the all-lists behaviour.
+    if (isFixedListWidth(list.boardId)) {
+      return TAPi18n.__('fixed-list-width-note');
+    }
+    return isPersonalListWidth(list.boardId)
+      ? TAPi18n.__('list-width-personal-note')
+      : TAPi18n.__('list-width-shared-note');
+  },
+
+  // #6409: auto-width follows the same scope as fixed widths.
+  isAutoWidth() {
+    const list = Template.currentData();
+    if (isPersonalListWidth(list.boardId)) {
+      const user = ReactiveCache.getCurrentUser();
+      return !!(user && user.isAutoWidth(list.boardId));
+    }
+    const board = ReactiveCache.getBoard(list.boardId);
+    return !!(board && board.autoWidth);
+  },
+
+  // In shared mode only members with board write access may toggle the shared
+  // auto-width; in personal mode any logged-in user may toggle their own.
+  canChangeAutoWidth() {
+    const list = Template.currentData();
+    if (isPersonalListWidth(list.boardId)) {
+      return !!ReactiveCache.getCurrentUser();
+    }
+    return Utils.canModifyBoard();
+  },
+
+  // #5729 Whether "same width for all lists" mode is on for the current viewer.
+  isFixedListWidth() {
+    const list = Template.currentData();
+    return isFixedListWidth(list.boardId);
   },
 });
 
 Template.setListWidthPopup.events({
-  'click .js-auto-width-board'() {
-    dragscroll.reset();
-    ReactiveCache.getCurrentUser().toggleAutoWidth(Utils.getCurrentBoardId());
+  'click .js-toggle-auto-width'(event) {
+    event.preventDefault();
+    const list = Template.currentData();
+    const boardId = list.boardId;
+    if (isPersonalListWidth(boardId)) {
+      const user = ReactiveCache.getCurrentUser();
+      if (user) user.toggleAutoWidth(boardId);
+    } else {
+      const board = ReactiveCache.getBoard(boardId);
+      const current = !!(board && board.autoWidth);
+      Meteor.call('setBoardAutoWidth', boardId, !current);
+    }
+    Popup.back();
+  },
+  // #5729 Toggle "same width for all lists" (fixed width) for the current
+  // viewer. Enabling it turns off auto-width (the two modes are exclusive).
+  'click .js-toggle-fixed-list-width'(event) {
+    event.preventDefault();
+    const list = Template.currentData();
+    const boardId = list.boardId;
+    const enabled = !isFixedListWidth(boardId);
+    const user = ReactiveCache.getCurrentUser();
+    if (user) {
+      if (enabled && isPersonalListWidth(boardId) && user.isAutoWidth(boardId)) {
+        user.toggleAutoWidth(boardId);
+      }
+      Meteor.call('setFixedListWidthEnabled', boardId, enabled);
+    } else {
+      setAnonFixedListWidthEnabled(boardId, enabled);
+    }
+    Popup.back();
   },
   'click .list-width-apply'(event, tpl) {
     const list = Template.currentData();
-    const board = list.boardId;
-    const width = parseInt(
-      tpl.$('.list-width-value').val(),
-      10,
-    );
-    const constraint = parseInt(
-      tpl.$('.list-constraint-value').val(),
-      10,
-    );
+    const boardId = list.boardId;
+    const width = parseInt(tpl.$('.list-width-value').val(), 10);
 
-    // FIXME(mark-i-m): where do we put constants?
-    if (width < 270 || !width || constraint < 270 || !constraint) {
+    if (!width || width < MIN_LIST_WIDTH) {
       tpl.$('.list-width-error').click();
-    } else {
-      Meteor.call('applyListWidth', board, list._id, width, constraint);
-      Popup.back();
+      return;
     }
+    const user = ReactiveCache.getCurrentUser();
+    // #5729 In fixed width mode the input applies to the single per-board value.
+    if (isFixedListWidth(boardId)) {
+      if (user) {
+        Meteor.call('setFixedListWidth', boardId, width);
+      } else {
+        setAnonFixedListWidth(boardId, width);
+      }
+      Popup.back();
+      return;
+    }
+    if (isPersonalListWidth(boardId)) {
+      if (user) {
+        Meteor.call('applyListWidthToStorage', boardId, list._id, width, width);
+      }
+    } else if (user) {
+      Meteor.call('applyListWidth', boardId, list._id, width, width);
+    }
+    Popup.back();
   },
   'click .list-width-error': Popup.open('listWidthError'),
 });

client/components/main/dueCards.css

@@ -3,3 +3,24 @@
   margin-inline-end: auto;
   margin-inline-start: auto;
 }
+
+/* Scrollable list container for the Due Cards view.
+   Scoped to the due-cards list only, not global (issue #5930). */
+.due-cards-list {
+  overflow-y: auto;
+  -webkit-overflow-scrolling: touch;
+  /* Leave room for the header bar / results header so the list itself can
+     scroll instead of being clipped after the first few cards. */
+  max-height: calc(100vh - 160px);
+}
+
+/* On small screens (mobile / iPhone) the previous fixed height clipped the
+   list at roughly 5 cards. Allow the list to use the available viewport
+   height and scroll past the first cards. */
+@media screen and (max-width: 800px) {
+  .due-cards-list {
+    max-height: calc(100vh - 120px);
+    overflow-y: auto;
+    -webkit-overflow-scrolling: touch;
+  }
+}

client/components/main/dueCards.jade

@@ -35,8 +35,9 @@ template(name="dueCards")
           .due-cards-results-header
             h1
               = resultsText
-          each card in dueCardsList
-            +resultCard(card)
+          .due-cards-list
+            each card in dueCardsList
+              +resultCard(card)
     else
       .global-search-results-list-wrapper
         .no-results

client/components/main/dueCards.js

@@ -1,6 +1,7 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import { Utils } from '/client/lib/utils';
+import { filterAndSortDueCards } from '/client/components/main/dueCardsLogic';
 
 // const subManager = new SubsManager();
 
@@ -70,44 +71,17 @@ Template.dueCards.onCreated(function () {
     // Filter cards based on user view preference
     const allUsers = dueCardsView() === 'all';
     const currentUser = ReactiveCache.getCurrentUser();
-    let filteredCards = cards;
 
     if (process.env.DEBUG === 'true') {
       console.log('dueCards client: current user:', currentUser ? currentUser._id : 'none');
       console.log('dueCards client: showing all users:', allUsers);
     }
 
-    if (!allUsers && currentUser) {
-      filteredCards = cards.filter(card => {
-        const isMember = card.members && card.members.includes(currentUser._id);
-        const isAssignee = card.assignees && card.assignees.includes(currentUser._id);
-        const isAuthor = card.userId === currentUser._id;
-        const matches = isMember || isAssignee || isAuthor;
-
-        if (process.env.DEBUG === 'true' && matches) {
-          console.log('dueCards client: card matches user:', card.title, { isMember, isAssignee, isAuthor });
-        }
-
-        return matches;
-      });
-    }
-
-    // Normalize dueAt to timestamps for stable client-side ordering
-    const future = new Date('2100-12-31').getTime();
-    const toTime = v => {
-      if (v === null || v === undefined || v === '') return future;
-      if (v instanceof Date) return v.getTime();
-      const t = new Date(v);
-      if (!isNaN(t.getTime())) return t.getTime();
-      return future;
-    };
-
-    filteredCards.sort((a, b) => {
-      const x = toTime(a.dueAt);
-      const y = toTime(b.dueAt);
-      if (x > y) return 1;
-      if (x < y) return -1;
-      return 0;
+    // Filter (by user unless "all") and sort ascending by due date. No cap is
+    // applied so every due card is shown (issues #5999 / #5930).
+    const filteredCards = filterAndSortDueCards(cards, {
+      allUsers,
+      userId: currentUser ? currentUser._id : null,
     });
 
     if (process.env.DEBUG === 'true') {

client/components/main/dueCardsLogic.js

@@ -0,0 +1,52 @@
+// Pure, side-effect-free helpers for the Due Cards view.
+//
+// These are extracted from dueCards.js so they can be unit-tested in
+// isolation (see client/lib/tests/dueCards.logic.tests.js). They must not
+// reference Meteor, Blaze, ReactiveCache or the DOM.
+
+// A far-future sentinel used to push cards with a missing/invalid dueAt to the
+// end of the ascending sort instead of dropping them.
+const FAR_FUTURE = new Date('2100-12-31').getTime();
+
+// Normalize a dueAt value (Date | string | null | undefined) to a comparable
+// millisecond timestamp. Invalid / empty values sort last.
+export function dueAtToTime(value, farFuture = FAR_FUTURE) {
+  if (value === null || value === undefined || value === '') return farFuture;
+  if (value instanceof Date) return value.getTime();
+  const t = new Date(value);
+  if (!isNaN(t.getTime())) return t.getTime();
+  return farFuture;
+}
+
+// Decide whether a card belongs to the current user (member, assignee or
+// author). Used when the view is "me" rather than "all".
+export function cardMatchesUser(card, userId) {
+  if (!card || !userId) return false;
+  const isMember = Array.isArray(card.members) && card.members.includes(userId);
+  const isAssignee =
+    Array.isArray(card.assignees) && card.assignees.includes(userId);
+  const isAuthor = card.userId === userId;
+  return isMember || isAssignee || isAuthor;
+}
+
+// Filter (by user, unless allUsers) and sort (ascending by due date) a list of
+// due cards. Returns a new array; does not mutate the input. Importantly this
+// imposes NO cap on the number of results (issue #5999 / #5930).
+export function filterAndSortDueCards(cards, { allUsers = false, userId = null } = {}) {
+  const list = Array.isArray(cards) ? cards.slice() : [];
+
+  const filtered =
+    allUsers || !userId
+      ? list
+      : list.filter(card => cardMatchesUser(card, userId));
+
+  filtered.sort((a, b) => {
+    const x = dueAtToTime(a.dueAt);
+    const y = dueAtToTime(b.dueAt);
+    if (x > y) return 1;
+    if (x < y) return -1;
+    return 0;
+  });
+
+  return filtered;
+}

client/components/main/editor.js

@@ -383,10 +383,29 @@ Blaze.Template.registerHelper(
   'mentions',
   new Template('mentions', function() {
     const view = this;
+    // Admin Panel / Features / Security: read the setting FIRST (a reactive dependency
+    // of this viewer) and push the "always show all code as plain text" flag into the
+    // wekan-markdown package BEFORE rendering the inner markdown below. Doing it here —
+    // not only in the separate startup autorun — removes a re-render race: this viewer
+    // already re-renders whenever the setting doc changes (it reads it for stripLinks),
+    // and the inner markdown helper then reads the up-to-date flag in the SAME
+    // synchronous render, so toggling "always show all code as plain text" takes effect
+    // immediately. Without this the viewer could re-render (setting changed) BEFORE the
+    // startup autorun updated the flag, read the stale value, and never re-render again
+    // since it does not itself depend on that ReactiveVar.
+    const setting = ReactiveCache.getCurrentSetting();
+    if (typeof Markdown !== 'undefined' && Markdown.alwaysShowCodeAsText) {
+      Markdown.alwaysShowCodeAsText.set(!!(setting && setting.alwaysShowCodeAsText));
+    }
     let content = Blaze.toHTML(view.templateContentBlock);
+    // Admin Panel / Features: when "render links as plain text" is enabled, every
+    // link (markdown [label](url) and raw HTML <a href>) is stripped to plain,
+    // non-clickable text everywhere rich text is shown. Reactive: toggling the
+    // setting re-renders viewers.
+    const stripLinks = !!(setting && setting.renderLinksAsPlainText);
     const currentBoard = Utils.getCurrentBoard();
     if (!currentBoard)
-      return HTML.Raw(sanitizeHTML(content));
+      return HTML.Raw(sanitizeHTML(content, { stripLinks }));
     const knowedUsers = [...new Set([...currentBoard.members
       .filter(member => member.isActive)
       .map(member => {
@@ -440,7 +459,7 @@ Blaze.Template.registerHelper(
       content = content.replace(fullMention, Blaze.toHTML(link));
     }
 
