Lauri Ojansivu 5c1f6088f4 Fix CreateBleed: "Only admins can create boards" holds on every path. ...

GHSA-qcfm-2g4w-wqcc. Admin Panel / Settings / Visibility / "Only admins
can create boards" (#4475) was checked only inside
createBoardWithInitialSwimlanes, the Add Board form. A non-admin still
created working boards by a client Boards.insert (Boards.allow.insert
approves any signed-in user), POST /api/boards and both board import
routes, as reported, and also by importBoard, cloneBoard, copyBoard,
POST /api/boards/:boardId/copy and createBoardFromCard.

One decision (models/lib/boardCreationPolicy.js) and one guard
(server/lib/boardCreationGuard.js) are asked by every one of those paths
before they write, and by a new Boards.deny insert rule. A board template
stays every member's own; boards WeKan makes itself (a Templates container,
a board's subtasks board) are not created by the user. A REST refusal is
403. A refusal is recorded in Admin Panel / Problems as CreateBleed
(authz.board-creation, low, CWE-863, blocks no account), and Duplicate and
"Create board from card" are hidden like Add Board, so only a client
bypassing the interface reaches it.

tests/createBleed.test.cjs drives the decision, the guard and the real deny
rule against the reporter's console insert, and fails if any path that
creates a board for a user does not ask the guard, or if anything else
reads the setting. tests/playwright/specs/createbleed-board-creation-admin-only.e2e.js
replays the report against a running server. The guards that pinned the
old inline check now pin the shared one.

Thanks to tsurutanmen and xet7 !

2026-11-07 00:51:53 +02:00

..

apiImport

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

fsHooks

Fix GitHub code scanning code-quality findings.

2026-11-02 14:15:02 +02:00

grid

New features:

2026-06-06 07:21:59 +03:00

accountEmailHtml.js

E-mails in the clear HTML layout by default: notifications and account mail.

2026-10-14 14:33:10 +03:00

accountLockout.js

Admin Panel / People shows who is locked again, and why.

2026-08-16 15:05:00 +03:00

accountWebhook.js

Admin Panel: a login and registration webhook, off by default.

2026-10-14 14:25:19 +03:00

actionItems.js

Checklist from description, action items, and search phrases.

2026-10-17 16:25:51 +03:00

activityCardLink.js

Fix #3144: an archived card is still named in its own history.

2026-08-12 16:01:51 +03:00

activityFeed.js

Activity feed: every sentence names what it is about.

2026-10-14 22:57:31 +03:00

activityPub.js

ActivityPub: a public board can be followed from Mastodon and the fediverse.

2026-10-14 16:46:15 +03:00

addressReportColumns.js

Admin Panel / Problems: "IPv6 location" and "Instrumentation" are translated.

2026-10-20 10:37:03 +03:00

adminAudit.js

Admin Panel / People / Audit log: what site administrators did.

2026-10-31 00:09:20 +02:00

adminOnlyCustomFields.js

Add read-only custom fields that every member sees and only admins set.

2026-10-08 12:05:59 +03:00

adminUrls.js

Admin Panel / Problems / Password length names itself in the title bar.

2026-10-31 15:18:11 +02:00

allBoardsFacets.js

All Boards groups boards by first character, organization, team and board label.

2026-10-14 15:25:36 +03:00

allBoardsSidebar.js

All Boards: Search and Multi-Selection become the board header's controls.

2026-07-31 07:14:52 +03:00

allBoardsUrls.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

allBoardsView.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

apiImportServices.js

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

apiLogout.js

Fix #2769 #1992 #2292 #2494 #1853 #1554 #2306 #1437.

2026-07-17 03:34:23 +03:00

apiUsage.js

Enforce Amiga-safe filenames on every read

2026-09-06 02:28:46 +03:00

archiveContributions.js

Show archived-card contributions in Pulse

2026-09-28 23:56:20 +03:00

attachedCards.js

Give the Attach card popup its title, and audit attached cards in the inventories.

2026-10-10 15:05:21 +03:00

attachmentBackwardCompatibility.js

- **Fixed Admin Panel / Attachments / Move Attachment doing nothing / crashing.**

2026-06-06 02:06:16 +03:00

attachmentKind.js

Preview ZIP contents from cards and Files Report

2026-09-25 02:29:43 +03:00

attachmentMeta.js

Remove obsolete Summernote integration and editor configuration.

2026-09-19 14:32:29 +03:00

attachmentRetention.js

Attachment retention: delete card attachments after N days, purge deleted ones after M days - in Admin Panel too.

2026-10-20 13:28:17 +03:00

attachmentSoftDelete.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

attachmentStoragePath.js

Single-file WeKan for every platform with a Node.js bundle.

2026-10-13 21:08:09 +03:00

attachmentStoreStrategy.js

Fix #5504: deleted-attachment notification credits the deleter

2026-06-20 17:45:43 +03:00

attachmentThumbnail.js

Serve image attachments as thumbnails at /cdn/storage/attachments/<id>/thumbnail.

2026-09-29 16:05:24 +03:00

attachmentTile.cjs

Declutter the opened card, attachments too, and fit Card Settings on the screen.

2026-10-22 19:15:36 +03:00

attachmentUploadAuth.js

StampBleed and UploadBleed: documents on one's own card stamped with another board, and unauthorized attachment uploads.

2026-10-27 15:38:58 +02:00

attachmentUploadPolicy.js

A card no longer offers the attachment "+" when uploads are blocked for the whole site.

2026-11-04 19:07:09 +02:00

attachmentUrlValidation.js

Fix SyncBleed: send List Sync requests through the SSRF guard and keep responses out of errors.

2026-10-02 09:46:00 +03:00

authConfigCatalog.js

Admin Panel / Problems / Password length, and a changed password signs every session out.

2026-10-31 14:54:22 +02:00

authenticationMethod.js

Read login secrets from *_FILE, and let the Admin Panel override DEFAULT_AUTHENTICATION_METHOD.

2026-10-05 21:11:12 +03:00

autoArchive.js

Archive cards automatically after a chosen number of days without activity.

2026-09-29 16:40:48 +03:00

avatarColor.js

Minicard avatars in the order people were added, each with its own colour.

2026-10-14 13:40:15 +03:00

avatarDisplayUrl.js

UCS: avatars show again after an upgrade, and lazily loaded code is fetched from the page's own address.

2026-10-12 01:30:07 +03:00

avatarUrlSafety.js

Tests: unit + negative tests for the avatar/import-export feature; extract pure logic

2026-07-13 09:16:33 +03:00

backupLease.js

Continuous backup runs on one server at a time, with a lease.

2026-11-04 19:11:32 +02:00

backupPaths.js

Single-file WeKan for every platform with a Node.js bundle.

2026-10-13 21:08:09 +03:00

backupRuns.js

Backup status: every run recorded, failures and overdue backups shown, old local backups pruned - in Admin Panel too.

2026-10-20 13:30:00 +03:00

base64Chunk.js

Unit + negative tests for newest features (lazy loading, streaming export, backup)

2026-07-11 00:14:49 +03:00

basecampApiFormat.js

Fix three guards the last commits tripped.

2026-10-14 23:23:07 +03:00

blocklyMessageKeys.json

Update the small npm dependencies, and translate Blockly 13.4's toolbox search.

2026-10-22 06:01:28 +03:00

boardAnnouncement.js

Give each board an announcement of its own.

2026-10-08 12:19:38 +03:00

boardBackground.js

Restore models/lib/boardBackground.js, which the BackgroundBleed fix overwrote.

2026-10-02 11:16:50 +03:00

boardBackgroundOwnership.js

Restore models/lib/boardBackground.js, which the BackgroundBleed fix overwrote.

2026-10-02 11:16:50 +03:00

boardCardScope.js

Board role permissions apply to every board view and every path to a card.

2026-10-16 13:03:34 +03:00

boardCopyDefaults.js

Board Settings / Subtasks: pick the swimlane new subtasks land in.

2026-10-14 14:19:52 +03:00

boardCopyOptions.js

Remap Scrum data when duplicating boards

2026-09-27 18:41:14 +03:00

boardCopyProperties.js

Refuse board-copy properties that could replace the source board's identity.

