Readiness probes redact MongoDB credentials before any URI reaches a log. Aggregation array, string, date and conversion operators keep client-provided BSON numbers fixed-width until their bounds are validated, including on 32-bit builds. Developer-tool URL expressions match the complete github.com hostname literally. The MongoDB-mandated MD5 preparation inside legacy SCRAM-SHA-1 is narrowly documented and suppressed rather than changed incompatibly; new deployments retain SCRAM-SHA-256 as the stronger option. Native unit tests, extreme-value regressions, 32-bit cross-compilation, the FerretDB build, vet and the affected tools-module tests pass.

Numeric aggregation type codes are compared without narrowing, every $range result is checked at its int32 conversion boundary, and array and code-point indexes retain int64 results when they exceed BSON’s int32 range. The legacy SCRAM-SHA-1 compatibility path now performs its MongoDB-mandated MD5 preparation as one direct digest, placing its narrow CodeQL exception on the reported operation. Native boundary tests, vet and 32-bit cross-compilation pass for alerts 6, 11 and 38 through 42.

Aggregation indexes are parsed directly at the requested BSON width instead of narrowing an architecture-dependent native integer. MongoDB’s mandatory legacy SCRAM-SHA-1 password preparation carries both current and legacy query-specific CodeQL annotations at the exact MD5 digest operation, documenting why replacing it would reject protocol-compatible credentials rather than improve security. Native boundary tests, vet and 32-bit cross-compilation pass for alerts 43 and 44; the MongoDB-generated authentication vectors remain unchanged.

Card, List and Swimlane cells no longer stop growing at a hardcoded 250 pixels. The table consumes its available container width, and card titles default to a single ellipsized line whose native tooltip retains the complete text. A toolbar control opts into wrapping, with the choice stored separately for each user. Unit coverage checks defaults, persistence and user isolation; a browser test checks width, tooltip, both modes and persistence across reload.

Card, List, Swimlane, people, label and date headers now toggle ascending and descending client-side sorting. Empty date values remain last in both directions, and card title provides deterministic ordering when selected values match. Comparator tests cover text, numeric titles, dates, nulls and state transitions; a browser regression checks header toggling and indicators.

Flat rows remain the default. A per-user toolbar toggle groups cards in board swimlane order while retaining the selected column sort inside each lane. Section headers are inserted after pagination, so they never consume any of the 25 card slots; a page beginning partway through a lane still names that lane. Unit coverage checks defaults, isolation and boundaries, and a browser scenario checks lane order, card count and persistence across reload.

The three affected card-action handlers copied their generated description into both the Action and its schema-bound Rule, although desc belongs only to the Action. SimpleSchema rejected the unknown Rule key and returned the user to the add-rule screen. Current-date, remove-date-value and add-member actions now match every working handler by storing desc solely on the Action. Positive and negative source coverage protects all three branches, and a Playwright flow checks that the UI saves a date Rule without desc while its Action retains the description.

The reported checklist, email, member-removal and date-action failures were already corrected by earlier changes. The remaining moved-from-list case is also fixed: its trigger resolves the activity’s old list and matches a move away, while rejecting a move into that list. The existing rule-engine suite now names issue 1972 on both the positive and negative cases so that the historical report cannot silently regress.

Firefox treated the popup’s Save buttons as implicit form submissions and navigated before the list or swimlane mutation completed, which was most visible when ROOT_URL included a path prefix. The existing handlers now prevent that navigation on both the click and submit paths. Four focused positive and negative checks pass. A production-mode Meteor server under /path compiled and started, and live Chromium changed both stored colors without leaving the prefixed board URL. The Firefox browser regression is registered but could not run locally because its Playwright binary is absent. FerretDB and the service-worker 404 are unrelated to these client mutations.

Boards created before the dedicated minicard creator setting existed no longer inherit the separate opened-card creator setting in the Card Settings popup. Their checkbox and rendered cards now both remain off by default, while an explicit click persists the opt-in and shows the creator. Five focused positive, negative and wiring checks pass. A live Meteor development stack compiled and started, and Chromium reproduced the legacy missing field, checked the initial UI state, enabled it and observed the avatar appear. FerretDB only stores the board setting and is not involved in its interpretation.

The earlier board-scoping fix constrains both the filter-to-selection query and every subsequent bulk action to the current board. Its positive, negative and end-to-end selector tests reproduce two boards whose cards share the filtered member, then prove that the cached card from the other board is neither selected nor mutated. This closing commit records that verified fix against issue 2306.