-    return HTML.Raw(sanitizeHTML(content));
+    return HTML.Raw(sanitizeHTML(content, { stripLinks }));
   }),
 );
 
@@ -473,3 +492,17 @@ Template.viewer.events({
     }
   },
 });
+
+// Admin Panel / Features / Security: keep the wekan-markdown package's
+// "show all code as plain text" flag in sync with the alwaysShowCodeAsText setting.
+// The package cannot import app code, so we push the setting into the reactive flag
+// it exposes on the exported Markdown object; the markdown helper reads it reactively
+// and shows the raw source (escaped, non-clickable, non-running) when enabled.
+Meteor.startup(() => {
+  Tracker.autorun(() => {
+    const setting = ReactiveCache.getCurrentSetting();
+    if (typeof Markdown !== 'undefined' && Markdown.alwaysShowCodeAsText) {
+      Markdown.alwaysShowCodeAsText.set(!!(setting && setting.alwaysShowCodeAsText));
+    }
+  });
+});

client/components/main/globalSearch.css

@@ -130,3 +130,22 @@ code {
 .global-search-instructions li {
   margin-bottom: 0.3rem;
 }
+
+/* #6034 (MVP): drag-and-drop search results into board columns. */
+.global-search-results-list .result-card-wrapper {
+  cursor: grab;
+}
+.global-search-results-list .result-card-wrapper:active {
+  cursor: grabbing;
+}
+.global-search-result-drag-helper {
+  z-index: 1000;
+  opacity: 0.85;
+  pointer-events: none;
+  list-style: none;
+}
+.global-search-drop-hover {
+  outline: 2px dashed #216694;
+  outline-offset: -2px;
+  background-color: rgba(33, 102, 148, 0.08);
+}

client/components/main/globalSearch.jade

@@ -76,7 +76,7 @@ template(name="globalSearch")
       if searching
         +spinner
       else if hasResults
-        .global-search-results-list-wrapper
+        .global-search-results-list-wrapper.global-search-results-list
           if hasQueryErrors
             ul
               each msg in errorMessages

client/components/main/globalSearch.js

@@ -74,8 +74,147 @@ Template.globalSearch.onRendered(function () {
       searchAllBoards(tpl, queryText || '');
     }
   });
+
+  // #6034 (MVP): make search-result cards draggable so they can be dropped
+  // into a board list/column. Re-wire whenever the results change.
+  this.autorun(() => {
+    tpl.search.results.get(); // reactive dependency: re-run when results render
+    Tracker.afterFlush(() => setupResultDrag(tpl));
+  });
 });
 
+// #6034 (MVP): drag-and-drop search results into board columns.
+//
+// We make each `.global-search-results-list` result item a jquery-ui
+// `draggable` (clone helper), and make every board list's `.js-minicards`
+// container a `droppable`. On drop we resolve the dragged card and call the
+// existing `card.move(boardId, swimlaneId, listId, sort)` model method - the
+// same method the in-board card sortable uses - so the move stays consistent
+// with normal card drag-drop and is persisted + reactively re-rendered.
+//
+// LIMITATION / TODO: this MVP drops the card at the END of the target list
+// (sort = list cards length) rather than at the exact pixel-precise insertion
+// index used by the in-board minicard sortable. Pixel-precise positioning and
+// multi-select drag are intentionally out of scope here; wiring those would
+// require modifying the (non-owned) list/minicard sortable `receive` handler.
+// Drag is only enabled when the board is editable and a board is open.
+function setupResultDrag(tpl) {
+  try {
+    if (typeof window === 'undefined' || !window.jQuery) return;
+    const $ = window.jQuery;
+
+    const $items = tpl.$('.global-search-results-list .result-card-wrapper');
+    if (!$items.length || typeof $items.draggable !== 'function') return;
+
+    // Only allow DnD when we are inside a board the user can modify.
+    const boardId = Session.get('currentBoard');
+    if (!boardId) return;
+    const canModify =
+      Utils && typeof Utils.canModifyBoard === 'function'
+        ? Utils.canModifyBoard()
+        : false;
+    if (!canModify) return;
+
+    $items.each(function () {
+      const el = this;
+      // Avoid double-initialising the same element.
+      if ($(el).data('uiDraggable')) return;
+
+      $(el).draggable({
+        helper: 'clone',
+        appendTo: 'body',
+        revert: 'invalid',
+        revertDuration: 150,
+        cursor: 'grabbing',
+        zIndex: 1000,
+        start(evt, ui) {
+          ui.helper.addClass('global-search-result-drag-helper');
+          ui.helper.css('width', $(el).width());
+        },
+      });
+    });
+
+    // Make board lists accept the dropped result card.
+    const $lists = $('.list .js-minicards');
+    if (!$lists.length || typeof $lists.droppable !== 'function') return;
+
+    $lists.each(function () {
+      const listEl = this;
+      if ($(listEl).data('uiDroppable')) return;
+
+      $(listEl).droppable({
+        accept: '.result-card-wrapper',
+        tolerance: 'pointer',
+        hoverClass: 'global-search-drop-hover',
+        drop(evt, ui) {
+          onResultDroppedOnList(listEl, ui.draggable.get(0));
+        },
+      });
+    });
+  } catch (e) {
+    console.error('Error wiring search-result drag-and-drop (#6034):', e);
+  }
+}
+
+// Resolve the dragged result card + target list and perform the move using the
+// existing card model `move()` method (mirrors the in-board card sortable).
+function onResultDroppedOnList(listEl, draggedEl) {
+  try {
+    if (!listEl || !draggedEl) return;
+
+    // Card data from the dragged result item (Blaze data on the result wrapper,
+    // falling back to the inner minicard).
+    let cardData = Blaze.getData(draggedEl);
+    if (!cardData || !cardData._id) {
+      const inner = draggedEl.querySelector('.js-minicard');
+      if (inner) cardData = Blaze.getData(inner);
+    }
+    if (!cardData || !cardData._id) return;
+
+    const card = ReactiveCache.getCard(cardData._id);
+    if (!card || typeof card.move !== 'function') return;
+
+    // Target list / swimlane / board from the drop target.
+    const listData = Blaze.getData(listEl.closest('.list') || listEl);
+    if (!listData || !listData._id) return;
+    const listId = listData._id;
+
+    const currentBoard = Utils.getCurrentBoard();
+    if (!currentBoard) return;
+
+    let swimlaneId = listData.swimlaneId;
+    if (!swimlaneId) {
+      const swimlaneEl = listEl.closest('.swimlane');
+      if (swimlaneEl) {
+        const swimlaneData = Blaze.getData(swimlaneEl);
+        swimlaneId = swimlaneData && swimlaneData._id;
+      }
+    }
+    if (!swimlaneId) {
+      const def = currentBoard.getDefaultSwimline && currentBoard.getDefaultSwimline();
+      swimlaneId = (def && def._id) || card.swimlaneId;
+    }
+
+    // MVP: append to the end of the target list.
+    let sort = 0;
+    try {
+      const existing = ReactiveCache.getCards(
+        { listId, archived: false },
+        { sort: { sort: -1 }, limit: 1 },
+      );
+      if (existing && existing.length && typeof existing[0].sort === 'number') {
+        sort = existing[0].sort + 1;
+      }
+    } catch (e) {
+      sort = 0;
+    }
+
+    card.move(currentBoard._id, swimlaneId, listId, sort);
+  } catch (e) {
+    console.error('Error moving dropped search result (#6034):', e);
+  }
+}
+
 function searchAllBoards(tpl, queryText) {
   const search = tpl.search;
 

client/components/main/header.css

@@ -290,15 +290,19 @@ body:not(.board-view) #header #header-main-bar h1 {
 }
 
 /* Zoom Controls in Header */
+/* #6465: compact fixed-pixel pill. The vh/vw padding+shadow made the pill
+   taller than the 28px overflow-hidden quick-access row, so it rendered cut
+   off at every window size. */
 #header-quick-access .zoom-controls {
   display: flex;
   align-items: center;
-  gap: 0.5vw;
+  gap: 4px;
   background: rgba(255, 255, 255, 0.9);
-  padding: 0.5vh 1vw;
-  border-radius: 0.5vw;
-  box-shadow: 0 0.2vh 0.5vh rgba(0,0,0,0.1);
-  margin: 0 1vw;
+  padding: 2px 8px;
+  border-radius: 10px;
+  box-shadow: 0 1px 2px rgba(0,0,0,0.1);
+  margin: 0 8px;
+  max-height: 24px;
   float: inline-start;
 }
 
@@ -496,15 +500,19 @@ body:not(.board-view) #header #header-main-bar h1 {
 @media screen and (max-width: 800px),
        screen and (max-device-width: 932px) and (-webkit-min-device-pixel-ratio: 3) {
   #header #header-main-bar {
-    height: 40px;
+    /* #6419: taller bar so the action icons can use ~44px touch targets. */
+    height: 48px;
   }
   #header #header-main-bar .board-header-btns {
     margin-top: 0px;
   }
   #header #header-main-bar .board-header-btn {
-    height: 32px;
-    line-height: 32px;
-    font-size: 15px;
+    /* #6419: 32px tall / 15px was below the comfortable mobile touch-target and
+       readable-font minimum (~44px / 16px). Enlarged vertically + bigger font;
+       width is unchanged so this does not worsen the horizontal icon crowding. */
+    height: 44px;
+    line-height: 44px;
+    font-size: 16px;
   }
   #header #header-main-bar .board-header-btn i.fa {
     line-height: 32px;
@@ -554,7 +562,7 @@ body:not(.board-view) #header #header-main-bar h1 {
     }
   }
 
-  /* Mobile - make all text and icons 2x bigger above #content by default */
+  /* Mobile - keep header text/icons at normal size (reverted #6426 oversizing) */
   @media screen and (max-width: 800px),
          screen and (max-device-width: 800px),
          screen and (-webkit-min-device-pixel-ratio: 2) and (max-width: 800px),
@@ -569,7 +577,7 @@ body:not(.board-view) #header #header-main-bar h1 {
       overflow: hidden !important; /* Prevent content overflow */
     }
     #header-quick-access {
-      font-size: 2em !important; /* 2x bigger base font size */
+      font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
     }
 