2026-09-29 15:12:12 +03:00

boardCreationPolicy.js

Fix CreateBleed: "Only admins can create boards" holds on every path.

2026-11-07 00:51:53 +02:00

boardDragging.js

Add per-board draggable settings for board objects

2026-09-25 23:51:28 +03:00

boardGroupLinks.js

A board admin may add only the organizations and teams they belong to.

2026-10-14 15:04:41 +03:00

boardInvites.js

Leaving a board that came through a team hides it, restorably.

2026-10-14 15:01:14 +03:00

boardItemUrl.js

Link to a swimlane or a list, the way you can link to a card.

2026-07-31 16:04:18 +03:00

boardKey.js

Give old boards their keys in one pass, not one query per board.

2026-10-14 13:13:55 +03:00

boardLayoutMount.js

Large board: open and close a card by its address without re-creating the board.

2026-10-07 03:08:48 +03:00

boardMap.js

Add a Map board view: cards as markers on an uploaded image.

2026-09-29 17:43:58 +03:00

boardMemberMapPlan.js

Custom board roles, and team memberships that leave with the team.

2026-10-14 08:20:49 +03:00

boardMutationGuard.js

Boards every signed-in user may edit, per-list permissions, board keys and shared labels.

2026-10-14 09:28:45 +03:00

boardNotificationRecipients.js

Honor scoped notification subscriptions and settings.

2026-09-17 13:05:45 +03:00

boardPermission.js

Add semi-open boards, visible to every signed-in user.

2026-09-29 16:28:44 +03:00

boardReadAccess.js

Custom board roles, and team memberships that leave with the team.

2026-10-14 08:20:49 +03:00

boardRepair.js

Fix #6515: the startup/board-open repair no longer unbinds per-swimlane lists.

2026-07-23 15:03:42 +03:00

boardRoleCapabilities.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

boardScopedSelection.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

boardSettingsColumns.js

Admin Panel / Settings / Visibility / Features: choose which card fields every board shows.

2026-10-08 08:54:04 +03:00

boardSortReorder.js

All Boards: a live drop gap that follows the drag, in place, not just at the end.

2026-07-24 08:06:14 +03:00

boardSummary.js

Summary, Since your last visit, At risk, Suggested members and Forecast.

2026-10-17 15:52:26 +03:00

boardTileData.js

Startup schema upgrade, self-healing attachments, migration speed; fix

2026-07-17 03:07:59 +03:00

boardTimeline.js

Add pure board-timeline reconstruction from the Activities log.

2026-09-10 21:41:46 +03:00

boardViewSettings.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

boardVisibility.js

Share board read authorization

2026-09-03 15:34:41 +03:00

boardVisibilitySelectors.js

Show private starred boards in the header Favorites popup.

2026-10-12 22:21:30 +03:00

boardWriteGuards.js

Fix GroupLinkBleed: board admins can no longer attach foreign teams or add members by direct board writes.

2026-11-06 16:15:34 +02:00

botRuns.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

brokenCardsRepair.js

Add a Repair button for "Broken cards N" in Admin Panel / Problems / Summary.

2026-07-24 03:23:37 +03:00

browserRootUrl.js

Copy links use the address the browser reached WeKan by when ROOT_URL is loopback.

2026-10-08 14:04:48 +03:00

businessmapFormat.js

Import and export boards as Businessmap (Kanbanize) Excel workbooks.

2026-10-08 21:49:11 +03:00

buttonRulePermission.js

Board role permissions apply to every board view and every path to a card.

2026-10-16 13:03:34 +03:00

caldavSync.js

CalDAV: a board's card due dates in Nextcloud Calendar or any CalDAV calendar.

2026-10-14 16:46:29 +03:00

calendarBaseOptions.js

The Calendar and Multi Board Calendar views share their calendar options.

2026-10-17 00:54:02 +03:00

calendarFilter.js

Board view fixes, and failed calls reported in the reader's language.

2026-10-17 01:01:34 +03:00

calendarMode.js

Add Calendar Mode to the Board View menu, below Calendar: Trello's calendar.

2026-10-10 14:31:28 +03:00

canaryTokens.js

Card links never launch an OS handler with a code-execution history.

2026-10-30 01:19:16 +02:00

cardChildrenBoard.js

Comments, reactions, text notes and attachments follow a card moved to another board.

2026-10-21 15:30:41 +03:00

cardCopyDestination.js

Validate server card-copy destinations before reads and writes

2026-09-29 00:13:43 +03:00

cardCopyOverrides.js

Restrict card-copy overrides to text and preserve the source

2026-09-29 00:04:16 +03:00

cardCreationActivity.js

Persist Sync creation activities with separate delivery acknowledgement

2026-09-28 04:04:25 +03:00

cardDateRange.js

Add rolling creation and modification date filters

2026-09-28 18:04:52 +03:00

cardDisplayColor.js

Let a list colour the cards that have no colour of their own.

2026-10-08 12:15:49 +03:00

cardDocument.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

cardDrawing.js

Drawing: the whole window to draw on, growing from its corner, with zoom, any color and Save above it; Drawing in Add Card's Search / Template / Drawing / More options.

2026-10-25 08:56:20 +02:00

cardExportDocument.js

Fix custom-field interactions and deleted-field exports.

2026-08-18 18:10:47 +03:00

cardFieldOrder.js

Card Settings: two panes, the card and the minicard follow their order, menus inline.

2026-10-29 02:02:54 +02:00

cardFieldVisibility.js

Admin Panel / Settings / Visibility / Features: choose which card fields every board shows.

2026-10-08 08:54:04 +03:00

cardForecast.js

Summary, Since your last visit, At risk, Suggested members and Forecast.

2026-10-17 15:52:26 +03:00

cardKinds.js

Story and Task cards, with custom fields of their own.

2026-10-14 15:26:00 +03:00

cardLinkRedirect.js

Convert client-reachable CJS helpers from CommonJS to ES modules (2/2).

2026-07-23 18:59:30 +03:00

cardListEntry.js

Track column entry time and filter old cards by list

2026-09-28 17:40:49 +03:00

cardListEntryHistory.js

Recover legacy card column entry dates from movement history

2026-09-28 17:48:00 +03:00

cardMovementRange.js

Filter cards by recorded historical movement dates

2026-09-28 18:19:22 +03:00

cardMoveModifier.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

cardNumberAssign.js

Card numbers: a card moved to another board, restored or given a number cannot take one another card has.

2026-11-02 12:42:33 +02:00

cardParents.js

Let a card be a subtask of several parent cards.

2026-09-29 17:59:21 +03:00

cardRecurrenceSchedule.js

Add Kanboard-style whole-card recurrence.

2026-09-10 22:11:01 +03:00

cardRisk.js

Summary, Since your last visit, At risk, Suggested members and Forecast.

2026-10-17 15:52:26 +03:00

cardSearch.js

Board search: match the typed text, not a regular expression.

2026-10-27 21:15:51 +02:00

cardSearchRanking.js

Bound high-volume database queries

2026-08-25 15:40:39 +03:00

cardSettingsCustomFields.js

Card Settings: a checkbox per section, always every field, only in Board Settings.

2026-10-28 22:43:29 +02:00

cardSettingsRows.js

Requested by and Assigned by show on the minicard when a member was picked, with the same icon everywhere.

2026-11-05 20:55:28 +02:00

cardSettingsSections.js

Card Settings: two panes, the card and the minicard follow their order, menus inline.

2026-10-29 02:02:54 +02:00

cardSettingsSplit.js

Card Settings: two panes, the card and the minicard follow their order, menus inline.

2026-10-29 02:02:54 +02:00

cardShownFields.js

Card Settings: a checkbox per section, always every field, only in Board Settings.

2026-10-28 22:43:29 +02:00

cardsLoading.js

A filter no longer leaves a spinner turning over an empty list, and a half-arrived card is not drawn as a blank box.

