v10.04 2026-07-20 WeKan ® release

This release adds the following new features:

• Safe filename handling everywhere: attachment and avatar names are always shown clean — URL-decoded, normalized to generally-used characters (Unicode NFKC plus confusable-homoglyph folding, so a typosquatting pаypal.exe with a Cyrillic а is shown as paypal.exe), invisible/control/bidi characters removed and HTML/JS/XML markup stripped. Uploads are hardened (exploit and EICAR virus-test filenames rejected, extension corrected to the real detected type, length capped to a portable 30 chars), SVG JavaScript and XML-loop content is sanitized at a staging path before storage, existing files can be corrected/sanitized on the fly, storage moves check free disk space, and migrations fix + disambiguate names. One general cleanFileName function via {{cleanFilename}} / {{downloadFilename}}. Design at docs/Features/Filename/Filename.md. Thanks to xet7.
• Log every filename/content sanitization to Admin Panel / Problems: whenever a name or file required sanitization (upload, migration, existing-file corrector, viewing), the Security report records WHEN, WHO uploaded it, FOR WHAT REASON (URL-encoding, invisible characters, typosquatting, the exploit kind such as JavaScript / XML code / XML loop, wrong file type, too long), the filename from → to, and WHERE (board › swimlane › list › card, plus organization and team). Thanks to xet7.
• CPU-usage monitor + governor + Admin Panel / Problems / CPU usage report: watch system-wide CPU, record only the START and END of each sustained high-CPU period with what WeKan/FerretDB were doing, the automatic mitigation taken and whether it helped; a governor pauses long batch operations to yield the CPU. On high CPU WeKan asks the bundled FerretDB (via its throttle command) to slow down in an adaptive feedback loop, FerretDB also self-regulates on its own and reports its own process CPU% so a core-peg is visible even when system-wide CPU looks moderate. Design at docs/Features/Admin-Panel/Problems/CPU-usage.md. Thanks to xet7.
• Automatic adaptive card loading (no admin toggle): WeKan decides per board by size — a board over the threshold (default 500 cards, CARDS_LOADING_LAZY_THRESHOLD) loads only the visible cards (infinite-scroll windows) plus a live count, so very large boards stay fast; smaller boards keep loading every card. The board publication also publishes comments/attachments with one board-level cursor instead of one per card (an N+1 that pinned FerretDB CPU), with supporting indexes. Thanks to xet7.
• Statistics board view (Finnish: Tilastot): a full-width board view alongside Swimlanes / Lists / Calendar / Gantt / Table showing the board’s card-loading mode, counts (swimlanes, lists, cards, archived cards, labels, members, custom fields) and a time-spent summary; counts come from the server so they are accurate even in lazy mode, and its text can be selected and copied with mouse or finger. Design at docs/Features/Board/Sidebar/Status.md. Thanks to xet7.
• Admin Panel / Problems documentation reorganized under Admin-Panel/Problems/ with new RAM-usage and Disk-usage design specs (log how much RAM+swap / disk is used and record only the start and end of each sustained high-usage period, mirroring the CPU-usage monitor). Thanks to xet7.
• Admin Panel report improvements: paginated, searchable report tables (Files, Rules, Boards, Cards, Impersonation) that load one page at a time via index-backed sorts instead of the whole collection, theme-following buttons, and the Files report shows every filename decoded and cleaned. Thanks to xet7.
• Organize docs/Features into categories (Admin-Panel, Board, Cards, Editor, Reports, Automation, Lists, Troubleshooting) and update all links. Thanks to xet7.

and fixes the following bugs:

• Fix: removing a member from a board now visibly works — the sidebar member list kept showing removed members (removeMember keeps the entry with isActive:false), so “Remove from board” looked like it did nothing; the list now shows only active members (#6479). Thanks to mueschel and xet7.
• Fix: opening a board no longer pins FerretDB CPU / takes minutes — the board publication opened one live comments cursor and one attachments cursor per card (an N+1 that pinned FerretDB/SQLite CPU), now one board-level cursor each plus indexes; FerretDB also reports its own process CPU% so Problems shows a core-peg (#6480). Thanks to mueschel and xet7.
• Fix: All Boards on mobile is scrollable again and shows at least 2 board icons per row — the list was forced min-height:100vh so it grew to fit and was clipped by the overflow:hidden wrapper; it now has a bounded height + overflow-y:auto, and the left menu is narrowed so the boards get room (#6488). Thanks to mimZD and xet7.
• Fix: Rules → Workflow view can create rules again — rulesWorkflow.js used TAPi18n without importing it, so building a rule threw ReferenceError and the Add Rule handler aborted before saving (#6489). Thanks to xet7.
• Fix: Rules list — Delete and “View rule” act on the clicked rule, not the first — the buttons live in the rulesList child template but their handlers on the parent rulesMain used Template.currentData(), so the rule id was null (delete failed with “Match failed”, View always opened the first rule); the buttons now carry an explicit data-rule-id (#6490). Thanks to xet7.
• Fix: a rule’s action never executed even though its trigger matched — the trigger match required fields a moveCard trigger omits (oldListName), and a Mongo $in does not match a missing field unless null is in the list, so the rule silently never fired; null is now included for every field, like the cardTitle handling (#6491). Thanks to xet7.
• Fix: admin reports load on FerretDB — the paginated report publications returned a sorted+limited live cursor, whose limited live observe hangs on FerretDB’s OpLog, so the report was stuck on the loading spinner; they now publish the page manually so ready always fires. Thanks to xet7.
• Fix: the paginated admin reports never get stuck on the loading spinner if a report subscription fails — they now handle onStop, clearing the spinner and surfacing the error. Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.