     #header-quick-access * {
@@ -578,7 +586,7 @@ body:not(.board-view) #header #header-main-bar h1 {
 
     #header-quick-access .fa,
     #header-quick-access .icon {
-      font-size: 2em !important; /* 2x bigger icons */
+      font-size: 1em !important; /* Normal icon size (reverted #6426 oversizing) */
     }
 
     #header-quick-access .home-icon a {
@@ -648,7 +656,7 @@ body:not(.board-view) #header #header-main-bar h1 {
     }
   }
 
-  /* Mobile All Boards page - make logo row elements 2x bigger */
+  /* Mobile All Boards page - keep logo row at normal size (reverted #6426 oversizing) */
   @media screen and (max-width: 800px),
          screen and (max-device-width: 800px),
          screen and (-webkit-min-device-pixel-ratio: 2) and (max-width: 800px),
@@ -656,16 +664,16 @@ body:not(.board-view) #header #header-main-bar h1 {
          screen and (max-width: 800px) and (orientation: landscape) {
     .wrapper ~ #header-quick-access,
     body:not(.board-view) #header-quick-access {
-      font-size: 2em !important; /* 2x bigger base font size for logo row */
+      font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
     }
 
-    /* iPhone 12 Mini specific - 3x bigger for All Boards page */
+    /* iPhone 12 Mini specific - keep All Boards logo row at normal size (reverted #6426) */
     @media screen and (device-width: 375px) and (device-height: 812px), /* iPhone 12 Mini exact */
            screen and (max-width: 375px) and (max-height: 812px), /* iPhone 12 Mini viewport */
            screen and (-webkit-min-device-pixel-ratio: 3) and (max-width: 375px) /* iPhone 12 Mini Retina */ {
       .wrapper ~ #header-quick-access,
       body:not(.board-view) #header-quick-access {
-        font-size: 3em !important; /* 3x bigger base font size for iPhone 12 Mini All Boards page */
+        font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
       }
     }
 
@@ -678,7 +686,7 @@ body:not(.board-view) #header #header-main-bar h1 {
     .wrapper ~ #header-quick-access .icon,
     body:not(.board-view) #header-quick-access .fa,
     body:not(.board-view) #header-quick-access .icon {
-      font-size: 2em !important; /* 2x bigger icons in logo row */
+      font-size: 1em !important; /* Normal icon size (reverted #6426 oversizing) */
     }
 
     .wrapper ~ #header-quick-access .home-icon a,
@@ -737,19 +745,19 @@ body:not(.board-view) #header #header-main-bar h1 {
     }
   }
 
-  /* iPhone 12 Mini specific - make header elements 3x bigger */
+  /* iPhone 12 Mini specific - keep the header a normal compact single row */
   @media screen and (device-width: 375px) and (device-height: 812px), /* iPhone 12 Mini exact */
          screen and (max-width: 375px) and (max-height: 812px), /* iPhone 12 Mini viewport */
          screen and (-webkit-min-device-pixel-ratio: 3) and (max-width: 375px), /* iPhone 12 Mini Retina */
          screen and (max-width: 375px) and (orientation: portrait), /* iPhone 12 Mini portrait */
          screen and (max-width: 375px) and (orientation: landscape) /* iPhone 12 Mini landscape */ {
     #header-quick-access {
-      font-size: 3em !important; /* 3x bigger base font size for iPhone 12 Mini */
-      height: auto !important; /* Allow height to grow */
-      min-height: 84px !important; /* Much taller minimum height for iPhone 12 Mini */
-      flex-wrap: wrap !important; /* Force wrapping */
-      align-items: flex-start !important; /* Align to top when wrapping */
-      padding: 18px 0px !important; /* More padding for iPhone 12 Mini */
+      font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
+      height: 48px !important;
+      min-height: 48px !important;
+      flex-wrap: nowrap !important;
+      align-items: center !important;
+      padding: 8px 0px !important;
     }
 
     #header-quick-access * {
@@ -758,7 +766,7 @@ body:not(.board-view) #header #header-main-bar h1 {
 
     #header-quick-access .fa,
     #header-quick-access .icon {
-      font-size: 3em !important; /* 3x bigger icons for iPhone 12 Mini */
+      font-size: 1em !important; /* Normal icon size (reverted #6426 oversizing) */
     }
 
     #header-quick-access .home-icon a {
@@ -844,7 +852,7 @@ body:not(.board-view) #header #header-main-bar h1 {
     }
   }
 
-  /* iPhone 12 Mini and very small screens - make header elements much larger */
+  /* iPhone 12 Mini and very small screens - header element sizing */
   @media screen and (max-width: 400px) and (max-height: 900px),
          screen and (max-device-width: 400px) and (max-device-height: 900px),
          screen and (-webkit-min-device-pixel-ratio: 2) and (max-width: 400px),
@@ -908,12 +916,12 @@ body:not(.board-view) #header #header-main-bar h1 {
 
   /* Fallback for iPhone devices using JavaScript detection */
   .iphone-device #header-quick-access {
-    font-size: 2em !important; /* 2x bigger base font size */
-    height: auto !important; /* Allow height to grow */
-    min-height: 48px !important; /* Minimum height for mobile */
-    flex-wrap: wrap !important; /* Force wrapping */
-    align-items: flex-start !important; /* Align to top when wrapping */
-    padding: 8px 0px !important; /* Adjust padding for mobile */
+    font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
+    height: 48px !important;
+    min-height: 48px !important;
+    flex-wrap: nowrap !important;
+    align-items: center !important;
+    padding: 8px 0px !important;
   }
 
   .iphone-device #header-quick-access * {
@@ -922,7 +930,7 @@ body:not(.board-view) #header #header-main-bar h1 {
 
   .iphone-device #header-quick-access .fa,
   .iphone-device #header-quick-access .icon {
-    font-size: 2em !important; /* 2x bigger icons */
+    font-size: 1em !important; /* Normal icon size (reverted #6426 oversizing) */
   }
 
   .iphone-device #header-quick-access .home-icon a {
@@ -991,14 +999,14 @@ body:not(.board-view) #header #header-main-bar h1 {
     width: auto !important;
   }
 
-  /* iPhone 12 Mini specific - JavaScript detection fallback */
+  /* iPhone 12 Mini specific - JavaScript detection fallback (normal compact row) */
   .iphone-device #header-quick-access {
-    font-size: 3em !important; /* 3x bigger base font size for iPhone 12 Mini */
-    height: auto !important; /* Allow height to grow */
-    min-height: 84px !important; /* Much taller minimum height for iPhone 12 Mini */
-    flex-wrap: wrap !important; /* Force wrapping */
-    align-items: flex-start !important; /* Align to top when wrapping */
-    padding: 18px 0px !important; /* More padding for iPhone 12 Mini */
+    font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
+    height: 48px !important;
+    min-height: 48px !important;
+    flex-wrap: nowrap !important;
+    align-items: center !important;
+    padding: 8px 0px !important;
   }
 
   .iphone-device #header-quick-access * {
@@ -1007,7 +1015,7 @@ body:not(.board-view) #header #header-main-bar h1 {
 
   .iphone-device #header-quick-access .fa,
   .iphone-device #header-quick-access .icon {
-    font-size: 3em !important; /* 3x bigger icons for iPhone 12 Mini */
+    font-size: 1em !important; /* Normal icon size (reverted #6426 oversizing) */
   }
 
   .iphone-device #header-quick-access .home-icon a {
@@ -1092,10 +1100,10 @@ body:not(.board-view) #header #header-main-bar h1 {
     width: auto !important;
   }
 
-  /* iPhone 12 Mini All Boards page - make logo row elements 3x bigger */
+  /* iPhone 12 Mini All Boards page - keep logo row at normal size (reverted #6426) */
   .iphone-device .wrapper ~ #header-quick-access,
   .iphone-device body:not(.board-view) #header-quick-access {
-    font-size: 3em !important; /* 3x bigger base font size for logo row */
+    font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
   }
 
   .iphone-device .wrapper ~ #header-quick-access *,
@@ -1107,7 +1115,7 @@ body:not(.board-view) #header #header-main-bar h1 {
   .iphone-device .wrapper ~ #header-quick-access .icon,
   .iphone-device body:not(.board-view) #header-quick-access .fa,
   .iphone-device body:not(.board-view) #header-quick-access .icon {
-    font-size: 2em !important; /* 2x bigger icons in logo row */
+    font-size: 1em !important; /* Normal icon size (reverted #6426 oversizing) */
   }
 
   .iphone-device .wrapper ~ #header-quick-access .home-icon a,
@@ -1205,7 +1213,7 @@ body:not(.board-view) #header #header-main-bar h1 {
   .iphone-device #header-quick-access,
   .iphone-device .wrapper ~ #header-quick-access,
   .iphone-device body:not(.board-view) #header-quick-access {
-    font-size: 1.2em !important;
+    font-size: 1em !important;
   }
   body:not(.board-view) #header-quick-access .fa,
   body:not(.board-view) #header-quick-access .icon,
@@ -1217,7 +1225,7 @@ body:not(.board-view) #header #header-main-bar h1 {
   .iphone-device .wrapper ~ #header-quick-access .icon,
   .iphone-device body:not(.board-view) #header-quick-access .fa,
   .iphone-device body:not(.board-view) #header-quick-access .icon {
-    font-size: 1.5em !important;
+    font-size: 1.2em !important;
   }
   /* Zoom (100%), drag-handle toggle and mobile/desktop toggle 30% smaller than
      the other quick-access controls at small width — for all browsers. */

client/components/main/header.jade

@@ -113,7 +113,7 @@ template(name="header")
           i.fa.fa-bullhorn(aria-hidden="true")
           +viewer
             | #{announcement}
-          a.js-close-announcement(aria-label="{{_ 'close'}}")
+          a.js-close-announcement(aria-label="{{_ 'close'}}" title="{{_ 'close'}}")
             i.fa.fa-times-thin(aria-hidden="true")
 
 template(name="offlineWarning")

client/components/main/header.js

@@ -2,7 +2,10 @@ import { Meteor } from 'meteor/meteor';
 import { Session } from 'meteor/session';
 import { ReactiveCache } from '/imports/reactiveCache';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
-import Announcements from '/models/announcements';
+import Announcements, {
+  announcementVersion,
+  shouldShowAnnouncement,
+} from '/models/announcements';
 import { Utils } from '/client/lib/utils';
 