2026-07-31 04:09:40 +03:00

cardSortRepair.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

cardSortTiebreaker.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

cardUrl.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

cardUrlAutolink.js

Fix 8 GitHub CodeQL code-scanning alerts: incomplete escaping, URL

2026-09-10 21:20:46 +03:00

cardWindowDiff.js

Refresh lazy card windows after card changes

2026-08-28 17:40:10 +03:00

cardWindowFields.js

Make large boards fast on 8 GB: load only what is visible, stop re-running every minicard, and stream big attachments.

2026-10-09 13:28:08 +03:00

changeHistoryGroups.js

History on FerretDB: date paths are stored as strings, and the migration reports refused documents.

2026-10-29 16:58:21 +02:00

changeHistoryIntegrity.js

A list move with no swimlane no longer fails its own history checksum.

2026-10-22 19:15:36 +03:00

changeHistoryQuery.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

chartCalculations.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

chartExportRows.js

Export scoped daily Scrum observations to Excel and PDF

2026-09-27 22:27:51 +03:00

chatView.js

Chat view: channels are the cards with a conversation, on every board, with unread counts.

2026-10-14 23:08:22 +03:00

checklistBulkCheck.js

Add "Check all items" / "Uncheck all items" to the checklist action menu.

2026-09-10 20:40:17 +03:00

checklistItemsAsText.js

Let a checklist's items be bulk-edited as plain text, one line per item.

2026-09-10 19:52:40 +03:00

checklistItemSchedule.js

Checklist items get a person responsible, and dated items show in the calendar and Gantt.

2026-10-14 15:24:57 +03:00

checklistItemTitles.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

checklistItemToCard.js

Dragging a checklist item onto a list creates a new card from its text.

2026-09-10 20:11:47 +03:00

checklistResetSchedule.js

Add a per-checklist automatic-reset schedule (daily/weekly/monthly).

2026-09-10 20:20:35 +03:00

checklistTemplateCopy.js

Extract the checklist-template append/copy document builders as pure functions, with tests.

2026-09-10 20:02:49 +03:00

clickupCsvFormat.js

Fix the code scanning and Dependabot alerts of 2026-10-10.

2026-10-10 00:45:30 +03:00

clientAccountCreation.js

Close the SignupBleed DDP sibling: a client sign-up cannot claim admin or LDAP creation.

2026-10-02 10:39:40 +03:00

cloudStorage.js

Attachments, avatars and backups in S3 can be encrypted at rest.

2026-10-31 00:12:09 +02:00

collectionFsStore.js

Stream files moved to or from the old CollectionFS storage.

2026-10-09 23:06:49 +03:00

columnSets.js

Column sets: the same cards in several named sets of columns.

2026-10-14 15:48:42 +03:00

commentActivity.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

commentBadgeTitle.js

Show a single comment in the minicard badge tooltip

2026-09-27 14:38:03 +03:00

commentCardBoundary.js

Bind comment inserts to the authorized card board

2026-09-14 11:49:40 +03:00

commentPrivateFields.js

Protect private webhook comment evidence across reads writes and copies

2026-09-28 12:55:11 +03:00

configResolver.js

Add Admin Panel overrides for LDAP_* environment variables, and a Test

2026-09-10 21:37:53 +03:00

continuousBackup.js

Continuous backup: encryption at rest, cloud upload, and a SQLite restore applied on restart.

2026-10-03 08:52:16 +03:00

contrastColor.js

Themes: every board theme and every color a member chooses is readable.

2026-11-03 12:37:10 +02:00

copiedComment.js

Protect private webhook comment evidence across reads writes and copies

2026-09-28 12:55:11 +03:00

cpuHighTracker.js

CPU-usage monitor + governor + Admin Panel / Problems / CPU usage report

2026-07-20 03:11:07 +03:00

createListParams.js

Fix add-list: Save did nothing (Match failed) + empty-swimlane + button (#6465).

2026-07-17 23:01:52 +03:00

cronSchedule.js

GitHub organization import: repositories, issues, releases, Actions, wiki.

2026-10-14 12:43:36 +03:00

crossBoardLabels.js

Bring a card's labels along when it moves or is copied to another board.

2026-10-08 12:01:22 +03:00

crossSiteRequest.js

A state-changing request that logs in only with the cookie must come from WeKan itself.

2026-10-30 23:52:09 +02:00

csvImportMapping.js

Ask for the columns of a CSV or Excel import, apply Owner, and import WeKan's own Excel export.

2026-10-09 12:52:21 +03:00

customFieldLinks.js

Link the custom fields of two cards, so a change on one is carried to the other.

2026-10-10 15:26:46 +03:00

customFieldsForBoard.cjs

Copying or linking a card carries only the custom field values of its new board.

2026-10-22 19:58:16 +03:00

customFieldsSum.js

Extend the list-header custom-field summary badge with min/max and a

2026-09-10 20:59:36 +03:00

customFieldStringTemplate.js

Stop a custom-field template regex from stopping the server (ReDoS).

2026-10-02 11:21:50 +03:00

customFieldsWD.js

Minicard: only the custom fields that have a value, as before.

2026-10-27 14:47:25 +02:00

customHeadMetaTags.js

Render the Admin Panel custom head meta tags, as meta elements only.

2026-10-08 11:41:59 +03:00

dailyClaim.js

Daily jobs run once per installation: notification cleanup and the file integrity audit.

2026-11-02 18:49:19 +02:00

databaseErrors.js

Database problems: a cleared connection pool is a lost connection; the board key backfill uses the key index.

2026-11-02 17:17:58 +02:00

databaseHealth.js

Database health: one server probes the database per period, so a finding is reported once.

2026-11-02 12:15:09 +02:00

dataHealth.js

Data health: custom fields whose boards were all deleted get their own check.

2026-10-28 13:50:49 +02:00

dateFormatPolicy.js

Move date format controls to global, board and member settings

2026-09-23 13:58:24 +03:00

defaultAvatarUrl.js

Show a default avatar from DEFAULT_AVATAR_URL for users without one.

2026-10-08 11:55:42 +03:00

defaultSwimlane.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

dependencyAccess.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

descriptionListItems.js

Checklist from description, action items, and search phrases.

2026-10-17 16:25:51 +03:00

diskHighTracker.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

diskSpace.js

Safe filename handling: display, upload, existing files, migrations

2026-07-20 03:11:07 +03:00

domainTablePage.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

dragHandles.js

Make the drag-handle toggle work on touch screens, and free the card body for panning.

2026-07-24 04:56:39 +03:00

dueDateShortcuts.js

Add previous-week and next-month due-date shortcuts

2026-09-28 18:23:09 +03:00

dueNotificationConfig.js

Set due-date reminder days and webhook delivery per board.

2026-09-29 13:44:54 +03:00

dueScanClaim.js

Full collection scans run once, not at every start of every server; due-date reminders are sent once.

2026-11-02 11:28:44 +02:00

dynamicImportOrigin.js

UCS: avatars show again after an upgrade, and lazily loaded code is fetched from the page's own address.

2026-10-12 01:30:07 +03:00

editCardWebhook.js

Send act-editCard to webhooks that opt in.

2026-10-02 15:09:58 +03:00

editorSubmitKey.js

Make text editors multiline and resizable with consistent Enter and theme behavior

2026-09-27 13:45:41 +03:00

emailBounce.js

Email bounces with Amazon SES, Problems -> Email, and runtime tests for sending and receiving.

2026-10-13 18:27:25 +03:00

emailBounceProviders.js

Email bounces from Mailgun, SendGrid, Postmark, Brevo, Mailjet, SparkPost, Mandrill and Resend.

2026-10-13 18:54:06 +03:00

emailDomainPolicy.js

Restrict OAuth login providers to email domains.

2026-10-08 11:48:01 +03:00

emailNotificationSafety.js

Wrap card/board URLs in HTML notification emails in real <a href> links.

2026-09-10 20:23:43 +03:00

emailToCard.js

Newest features' settings: on every release platform and in the Admin Panel, and kept that way.

2026-10-20 13:50:10 +03:00

emailView.js

Email view and Public Boards: a search shows its own results, never the last one's.

