v10.37 2026-07-25 WeKan ® release

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

• js/incomplete-sanitization (High), alert #428, in tests/boardHeaderOneLine.test.cjs: the CSS rule bodies were split with rule.split('{') and the trailing brace removed with body.replace('}', ''), which strips only the FIRST }. The block is now matched with one regex that captures selector and body as separate groups, so no brace ends up in the text and there is nothing to strip.
• js/incomplete-sanitization (High), alert #427, in tests/testsAreRegistered.test.cjs: a file name was spliced into a RegExp after escaping only dots, leaving every other metacharacter — the backslash above all — able to change the meaning of the pattern. It now goes through an escapeRegExp() that escapes the full set, backslash included.
• Both are test helpers, so neither was reachable by an attacker, but both were genuinely wrong string handling (commit).
• Thanks to GitHub CodeQL (alerts #427 and #428) and xet7.

and resolves the following GitHub Dependabot alerts in npm dependencies:

• brace-expansion 5.0.7 → 5.0.8 (RUNTIME dependency, transitive via minimatch): fixes CVE-2026-14257 (GHSA-mh99-v99m-4gvg, High, CVSS 7.5, alert #119) — expand() bounds how MANY results it produces (max, 100000) but not how LONG they get, so chained brace groups keep the count under the cap while every result grows one character per group. A ~7.5 KB input ('{a,b}'.repeat(1500)) exhausts memory and kills the Node process with a fatal, uncatchable out-of-memory error that try/catch cannot contain. 5.0.8 bounds the total characters one expand() call may accumulate (maxLength, default 4000000) inside the output-building loops, so intermediate arrays are bounded too and oversized input is truncated rather than fatal. Patch release in the same major line; the only other change is engines.node, which drops Node 18 — WeKan builds and ships on Node 24 (Dockerfile NODE_VERSION=v24.18.0, CI NODE_VERSION: '24'), so nothing is affected (#6523, merge commit).
• postcss 8.5.15 → 8.5.22 (dev dependency; enters only through css-loader, which the rspack build uses for .css, and is not itself part of the shipped bundle): fixes GHSA-r28c-9q8g-f849 (High, CVSS 7.5) — postcss follows a /*# sourceMappingURL=... */ comment in the CSS it parses and builds the path with path.join(dirname(from), annotation), which normalises but does not sandbox .., so a crafted comment discloses arbitrary .map files. Affected <= 8.5.17, patched in 8.5.18. nanoid 3.3.12 → 3.3.16 rides along as postcss’s own dependency (#6522, merge commit).
• Both are lock-only changes whose tarball integrity hashes were verified against the npm registry, and the brace-expansion lock edit was reproduced independently with npm update brace-expansion --package-lock-only, which produced a byte-identical diff. elliptic (alert #55, CVE-2025-14505) is still left pinned for the reason recorded in v10.14: no fixed version is published upstream — the latest release is still 6.6.1 and the advisory lists no patched version. It is a dev-only transitive polyfill (@meteorjs/rspack → node-stdlib-browser → crypto-browserify → browserify-sign/create-ecdh), no WeKan client module imports node crypto, and the built client bundle contains no elliptic/secp256k1/crypto-browserify code at all, so it never reaches users.
• Thanks to GitHub Dependabot and xet7.

and has the following developer-tooling fix:

• docs/Security/gh/pull-security-reports.sh reported OK for every endpoint and then wrote empty split files and blank counts. gh api --paginate --slurp returns ONE ARRAY PER PAGE, so a list endpoint arrives as [[alert,...],[alert,...]]; nothing flattened that, so .[] yielded PAGES rather than alerts and every select(.state == "open") ran against an array. jq failed, its error went to /dev/null, and the > redirect left a 0-byte file — not valid JSON, so every later step on it failed too and printed nothing. A security report that quietly claims there is nothing to see is worse than one that fails. The pages are now concatenated (only when every element is itself an array, so single-object endpoints like the SBOM are untouched), a failed filter leaves a valid empty array plus a readable error instead of truncating the file, the secret-scanning redaction validates the redacted copy before deleting the dump that still holds live secrets (and removes it on the failure path too), and counts always print a number. The same shape had also broken the newest-analysis lookup and the codeql-databases dump. Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.