 Meteor.subscribe('user-admin');
@@ -71,14 +74,25 @@ Template.header.helpers({
   },
 
   hasAnnouncement() {
-    const announcements = Announcements.findOne();
-    return announcements && announcements.enabled;
+    const announcement = Announcements.findOne();
+    if (!announcement || !announcement.enabled) {
+      return false;
+    }
+    const version = announcementVersion(announcement);
+    const user = Meteor.user();
+    const dismissedVersion =
+      (user && user.profile && user.profile.dismissedAnnouncementVersion) || null;
+    return shouldShowAnnouncement({
+      enabled: announcement.enabled,
+      version,
+      dismissedVersion,
+    });
   },
 
   announcement() {
     $('.announcement').show();
-    const announcements = Announcements.findOne();
-    return announcements && announcements.body;
+    const announcement = Announcements.findOne();
+    return announcement && announcement.body;
   },
 
   zoomLevel() {
@@ -150,6 +164,13 @@ Template.header.events({
   },
   'click .js-close-announcement'() {
     $('.announcement').hide();
+    // Permanently dismiss the current announcement for this user (#6051).
+    // The banner reappears only when the admin changes the announcement text.
+    Meteor.call('dismissAnnouncement', (err) => {
+      if (err && process.env.DEBUG === 'true') {
+        console.error('dismissAnnouncement error', err);
+      }
+    });
   },
   'click .js-select-list'() {
     Session.set('currentList', this._id);

client/components/main/layouts.css

@@ -157,8 +157,14 @@ input,
 select,
 textarea,
 button {
-  font: clamp(14px, 2.5vw, 18px) Roboto, Poppins, "Helvetica Neue", Arial, Helvetica, sans-serif;
-  line-height: 1.4;
+  /* #6465: back to the WeKan 6.09 desktop density. The clamp() introduced in
+     v7.98 (20e9cf114) and raised in v8.02 (67b078b80) resolved to 18px on any
+     window wider than 720px — +28.5% on EVERY font, input and button versus
+     6.09's 14px — which is the "everything is way too big" regression. Mobile
+     readability is handled by the mobile media queries, not by inflating the
+     desktop base font. */
+  font: 14px Roboto, Poppins, "Helvetica Neue", Arial, Helvetica, sans-serif;
+  line-height: 18px;
   color: #4d4d4d;
   /* Improve text rendering */
   -webkit-font-smoothing: antialiased;
@@ -217,8 +223,10 @@ body.mobile-mode #content {
   margin-top: 30vh;
 }
 #content > .wrapper {
-  margin-top: 1vh;
-  padding: 2vh 2vw;
+  /* #6465: 6.09 values; 2vh/2vw padding was ~21x38px on FullHD — the huge
+     empty header band on the All Boards page. */
+  margin-top: 10px;
+  padding: 15px;
 }
 #modal {
   position: absolute;
@@ -264,13 +272,15 @@ body.mobile-mode #content {
   float: inline-end;
   font-size: clamp(18px, 4vw, 24px);
 }
+/* #6465: heading sizes back to the 6.09 values (22/18/16px) — the vw clamps
+   resolved to 24/20/18px on desktop and compounded the density regression. */
 h1 {
-  font-size: clamp(18px, 4vw, 24px);
+  font-size: 22px;
   line-height: 1.2em;
   margin: 0 0 1vh;
 }
 h2 {
-  font-size: clamp(16px, 3.5vw, 20px);
+  font-size: 18px;
   line-height: 1.2em;
   margin: 0 0 0.8vh;
 }
@@ -278,7 +288,7 @@ h3,
 h4,
 h5,
 h6 {
-  font-size: clamp(14px, 3vw, 18px);
+  font-size: 16px;
   line-height: 1.25em;
   margin: 0 0 0.6vh;
 }

client/components/main/layouts.js

@@ -31,7 +31,10 @@ Template.userFormsLayout.onCreated(function () {
     Meteor.call('isOidcRedirectionEnabled', (_, result) => {
       if (result) {
         AccountsTemplates.options.socialLoginStyle = 'redirect';
-        options = {
+        // #5695: this is an ES module, so the body runs in strict mode and
+        // the previous undeclared `options = {...}` assignment threw a
+        // ReferenceError, breaking the OIDC_REDIRECTION_ENABLED auto-login.
+        const options = {
           loginStyle: AccountsTemplates.options.socialLoginStyle,
         };
         Meteor.loginWithOidc(options);
@@ -52,6 +55,13 @@ Template.userFormsLayout.onRendered(() => {
   // gesture works the same as on the board swimlanes view.
   enablePageDragscroll();
 
+  // Mark the auth pages so CSS can let <body> scroll as a normal document.
+  // body.mobile-mode locks <body> to position:fixed/100vh (an iOS board-view
+  // anti-bounce fix); without an inner #content scroller that traps these pages
+  // at viewport height, hiding the sign-up link / language selector below the
+  // form (and they sit behind the on-screen keyboard). See userForm.css.
+  document.body.classList.add('userform-layout');
+
   Meteor.call('getAuthenticationsEnabled', (_, result) => {
     let enabledAuthenticationMethods = ['password']; // we show/hide this based on isPasswordLoginEnabled
 
@@ -76,14 +86,23 @@ Template.userFormsLayout.onRendered(() => {
       })();
     });
 
+    // #4394 (security): a one-shot $('.at-signup-link').hide() does not survive
+    // the useraccounts form re-rendering that happens after a failed login (e.g.
+    // an LDAP "User not Found") — the links were recreated without the inline
+    // display:none and reappeared even though registration / forgot-password
+    // were disabled in the Admin Panel. Toggle a class on the stable <body>
+    // ancestor and hide the links via CSS (userForm.css) so the rule keeps
+    // applying to every freshly re-rendered copy of the links.
     Meteor.call('isDisableRegistration', (_, result) => {
       if (result) {
+        document.body.classList.add('registration-disabled');
         $('.at-signup-link').hide();
       }
     });
 
     Meteor.call('isDisableForgotPassword', (_, result) => {
       if (result) {
+        document.body.classList.add('forgotpwd-disabled');
         $('.at-pwd-link').hide();
       }
     });
@@ -200,6 +219,7 @@ Template.userFormsLayout.onDestroyed(() => {
   // Stop drag-scrolling <body> after leaving login / register (e.g. once logged
   // in) so other layouts keep their normal behaviour.
   disablePageDragscroll();
+  document.body.classList.remove('userform-layout');
 });
 
 Template.userFormsLayout.helpers({
@@ -267,7 +287,12 @@ Template.main.helpers({
 Template.userFormsLayout.events({
   'change .js-userform-set-language'(event) {
     const tag = $(event.currentTarget).val();
-    TAPi18n.setLanguage(tag);
+    // setLanguage is async; surface a failed load instead of silently leaving
+    // the UI in English (#5756).
+    Promise.resolve(TAPi18n.setLanguage(tag)).catch(error => {
+      // eslint-disable-next-line no-console
+      console.error(`Failed to switch language to ${tag}:`, error);
+    });
     event.preventDefault();
   },
   'click #at-btn'(event, templateInstance) {
@@ -309,6 +334,31 @@ Template.defaultLayout.onRendered(function () {
       }
     });
   });
+
+  // Drag-to-scroll for every whole-page layout rendered inside defaultLayout
+  // (All Boards, My Cards, Due Cards, Global Search, Public, Bookmarks, Broken
+  // Cards, Settings, People, Admin, Import, board Rules, …). These pages scroll
+  // <body> on desktop and #content in mobile mode (where <body> is
+  // position:fixed), so enablePageDragscroll() tags whichever element actually
+  // scrolls. The board-canvas pages are the exception: their own
+  // `.board-canvas.dragscroll` handles dragging, and the canvas does its own
+  // vertical/horizontal scroll, so page-level tagging is turned off there to
+  // avoid scrolling #content and the canvas at the same time. defaultLayout is
+  // persistent (only its `content` swaps), so this single autorun covers every
+  // route without per-template wiring. Login / Register use userFormsLayout and
+  // keep their own enable/disable. Works the same in mobile and desktop mode.
+  const boardCanvasRoutes = ['board', 'board-short', 'card'];
+  this.autorun(() => {
+    FlowRouter.watchPathChange();
+    const onBoardCanvas = boardCanvasRoutes.includes(FlowRouter.getRouteName());
+    Tracker.afterFlush(() => {
+      if (onBoardCanvas) {
+        disablePageDragscroll();
+      } else {
+        enablePageDragscroll();
+      }
+    });
+  });
 });
 
 async function authentication(event, templateInstance) {

client/components/main/myCards.jade

@@ -94,7 +94,7 @@ template(name="myCards")
                                 td
                                   .div
                                     each label in card.labelIds
-                                      span.card-label(class="card-label-{{labelColor board label}}" title=name)
+                                      span.card-label(class="{{labelColorClass (labelColor board label)}}" style="{{labelColorStyle (labelColor board label)}}" title=name)
                                         | {{labelName board label}}
                                 td
                                   if card.dueAt

client/components/main/myCards.js

@@ -1,6 +1,5 @@
 import { CardSearchPaged } from '../../lib/cardSearch';
 import { Utils } from '/client/lib/utils';
-import { enablePageDragscroll, disablePageDragscroll } from '/client/lib/pageDragscroll';
 
 Template.myCardsHeaderBar.helpers({
   myCardsSort() {
@@ -41,15 +40,8 @@ Template.myCards.onCreated(function () {
   Meteor.subscribe('setting');
 });
 
-Template.myCards.onRendered(function () {
-  // My Cards renders into <body>'s page scroll area (.wrapper inside #content),
-  // so enable drag-to-scroll on <body> like the All Boards page does.
-  enablePageDragscroll();
-});
-
-Template.myCards.onDestroyed(function () {
-  disablePageDragscroll();
-});
+// Drag-to-scroll is handled centrally for all non-board pages by
+// defaultLayout's route-aware autorun (see client/components/main/layouts.js).
 
 Template.myCards.helpers({
   userId() {

client/components/main/popup.js

@@ -1,4 +1,5 @@
 import { CSSEvents } from '/client/lib/cssEvents';
+import { isMobileViewportNow } from '/client/lib/responsiveUtils';
 