2026-10-15 04:14:10 +03:00

envSecretFiles.js

Read MONGO_URL_FILE, MAIL_URL_FILE and S3_SECRET_KEY_FILE instead of three dead secret files.

2026-10-08 11:07:58 +03:00

eventLogProblems.js

Stop Admin Panel / Problems showing a finished board-repair and info CPU rows.

2026-07-24 10:14:29 +03:00

eventLogSummary.js

Enforce Amiga-safe filenames on every read

2026-09-06 02:28:46 +03:00

exactFieldSelector.js

Prepare conditional field patches for durable Sync steps

2026-09-28 01:59:40 +03:00

exportAccess.js

Export scoped daily Scrum observations to Excel and PDF

2026-09-27 22:27:51 +03:00

exportAllBoards.js

Import and export many boards at once for every format, and document each format in its own directory.

2026-10-09 10:33:37 +03:00

exporterCsvRow.js

Add a multi-select dropdown custom field type, storing several chosen options.

2026-09-10 19:54:38 +03:00

exportFields.js

Include versioned Scrum data in native board exports

2026-09-27 18:24:38 +03:00

exportFilename.js

Name PDF and Excel exports by their localized scope.

2026-08-17 02:34:38 +03:00

exportMarkdown.js

Normalize markdown-it module interop.

2026-08-17 01:02:51 +03:00

externalExporters.js

CrossBoardExportBleed: a checklist scope stays on its board, and every export obeys Disable all export and Anonymize export users.

2026-11-01 14:00:19 +02:00

externalExportFormatters.js

Import Kanboard task links as parent cards and dependencies, and GitHub comments as card comments.

2026-10-09 12:27:59 +03:00

externalLinkAutolink.js

Add an admin-configurable external issue-tracker autolink for card text.

2026-09-10 20:44:45 +03:00

externalLinkRules.js

Autolink references with an identifier and abbreviations to other tools.

2026-10-08 12:22:43 +03:00

externalParsers.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

externalScrumPlanning.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

featureFlags.js

Keep Sync's rule, notification and webhook effects off unless enabled.

2026-09-30 02:00:42 +03:00

fileCacheHeaders.js

Fix CacheBleed: serve attachments and avatars as private, revalidated responses.

2026-10-02 08:42:18 +03:00

fileIntegrity.js

Filesystem integrity: is that still the file WeKan stored, and did this server stop cleanly?

2026-08-09 03:43:07 +03:00

filenameSanitizer.js

Make #6412 filename test negative-testable: extract pure helpers + Node test

2026-06-22 15:46:43 +03:00

fileResponseSafety.js

Hall of Fame regression audit: every fixed vulnerability still fixed, siblings of six of them closed.

2026-10-27 16:28:12 +02:00

filesRoot.js

Single-file WeKan for every platform with a Node.js bundle.

2026-10-13 21:08:09 +03:00

fileStoreConstants.js

WebDAV attachment storage: attachments in Nextcloud Files or any WebDAV server.

2026-10-14 16:46:59 +03:00

fileStoreStrategy.js

Lint for promises that are not awaited, handled or marked void.

2026-11-02 14:30:49 +02:00

fileTypeCorrection.js

Provide full MIME detection across server platforms

2026-09-20 21:06:30 +03:00

fileVersionFields.js

Hall of Fame regression audit: every fixed vulnerability still fixed, siblings of six of them closed.

2026-10-27 16:28:12 +02:00

filterPresetState.js

Register extensible card filters with versioned saved state

2026-09-28 18:47:02 +03:00

flowAnalytics.js

Preserve time history and record reversible move reasons

2026-09-26 23:00:58 +03:00

flowAnalyticsRows.js

Preserve time history and record reversible move reasons

2026-09-26 23:00:58 +03:00

flowHistory.js

Add directed duplicate card relationships and Jira import mapping

2026-09-28 17:23:15 +03:00

focalboardFormat.js

Import and export boards as Focalboard (Mattermost Boards) archive text.

2026-10-03 00:17:10 +03:00

framePolicy.js

FrameBleed follow-up: a 304 Not Modified no longer replaces a stored file's own Content-Security-Policy.

2026-10-27 20:57:38 +02:00

fullscreen.js

A full screen button in the header bar, to the right of the logo.

2026-11-04 00:27:28 +02:00

generateDefaultRuleTitle.js

Add Admin Panel setting to restrict board creation to admins only.

2026-09-10 19:45:52 +03:00

geoHeaders.js

Locations from Cloudflare keep their letters: "Dinkelsbühl", not "Dinkelsbühl".

2026-10-20 10:24:32 +03:00

githubActionsRules.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

githubCompatApi.js

Optional APIs: Trello, Jira, GitHub and Gitea compatible, off by default.

2026-10-14 13:11:23 +03:00

githubOrgImport.js

GitHub organization import: repositories, issues, releases, Actions, wiki.

2026-10-14 12:43:36 +03:00

githubWiki.js

GitHub organization import: repositories, issues, releases, Actions, wiki.

2026-10-14 12:43:36 +03:00

googlekeepApiFormat.js

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

googletasksApiFormat.js

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

groupBoardMembership.js

Custom board roles, and team memberships that leave with the team.

2026-10-14 08:20:49 +03:00

groupMembers.js

All Boards: a tab per organization and team, where their admins manage members.

2026-10-14 15:52:07 +03:00

helperBoards.js

Public Boards no longer lists the internal Subtasks boards.

2026-07-31 04:09:41 +03:00

historyLegacyAppend.js

A list move with no swimlane no longer fails its own history checksum.

2026-10-22 19:15:36 +03:00

historyReadScope.js

Enforce current access when reading and restoring universal History

2026-09-27 17:38:27 +03:00

httpRange.js

Make large boards fast on 8 GB: load only what is visible, stop re-running every minicard, and stream big attachments.

2026-10-09 13:28:08 +03:00

httpsConfig.js

Serve HTTPS from WeKan itself, when a certificate is configured.

2026-10-14 08:25:25 +03:00

httpStream.js

SVG of any size is sanitized whole, streaming: on upload, on validation and on every serve.

2026-10-25 07:23:31 +02:00

icalExport.js

Add a per-board iCal (.ics) export feed, answering #2836.

2026-09-10 20:35:37 +03:00

idleLogout.js

Sign a browser session out after it has been idle for LOGOUT_IDLE_MINUTES.

2026-10-31 00:08:20 +02:00

impersonationReportQuery.js

Tests for newest Security/Reports features (positive + negative)

2026-07-14 17:01:35 +03:00

importAttachmentAuth.js

Import: attachment files of Jira, Nextcloud Deck, OpenProject, Asana and GitLab.

2026-10-15 01:27:26 +03:00

importAttachmentDownload.js

Import: attachment files of Jira, Nextcloud Deck, OpenProject, Asana and GitLab.

2026-10-15 01:27:26 +03:00

importDeadline.js

Large Jira exports import, and an existing board can be saved as a board template.

2026-10-21 15:30:32 +03:00

importedAttachmentsByCard.js

Audit menu actions and repair import data loss and policy enforcement

2026-09-23 19:49:33 +03:00

importedBoardMemberPlan.js

Custom board roles, and team memberships that leave with the team.

2026-10-14 08:20:49 +03:00

importedBoardPermission.js

Add semi-open boards, visible to every signed-in user.

2026-09-29 16:28:44 +03:00

importedCardChildren.js

Record what an external import could not bring over in Problems -> Recovery.

2026-09-29 09:26:20 +03:00

importedCardDates.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

importedTableRows.js

Audit menu actions and repair import data loss and policy enforcement

2026-09-23 19:49:33 +03:00

importedTaskPlan.js

Import and export boards as Kanri JSON.

2026-10-08 21:08:40 +03:00

importedUserReconciliationPlan.js

Tests: unit + negative tests for the avatar/import-export feature; extract pure logic

2026-07-13 09:16:33 +03:00

importExportBoundary.js

A failed import or export disables an account only when it was an attempt.

2026-10-22 04:56:40 +03:00

importExportSecurity.js

CrossBoardExportBleed: a checklist scope stays on its board, and every export obeys Disable all export and Anonymize export users.