The earlier startup-schema and tile-data fix restored card counters and member avatars without reactive cursor loops. The current suite verifies enabled and disabled counters independently, treats a missing legacy flag consistently as disabled, keeps boards and their lists isolated, and confirms that the template uses the resolved per-board settings. This closing commit records that verified fix against issue 4825.

The non-reactive tile-data implementation already restored the optional list names and card counts that were removed to stop board icons moving beneath the pointer. The positive regression now names issue 4959 and confirms that an enabled board receives every list in board order. Disabled, legacy and cross-board negative cases remain covered by the same suite.

The top-bar Create Board control is restored and now classifies its nested picker as a board-template search, just like Add Board on the overview. The picker remains open while its template-container subscription becomes ready, instead of returning early with stale or empty data. Focused coverage protects both entry points, archived filtering and custom-field remapping. Live Chromium shows only the active Std template, excludes an archived old template and an ordinary card, creates the board and verifies its custom-field definition.

The current server-side People paging explicitly names every page and the table renders only those users in the server’s stable creation-time order. Each row also receives its email, creation time and authentication method. Positive and negative coverage now names issue 4897 so unrelated cached user documents cannot make rows disappear, duplicate or display different account data while an administrator scrolls or pages.

LDAP servers can return one email as a Buffer or several aliases as an array of Buffers. Expanding a Buffer produced numeric byte values, while preserving an array passed binary objects into Meteor’s string-only email schema and rejected the first login. WeKan now decodes every shape to UTF-8 text, keeps all aliases, uses the first as the account email, ignores empty values and removes duplicate aliases case-insensitively. Nine focused positive, negative and wiring tests pass, all LDAP tests pass, the package compiles in the live Meteor stack, and the related live Chromium suites pass 19 tests with one opt-in scenario skipped.

Enabling LDAP group filtering without its member attribute could omit the only clause tying a group search to the current user. The directory then returned every group, and the logs did not explain which setting was absent. Every group consumer now requires the identifier, member attribute and member-value format; the login restriction additionally requires an allowed group. Missing values are named in the error and produce no groups or a refused login before an LDAP search begins. Six focused configuration and wiring tests pass, the full LDAP suite remains green, and the package compiles and starts in the live Meteor stack. FerretDB is not involved in the pre-login directory searches.

The existing fix already ORed ordinary login groups with admin-sync groups, so an administrator no longer had to be duplicated into the ordinary-user group. The closing audit now parses that combined list once, removes blank and case-insensitive duplicate names, escapes every LDAP assertion value and refuses a blank-only list before it can become a broad directory query. Nine positive, negative and wiring cases cover admin-only users, multiple groups, disabled admin sync and malformed lists; the full LDAP suite passes and the package compiles and starts in Meteor. A live bind still needs an external LDAP directory; FerretDB is not involved.

The existing Meteor login-attempt guard already rejected a migrated LDAP account’s retained local password in browser logins. The REST email form did not use Meteor’s login hooks and could still compare that stale bcrypt hash directly. It now applies the same guard first, performs dummy bcrypt work and returns the route’s uniform failure. Fourteen guard, eight REST LDAP, seven timing and ten throttle tests pass. In the live Meteor stack, the same valid password receives HTTP 401 for an LDAP account and HTTP 200 for a local account. FerretDB is not involved in authentication.

The earlier merge fix updates an LDAP account with verified OIDC identity data instead of replacing its profile, so avatars, template board and swimlane references, language and preferences remain present. The behavioral regression executes the real account-creation hook and now also proves that existing login sessions, LDAP service data and organization membership survive. Seven profile merge, eleven concurrent-login, twelve login-style and three CAS boundary tests pass, and the full app compiles and starts in Meteor. A real provider handshake still requires external LDAP and OIDC services; FerretDB is not involved.

Existing LDAP accounts are re-found by their stored identifier attribute, with the configured search field as a fallback, so later username, full-name and email changes are written instead of stopping after the first import. The opt-in authoritative mode disables a user only when a successful directory search returns zero entries and re-enables that user on reappearance. Missing identifier configuration and ambiguous matches now abort safely rather than masquerading as deletion. Eight new background-sync and eleven identifier filter tests pass, every LDAP plain-Node suite remains green, and Meteor compiles and starts. A live directory sync still requires an external LDAP server; FerretDB only stores the resulting user document.

A base DN containing both people and groups could return Active Directory, OpenLDAP or POSIX group objects when LDAP_USER_SEARCH_FILTER was empty. Their name plus the configured default email domain was enough to create spurious WeKan accounts. Bulk import now skips known group object classes and account creation independently rejects them, case-insensitively and with string, Buffer or array attributes. Standard and custom user schemas remain accepted. Six focused positive, negative and wiring tests and every LDAP plain-Node suite pass, and Meteor compiles and starts. The guide also shows appropriate user filters. FerretDB only stores accounts after this validation.