 Popup.template.events({
   'click .js-back-view'() {
@@ -10,6 +11,20 @@ Popup.template.events({
   'click .js-confirm'() {
     this.__afterConfirmAction.call(this);
   },
+  // #5942: On mobile/touch, tapping inside the card-detail sub-popups (assign
+  // user / set due date) made the popup DISAPPEAR. The document-level
+  // click-outside handler (EscapeActions in client/lib/popup.js) closes the
+  // popup, and on touch some freshly-rendered children (avatars, native date
+  // inputs) generated events that were not recognised as "inside the popup",
+  // closing it before the tap could register. Stop touch/pointer events that
+  // originate inside the popup from bubbling to that document handler so the
+  // popup stays open and usable on mobile. Scoped to mobile viewports so the
+  // desktop click-outside-to-close behaviour is untouched.
+  'touchstart .pop-over, pointerdown .pop-over'(evt) {
+    if (isMobileViewportNow()) {
+      evt.stopPropagation();
+    }
+  },
   // This handler intends to solve a pretty tricky bug with our popup
   // transition. The transition is implemented using a large container
   // (.content-container) that is moved on the x-axis (from 0 to n*PopupSize)

client/components/main/responsiveFixes.css

@@ -0,0 +1,162 @@
+/* ============================================================================
+   responsiveFixes.css
+
+   Global mobile / responsive corrective overrides. Meteor auto-includes every
+   .css file under client/, so simply creating this file loads it.
+
+   Everything here is ADDITIVE and scoped under (max-width) media queries so the
+   desktop layout is left untouched. It deliberately lives in one place so the
+   mobile regressions below are easy to find and tune.
+
+   Issues addressed:
+     #5942  card-detail sub-popups (assign user / due date) disappearing on
+            touch  -> JS guard lives in client/components/main/popup.js; this
+            file just makes sure those popups can't be visually clipped.
+     #5902  minicards rendering two-per-row instead of one-per-row on phones;
+            tiny hard-to-tap Home button in the header.
+     #6018  enormous icons / menus / text below the menu bar after upgrade.
+     #5982  excessive padding / margins and tiny button labels.
+   ============================================================================ */
+
+/* ----------------------------------------------------------------------------
+   #5902 - One minicard per row on narrow screens.
+
+   The minicard width itself is owned by minicard.css; we only add a mobile
+   override here (per task constraints) so phones get a single full-width card
+   per row instead of two side by side.
+   ---------------------------------------------------------------------------- */
+@media (max-width: 768px) {
+  .minicard,
+  .minicard-wrapper {
+    width: 100% !important;
+    box-sizing: border-box !important;
+  }
+
+  /* The list/swimlane card container should stack cards vertically, not wrap
+     them into columns. */
+  .list-body .minicard-wrapper,
+  .swimlane .minicard-wrapper {
+    display: block !important;
+    float: none !important;
+  }
+}
+
+/* ----------------------------------------------------------------------------
+   #5902 - Make the header "Home / All Boards" button a proper tap target.
+
+   The home icon link was tiny. Apple/Material guidance is a >=44px touch
+   target; give it comfortable padding and a minimum size on touch widths.
+   ---------------------------------------------------------------------------- */
+@media (max-width: 768px) {
+  #header-quick-access .home-icon a {
+    min-height: 44px !important;
+    min-width: 44px !important;
+    display: inline-flex !important;
+    align-items: center !important;
+    justify-content: center !important;
+    padding: 6px 12px !important;
+  }
+
+  /* Keep the home glyph visible and tappable without it ballooning. */
+  #header-quick-access .home-icon .fa-home {
+    font-size: 18px !important;
+    line-height: 1 !important;
+  }
+}
+
+/* ----------------------------------------------------------------------------
+   #6018 - "text and icons are enormous" below the menu bar.
+
+   After the upgrade, em/vw cascades in the content area scaled icons, menus and
+   text far too large (zoom only affected task names). Re-anchor a sane base
+   font-size on mobile and cap runaway icon sizing in the content region so the
+   UI is usable again. Scoped to #content so the (separately tuned) header bar
+   is not affected.
+   ---------------------------------------------------------------------------- */
+@media (max-width: 768px) {
+  /* Anchor the root size so rem-based sizing can't drift huge. */
+  html {
+    font-size: 100% !important; /* 16px base */
+  }
+
+  /* Body text in the working area: a readable, non-enormous default. */
+  #content {
+    font-size: 14px !important;
+  }
+
+  /* Cap oversized Font Awesome icons in the content area. Many icons had
+     inherited a multiplied em size; clamp them to a sane range while still
+     allowing the explicit small/large fa-modifiers to scale relative to it. */
+  #content .fa {
+    font-size: 16px !important;
+  }
+  #content .fa.fa-lg {
+    font-size: 20px !important;
+  }
+  #content .fa.fa-2x {
+    font-size: 24px !important;
+  }
+
+  /* Sidebar and card-detail menus: keep labels at a readable size rather than
+     the blown-up post-upgrade sizing. */
+  #content .sidebar .fa,
+  .card-details .fa {
+    font-size: 16px !important;
+  }
+
+  /* Menu / list item labels should match their controls, not be tiny next to
+     oversized padding (#5982 symptom of the same cluster). */
+  #content .pop-over-list li > a,
+  #content .sidebar .board-sidebar-content a {
+    font-size: 14px !important;
+  }
+}
+
+/* ----------------------------------------------------------------------------
+   #5982 - Excessive padding / margins and lots of empty space on mobile.
+
+   Trim the inflated spacing so controls sit closer together and button labels
+   no longer look tiny inside huge padded boxes.
+   ---------------------------------------------------------------------------- */
+@media (max-width: 768px) {
+  #content .pop-over-list li > a {
+    padding-top: 4px !important;
+    padding-bottom: 4px !important;
+    line-height: 1.4 !important;
+  }
+
+  /* Generic over-padded buttons inside the content area. */
+  #content button,
+  #content .btn,
+  #content .js-submit {
+    padding: 6px 12px !important;
+    margin: 4px 0 !important;
+  }
+
+  /* Reduce empty space between sidebar sections. */
+  #content .sidebar .sidebar-list li,
+  #content .board-sidebar-content > * {
+    margin-top: 4px !important;
+    margin-bottom: 4px !important;
+  }
+}
+
+/* ----------------------------------------------------------------------------
+   #5942 - Keep card-detail sub-popups visible & usable on mobile.
+
+   The JS fix (popup.js) stops touch events inside the popup from bubbling to
+   the document close handler. As belt-and-braces, make sure the assign-user /
+   due-date popups are never clipped off-screen and can scroll their content.
+   ---------------------------------------------------------------------------- */
+@media (max-width: 768px) {
+  .pop-over[data-popup="cardAssigneesPopup"],
+  .pop-over[data-popup="cardMembersPopup"],
+  .pop-over[data-popup="editCardDueDatePopup"],
+  .pop-over[data-popup="editCardReceivedDatePopup"],
+  .pop-over[data-popup="editCardStartDatePopup"],
+  .pop-over[data-popup="editCardEndDatePopup"] {
+    max-height: 100vh !important;
+    overflow-y: auto !important;
+    -webkit-overflow-scrolling: touch !important;
+  }
+}

client/components/rules/actions/boardActions.js

@@ -4,6 +4,7 @@ import Actions from '/models/actions';
 import Rules from '/models/rules';
 import Triggers from '/models/triggers';
 import { Utils } from '/client/lib/utils';
+import { canSelectBoardInRules } from '/models/lib/rulesBoardSelector';
 
 Template.boardActions.onCreated(function () {
   this.subscribe('boards');
@@ -11,19 +12,30 @@ Template.boardActions.onCreated(function () {
 
 Template.boardActions.helpers({
   boards() {
-    const ret = ReactiveCache.getBoards(
-      {
-        archived: false,
-        'members.userId': Meteor.userId(),
-        _id: {
-          $ne: ReactiveCache.getCurrentUser().getTemplatesBoardId(),
-        },
-      },
+    // #5698: don't restrict to boards where the user is a DIRECT member — that
+    // hid every board reached through an Organization / Team / email-domain
+    // share (the reporter's whole board dropdown was empty, current board
+    // included). Filter the already access-scoped client cache with the same
+    // visibility rule as Boards.userBoards() so org/team/domain boards show too.
+    const user = ReactiveCache.getCurrentUser();
+    if (!user) return [];
+    const ctx = {
+      userId: user._id,
+      orgIds: typeof user.orgIds === 'function' ? user.orgIds() : [],
+      teamIds: typeof user.teamIds === 'function' ? user.teamIds() : [],
+      emailDomains:
+        typeof user.emailDomains === 'function' ? user.emailDomains() : [],
+    };
+    const templatesBoardId = user.getTemplatesBoardId();
+    const boards = ReactiveCache.getBoards(
+      { archived: false },
       {
         sort: { sort: 1 /* boards default sorting */ },
       },
     );
-    return ret;
+    return boards.filter(board =>
+      canSelectBoardInRules(board, ctx, templatesBoardId),
+    );
   },
 
   loadingBoardsLabel() {
@@ -94,38 +106,19 @@ Template.boardActions.events({
     const boardId = Session.get('currentBoard');
     const destBoardId = tpl.find('#board-id').value;
     const desc = Utils.getTriggerActionDesc(event, tpl);
-    if (actionSelected === 'top') {
-      const triggerId = Triggers.insert(trigger);
-      const actionId = Actions.insert({
-        actionType: 'moveCardToTop',
-        listName,
-        swimlaneName,
-        boardId: destBoardId,
-        desc,
-      });
-      Rules.insert({
-        title: ruleName,
-        triggerId,
-        actionId,
-        boardId,
-      });
-    }
-    if (actionSelected === 'bottom') {
-      const triggerId = Triggers.insert(trigger);
-      const actionId = Actions.insert({
-        actionType: 'moveCardToBottom',
-        listName,
-        swimlaneName,
-        boardId: destBoardId,
-        desc,
-      });
-      Rules.insert({
-        title: ruleName,
-        triggerId,
-        actionId,
-        boardId,
-      });
-    }
+    // #5536: create the rule on the server (see server/rulesButton.js →
+    // rules.createRule) instead of three optimistic client Collection.insert()
+    // calls. The optimistic writes landed in minimongo limbo once the wizard
+    // subscription stopped, so the cross-board move action rendered BLANK; and
+    // the client allow/deny rules rejected them outright for non-owner members.
+    // The action keeps its own destination `boardId` (the board to move to).
+    Meteor.call('rules.createRule', boardId, ruleName, trigger, {
+      actionType: actionSelected === 'bottom' ? 'moveCardToBottom' : 'moveCardToTop',
+      listName,
+      swimlaneName,
+      boardId: destBoardId,
+      desc,
+    });
   },
   'click .js-add-gen-move-action'(event, tpl) {
     const desc = Utils.getTriggerActionDesc(event, tpl);
@@ -141,7 +134,11 @@ Template.boardActions.events({
     // documents land in minimongo limbo when the wizard subscription stops.
     Meteor.call('rules.createRule', boardId, ruleName, trigger, {
       actionType,
-      listTitle: '*',
+      // #6472: was `listTitle: '*'` since the original rules implementation,
+      // but performAction reads action.listName/action.swimlaneName — so every
+      // generic "move to top/bottom" rule created by this wizard did nothing.
+      listName: '*',
+      swimlaneName: '*',
       boardId,
       desc,
     });
@@ -191,20 +188,16 @@ Template.boardActions.events({
     const boardId = Session.get('currentBoard');
     const destBoardId = tpl.find('#board-id-link').value;
     const desc = Utils.getTriggerActionDesc(event, tpl);
-    const triggerId = Triggers.insert(trigger);
-    const actionId = Actions.insert({
+    // #5536: create on the server so the cross-board link action does not land
+    // blank in minimongo limbo / get rejected by client allow/deny. The action
+    // keeps its own destination `boardId` (the board to link the card into).
+    Meteor.call('rules.createRule', boardId, ruleName, trigger, {
       actionType: 'linkCard',
       listName,
       swimlaneName,
       boardId: destBoardId,
       desc,
     });
-    Rules.insert({
-      title: ruleName,
-      triggerId,
-      actionId,
-      boardId,
-    });
   },
   'click .js-sort-list-action'(event, tpl) {
     const data = Template.currentData();