2026-11-01 14:00:19 +02:00

importLossReport.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

importManyFiles.js

Read every import source through one path and one file chooser, from one description of the sources.

2026-10-09 13:13:37 +03:00

importMembersMode.js

Import placeholders take a person's name where the file gives one; import browser tests follow the people choice.

2026-10-10 12:21:36 +03:00

importParts.js

Import: attachment files of Jira, Nextcloud Deck, OpenProject, Asana and GitLab.

2026-10-15 01:27:26 +03:00

importPipeline.js

Record every board import before its first write, and let an admin keep or discard an interrupted one.

2026-10-08 12:44:46 +03:00

importPlacement.js

ImportPlacementBleed: an import into a board is placed only beside that board's own list, swimlane or card.

2026-10-29 20:27:14 +02:00

importSources.js

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

importSourceShape.js

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

importSplit.js

Import and export many boards at once for every format, and document each format in its own directory.

2026-10-09 10:33:37 +03:00

inactiveUsers.js

People shows everyone's Last active; inactive users can be disabled; LDAP sync honours its search filter.

2026-10-19 17:35:51 +03:00

indexKeys.cjs

List sort indexes are made from key objects, not from "-modifiedAt" strings.

2026-10-22 15:16:50 +03:00

injectionDetect.js

Canary tokens: who tried to override permissions, and from where.

2026-08-09 03:29:20 +03:00

insertPosition.js

Import into a swimlane, a list or a card, beside the one whose menu was

2026-08-14 01:03:08 +03:00

instanceFeatures.js

Checklist from description, action items, and search phrases.

2026-10-17 16:25:51 +03:00

instrumentationAreas.js

Password policy for new passwords, and compulsory two-factor authentication.

2026-10-31 00:07:58 +02:00

intEnv.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

internalCardLink.js

Open linked card URLs in the current tab

2026-09-22 15:12:52 +03:00

internalWebhookHosts.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

invitationBoardPermission.js

Custom board roles, and team memberships that leave with the team.

2026-10-14 08:20:49 +03:00

invitationCodeEmail.js

Startup schema upgrade, self-healing attachments, migration speed; fix

2026-07-17 03:07:59 +03:00

inviteEmailLanguage.js

Add regression test for board-invite email language. Refs #5664.

2026-07-06 16:02:56 +03:00

inviteeUsername.js

Fix #619: invitee username collisions no longer fail with a raw 403.

2026-07-17 03:36:07 +03:00

ipAddress.js

Docs: implemented designs move to docs/Features, filed the way the menu is.

2026-08-16 15:15:01 +03:00

issueAttachments.js

Board View / Version Control, issue files and synced issue details.

2026-10-14 12:09:34 +03:00

issueTypeIcon.js

Show a card's Jira issue type on the minicard with an icon.

2026-09-29 17:23:10 +03:00

jiraCompatApi.js

Optional APIs: Trello, Jira, GitHub and Gitea compatible, off by default.

2026-10-14 13:11:23 +03:00

jiraEstimateMapping.js

Discover the Jira estimate field from the export's schema.

2026-10-02 19:23:20 +03:00

jiraIssueExtras.js

Import: attachment files of Jira, Nextcloud Deck, OpenProject, Asana and GitLab.

2026-10-15 01:27:26 +03:00

jiraScrumMetadata.js

Let a card be in more than one release.

2026-10-08 11:51:44 +03:00

jiraScrumPlanning.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

jiraTimeTracking.js

Round-trip Jira time tracking through external export

2026-09-27 19:08:35 +03:00

jsWebLabels.js

LibreJS: a JS Web Labels page for the browser bundle.

2026-10-14 14:39:40 +03:00

kanbanflowApiFormat.js

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

kanriFormat.js

Themes: every board theme and every color a member chooses is readable.

2026-11-03 12:37:10 +02:00

labelAutocomplete.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

labelDisplayName.js

Fix #5442: outgoing webhooks now include the label name on add/remove label

2026-07-09 02:14:07 +03:00

labelOrder.js

Sort a list by the board's label order.

2026-10-14 13:44:33 +03:00

labelTextVisibility.js

Add the shared label-text resolution helper and its unit test (#4256).

2026-09-10 20:00:19 +03:00

lastActive.js

Add Admin Panel / People "Last active" presence for #3678 and #3734.

2026-09-10 19:59:02 +03:00

leftMenu.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

leoOutline.js

Import and export Leo .leo outlines.

2026-09-29 18:41:21 +03:00

leoOutlineFormat.js

Import and export Leo .leo outlines.

2026-09-29 18:41:21 +03:00

linearCsvFormat.js

Import and export boards as Linear CSV.

2026-10-08 20:59:26 +03:00

linkedCardCover.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

linkedCardMembers.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

linkedCardTarget.js

Allow same-board linked cards while retaining link and write guards

2026-09-27 00:09:56 +03:00

linkedCardTitle.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

linkedList.js

A linked whole list: a live mirror of another board's list.

2026-10-14 15:44:38 +03:00

linkedWritePolicy.js

Prevent linked cards from promoting non-writing source roles

2026-09-14 12:05:14 +03:00

listActivityDates.js

API: a list says when it changed, and when its cards last did.

2026-08-08 02:19:08 +03:00

listApiUpdate.js

Feature #5396: edit Lists (title, color) via the REST API + api.py commands.

2026-07-09 02:14:07 +03:00

listCopyPlan.js

Copy a list into a new list, with all of its cards

2026-09-04 21:29:31 +03:00

listLifecycleRestore.js

Restore list deletion batches through History undo and redo

2026-09-27 00:10:25 +03:00

listMovePlan.js

Bind a list to the swimlane it is moved to

2026-09-04 19:26:03 +03:00

listPermissions.js

Boards every signed-in user may edit, per-list permissions, board keys and shared labels.

2026-10-14 09:28:45 +03:00

listSwimlaneRestore.js

"Lists missing their swimlane" no longer counts board-wide lists, and Restore never hides cards.

2026-10-14 11:03:53 +03:00

listSyncEstimate.js

Sync GitLab's weight or time estimate into a numeric field.

2026-10-02 19:34:47 +03:00

listSyncIssueDetails.js

Board View / Version Control, issue files and synced issue details.

2026-10-14 12:09:34 +03:00

listSyncPlanning.js

Sync sprints and releases into Scrum planning.

2026-10-08 12:35:58 +03:00

listSyncReconcile.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

listSyncSourceIdentity.js

Scope list Sync mappings and credentials to their source project

2026-09-27 21:32:16 +03:00

listSyncTextMerge.js

Sync sprints and releases into Scrum planning.

2026-10-08 12:35:58 +03:00

listSyncTimeEstimates.js

Sync Jira original and remaining time estimates with conflict review

2026-09-28 03:49:38 +03:00

listSyncWriteBack.js

List Sync: write WeKan's changes back to GitLab.

2026-10-14 22:08:34 +03:00

listUnbindRepair.js

Add repairBoardWideLists: un-bind lists corrupted by the #6484 swimlane bug.

2026-07-22 16:22:39 +03:00

listWidth.js

Align list-width validation and source translations with 200px minimum

2026-09-15 07:30:40 +03:00

loginBackground.js

Admin Panel: a login page background colour, and a readable layout for the login text and the support page.

2026-11-03 17:19:22 +02:00

loginOriginMismatch.js

Say on the sign-in page why a Google login returns to it.

2026-10-08 14:09:34 +03:00

loginProblems.js

snap wekan.problems: neutral check titles so a failing check does not read contradictorily.

2026-07-23 10:49:13 +03:00

loginTally.js

Add country login locations to Admin Panel People.

2026-08-18 23:07:48 +03:00

logoutTimer.js

Implement automatic logout with LOGOUT_WITH_TIMER and the LOGOUT_* settings.

2026-10-08 11:03:50 +03:00

mailProblems.js

Email bounces with Amazon SES, Problems -> Email, and runtime tests for sending and receiving.

2026-10-13 18:27:25 +03:00

mailServices.js

Add Admin Panel Nodemailer service settings

2026-09-01 23:09:31 +03:00

mapLink.js

Login offices: who logs in from where, and users shown as initials or avatar.