The maintained LDAP guide now recommends true for immediate TLS (LDAPS), starttls for an upgraded connection and false only for an unencrypted connection. It removes the obsolete claim that STARTTLS is inherently more secure than LDAPS and updates the FreeIPA example. Legacy ssl and tls values remain compatible with explicit deprecation warnings. Twenty-five positive, negative, wiring and documentation tests pass, and the package compiles and starts with Meteor’s development MongoDB. A real TLS handshake still needs an external LDAP directory; FerretDB is not involved.

The REST route called Meteor’s private bcrypt checker directly, so every LDAP account without a duplicated local password failed before WeKan’s LDAP handler could run. Existing and first-time LDAP username logins now use Meteor’s server-side login-handler API, then receive the same REST token as local users. Local-password accounts, uniform failure messages, throttling and two-factor checks retain their existing paths. Seven focused positive, negative and wiring tests and 28 related authentication tests pass; the full app compiles and all 25 live REST API browser tests pass. A real LDAP bind still requires an external directory fixture and was not available locally. FerretDB is not involved in credential validation.

Authorization, token, Oracle token and UserInfo requests now share one endpoint resolver. Complete HTTP and HTTPS URLs remain intact, while relative paths are joined to the provider URL without duplicate slashes. The maintained guide documents Spring Authorization Server’s /oauth2/authorize, /oauth2/token and /userinfo defaults and the exact WeKan callback. Six endpoint and 30 related OIDC/CAS tests pass, and the live Meteor app compiles and starts. A complete Spring handshake still requires an external authorization server; FerretDB is not involved in provider communication.

The Japanese-specific Yu Gothic and Meiryo defaults were removed in 2017, and the current client also synchronizes the document language with the selected locale while retaining a validated per-user font override. Positive and negative source coverage protects all three boundaries. A live Chromium regression selects Chinese, requires html[lang="zh-CN"] and rejects both Japanese fonts from the computed default stack.

The earlier scoped CJK wrapping fix keeps Japanese words such as 追加 (Add) and リンク (Link) intact while allowing the footer to wrap between controls. Nine positive, negative and scope checks prevent either mid-word CJK breaks or a global rule that would damage Latin and long-URL wrapping. A live Meteor development stack compiled and started, and Chromium selected Japanese, opened the real add-card composer and measured every translated control as one line. FerretDB is not involved in client layout.

Each list body and card-details window now exposes the standard region role, a translated accessible name and keyboard focus. Speech-recognition software can therefore target the intended scrollbar instead of guessing among the several independent regions on a board, and keyboard users gain the same control. Four focused positive, negative and wiring checks pass. A live Meteor development stack compiled and started, and Chromium focused overflowing list and card regions and scrolled each with Page Down. A Dragon installation was not available for its proprietary voice-command layer. FerretDB is not involved in client focus or scrolling.

The Winston/Zulip database observer that replaced Meteor’s default console transport was removed in 2017, restoring normal database startup. Docker guidance no longer advertises that obsolete integration. Focused regressions protect the removed startup files and dependencies while requiring the active container database URL; live Meteor runs also started logging and MongoDB together.

The existing logout endpoint revokes either the presented token or every session with authenticated-user scoping. All 12 positive and negative planning cases pass. A new end-to-end API regression logs out with a real bearer token, verifies its removal from the user’s resume tokens and requires that same token to receive HTTP 401 on its next request.

The earlier fix wraps every archived card together with its own Restore and Delete links and separates that complete group from the next card. Structural, spacing, hover, narrow-sidebar, RTL and theme-neutral regressions all pass, and the browser restore flow remains registered. The negative case prevents the old equal spacing above and below the actions from returning.

The existing cascade archives a swimlane’s active cards with the lane and restores exactly those cards later. Eleven positive, negative, legacy-data and repeated-round-trip cases pass: cards archived independently remain archived, other lanes remain untouched and no active card can be stranded beneath an archived swimlane.

The current board menu opens its card, list and swimlane archive in the board sidebar, while archived boards remain a distinct section of All Boards. The strengthened 12-case navigation suite now names issue 1280 and prevents those destinations from being conflated again. The archived-card browser restore flow also remains registered.

The earlier invitation fix deactivates removed or declining members, clears the pending invitation and refuses to reactivate anyone who no longer has a real invite, while preserving the valid acceptance path. All 11 lifecycle cases and 16 team-to-board propagation cases pass. Browser coverage also registers both administrator removal and the negative non-admin permission path.

