v10.14 2026-07-22 WeKan ® release

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

• SpliceBleed: incomplete multi-character sanitization when stripping exploit markup from a filename (GitHub CodeQL code scanning alert #425, rule js/incomplete-multi-character-sanitization, CWE-116 Improper Encoding or Escaping of Output; imports/lib/fileNameDisplay.js). stripExploitPatterns() removed HTML/script/XML/template markup from a shown filename in a single pass — so an input crafted with nested or interleaved fragments (for example <scr<x>ipt> or <scr{{y}}ipt>) could have its inner part removed and the two surviving outer fragments SPLICED together into a fresh <script> token that the single pass no longer re-examined (CodeQL: “this string may still contain <script”).

  • Fixed by applying the removals REPEATEDLY until the string stops changing (a fixpoint loop). Each pass only ever deletes text, so the string strictly shrinks and the loop always terminates; any dangerous token an earlier removal reveals is then removed too. Blaze {{ }} already HTML-escapes every rendered filename, so this is defence-in-depth on the displayed text rather than a live XSS, but the incomplete single-pass strip was genuinely wrong.
  • Thanks to GitHub CodeQL (code scanning alert #425) and xet7 (fix).

• IdentityBleed: identity string replacement (a no-op replace) (GitHub CodeQL code scanning alert #424, rule js/identity-replacement, CWE-116 Improper Encoding or Escaping of Output; tests/securityLog.test.cjs). A test built a menu-id regex with id.replace('report-', 'report-') — replacing a substring with itself, a no-op that CodeQL flags because it is almost always a mistake for a real transformation.

  • Fixed by dropping the dead replace and matching 'js-' + id directly. Test-only code with no runtime exposure, but the no-op was removed for correctness.
  • Thanks to GitHub CodeQL (code scanning alert #424) and xet7 (fix).

This release also resolves the following GitHub Dependabot alerts in the rspack build-toolchain dev dependencies, without touching the rspack major version so builds are unaffected (both packages enter only via @rspack/dev-server — the rspack serve dev server — and are not used by meteor build):

• webpack-dev-server 5.2.5 → 5.2.6 (npm overrides): fixes CVE-2026-14631 (DoS via a malformed Host/Origin header, alert #113) and CVE-2026-14620 (CSRF via the internal /webpack-dev-server/open-editor and /invalidate endpoints, alert #114). Patch release in the same major line.
• http-proxy-middleware 2.0.9 → 2.0.10 (npm overrides): fixes CVE-2026-55602 (a host+path router key matched by unanchored substring, so a crafted Host header could route to an unintended backend, alert #107). Patch release in the same major line.
• The lock resolves with only those two entries changed; @rspack/cli and @rspack/core stay at 1.7.11. elliptic (alert #55, CVE-2025-14505) is left pinned because no fixed version is published upstream (latest is still 6.6.1, dev-only, Low). The @rspack/cli 1→2 (PR #6497) and @babel/parser 7→8 (PR #6484, a runtime dependency) major bumps are deferred pending build/ runtime testing.
• Thanks to GitHub Dependabot and xet7.

This release also fixes the following bug:

• Case-insensitive # label autocomplete in the card title (#5116). Typing #test in the add-card / edit-card-title field did not suggest a label named Testing — the label search matched with a case-sensitive label.name.indexOf(term), so only #Test matched. The match now lowercases both the typed term and the label name/color (matching the @ member autocomplete), extracted into a pure, unit-tested models/lib/labelAutocomplete.js. Thanks to rjl9 and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.