2026-08-16 16:17:13 +03:00

markdownKanbanFormat.js

Add Markdown import/export and give GitHub-style import loss reporting

2026-09-08 17:49:24 +03:00

markdownLink.js

Fix the code scanning and Dependabot alerts of 2026-10-10.

2026-10-10 00:45:30 +03:00

mattermostDirectMessages.js

Webhooks: also send a Mattermost direct message to the card's people.

2026-10-14 14:54:38 +03:00

meistertaskCsvFormat.js

Import and export boards as MeisterTask project CSV.

2026-10-08 20:52:04 +03:00

memberAutocomplete.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

memberSuggestions.js

Summary, Since your last visit, At risk, Suggested members and Forecast.

2026-10-17 15:52:26 +03:00

meteorSecurityEvent.cjs

Meteor 3.5.3's six security fixes on Meteor 3.6-rc.0.

2026-10-22 04:12:13 +03:00

mimeDetection.js

Provide full MIME detection across server platforms

2026-09-20 21:06:30 +03:00

minicardChecklistVisibility.js

Checklists: "Show on minicard" is an override, so unchecking it hides the checklist.

2026-08-12 14:45:07 +03:00

minicardGroups.js

Card Settings: two panes, the card and the minicard follow their order, menus inline.

2026-10-29 02:02:54 +02:00

mondayFormat.js

Import and export boards as monday.com Excel workbooks.

2026-10-08 21:13:39 +03:00

mongoSelectorSafety.js

Tests: ask whether a fixed mistake is anywhere ELSE, and close two gaps it found.

2026-08-12 15:06:45 +03:00

mstodoApiFormat.js

Fix three guards the last commits tripped.

2026-10-14 23:23:07 +03:00

multilineTitles.js

Create cards, lists and swimlanes from multiline titles

2026-09-23 18:21:03 +03:00

myAttachmentsQuery.js

Add a My Attachments page to the member menu.

2026-09-10 20:07:59 +03:00

notificationActivityGroups.js

Activity feed: every sentence names what it is about.

2026-10-14 22:57:31 +03:00

notificationCleanup.js

Notifications: cap the tray array, which SQLite was being rewritten by.

2026-08-11 16:15:06 +03:00

notificationDelivery.js

E-mails in the clear HTML layout by default: notifications and account mail.

2026-10-14 14:33:10 +03:00

notificationInsertion.js

Deduplicate notification retries by activity without resetting read state

2026-09-28 04:43:49 +03:00

notificationSettings.js

Add a 3-tier Notification Settings popup (Member/Board/Admin).

2026-09-10 21:00:20 +03:00

notionFormat.js

Import and export boards as Notion Markdown & CSV exports.

2026-10-08 22:01:22 +03:00

ntfy.js

ntfy as a notification channel, per member.

2026-10-14 14:37:00 +03:00

nullboardFormat.js

Import and export boards as Nullboard .nbx files.

2026-10-08 21:07:01 +03:00

oauth2ClientSecretJwt.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

oauth2Scopes.js

Fix #6545 OAuth2 scopes, #6546/#6555 bind IP, #6550 IPv6 database, #6551/#6553 TLS verification.

2026-07-28 14:47:22 +03:00

oauthProviders.js

Log in by full-page redirect by default with OAuth2/OIDC, Google & co, SAML and CAS.

2026-10-08 15:18:59 +03:00

obsidianKanbanFormat.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

openCardPresence.js

A card opened from its link stays open when the connection drops and comes back while the page loads.

2026-10-27 10:05:01 +02:00

opmlOutline.js

Import and export boards as OPML outlines.

2026-10-08 11:18:14 +03:00

opmlOutlineFormat.js

Import and export boards as OPML outlines.

2026-10-08 11:18:14 +03:00

optionalApis.js

Optional APIs: Trello, Jira, GitHub and Gitea compatible, off by default.

2026-10-14 13:11:23 +03:00

orgAutoAddByDomain.js

Fix #5351: auto-add users to organizations matching their email domain on sign-up.

2026-07-09 02:14:07 +03:00

orgModeFormat.js

Import and export boards as Org mode outlines.

2026-10-08 11:21:05 +03:00

originalPositions.js

Original positions: a right-sidebar view from the board menu, in every language.

2026-10-17 01:23:15 +03:00

pageSidebar.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

pageTitles.js

Accessibility: fix the findings of the axe-core audit in the default theme.

2026-11-02 16:08:32 +02:00

passkeys.js

Passkey (WebAuthn) login, and Log out everywhere.

2026-10-14 14:59:25 +03:00

passwordlessRequestGuard.cjs

Harden Meteor 3.6 passwordless account requests

2026-09-22 19:16:55 +03:00

passwordPolicy.js

Admin Panel / Problems / Password length, and a changed password signs every session out.

2026-10-31 14:54:22 +02:00

pdfDocument.js

Keep each chart PDF export row on one line, in fixed columns.

2026-09-11 10:42:40 +03:00

pivotalCsvFormat.js

Import and export boards as Pivotal Tracker stories CSV.

2026-10-08 21:09:53 +03:00

planeFormat.js

Fix the code scanning and Dependabot alerts of 2026-10-10.

2026-10-10 00:45:30 +03:00

plankaApiFormat.js

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

plannerFormat.js

Choose who an import's people become, for every import, and stream imported attachments.

2026-10-09 12:20:36 +03:00

platformPackaging.js

Version pane: the packaging row is package, and its value is never translated.

2026-08-10 03:52:18 +03:00

positionHistoryCleanup.js

History audit and position-history cleanup: once per installation.

2026-10-27 21:18:08 +02:00

problemsOverview.js

Restore lost list swimlanes from Admin Panel / Problems

2026-09-04 21:29:31 +03:00

productName.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

qrCode.js

Board View / Version Control, issue files and synced issue details.

2026-10-14 12:09:34 +03:00

quickAddCardLabel.js

Add card: [Text] at the start of a title becomes a label only when turned on in Member Settings.

2026-10-27 15:04:31 +02:00

quireCsvFormat.js

Import and export boards as Quire CSV.

2026-10-08 21:35:31 +03:00

ramHighTracker.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

reactionOwnership.js

Comment reactions: react as yourself, not as somebody else.

2026-08-09 02:54:56 +03:00

reconcileBoardTeamMembers.js

Custom board roles, and team memberships that leave with the team.

2026-10-14 08:20:49 +03:00

recoveryEventsJsonl.js

Automatic recovery/remediation for the SQLite text data + Admin Panel Recovery report

2026-07-21 10:06:40 +03:00

recoveryReportQuery.js

Filter Recovery events by operation outcome.

2026-08-17 23:58:04 +03:00

redmineCsvFormat.js

Import and export boards as Redmine issue CSV.

2026-10-08 21:55:27 +03:00

relativeDateOffset.js

Add unit selector (minute/hour/day/week/month) to the Rules relative-date action (#5621)

2026-07-09 02:14:07 +03:00

relativePosition.js

Implement audited board usability and accessibility fixes.

2026-09-19 14:00:48 +03:00

reportPageIndex.js

Email view and Public Boards: a search shows its own results, never the last one's.

2026-10-15 04:14:10 +03:00

restLabel.js

Board labels: a padded name finds the stored label, in every way a label is added.

2026-11-03 12:37:10 +02:00

revealBoardItem.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

ruleActingUser.js

Add the missing acting-user module and UI button for rule "add member" (#2522).

2026-09-10 20:46:04 +03:00

ruleActionResolve.js

Fix #5536: Automated rule can now move/link card to a different board

2026-07-09 09:45:53 +03:00

ruleButtonMetadata.js

Keep rule button menus consistent with trigger type changes

2026-09-27 20:27:41 +03:00

ruleCardTitleFilter.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

ruleDeletePermission.js

Fix: deleting a board rule no longer fails with "Access denied [403]"

2026-07-09 02:14:07 +03:00

ruleDescriptionLocalization.js

Revert Legacy HTML4 browser interface and parity changes

2026-09-07 17:03:59 +03:00

ruleEmailMembers.js

Rule emails: pick board members for To from a list with autocomplete.