The existing navigation helper derives the card and board route from the subtask itself and falls back to its stored board ID when a cross-board deposit board is not loaded in the browser. Eleven loaded, unloaded, plain-document and malformed-data cases pass; truly broken references warn instead of throwing or routing to an undefined card.

A member of the linking board must not inherit access to the private source board. Current source already filters the real card and all children by board visibility while falling back to the linked card’s stored snapshot, avoiding the historical blank and frozen view. Unit coverage pins both sides of that boundary, and a browser scenario proves an unauthorized viewer can open and close the snapshot normally without weakening source-board authorization.

The existing importer restores created, received, start, due and end dates and falls back to the exported card when an old or pruned board has no creation activity. Thirteen focused cases prove valid dates, missing fields and corrupt values; invalid optional dates become null rather than aborting insertion and hiding the entire card. Both WeKan import browser flows remain registered.

Old Sandstorm exports can omit the board permission. The importer now preserves an exact explicit public or private value while missing, malformed and lookalike values fail closed to private. Five focused positive and negative cases pass, and a browser regression imports a permission-less Sandstorm-style board and verifies its stored visibility.

A grain that finished rendering while its iframe was hidden could retain the hidden frame’s narrow dimensions because returning did not reliably emit a resize. Visibility, page-show and focus restoration now coalesce into the ordinary resize path after the iframe has rendered, refreshing the sidebar, header, popups and responsive layout. Hidden-frame, timing, wiring and hot-reload regressions pass, and a live Chromium test confirms that restoring a preserved page publishes a fresh viewport measurement.

The member button no longer depends exclusively on the Powerbox native module, which is unavailable in the Node 24 bundle and never attached its claimed identity to the selected board. It now opens WeKan’s maintained, permission-checked search for identities that have visited the grain. Local email-account creation stays hidden because those accounts cannot authenticate through Sandstorm. Focused coverage protects the Sandstorm branch and admin mapping; live Chromium adds a user to the second of two boards, leaves the first unchanged and opens the second board as that user.

Revoking a user’s Sandstorm share prevents access but cannot notify the app, so the old WeKan member avatar can remain. Board administrators can remove that stale local member and all of their card roles, while a Sandstorm-only warning now states that this action does not revoke grain access and points them to the platform’s Share access dialog. Four positive, negative and wiring regressions pass, the complete client compiles, and both live member-removal permission scenarios pass in Chromium. A real revoke callback cannot be tested because Sandstorm exposes none; FerretDB is not involved in grain authorization.

The earlier Sandstorm account fix probes candidate usernames with an anchored, escaped, case-insensitive match and retries the next numeric suffix if a concurrent insert wins the unique-index race. Eleven positive, negative, race and integration-wiring regressions pass. This closing commit records the verified implementation against issue 574.

The existing reactive dependency reinitializes droppable behavior whenever a card enters the board after its lists first render. Three focused wiring cases pass. A new browser regression inserts a late card, performs a real pointer drag from the sidebar label and verifies the resulting label assignment in the database, reproducing the navigation-dependent failure from issue 1554.

The linked-source publication already sends the minimal username, name, initials and avatar fields only after source-board visibility filtering. Three field-parity and authorization checks pass. The cross-board browser regression now assigns a custom avatar to a second source member, leaves the picker subscription, reloads through the linking board and requires that image to remain rendered in card details.

Comment authorship was already retained, and the copy dialog already prefilled the source title, but schema auto-values still replaced every copied comment’s date with the copy time. Copies now re-home immutable comment data without mutating the cached source or emitting false new-comment activity. Unit tests cover preserved history and invalid input; the REST browser regression checks the original author, timestamp and destination board together.

The earlier server-language loading fix ensures the recipient’s translation bundle is present before notification subjects and activity descriptions are rendered, then carries that same language into buffered delivery. Six focused checks cover exact French prose, placeholder preservation, load order, the send-language handoff, supported-language fallback and rejection of the server default in this path; seven invitation-language tests also pass. The live Meteor development stack compiles and starts. An SMTP server was not required to verify content generation before transport, and FerretDB is not involved in localization.

The production correction landed earlier in commit 0f2179988 for duplicate issue #619: email addresses are normalized to lowercase, and a repeated local part receives the first free numeric suffix before account creation. New tests pin #825’s exact john.doe addresses at two domains and its mixed-case account scenario, proving they produce distinct, lowercase-login-safe usernames rather than the old raw 403 response.

Verification emails were enabled, but the accounts package’s token route was never configured, so links fell through to WeKan’s signed-in guard without changing the account. /verify-email/:token and the companion resend route are now installed explicitly. Routing and mail regressions pass; live Chromium coverage proves a valid token verifies the address, is consumed and signs the user in, while an invalid token leaves both account and session unchanged.

