v10.38 2026-07-26 WeKan ® release

This release fixes the following CRITICAL SECURITY ISSUES:

• ZipBleed: arbitrary file write when restoring a backup archive (zip-slip) (f1c89548e). Thanks to xet7.
• GHSA-3gcg-g6rf-w2rx: an invalid authToken on a board export endpoint crashed the server (40de1799a). Thanks to laijunyue for the coordinated disclosure, and xet7.

and adds the following new features:

• Multitenancy: one WeKan server for many domains, with Organizations as the tenants (36b899b9d). Thanks to xet7.
• Admin Panel / Settings / Visibility: Change color sets the site theme (36b899b9d). Thanks to xet7.

and reorganises the Admin Panel:

• Admin Panel / Settings is reorganised so every setting sits with the thing it is about (fa0da9178). Thanks to xet7.
• Every Admin Panel page renders ONE shared left menu (e26706799). Thanks to xet7.
• Admin Panel / People: Domains, Organizations, Teams and People use the shared table page (ccc95bffb). Thanks to xet7.
• The Admin Panel Features tab is removed (b72a4996d). Thanks to xet7.
• Admin Panel / Problems: the Security report is renamed Security Report and moved above Broken Cards (4df87fd6b). Thanks to xet7.
• Admin Panel: the Login and E-mail panes moved from Settings to People, above Organizations (47b03ef89). Thanks to xet7.
• Every Admin Panel pane opens with the same heading, and the heading is the open left-menu entry’s own label (d23219407). Thanks to xet7.
• Admin Panel / Settings / Translation renders through the shared table page (docs/Design/Page/Table.md) (d23219407). Thanks to xet7.
• Version is the FIRST pane of Admin Panel / Settings and the one that opens with the page (d23219407). Thanks to xet7.
• Admin Panel / Settings / Visibility is four named groups instead of one long list (671262ddb). Thanks to xet7.
• “Add board members only from the same Organization or Team” moves out of Admin Panel / People / Login (f0ea1601b). Thanks to xet7.
• Admin Panel / People / Login is one “Login: Allow” group of checkboxes (40c1c1e71). Thanks to xet7.
• Admin Panel / People / E-mail: “Email domain name” is renamed to say what it does (f15b37e4e). Thanks to xet7.
• Admin Panel / Settings / Visibility: the All Boards rows say only what is hidden (2ef34924d). Thanks to xet7.
• Each section of Admin Panel / Settings / Visibility has its own Save, directly above the rule that closes it (9255a6533). Thanks to xet7.
• “Product name” appears once in that pane, not twice: the group holds one field (bbb1b3ff0). Thanks to xet7.
• Admin Panel / Problems: the left menu is grouped under Settings and Reports (fc0fe3177). Thanks to xet7.
• Admin Panel / People: Domains moves up beside E-mail, the settings it is about (d23219407). Thanks to xet7.
• Admin Panel / Problems / Broken Cards has the same controls as the other reports (fc0fe3177). Thanks to xet7.
• No Admin Panel pane repeats the title above it (9a0db4343). Thanks to xet7.
• Admin Panel / Attachments opens on Backup, which is also the first entry of its menu (a9680fa3d). Thanks to xet7.
• Admin Panel / Attachments no longer has a Sandstorm pane (eba25459a). Thanks to xet7.

and updates the following dependencies:

• @aws-sdk/client-s3 3.1090.0 → 3.1095.0 — the S3 / MinIO attachment storage client (#6530, 36b54b1f5). Thanks to dependabot.
• unzipper 0.12.3 → 0.12.5 — the zip reader behind board import and backup restore (#6529, aa7abcf09). Thanks to dependabot.
• bson 7.3.0 → 7.3.1 — the BSON codec used with MongoDB and FerretDB (#6527, 047319fb2). Thanks to dependabot.
• @playwright/test 1.61.1 → 1.62.0 in tests/playwright — the browser test runner, a development dependency that is not part of the shipped bundle (#6528, f7fb32774). Thanks to dependabot.
• docker/login-action 4.4.0 → 4.5.1 — the GitHub Actions step that signs in to the container registries when a release image is published (#6526, d4684448c). Thanks to dependabot.

and fixes the following bugs:

• Clicking a card closes the one that was open; keeping many open is a per-user setting (2973240a7). Thanks to mimZD and xet7.
• All Boards on a phone sizes its scrollers by the viewport that is actually there (89920762a). Thanks to mimZD and xet7.
• Choosing a theme now recolours the whole UI, not just the header (d72675906). Thanks to xet7.
• Admin Panel: the Edit User, Organization and Team popups fit the window, in columns (19a5ea0b7). Thanks to xet7.
• Admin Panel / Settings / Visibility / Wait Spinner shows the spinner it names, spinning (19a5ea0b7). Thanks to xet7.
• Admin Panel / Settings / Translation puts its New column on the left (19a5ea0b7). Thanks to xet7.
• Admin Panel / People / People showed nothing at all — no table, no search box, no pager (d23219407). Thanks to xet7.
• The right-hand side of an Admin Panel table is no longer off screen (d23219407). Thanks to xet7.
• An empty Admin Panel table still shows its header, so its New button is there (d23219407). Thanks to xet7.
• Every control in an Admin Panel table’s controls row sits at the same height (d23219407). Thanks to xet7.
• A long Admin Panel left menu scrolls inside its panel (a4990a474). Thanks to xet7.
• The build stopped with Can't use the built-in 'if' here on the People page (f8793bec4). Thanks to xet7.
• Admin Panel / People / E-mail saved neither of the two settings it shows (f15b37e4e). Thanks to xet7.
• Admin Panel pages no longer repeat the pane name in a bar of their own (73cd930a4). Thanks to xet7.
• The Admin Panel left menu is back on every page (d34d28159). Thanks to xet7.
• The password field is back on the Sign In and Register pages (696c49038). Thanks to xet7.
• A finished MongoDB → FerretDB migration on Snap no longer leaves WeKan on 503 (aebede877). Thanks to S0QR2 and xet7.
• In mobile mode the fixed-size light grey bands around a swimlane are gone (6837198bf). Thanks to xet7.
• In mobile mode the board fits the width again (a5850296a). Thanks to xet7.
• In mobile mode the titles and the top bar sit on one line (a5850296a). Thanks to xet7.
• In mobile mode, clicking the Add List + no longer opens the list as well (df27e349d). Thanks to xet7.
• In mobile mode the “Add List” + moved into each list header, between the caret and the drag handle (61979c0f6). Thanks to xet7.
• Checked for the same window-resizing bug everywhere else it could hide (7dcd9da67). Thanks to xet7.
• Elements no longer change size when the browser window is resized (d03cd0300). Thanks to xet7.
• The second header bar in mobile mode is the same on a phone as in mobile mode on a desktop window (72315d8f9). Thanks to xet7.
• The list title is visible in mobile mode again, both on a phone and on a desktop (72315d8f9). Thanks to xet7.
• The board in mobile mode reflows sideways again instead of overflowing by a sliver (72315d8f9). Thanks to xet7.
• The minicard drag handle is below the minicard menu button, on the same edge (114a0af31). Thanks to xet7.
• Drag-to-scroll now works on both top header bars, not only below them (a5246fbf5). Thanks to xet7.
• The board title is shown again in mobile mode, and the second header bar now reads title, buttons, hamburger (a5246fbf5). Thanks to xet7.
• The sidebar hamburger keeps its divider at the end of the header bar (a5246fbf5). Thanks to xet7.
• Lists and cards are full width in mobile mode on a desktop browser too, not only on a phone (a5246fbf5). Thanks to xet7.
• The Sign In and Register pages have real scrollable space below the form again (45022e907). Thanks to xet7.

and has the following developer-facing changes:

• The Playwright tests address an Admin Panel menu entry by its data-id, not by a per-page class (b0bffe8c1). Thanks to xet7.

• Every paginated admin table renders through ONE shared table page (9791993d5). Thanks to xet7.

• Every .jade template is now compiled by a test, using the same compiler the build uses (a5246fbf5). Thanks to xet7.

• The shared left menu is a design of its own — docs/Design/Page/Left-Menu.md — beside the table page (f14dc6a78). Thanks to xet7.

and updates the documentation:

• docs/Design/Multitenancy/Multitenancy.md designs one server for many domains (fd12199e9). Thanks to xet7.
• The Admin Panel documentation mirrors the Admin Panel menu: a menu path is a docs path (1e9e58dab). Thanks to xet7.

and fills untranslated strings in every language:

• The new multitenancy and site-theme strings are translated into every language (78e2adb69). Thanks to xet7.
• Strings untranslated everywhere are filled directly, never overwriting a human one (526905483). Thanks to xet7.
• Every remaining language is translated, most spoken to least (cc71cb28c). Thanks to xet7.
• releases/translations/fill_translations.py joins the .mjs of the same name: the same rules (526905483). Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.