2026-10-14 14:30:10 +03:00

ruleMoveDirection.js

Add rule triggers for a card moved forward or back.

2026-10-08 12:25:29 +03:00

ruleParts.js

Let a rule have several triggers (any fires it) and several actions (in order).

2026-09-29 14:34:18 +03:00

rulesBlocks.js

Add editable Blockly rules with local translated message catalogs

2026-09-27 17:07:02 +03:00

rulesBlocksDefinition.js

Add editable Blockly rules with local translated message catalogs

2026-09-27 17:07:02 +03:00

rulesBoardSelector.js

Add semi-open boards, visible to every signed-in user.

2026-09-29 16:28:44 +03:00

ruleSortList.js

Run the sortList rule action through durable Sync.

2026-10-02 16:55:19 +03:00

rulesReadOnly.js

Rules can be shown to board members, read-only, when the Admin Panel allows it.

2026-10-14 14:23:31 +03:00

ruleSuggestions.js

Rule suggestions from what people on a board keep doing by hand.

2026-10-17 14:42:59 +03:00

rulesWorkflowPalette.js

Rules: assignee actions, an optional title, and remove-all members that removes them.

2026-10-08 11:31:12 +03:00

ruleTextContainsMatch.js

CHANGELOG.md is the short changelog, written from CHANGELOG-big.md.

2026-10-30 03:29:48 +02:00

ruleTriggerVars.js

Accept rule variables in trigger values.

2026-09-29 16:09:49 +03:00

ruleVariablePicker.js

Pick rule variables from a list instead of typing them.

2026-09-29 18:45:10 +03:00

ruleVarsSubstitute.js

Resolve people and custom-field variables in rule action values.

2026-09-29 14:02:14 +03:00

runtimeHealth.js

Bound platform resources and report runtime failures.

2026-08-23 00:16:15 +03:00

s3Encryption.js

Attachments, avatars and backups in S3 can be encrypted at rest.

2026-10-31 00:12:09 +02:00

safeMapKey.js

Fix PrototypeBleed: user-chosen ids can no longer pollute Object.prototype in the server.

2026-10-02 10:37:08 +03:00

samlConfig.js

Log in by full-page redirect by default with OAuth2/OIDC, Google & co, SAML and CAS.

2026-10-08 15:18:59 +03:00

sandstormApiIdentity.js

On Sandstorm, send webhooks through the Powerbox, and accept the REST API with a grain API key.

2026-10-14 09:49:42 +03:00

sandstormAutoOpen.js

Convert client-reachable CJS helpers from CommonJS to ES modules (2/2).

2026-07-23 18:59:30 +03:00

sandstormShare.js

Sandstorm: build from install.sandstorm.org, and link sandstorm.org everywhere.

2026-10-30 00:27:54 +02:00

sandstormSlim.js

The Sandstorm .spk leaves out every login method but Sandstorm's, and FerretDB's other database handlers.

2026-10-23 19:34:34 +03:00

sandstormUsername.js

Fix #2345 #2674 #574: rules card title filter, rules REST API, api docs;

2026-07-17 03:36:50 +03:00

sanitizeSvg.js

SVG of any size is sanitized whole, streaming: on upload, on validation and on every serve.

2026-10-25 07:23:31 +02:00

sanitizeUploadedFile.js

SVG of any size is sanitized whole, streaming: on upload, on validation and on every serve.

2026-10-25 07:23:31 +02:00

scheduledDueFilter.js

Let scheduled rule triggers watch a card's start date.

2026-09-29 14:10:38 +03:00

scrollbarCss.js

Fix #5439: list scrollbar is now always visible on desktop and mobile browsers

2026-07-09 09:45:53 +03:00

scrum.js

Scrum: release names on cards, the import-into-board preview and the import report show again.

2026-10-10 12:21:44 +03:00

scrumCardOrder.js

Keep Scrum planning order consistent for equal ranks

2026-09-27 20:36:08 +03:00

scrumCopy.js

Let a card be in more than one release.

2026-10-08 11:51:44 +03:00

scrumDailyHistory.js

Export scoped daily Scrum observations to Excel and PDF

2026-09-27 22:27:51 +03:00

scrumHistory.js

Run each large-sprint rollover and undo job on one server at a time, by lease.

2026-10-03 09:49:31 +03:00

scrumReports.js

Let a card be in more than one release.

2026-10-08 11:51:44 +03:00

scrumScopeReplay.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

scrumSnapshotRows.js

Lift the sprint card cap: chunked rollover plans and History, daily rows.

2026-10-03 01:47:19 +03:00

scrumTransfer.js

Import Scrum planning into an existing board.

2026-10-08 12:36:57 +03:00

scrumTransferMerge.js

Import Scrum planning into an existing board.

2026-10-08 12:36:57 +03:00

searchPaginationAuthorization.js

Bind search pagination sessions to their users

2026-08-27 10:19:56 +03:00

searchPhrases.js

Checklist from description, action items, and search phrases.

2026-10-17 16:25:51 +03:00

securityCategories.js

Fix CreateBleed: "Only admins can create boards" holds on every path.

2026-11-07 00:51:53 +02:00

securityHeaders.js

Strict-Transport-Security on every response of an HTTPS site.

2026-10-30 23:50:02 +02:00

securityLogFormat.js

Convert client-reachable CJS helpers from CommonJS to ES modules (2/2).

2026-07-23 18:59:30 +03:00

selectedStars.js

All Boards: make the Selected star a toggle, and name every button.

2026-07-31 06:47:19 +03:00

selectorGuard.js

Invite via Email adds the invited new user, not the first user of the database.

2026-10-29 17:35:21 +02:00

serveFileSanitizer.js

Hall of Fame regression audit: every fixed vulnerability still fixed, siblings of six of them closed.

2026-10-27 16:28:12 +02:00

sharedDescription.js

Edit a card description together, live, with Yjs.

2026-10-14 16:49:21 +03:00

sharedLabels.js

Boards every signed-in user may edit, per-list permissions, board keys and shared labels.

2026-10-14 09:28:45 +03:00

shareTarget.js

Android: share to WeKan from other apps.

2026-10-14 14:55:04 +03:00

shortPasswordLogins.js

Admin Panel / Problems / Password length, and a changed password signs every session out.

2026-10-31 14:54:22 +02:00

sidebarBackAction.js

Return mobile Search directly to the board

2026-08-25 17:52:23 +03:00

sidebarViewButton.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

similarCards.js

Due date from the card title, and similar cards and possible duplicates.

2026-10-17 14:39:43 +03:00

sinceLastVisit.js

Summary, Since your last visit, At risk, Suggested members and Forecast.

2026-10-17 15:52:26 +03:00

siteLogo.js

Load configured logos without stock logo flash and allow uploads

2026-09-16 02:26:25 +03:00

snapArchitectures.js

Add the armv6 bundle: Raspberry Pi 1 and Zero.

2026-08-09 23:38:43 +03:00

softDelete.js

Soft delete for lists: delete = mark, restorable + undoable (#1023).

2026-07-17 20:20:06 +03:00

sortableOptions.js

Large board: set jQuery UI sortable options only when they changed.

2026-10-07 03:08:48 +03:00

sortCardsByTitle.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

sqrl.js

SQRL: sqrlonly and hardlock lock an account to SQRL.

2026-10-14 21:45:34 +03:00

starredPages.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

statusActive.js

Stop Admin Panel / Problems showing a finished board-repair and info CPU rows.

2026-07-24 10:14:29 +03:00

storagePathContainment.js

PathBleed: an avatar could name any file on disk, and board export read it.

2026-08-09 02:19:15 +03:00

structuralSelection.js

Support mixed multi-selection moves and collapsed drop targets

2026-09-25 23:35:16 +03:00

subtaskCopy.js

Board View / Version Control, issue files and synced issue details.

2026-10-14 12:09:34 +03:00

subtaskDone.js

Tick subtasks done from the parent card's Subtasks list, with done/total in its heading.

2026-10-10 15:25:16 +03:00

subtaskLabelInheritance.js

CHANGELOG: triage remaining open Rules (IFTTT) issues to TODO Later.