client/components/rules/actions/cardActions.jade

@@ -100,8 +100,15 @@ template(name="cardActions")
           option(value="receivedAt") {{_'r-df-received-at'}}
       div.trigger-dropdown
         input(id="reldate-days",type="number",value="0")
+      div.trigger-dropdown
+        select(id="reldate-unit")
+          option(value="minutes") {{_'r-unit-minutes'}}
+          option(value="hours") {{_'r-unit-hours'}}
+          option(value="days",selected="selected") {{_'r-unit-days'}}
+          option(value="weeks") {{_'r-unit-weeks'}}
+          option(value="months") {{_'r-unit-months'}}
       div.trigger-text
-        | {{_'r-days-after'}}
+        | {{_'r-later'}}
     div.trigger-button.js-set-reldate-action.js-goto-rules
       i.fa.fa-plus
 

client/components/rules/actions/cardActions.js

@@ -238,12 +238,16 @@ Template.cardActions.events({
     const boardId = Session.get('currentBoard');
     const desc = Utils.getTriggerActionDesc(event, tpl);
     const dateField = tpl.find('#reldate-datefield').value;
+    // `days` keeps its name for backward compatibility: it is the numeric
+    // amount, interpreted together with `unit` (minutes/hours/days/weeks/months).
     const days = parseInt(tpl.find('#reldate-days').value, 10) || 0;
+    const unit = tpl.find('#reldate-unit').value;
     const triggerId = Triggers.insert(trigger);
     const actionId = Actions.insert({
       actionType: 'setDateRelative',
       dateField,
       days,
+      unit,
       boardId,
       desc,
     });

client/components/rules/rulesImportExport.js

@@ -1,9 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import Papa from 'papaparse';
-import Actions from '/models/actions';
-import Rules from '/models/rules';
-import Triggers from '/models/triggers';
 
 const RULES_FORMAT = 'wekan-rules-1.0.0';
 const STRIP_FIELDS = ['_id', 'boardId', 'createdAt', 'modifiedAt', 'updatedAt'];
@@ -33,14 +30,43 @@ function collectBoardRules(boardId) {
     .filter(Boolean);
 }
 
+// #6472: the trigger matcher (server/rulesHelper.js buildMatchingFieldsMap)
+// queries every matching field of the trigger type with {$in: [value, '*']} —
+// a trigger DOCUMENT that lacks one of those fields can never match. Hand-
+// written or third-party JSON often omits fields like userId, so default every
+// known matching field to the '*' wildcard when absent. Extra fields on
+// trigger types that do not use them are harmless (never queried).
+const TRIGGER_MATCHING_FIELDS = [
+  'userId', 'username', 'cardTitle', 'listName', 'oldListName',
+  'swimlaneName', 'checklistName', 'checklistItemName', 'labelId',
+  'attachmentName',
+];
+
+function normalizeTrigger(trigger) {
+  const out = { ...trigger };
+  TRIGGER_MATCHING_FIELDS.forEach(f => {
+    if (out[f] === undefined || out[f] === null || out[f] === '') out[f] = '*';
+  });
+  return out;
+}
+
 // Insert an array of {title, trigger, action} onto the given target board.
 function importRules(rulesArray, boardId) {
   let count = 0;
   (rulesArray || []).forEach(entry => {
     if (!entry || !entry.trigger || !entry.action) return;
-    const triggerId = Triggers.insert({ ...stripDoc(entry.trigger), boardId });
-    const actionId = Actions.insert({ ...stripDoc(entry.action), boardId });
-    Rules.insert({ title: entry.title || 'Imported rule', triggerId, actionId, boardId });
+    // #6472: create via the rules.createRule server method (like the rules
+    // wizard since #5536) instead of three optimistic client inserts — those
+    // are rejected by the board-admin-only allow() rules for non-admins and
+    // land in minimongo limbo: the imported rule LOOKS created but never
+    // exists on the server, so it silently does nothing until it vanishes.
+    Meteor.call(
+      'rules.createRule',
+      boardId,
+      entry.title || 'Imported rule',
+      normalizeTrigger(stripDoc(entry.trigger)),
+      stripDoc(entry.action),
+    );
     count += 1;
   });
   return count;

client/components/rules/rulesList.js

@@ -1,7 +1,5 @@
 import { ReactiveCache } from '/imports/reactiveCache';
-import Actions from '/models/actions';
 import Rules from '/models/rules';
-import Triggers from '/models/triggers';
 
 function boardRuleIds() {
   const boardId = Session.get('currentBoard');
@@ -62,9 +60,10 @@ Template.rulesList.events({
     getSelected().forEach(ruleId => {
       const rule = ReactiveCache.getRule(ruleId);
       if (rule) {
-        Rules.remove(rule._id);
-        Actions.remove(rule.actionId);
-        Triggers.remove(rule.triggerId);
+        // Delete the rule + its trigger + action server-side (see
+        // server/rulesButton.js `rules.deleteRule`): three client-side
+        // Collection.remove() calls were rejected with 403 "Access denied".
+        Meteor.call('rules.deleteRule', rule._id);
       }
     });
     setSelected([]);

client/components/rules/rulesMain.js

@@ -1,9 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import { Utils } from '/client/lib/utils';
-import Actions from '/models/actions';
-import Rules from '/models/rules';
-import Triggers from '/models/triggers';
 
 Template.rulesMain.onCreated(function () {
   this.rulesCurrentTab = new ReactiveVar('rulesList');
@@ -83,9 +80,12 @@ function sanitizeObject(obj) {
 Template.rulesMain.events({
   'click .js-delete-rule'() {
     const rule = Template.currentData();
-    Rules.remove(rule._id);
-    Actions.remove(rule.actionId);
-    Triggers.remove(rule.triggerId);
+    // Delete the rule + its trigger + action in one server call. Doing this
+    // client-side as three separate Collection.remove() calls failed with 403
+    // "Access denied" whenever a trigger/action document's boardId did not
+    // resolve to a board in the allow() rule; the method authorizes once and
+    // removes all three server-side.
+    Meteor.call('rules.deleteRule', rule._id);
   },
   'click .js-goto-trigger'(event, tpl) {
     event.preventDefault();

client/components/rules/rulesWorkflow.jade

@@ -12,7 +12,7 @@ template(name="rulesWorkflow")
             .workflow-node.workflow-node-when
               span.workflow-node-label {{_ 'r-when'}}
               span.workflow-node-text= builderTriggerLabel
-              a.workflow-slot-clear.js-clear-when(title="{{_ 'remove'}}") ✕
+              a.workflow-slot-clear.js-clear-when(title="{{_ 'r-remove'}}") ✕
           else
             span.workflow-slot-placeholder {{_ 'r-when'}}: {{_ 'r-drop-trigger'}}
         .workflow-arrow
@@ -22,7 +22,7 @@ template(name="rulesWorkflow")
             .workflow-node.workflow-node-then
               span.workflow-node-label {{_ 'r-action'}}
               span.workflow-node-text= builderActionLabel
-              a.workflow-slot-clear.js-clear-then(title="{{_ 'remove'}}") ✕
+              a.workflow-slot-clear.js-clear-then(title="{{_ 'r-remove'}}") ✕
           else
             span.workflow-slot-placeholder {{_ 'r-action'}}: {{_ 'r-drop-action'}}
       .workflow-builder-controls

client/components/rules/rulesWorkflow.js

@@ -12,31 +12,44 @@ import Triggers from '/models/triggers';
 // can be built entirely by dragging. Parameterized rules (specific list, label,
 // member, schedule time, …) are still created with the form builder on the
 // List view.
+// Each palette entry carries an i18n `labelKey` (translated at render time via
+// TAPi18n.__) instead of a hardcoded English string, so the whole workflow view
+// follows the UI language. `labelParams` is passed to TAPi18n.__ for labels that
+// need a placeholder (e.g. the scheduled time). Existing rule keys are reused
+// where they fit; workflow-only labels use new `r-w-*` keys (see en.i18n.json).
 const TRIGGER_PALETTE = [
-  { label: 'Card is created', doc: { activityType: 'createCard', listName: '*', swimlaneName: '*', cardTitle: '*', userId: '*' } },
-  { label: 'Card is moved', doc: { activityType: 'moveCard', listName: '*', oldListName: '*', swimlaneName: '*', cardTitle: '*', userId: '*' } },
-  { label: 'Card is archived', doc: { activityType: 'archivedCard', userId: '*' } },
-  { label: 'Card is unarchived', doc: { activityType: 'restoredCard', userId: '*' } },
-  { label: 'Any label is added', doc: { activityType: 'addedLabel', labelId: '*', userId: '*' } },
-  { label: 'Any label is removed', doc: { activityType: 'removedLabel', labelId: '*', userId: '*' } },
-  { label: 'A member is added', doc: { activityType: 'joinMember', username: '*', userId: '*' } },
-  { label: 'A member is removed', doc: { activityType: 'unjoinMember', username: '*', userId: '*' } },
-  { label: 'A checklist is added', doc: { activityType: 'addChecklist', checklistName: '*', userId: '*' } },
-  { label: 'An attachment is added', doc: { activityType: 'addAttachment', userId: '*' } },
-  { label: 'Every day at 09:00', doc: { activityType: 'scheduledTrigger', scheduleKind: 'calendar', scheduleType: 'daily', atTime: '09:00', listName: '*', swimlaneName: '*' } },
+  { labelKey: 'r-w-card-created', doc: { activityType: 'createCard', listName: '*', swimlaneName: '*', cardTitle: '*', userId: '*' } },
+  { labelKey: 'r-when-a-card-is-moved', doc: { activityType: 'moveCard', listName: '*', oldListName: '*', swimlaneName: '*', cardTitle: '*', userId: '*' } },
+  { labelKey: 'r-w-card-archived', doc: { activityType: 'archivedCard', userId: '*' } },
+  { labelKey: 'r-w-card-unarchived', doc: { activityType: 'restoredCard', userId: '*' } },
+  { labelKey: 'r-w-label-added', doc: { activityType: 'addedLabel', labelId: '*', userId: '*' } },
+  { labelKey: 'r-w-label-removed', doc: { activityType: 'removedLabel', labelId: '*', userId: '*' } },
+  { labelKey: 'r-w-member-added', doc: { activityType: 'joinMember', username: '*', userId: '*' } },
+  { labelKey: 'r-w-member-removed', doc: { activityType: 'unjoinMember', username: '*', userId: '*' } },
+  { labelKey: 'r-w-checklist-added', doc: { activityType: 'addChecklist', checklistName: '*', userId: '*' } },
+  { labelKey: 'r-w-attachment-added', doc: { activityType: 'addAttachment', userId: '*' } },
+  { labelKey: 'r-w-every-day-at', labelParams: { time: '09:00' }, doc: { activityType: 'scheduledTrigger', scheduleKind: 'calendar', scheduleType: 'daily', atTime: '09:00', listName: '*', swimlaneName: '*' } },
 ];
 
 const ACTION_PALETTE = [
-  { label: 'Move card to top', doc: { actionType: 'moveCardToTop', listName: '*', swimlaneName: '*' } },
-  { label: 'Move card to bottom', doc: { actionType: 'moveCardToBottom', listName: '*', swimlaneName: '*' } },
-  { label: 'Archive card', doc: { actionType: 'archive' } },
-  { label: 'Unarchive card', doc: { actionType: 'unarchive' } },
-  { label: 'Mark card complete', doc: { actionType: 'markCardComplete' } },
-  { label: 'Mark card incomplete', doc: { actionType: 'markCardIncomplete' } },
-  { label: 'Remove all members', doc: { actionType: 'removeMember', username: '*' } },
-  { label: 'Set received date to now', doc: { actionType: 'setDate', dateField: 'receivedAt' } },
+  { labelKey: 'r-d-move-to-top-gen', doc: { actionType: 'moveCardToTop', listName: '*', swimlaneName: '*' } },
+  { labelKey: 'r-d-move-to-bottom-gen', doc: { actionType: 'moveCardToBottom', listName: '*', swimlaneName: '*' } },
+  { labelKey: 'r-d-archive', doc: { actionType: 'archive' } },
+  { labelKey: 'r-d-unarchive', doc: { actionType: 'unarchive' } },
+  { labelKey: 'r-mark-complete', doc: { actionType: 'markCardComplete' } },
+  { labelKey: 'r-mark-incomplete', doc: { actionType: 'markCardIncomplete' } },
+  { labelKey: 'r-remove-all', doc: { actionType: 'removeMember', username: '*' } },
+  { labelKey: 'r-w-set-received-now', doc: { actionType: 'setDate', dateField: 'receivedAt' } },
 ];
 
