v10.28 2026-07-23 WeKan ® release

This release fixes the following bugs:

• Fix #6508 (follow-up): the board member popup now shows “Remap User” for an imported (placeholder) member. The action is gated on the member’s authenticationMethod === 'imported', but the board publication shipped board members’ user docs without authenticationMethod, so the field was undefined on the client and the action never appeared. It is now published with the board members’ user fields (already part of Users.safeFields), so the in-board Remap → map-to-existing-user flow works. Thanks to AmigaAbattoir and xet7.

• Fix #6511: a board showed NO cards, with Error: Bad index in range.removeMember: 0 in the console. The card list is a Blaze {{#each}} over a LIMITED, ordered reactive cursor sorted by { sort: 1 }, which has TIES — when several cards share the same sort value (or due date, etc.) their order is non-deterministic across observe/poll cycles, so Meteor’s ordered diff computes an out-of-range index and the #each throws, rendering no cards (and cascading into the undefined.remove() teardown error). A unique _id tiebreaker is now appended to the card-list sort (client cursor and server window), making the order deterministic. Thanks to mueschel and xet7.

• Opening a card no longer takes ~40 seconds on FerretDB v1 (SQLite). A card’s attachments are looked up with the dotted key {'meta.cardId': ...}, which the bundled FerretDB dropped from the WHERE (it skipped any dotted-path key), so it full-scanned the whole attachments collection with a per-row decode on every poll while a card was open — slow card content and high idle CPU. The FerretDB v1 fork now pushes down a dotted-path equality/$in as the nested -> expression that matches the existing meta.cardId index (see the FerretDB fork changelog). Ships with the bundled FerretDB update. Thanks to xet7.

• Activity feed pushes down on FerretDB: the comment-only feed selected activities with a top-level $and, which FerretDB v1 (SQLite) does not push down, so the activities collection was full-scanned on every poll (slow board/card history on a big board). The scope and activityType are now at the top level — exactly equivalent, and both push down to the index. Thanks to xet7.

• snap run wekan.problems: the login-page checks used affirmative titles, so a FAILING check printed e.g. “[error] ROOT_URL is set: ROOT_URL is not set” — confusing. Titles are now neutral subjects (“ROOT_URL”, “Migration or repair”) so each line reads correctly whether the check passes or fails. Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.