v10.32 2026-07-23 WeKan ® release

This release fixes the following bugs:

• Fix #6512 for OAuth / OIDC logins: after “Login with Google” (or any redirect-style social login) the user is now sent to All Boards instead of being left on the sign-in route showing only the language selector until a manual reload. The earlier #6512 fix covered only the password/register flow (onSubmitHook); OAuth logins do not go through it, so a client Accounts.onLogin handler (fires for every login method after Meteor.userId() is set) now navigates home when still on an auth route — guarded so an auto-login on a deep-linked board URL is not redirected away. Thanks to xet7.

• [Fix #6511 and #6514 (and the v10.30–10.31 Docker / Sandstorm / production “board maintenance spinner”, missing top user/settings bar, and login-form-not-rendering reports): the whole client broke with Uncaught Error: ES Modules may not assign module.exports or exports.* followed by Error: No such template: swimlane / notifications / boardButtons. imports/collectionHelpers.js — a side-effect shim imported FIRST in client/main.js — ended with module.exports = {} while referencing the Meteor pseudo-global Package bare; the client rspack build’s ProvidePlugin rewrites Package into an injected ESM import, marking the file an ES module, and an ES module that assigns module.exports throws at evaluation time. That threw before any template registered, so Blaze reported “No such template” for the board and header templates, the board stayed on the spinner, the top bar was missing and the board went blank grey after login. It reproduced on the official root-domain boards.wekan.team and on plain Docker with no reverse proxy (ROOT_URL=http://neptun:4001), so it was a global build bug, not a reverse-proxy / sub-path issue. collectionHelpers (the first such file) was fixed to use export {}, and then a transitive walk from client/main.js found and converted EVERY remaining client-reachable CommonJS helper (~55 files under models/lib, client/lib, imports/lib, imports/) from module.exports = { … } to export { … }, so nothing in the client bundle assigns module.exports any more — done in two parts. Server-only helpers (the server/lib files Meteor never ships to the client, and the fs-using file-storage helpers) stay CommonJS. Their plain-Node .cjs unit tests now use await import(…js); the full tests/*.test.cjs suite has no new failures. This is NOT an rspack version regression — the lockfile has pinned @rspack/core ~1.7.x since v8.40, unchanged between the working v10.17 and the broken v10.27. Thanks to mueschel, jullbo, akshat-goel, AmigaAbattoir and xet7.

• Removed the unused jam:offline / jam:method / jam:pub-sub packages. Once the client booted (after the ES-module fix above), jam:offline’s startup sync threw can't access property "remove", localCollections[name] is undefined — it tried to reconcile a collection the client never registered, because WeKan uses no jam:offline .keep() and no jam:method / jam:pub-sub APIs anywhere. These were already removed once for the same reason and had been re-added; the offline-warning UI uses Meteor.status(), so it is unaffected. Thanks to xet7.

• Fixed six pre-existing plain-Node unit-test failures that surfaced while verifying the ES-module conversion: five were stale source-guards (a slice window too small, a regex matching a pattern quoted in a comment, a moved template button, a widened valid-width range, a report-controls count that grew) and one was a real cleanup race — streamHeaderToTemp unlinked its partial temp file fire-and-forget while the write stream was still opening, so a caller could see the file after the rejection; it now removes the file only after the stream closes. Thanks to xet7.

and updates the following dependencies:

• Pinned @rspack/core, @rspack/cli and @meteorjs/rspack to exact versions (removing the ^ caret ranges) so a fresh npm install cannot silently drift the bundler to a newer release that changes CommonJS/ES-module handling and breaks the client build. Thanks to xet7.

and has the following developer-tooling fix:

• rebuild-wekan.sh can now stop a running dev server on a minimal Linux that has neither fuser (psmisc) nor lsof installed: free_tcp_port gained an ss fallback that parses the owning pid from ss -ltnpH "sport = :PORT" and kills it. Previously it did nothing on such a host — while port_in_use (which uses ss) kept reporting the port busy — so the menu failed with “Port 3000, 8080 or 3001 is still in use … Stop it manually and retry” and the dev server could not restart. Thanks to xet7.

and improves the translation workflow:

• Fix #6494 (Transifex human translations were overwritten and the fetch was omitted): removed the external machine-translation service (machine-translate.mjs, which called LibreTranslate/DeepL and needed a WEKAN_MT_URL / WEKAN_MT_API_KEY). Remaining strings that are untranslated everywhere are now translated DIRECTLY (no external service, key or password), using each language’s existing translations and general kanban terminology as the reference, and applied with a new fill-translations.mjs that writes ONLY into English-placeholder keys — so a fill can never overwrite a human translation. In the releases/translations/ scripts a HUMAN translation is ALWAYS PREFERRED and merged: the pull always fetches the newest Transifex translations first, merge-translations.mjs keeps a real Transifex translation and restores a committed human translation the pull reverted to English (leaving English only where a string is untranslated everywhere), and filled strings stay LOCAL — they are never pushed to Transifex as if human. This restores the two-way process; verify-human-preference.mjs proves both directions with 10 cases. Thanks to s2ldan and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.