+// Translate a palette entry's label for display / storage in the current UI
+// language (matches the classic Rules view, which also stores already-translated
+// description text at creation time).
+function paletteLabel(entry) {
+  if (!entry) return '';
+  return TAPi18n.__(entry.labelKey, entry.labelParams);
+}
+
 Template.rulesWorkflow.onCreated(function () {
   this.builderTrigger = new ReactiveVar(null);
   this.builderAction = new ReactiveVar(null);
@@ -52,24 +65,22 @@ Template.rulesWorkflow.helpers({
     return Utils.getCurrentBoard();
   },
   triggerPalette() {
-    return TRIGGER_PALETTE.map((t, idx) => ({ idx, label: t.label }));
+    return TRIGGER_PALETTE.map((t, idx) => ({ idx, label: paletteLabel(t) }));
   },
   actionPalette() {
-    return ACTION_PALETTE.map((a, idx) => ({ idx, label: a.label }));
+    return ACTION_PALETTE.map((a, idx) => ({ idx, label: paletteLabel(a) }));
   },
   builderTrigger() {
     return Template.instance().builderTrigger.get();
   },
   builderTriggerLabel() {
-    const t = Template.instance().builderTrigger.get();
-    return t ? t.label : '';
+    return paletteLabel(Template.instance().builderTrigger.get());
   },
   builderAction() {
     return Template.instance().builderAction.get();
   },
   builderActionLabel() {
-    const a = Template.instance().builderAction.get();
-    return a ? a.label : '';
+    return paletteLabel(Template.instance().builderAction.get());
   },
   createDisabled() {
     const tpl = Template.instance();
@@ -96,9 +107,11 @@ function persistRule(tpl) {
   if (!t || !a) return;
   const boardId = Session.get('currentBoard');
   const titleField = tpl.find('.js-workflow-rule-title');
-  const title = (titleField.value || '').trim() || `${t.label} → ${a.label}`;
-  const triggerId = Triggers.insert({ ...t.doc, boardId, desc: t.label });
-  const actionId = Actions.insert({ ...a.doc, boardId, desc: a.label });
+  const tLabel = paletteLabel(t);
+  const aLabel = paletteLabel(a);
+  const title = (titleField.value || '').trim() || `${tLabel} → ${aLabel}`;
+  const triggerId = Triggers.insert({ ...t.doc, boardId, desc: tLabel });
+  const actionId = Actions.insert({ ...a.doc, boardId, desc: aLabel });
   Rules.insert({ title, triggerId, actionId, boardId });
   tpl.builderTrigger.set(null);
   tpl.builderAction.set(null);
@@ -140,7 +153,7 @@ Template.rulesWorkflow.events({
     const a = ACTION_PALETTE[tpl.dragItem.idx];
     const boardId = Session.get('currentBoard');
     const oldActionId = rule.actionId;
-    const newActionId = Actions.insert({ ...a.doc, boardId, desc: a.label });
+    const newActionId = Actions.insert({ ...a.doc, boardId, desc: paletteLabel(a) });
     Rules.update(ruleId, { $set: { actionId: newActionId } });
     if (oldActionId) Actions.remove(oldActionId);
     tpl.dragItem = null;
@@ -163,8 +176,9 @@ Template.rulesWorkflow.events({
     const ruleId = node && node.dataset.ruleId;
     const rule = ReactiveCache.getRule(ruleId);
     if (!rule) return;
-    Rules.remove(rule._id);
-    Actions.remove(rule.actionId);
-    Triggers.remove(rule.triggerId);
+    // Delete the rule + its trigger + action server-side (see
+    // server/rulesButton.js `rules.deleteRule`): three client-side
+    // Collection.remove() calls were rejected with 403 "Access denied".
+    Meteor.call('rules.deleteRule', rule._id);
   },
 });

client/components/rules/triggers/boardTriggers.jade

@@ -106,6 +106,9 @@ template(name="boardCardTitlePopup")
     form
       label
         | {{_ 'boardCardTitlePopup-title'}}
-        input.js-card-filter-name(type="text" value=title autofocus)
+        //- #2345: cardTitleFilter is passed as the popup's data context by the
+        //- js-open-card-title-popup handler so reopening the popup shows the
+        //- filter that is already set (it used to always render empty).
+        input.js-card-filter-name(type="text" value=cardTitleFilter autofocus)
       input.js-card-filter-button.primary.wide(type="submit" value="{{_ 'set-filter'}}")
 

client/components/rules/triggers/boardTriggers.js

@@ -1,4 +1,31 @@
+import { TAPi18n } from '/imports/i18n';
 import { Utils } from '/client/lib/utils';
+import {
+  cardTitleFilterOrWildcard,
+  appendCardTitleFilterToDesc,
+} from '/models/lib/ruleCardTitleFilter';
+
+// #2345: fallback reference to the live boardTriggers template instance, so the
+// card-title-filter popup can still store its value even if the Blaze
+// data-context walk in Popup.getOpenerComponent() does not resolve (same
+// module-level pattern as cardActions.js' sharedCardColorButtonValue).
+let activeBoardTriggersTemplate = null;
+
+// #2345: the trigger description is assembled from the wizard's DOM text, which
+// never includes the card-title filter (it lives in a popup). Append it so the
+// created rule's details actually show the filter.
+function descWithCardTitleFilter(desc, cardTitle) {
+  let label = 'card title filter';
+  try {
+    const translated = TAPi18n.__('boardCardTitlePopup-title');
+    if (translated && translated !== 'boardCardTitlePopup-title') {
+      label = translated.toLowerCase();
+    }
+  } catch (e) {
+    // keep the English fallback label
+  }
+  return appendCardTitleFilterToDesc(desc, cardTitle, label);
+}
 
 Template.boardTriggers.onCreated(function () {
   this.provaVar = new ReactiveVar('');
@@ -7,6 +34,13 @@ Template.boardTriggers.onCreated(function () {
   this.setNameFilter = (name) => {
     this.cardTitleFilters[this.currentPopupTriggerId] = name;
   };
+  activeBoardTriggersTemplate = this;
+});
+
+Template.boardTriggers.onDestroyed(function () {
+  if (activeBoardTriggersTemplate === this) {
+    activeBoardTriggersTemplate = null;
+  }
 });
 
 Template.boardTriggers.events({
@@ -14,16 +48,24 @@ Template.boardTriggers.events({
     const funct = Popup.open('boardCardTitle');
     const divId = $(event.currentTarget.parentNode.parentNode).attr('id');
     tpl.currentPopupTriggerId = divId;
-    funct.call(this, event);
+    // #2345: hand the already-stored filter to the popup as its data context so
+    // reopening it shows the current value instead of an empty input.
+    funct.call({ cardTitleFilter: tpl.cardTitleFilters[divId] || '' }, event);
   },
   'click .js-add-create-trigger'(event, tpl) {
-    const desc = Utils.getTriggerActionDesc(event, tpl);
     const datas = Template.currentData();
     const listName = tpl.find('#create-list-name').value;
     const swimlaneName = tpl.find('#create-swimlane-name').value;
     const boardId = Session.get('currentBoard');
     const divId = $(event.currentTarget.parentNode).attr('id');
-    const cardTitle = tpl.cardTitleFilters[divId];
+    // #2345: an unset/empty filter is stored as the '*' wildcard so the trigger
+    // document always carries a cardTitle field (the server matches with
+    // cardTitle: { $in: [...] }, which a document missing the field never satisfies).
+    const cardTitle = cardTitleFilterOrWildcard(tpl.cardTitleFilters[divId]);
+    const desc = descWithCardTitleFilter(
+      Utils.getTriggerActionDesc(event, tpl),
+      cardTitle,
+    );
     // move to generic funciont
     datas.triggerVar.set({
       activityType: 'createCard',
@@ -36,13 +78,16 @@ Template.boardTriggers.events({
   },
   'click .js-add-moved-trigger'(event, tpl) {
     const datas = Template.currentData();
-    const desc = Utils.getTriggerActionDesc(event, tpl);
     const swimlaneName = tpl.find('#create-swimlane-name-2').value;
     const actionSelected = tpl.find('#move-action').value;
     const listName = tpl.find('#move-list-name').value;
     const boardId = Session.get('currentBoard');
     const divId = $(event.currentTarget.parentNode).attr('id');
-    const cardTitle = tpl.cardTitleFilters[divId];
+    const cardTitle = cardTitleFilterOrWildcard(tpl.cardTitleFilters[divId]);
+    const desc = descWithCardTitleFilter(
+      Utils.getTriggerActionDesc(event, tpl),
+      cardTitle,
+    );
     if (actionSelected === 'moved-to') {
       datas.triggerVar.set({
         activityType: 'moveCard',
@@ -68,27 +113,44 @@ Template.boardTriggers.events({
   },
   'click .js-add-gen-moved-trigger'(event, tpl) {
     const datas = Template.currentData();
-    const desc = Utils.getTriggerActionDesc(event, tpl);
     const boardId = Session.get('currentBoard');
+    const divId = $(event.currentTarget.parentNode).attr('id');
+    // #2345: this trigger ignored the card-title-filter popup entirely AND
+    // stored no cardTitle field at all — and since the server matches triggers
+    // with cardTitle: { $in: [...] }, a moveCard trigger without the field
+    // never fired for any card. Store the filter (or the '*' wildcard).
+    const cardTitle = cardTitleFilterOrWildcard(tpl.cardTitleFilters[divId]);
+    const desc = descWithCardTitleFilter(
+      Utils.getTriggerActionDesc(event, tpl),
+      cardTitle,
+    );
 
     datas.triggerVar.set({
       activityType: 'moveCard',
       boardId,
+      cardTitle,
       swimlaneName: '*',
       listName: '*',
       oldListName: '*',
       desc,
     });
   },
-  'click .js-add-arc-trigger'(event, tpl) {
+  'click .js-add-arch-trigger'(event, tpl) {
     const datas = Template.currentData();
-    const desc = Utils.getTriggerActionDesc(event, tpl);
     const actionSelected = tpl.find('#arch-action').value;
     const boardId = Session.get('currentBoard');
+    const divId = $(event.currentTarget.parentNode).attr('id');
+    // #2345: the archive/unarchive trigger also dropped the card-title filter.
+    const cardTitle = cardTitleFilterOrWildcard(tpl.cardTitleFilters[divId]);
+    const desc = descWithCardTitleFilter(
+      Utils.getTriggerActionDesc(event, tpl),
+      cardTitle,
+    );
     if (actionSelected === 'archived') {
       datas.triggerVar.set({
         activityType: 'archivedCard',
         boardId,
+        cardTitle,
         desc,
       });
     }
@@ -96,6 +158,7 @@ Template.boardTriggers.events({
       datas.triggerVar.set({
         activityType: 'restoredCard',
         boardId,
+        cardTitle,
         desc,
       });
     }
@@ -104,15 +167,27 @@ Template.boardTriggers.events({
 