2026-09-10 20:50:08 +03:00

subtaskLandingList.js

Land subtasks in the list the main board chose on its deposit board.

2026-10-08 11:40:25 +03:00

subtaskLandingSwimlane.js

Board Settings / Subtasks: pick the swimlane new subtasks land in.

2026-10-14 14:19:52 +03:00

superProductivityFormat.js

Fix the code scanning and Dependabot alerts of 2026-10-10.

2026-10-10 00:45:30 +03:00

svgSanitizer.js

SVG of any size is sanitized whole, streaming: on upload, on validation and on every serve.

2026-10-25 07:23:31 +02:00

swimlaneArchive.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

swimlaneFilter.js

Keep cards in their real swimlanes and persist view changes

2026-08-31 13:27:15 +03:00

swimlaneSort.js

Fix #3624: new_swimlane REST API appends the swimlane last (and accepts a sort)

2026-07-09 09:45:53 +03:00

tablePage.js

Admin Panel / Problems: "IPv6 location" and "Instrumentation" are translated.

2026-10-20 10:37:03 +03:00

tableViewDrop.js

Table view: add cards, and drag a row onto another to move its card.

2026-10-14 15:13:09 +03:00

tableViewFilter.js

Resolve authorized linked dates for lazy Table pages

2026-09-28 19:19:26 +03:00

tableViewGrouping.js

Add optional swimlane grouping to Table view

2026-08-25 17:39:23 +03:00

tableViewSort.js

Restore sorting to board Table view

2026-08-25 17:32:57 +03:00

tableViewTitleMode.js

Make board Table view responsive

2026-08-25 17:31:29 +03:00

taigaFormat.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

tasksorgFormat.js

Import and export many boards at once for every format, and document each format in its own directory.

2026-10-09 10:33:37 +03:00

taskwarriorFormat.js

Import and export boards as Taskwarrior JSON.

2026-10-02 15:53:14 +03:00

teamworkFormat.js

Import and export boards as Teamwork.com Excel task import templates.

2026-10-08 21:40:19 +03:00

tenantAdmin.js

Multitenancy: the three tenant modules must be ES modules.

2026-07-26 07:59:30 +03:00

tenantBackup.js

Multitenancy: the three tenant modules must be ES modules.

2026-07-26 07:59:30 +03:00

tenants.js

Multitenancy: the three tenant modules must be ES modules.

2026-07-26 07:59:30 +03:00

themeAccents.js

Themes: every board theme and every color a member chooses is readable.

2026-11-03 12:37:10 +02:00

themeCategories.js

Add Apple Glass Pastel board theme

2026-08-10 21:51:21 +07:00

ticktickCsvFormat.js

Import and export boards as TickTick backup CSV.

2026-10-08 21:02:01 +03:00

timeHistory.js

Preserve time history and record reversible move reasons

2026-09-26 23:00:58 +03:00

titleDueDate.js

Due date from the card title, and similar cards and possible duplicates.

2026-10-17 14:39:43 +03:00

titleTags.js

Updates

2026-10-14 14:04:07 +03:00

todoistCsvFormat.js

Choose who an import's people become, for every import, and stream imported attachments.

2026-10-09 12:20:36 +03:00

todoTxtFormat.js

Keep the todo.txt module free of a URL the release audit flags.

2026-09-30 03:19:02 +03:00

touchDragClickGuard.js

Prevent fast touch drags from opening cards

2026-08-25 17:27:33 +03:00

transferFailure.cjs

A failed import or export disables an account only when it was an attempt.

2026-10-22 04:56:40 +03:00

trelloCompatApi.js

Board Settings / Bots: hand cards to external runners, as kanbots does.

2026-10-14 13:39:18 +03:00

trelloExportPlan.js

Export boards to Trello, keep swimlanes as labels, and reach Trello from Sandstorm.

2026-10-13 14:20:56 +03:00

twoFactorRequirement.js

Password policy for new passwords, and compulsory two-factor authentication.

2026-10-31 00:07:58 +02:00

uiFonts.js

Themes: every board theme and every color a member chooses is readable.

2026-11-03 12:37:10 +02:00

undoRedoSelection.js

Add verified low-load recovery and integrity audits

2026-09-05 23:51:02 +03:00

universalUrlGenerator.js

Greatly improved import from Trello to WeKan.

2026-06-13 17:19:51 +03:00

unreadChanges.js

Cards changed since a member last opened them are marked, as a Member Settings switch.

2026-10-14 15:37:02 +03:00

unreadComments.js

Large board: read only the user fields each card and list needs.

2026-10-07 03:08:48 +03:00

unusedTemplateContainers.js

Remove the Templates containers made for accounts that never used them.

2026-08-11 16:28:38 +03:00

uploadContentMismatch.js

Validate an uploaded attachment/avatar's real content type against its

2026-09-10 20:02:50 +03:00

uploadFileId.js

Close the UploadPathBleed avatar sibling: an avatar's client-supplied file id cannot traverse paths.

2026-10-02 11:05:04 +03:00

uploadFileName.js

Hall of Fame regression audit: every fixed vulnerability still fixed, siblings of six of them closed.

2026-10-27 16:28:12 +02:00

urlSchemeAllowlist.js

Card links never launch an OS handler with a code-execution history.

2026-10-30 01:19:16 +02:00

userAnonymization.js

Add the anonymizeUser server method and its unit tests (#2731).

2026-09-10 20:38:44 +03:00

userDeletionCleanup.js

Remove files nothing uses, and point their tests at the code that runs.

2026-10-16 22:54:48 +03:00

userFieldsProjection.js

Large board: read only the user fields each card and list needs.

2026-10-07 03:08:48 +03:00

userStorageHelpers.js

Reverted New UI Design of WeKan v8.29 and added more fixes and performance improvements.

2026-02-08 00:48:39 +02:00

versionCheck.js

Publish and use the WeKan version manifest

2026-08-30 18:04:24 +03:00

versionControlView.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

vikunjaFormat.js

Fix the code scanning and Dependabot alerts of 2026-10-10.

2026-10-10 00:45:30 +03:00

voteSortCards.js

Add an optional "Sort by votes" mode that floats highly-voted cards up.

2026-09-10 20:37:09 +03:00

webdavStorage.js

WebDAV attachment storage: attachments in Nextcloud Files or any WebDAV server.

2026-10-14 16:46:59 +03:00

webhookActivityPicker.js

Webhooks: pick which activities a webhook is sent.

2026-10-14 15:37:16 +03:00

webhookPayload.js

Choose what notifications contain, and group and schedule them, for e-mail, the tray and webhooks.

2026-10-10 15:28:26 +03:00

webPush.js

Browser push notifications, per device.

2026-10-14 15:44:01 +03:00

weekStart.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

windowDrag.js

The opened card and every popup move under a finger: Pointer Events and touch-action.

2026-11-04 01:00:19 +02:00

windowsSso.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

wipLimitGroupDecision.js

Add reply-by-email: replying to a notification email comments on the card.

2026-09-10 20:51:52 +03:00

wipRestore.js

Restore from Archive into a full list asks for another list, instead of doing nothing.

2026-10-15 13:16:14 +03:00

withDeadline.js

Convert client-reachable models/lib helpers from CommonJS to ES modules (1/2).

2026-07-23 18:55:30 +03:00

workerCardWrite.js

Preserve time history and record reversible move reasons

2026-09-26 23:00:58 +03:00

workerChecklistItemToggle.js

Let a Worker check/uncheck a checklist item without editing or deleting it.

2026-09-10 20:00:09 +03:00

workflowYaml.js

GitHub organization import: repositories, issues, releases, Actions, wiki.

2026-10-14 12:43:36 +03:00

workspacesTree.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

wrikeFormat.js

Export Wrike Excel with Wrike's custom workflow statuses, and import and export Wrike workflows as lists and rules.

2026-10-09 09:48:47 +03:00

wrikeWorkflow.js

Export Wrike Excel with Wrike's custom workflow statuses, and import and export Wrike workflows as lists and rules.

2026-10-09 09:48:47 +03:00