RouteBleed - code scanning alert #434, rule js/incomplete-sanitization (CWE-20, CWE-80 and CWE-116), in tests/boardExportScope.test.cjs: an export path was interpolated into a dynamic regular expression after escaping only forward slashes. Backslashes and every actual regular-expression metacharacter remained active, so the test could match a different route, fail to match the intended one or fail to compile.

The code was test-only, read a hardcoded route table and is never shipped in a WeKan bundle, so there was no runtime or user-input exposure. There is no denied operation to attribute in Admin Panel → Problems. The fix removes the pattern rather than adding another sanitizer: the test wants an exact route literal and now checks that exact string with includes().

Positive and negative cases cover backslashes and the full metacharacter set, and a repository-wide guard rejects the reported slash-only escape shape in tracked JavaScript. The same sweep removed a second partial dynamic pattern from release-bundle coverage.

The page had nested vertical overflow panes on #content, its wrapper, the left menu, the icon grid and the table view. A swipe could be captured by the wrong pane, and an invited-board tile’s Accept and Decline controls made its grid row taller than the percentage-height chain expected, leaving boards below it unreachable.

#content is now the one native vertical scroller. The wrapper, both columns, the board grid and the table page contribute their natural height to it, so a gesture has one owner and invitation controls are not clipped. Regression tests cover ordinary tiles, invitations, table view, viewport sizing and reject a second nested vertical scroller.

The narrow-device rule made the body a viewport-sized, non-scrolling box, but made #content non-scrollable too. Mobile UI mode happened to restore its overflow through a more specific selector; explicitly selecting desktop UI mode did not, so the bottom of All Boards and other pages was clipped behind the browser controls.

The phone viewport and content-scroller contract now lives in the shared page layout rather than the All Boards stylesheet. The top header stays separate while #content scrolls in both UI modes on every route. All Boards continues to use that one scroll owner for Starred, Remaining, Public, Archived, Workspaces and every other left-menu section. Source and negative tests reject a hidden content pane, and the phone browser test toggles to desktop mode before checking that its final board remains visible.

database-compare and database-merge tried only the current MongoDB 7 executable, although the migration carries MongoDB 5.0 and 4.2 readers for older WiredTiger formats. A retained MongoDB 4.x or 5.0 database was therefore reported as unreadable, and merge had no source from which to recover the missing work.

Both recovery phases now use the same 7, 5.0 and 4.2 compatibility ladder as migration, safely skipping readers absent on an architecture and naming the startup log when all of them fail. Merge also reuses a running FerretDB target; it no longer starts a second FerretDB against the already-open SQLite database. Only temporary processes are stopped afterwards, so a live database borrowed for the operation remains running.

The official chart limited WeKan to 1 GiB while its own comments claimed the Docker image supplied a 4 GiB heap setting. It did not: Node.js 24 derived a roughly 640 MiB V8 ceiling from the cgroup, and the v10.96+ server bundle could exhaust it while linking and creating startup indexes, before ordinary application logging began.

The container now gives V8 three quarters of its cgroup memory, from 768 MiB up to the documented 4 GiB ceiling, leaving one quarter for native allocations. An administrator’s explicit NODE_OPTIONS always wins. The official chart now requests 512 MiB and limits the WeKan pod to 2 GiB, providing a 1536 MiB heap plus 512 MiB of native headroom by default.

The title editor is a nested inlinedForm, whose submit event receives the form arguments as this, not the Card document. Saving therefore called getTitle() on { classNames: "js-minicard-title-form" }, threw a TypeError and restored the old title.

The handler now takes the Card from its enclosing minicard template instance, compares and saves through that document, and never treats the nested event context as a Card. Empty and unchanged titles remain no-ops.

The common date form became a child Blaze template, but its Save, Delete and validation event map remained on each parent popup. Blaze does not dispatch a child template’s events to its parent’s event map, so the form rendered its existing value while every control inside it was inert.

The common form now owns its common event handlers and receives the parent popup’s state and field-specific callbacks explicitly. Received, start, due, end, vote, planning-poker and custom-field dates retain one shared form, and a browser regression test changes a previously stored due date.

The first date could be added because its plus button lives directly in the opened card’s data context. Once saved, however, the date became a shared badge whose child-template data contains only display arguments. Clicking that badge passed those arguments to the popup as though they were a Card, so calls such as getStart() and getReceived() threw and no editor appeared.

Every received, start, due, end, vote and planning-poker date badge now opens its popup explicitly with the surrounding date template’s Card and stops the click before the opened-card handler can create a second popup. Source-level positive and negative tests cover all four ordinary card dates, and the browser suite adds a saved start date, reopens it, changes it and verifies the new date.

The free-text control previously said Add regardless of whether the field was empty or already displayed a value. Both opened-card fields now use the existing translated Edit label when text exists and retain Add only for an empty value; their separate plus button continues to open the board-member selector.

The source guard checks both branches for both fields, including the empty-value negative case. Browser coverage seeds populated Requested By text beside an empty Assigned By field and verifies that the two controls render Edit and Add respectively.

The shared date form registered its Blaze event map before its Jade template existed, throwing on client startup and leaving Node E2E and every browser test on a blank page. The forms feature now creates editDateForm before the datepicker library attaches its events, with an import-order regression guard.

On phone-sized All Boards pages, the more-specific .board-list.mobile-view rule overrode the new natural-height list and restored a nested vertical scroller. The phone rule now covers both selectors, so #content remains the one swipe owner in either view.

The standalone E2E runner now discovers current Playwright cache revisions and rejects a Chromium binary for the wrong CPU architecture. Failed page renders also report browser exceptions and failed requests instead of only an empty body. The remaining completed failures were stale guards updated for the shared export document, server-supplied download names, reorganized LDAP documentation, the translation-memory helper and explicit bundle-smoke Node binary.

The browser suite now edits a minicard title from the board and verifies that the card is renamed without opening its details. Its negative case submits only whitespace and verifies that the original title remains visible.

A plain Node.js suite inventories every Office and API report translation in Finnish, rejects missing, empty and unintended English placeholders, and keeps the universal API, REST API and WITH_API=true terms recognizable. The existing Upcoming tests continue to cover RouteBleed, phone scrolling, Snap recovery, container heap limits, card dates and same-language translation memory, including their negative cases.

WeKan has many keys with identical English text. When a language already has exactly one non-English translation for that source, the same value can safely fill its still-English copies without guessing or crossing a language boundary. This filled 3,838 placeholders across 227 language files.

The reusable pass is dry-run by default, writes only when explicitly asked, never replaces an existing target translation, and leaves a source untouched when its translations disagree. Tests pin all four constraints; the human-preference and wrong-script checks remain clean.

All fourteen translatable strings added by the two Admin Panel → Problems reports now have Finnish labels, descriptions and empty-state messages. Product names, protocol acronyms, numbers and symbols remain unchanged because those values are already the same in Finnish.