 Template.boardCardTitlePopup.events({
   submit(event) {
+    // #2345: preventDefault FIRST — if anything below throws, a real form
+    // submit would reload the page and silently drop the filter.
+    event.preventDefault();
     const title = $(event.target)
       .find('.js-card-filter-name')
       .val()
       .trim();
-    const opener = Popup.getOpenerComponent();
-    if (opener?.setNameFilter) {
+    let opener = null;
+    try {
+      opener = Popup.getOpenerComponent();
+    } catch (e) {
+      opener = null;
+    }
+    if (!opener || typeof opener.setNameFilter !== 'function') {
+      // #2345: fall back to the live boardTriggers instance when the Blaze
+      // data-context walk cannot resolve the opener.
+      opener = activeBoardTriggersTemplate;
+    }
+    if (opener && typeof opener.setNameFilter === 'function') {
       opener.setNameFilter(title);
     }
-    event.preventDefault();
     Popup.back();
   },
 });

client/components/settings/adminFeatures.jade

@@ -0,0 +1,101 @@
+template(name="adminFeatures")
+  .setting-content
+    unless currentUser.isAdmin
+      | {{_ 'error-notAuthorized'}}
+    else
+      .content-title.ext-box
+        span
+          span.emoji-icon
+          i.fa.fa-flask
+          | {{_ 'features'}}
+      .content-body
+        .side-menu
+          ul
+            li(class="{{#if isPerformanceActive}}active{{/if}}")
+              a.js-features-menu(data-id="performance")
+                span.emoji-icon
+                i.fa.fa-tachometer
+                | {{_ 'features-performance'}}
+            li(class="{{#if isSecurityActive}}active{{/if}}")
+              a.js-features-menu(data-id="security")
+                span.emoji-icon
+                i.fa.fa-shield
+                | {{_ 'features-security'}}
+            li(class="{{#if isNotificationsActive}}active{{/if}}")
+              a.js-features-menu(data-id="notifications")
+                span.emoji-icon
+                i.fa.fa-bell
+                | {{_ 'features-notifications'}}
+        .main-body
+          if isPerformanceActive
+            ul.setting-detail
+              li.layout-form
+                .title {{_ 'cards-loading'}}
+                .form-group
+                  select#cards-loading.js-cards-loading
+                    each cardsLoadingOptions
+                      if this.selected
+                        option(value="{{value}}" selected) {{_ label}}
+                      else
+                        option(value="{{value}}") {{_ label}}
+                p.description {{_ 'cards-loading-description'}}
+                p.description {{_ 'cards-loading-lazy-note'}}
+          if isSecurityActive
+            ul.setting-detail
+              li
+                a.flex.js-toggle-render-links-as-plain-text
+                  .materialCheckBox(class="{{#if renderLinksAsPlainText}}is-checked{{/if}}")
+                  span {{_ 'render-links-as-plain-text'}}
+                p.description {{_ 'render-links-as-plain-text-description'}}
+              li
+                a.flex.js-toggle-always-show-code-as-text
+                  .materialCheckBox(class="{{#if alwaysShowCodeAsText}}is-checked{{/if}}")
+                  span {{_ 'always-show-code-as-text'}}
+                p.description {{_ 'always-show-code-as-text-description'}}
+              li
+                a.flex.js-toggle-disable-all-import
+                  .materialCheckBox(class="{{#if disableAllImport}}is-checked{{/if}}")
+                  span {{_ 'disable-all-import'}}
+                p.description {{_ 'disable-all-import-description'}}
+              li
+                a.flex.js-toggle-disable-all-export
+                  .materialCheckBox(class="{{#if disableAllExport}}is-checked{{/if}}")
+                  span {{_ 'disable-all-export'}}
+                p.description {{_ 'disable-all-export-description'}}
+              li
+                a.flex.js-toggle-disable-import-avatars
+                  .materialCheckBox(class="{{#if disableImportAvatars}}is-checked{{/if}}")
+                  span {{_ 'disable-import-avatars'}}
+                p.description {{_ 'disable-import-avatars-description'}}
+              li
+                a.flex.js-toggle-disable-export-avatars
+                  .materialCheckBox(class="{{#if disableExportAvatars}}is-checked{{/if}}")
+                  span {{_ 'disable-export-avatars'}}
+                p.description {{_ 'disable-export-avatars-description'}}
+              li
+                a.flex.js-toggle-anonymize-import-users
+                  .materialCheckBox(class="{{#if anonymizeImportUsers}}is-checked{{/if}}")
+                  span {{_ 'anonymize-import-users'}}
+                p.description {{_ 'anonymize-import-users-description'}}
+              li
+                a.flex.js-toggle-anonymize-export-users
+                  .materialCheckBox(class="{{#if anonymizeExportUsers}}is-checked{{/if}}")
+                  span {{_ 'anonymize-export-users'}}
+                p.description {{_ 'anonymize-export-users-description'}}
+          if isNotificationsActive
+            ul.setting-detail
+              li
+                a.flex.js-toggle-disable-activities
+                  .materialCheckBox(class="{{#if disableActivities}}is-checked{{/if}}")
+                  span {{_ 'disable-activities'}}
+                p.description {{_ 'disable-activities-description'}}
+              li
+                a.flex.js-toggle-disable-notifications
+                  .materialCheckBox(class="{{#if disableNotifications}}is-checked{{/if}}")
+                  span {{_ 'disable-notifications'}}
+                p.description {{_ 'disable-notifications-description'}}
+              li
+                a.flex.js-toggle-disable-watch
+                  .materialCheckBox(class="{{#if disableWatch}}is-checked{{/if}}")
+                  span {{_ 'disable-watch'}}
+                p.description {{_ 'disable-watch-description'}}

client/components/settings/adminFeatures.js

@@ -0,0 +1,118 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { ReactiveVar } from 'meteor/reactive-var';
+import Settings from '/models/settings';
+
+// Admin Panel / Features — a home for optional / performance / tier-gated
+// capabilities. First entry: "Card loading" (all | lazy), which also mirrors the
+// CARDS_LOADING env var. Grouped by category in the side menu so more feature
+// toggles (and, later, pricing-tier gating) can be added here.
+Template.adminFeatures.onCreated(function () {
+  this.activePane = new ReactiveVar('performance');
+  Meteor.subscribe('setting');
+});
+
+Template.adminFeatures.helpers({
+  isPerformanceActive() {
+    return Template.instance().activePane.get() === 'performance';
+  },
+  isSecurityActive() {
+    return Template.instance().activePane.get() === 'security';
+  },
+  isNotificationsActive() {
+    return Template.instance().activePane.get() === 'notifications';
+  },
+  cardsLoadingOptions() {
+    const current = (ReactiveCache.getCurrentSetting() || {}).cardsLoading || 'all';
+    return [
+      { value: 'all', label: 'cards-loading-all', selected: current === 'all' },
+      { value: 'lazy', label: 'cards-loading-lazy', selected: current === 'lazy' },
+    ];
+  },
+  renderLinksAsPlainText() {
+    return (ReactiveCache.getCurrentSetting() || {}).renderLinksAsPlainText;
+  },
+  alwaysShowCodeAsText() {
+    return (ReactiveCache.getCurrentSetting() || {}).alwaysShowCodeAsText;
+  },
+  disableAllImport() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableAllImport;
+  },
+  disableAllExport() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableAllExport;
+  },
+  disableImportAvatars() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableImportAvatars;
+  },
+  disableExportAvatars() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableExportAvatars;
+  },
+  anonymizeImportUsers() {
+    return (ReactiveCache.getCurrentSetting() || {}).anonymizeImportUsers;
+  },
+  anonymizeExportUsers() {
+    return (ReactiveCache.getCurrentSetting() || {}).anonymizeExportUsers;
+  },
+  disableActivities() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableActivities;
+  },
+  disableNotifications() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableNotifications;
+  },
+  disableWatch() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableWatch;
+  },
+});
+
+// Toggle one boolean setting field, saving immediately.
+function toggleSettingField(field) {
+  const setting = ReactiveCache.getCurrentSetting();
+  if (setting) {
+    Settings.update(setting._id, { $set: { [field]: !setting[field] } });
+  }
+}
+
+Template.adminFeatures.events({
+  'click .js-features-menu'(event, tpl) {
+    tpl.activePane.set(event.currentTarget.dataset.id);
+  },
+  'change .js-cards-loading'(event) {
+    const value = event.currentTarget.value === 'lazy' ? 'lazy' : 'all';
+    const setting = ReactiveCache.getCurrentSetting();
+    if (setting) {
+      Settings.update(setting._id, { $set: { cardsLoading: value } });
+    }
+  },
+  'click .js-toggle-render-links-as-plain-text'() {
+    toggleSettingField('renderLinksAsPlainText');
+  },
+  'click .js-toggle-always-show-code-as-text'() {
+    toggleSettingField('alwaysShowCodeAsText');
+  },
+  'click .js-toggle-disable-all-import'() {
+    toggleSettingField('disableAllImport');
+  },
+  'click .js-toggle-disable-all-export'() {
+    toggleSettingField('disableAllExport');
+  },
+  'click .js-toggle-disable-import-avatars'() {
+    toggleSettingField('disableImportAvatars');
+  },
+  'click .js-toggle-disable-export-avatars'() {
+    toggleSettingField('disableExportAvatars');
+  },
+  'click .js-toggle-anonymize-import-users'() {
+    toggleSettingField('anonymizeImportUsers');
+  },
+  'click .js-toggle-anonymize-export-users'() {
+    toggleSettingField('anonymizeExportUsers');
+  },
+  'click .js-toggle-disable-activities'() {
+    toggleSettingField('disableActivities');
+  },
+  'click .js-toggle-disable-notifications'() {
+    toggleSettingField('disableNotifications');
+  },
+  'click .js-toggle-disable-watch'() {
+    toggleSettingField('disableWatch');
+  },
+});