The shared account-creation hook assumed every login handler supplied an OIDC services object. CAS instead supplies its validated username, verified email, profile and authentication method as top-level fields, so a first login crashed before insertion. OIDC normalization now runs only when that service data exists. Focused coverage proves the missing-services path and complete CAS identity wiring while retaining the negative conflict check that prevents a CAS identity from silently taking over a non-CAS username. Provider validation still requires a deployment’s external CAS server.

Sandstorm and other SSO accounts may have no emails array. Profile submission now treats that state as an empty address instead of dereferencing a missing element, and the server honors the configured Allow Email Change setting for the authenticated user’s own account. Global administrators retain their existing authority; cross-user and disabled-setting writes are rejected, and new addresses begin unverified. Focused regressions and live Chromium cover all three authorization paths and the complete missing-field save.

On a mini screen, Search occupies the board area, but its Back arrow used to replace Search with the sidebar Home/settings content. It now resets Search for the next opening and closes the sidebar, uncovering the board immediately. Desktop Search and every other sidebar view retain their existing transitions. Positive and negative unit coverage protects that boundary, and a mobile browser regression checks the full Search-to-board interaction.

A deleted, archived or cross-board-moved card no longer leaves an empty details shell open on mobile. Each details instance observes the card that created it and clears desktop windows, mobile routes and popup state when that card disappears or changes boards. Positive and negative unit coverage pins the presence decision and cleanup wiring; a mobile browser regression removes an open card directly from the database and expects the board canvas to return.

Activities starts collapsed to keep card opening light, but its caret now asks for the complete card history regardless of obsolete per-card visibility flags. All 26 section-state, keyboard, subscription and negative regressions pass. A new browser scenario seeds a non-comment activity, opens the card’s Activities section and requires that exact persisted entry to render.

The required jQuery UI cancellation used to draw a card back in its source list until Blaze finished rendering the database move, producing the intermittent one-second flicker reported on large boards. A presentation-only copy now holds the target slot until the real reactive card arrives; it cannot receive pointer events and is removed immediately on arrival or failure, with a safety timeout. A Chromium drag regression deliberately delays the model move and verifies the target remains occupied throughout before the real card replaces the preview.

The touch bridge synthesized a click for every gesture shorter than 500 ms, even after jQuery UI had completed a sortable drag. That click followed the minicard link, making the board appear to reload with the moved card open. The adapter now suppresses only the synchronous post-drag click; normal taps and later independent clicks remain unchanged. Positive and negative unit coverage pins that boundary, and a Chromium regression performs a raw fast touch drag, checks the database move and verifies that card details stay closed.

The synchronous client no-cache lookup already prevents destination sort values from becoming NaN, overlapping existing cards and making them appear or disappear during later reordering. Eight focused positive and negative cases pass. A new browser regression moves a card into a populated list on another board, requires three distinct finite positions and verifies that all destination cards remain visible.

The current drag handler scrolls the list body under the pointer, refreshes sortable geometry after scrolling, and keeps the board still until the list reaches its end. Focused source regressions cover list selection, both scroll directions, the end boundary and geometry refresh. A Chromium regression drags through a long list, observes vertical scrolling and requires the persisted card position to change.

The restore command retains its existing --drop behavior, preventing the duplicate-key collisions caused by merging a backup into populated collections. It now also requires exactly one existing file and preserves an archive path containing spaces as one argument. Three command-level positive and negative regressions execute the real script around a mocked Snap environment and mongorestore; the related 13 old-database recovery checks and shell syntax validation pass. Building and installing a complete Snap was not required to exercise this command boundary. FerretDB is not used by this MongoDB archive restore path.

The earlier startup fix gives an explicitly configured mongo-url priority over the internally constructed address, including its database name, while an empty setting still receives the local port and oplog defaults. Four executable positive and negative regressions run the real setting reader with a mocked snapctl and evaluate the startup selection block. They prove that both the external database and its explicit oplog URL survive unchanged; shell syntax validation also passes. A complete Snap install and external MongoDB were not needed to exercise the configuration boundary. FerretDB is bypassed when this external URL is selected.

The canonical report, #2226, is closed and the current activity builder resolves members, checklist items, cards, lists, swimlanes, boards and labels before the complete parameter object reaches TAPi18n. Focused regression coverage now protects that wiring and verifies that representative German activity strings remain translated while preserving the exact replaceable-token inventory.

The current activity hook starts each outgoing delivery without awaiting it, and its guard resolves both synchronous and asynchronous failures instead of propagating them into the database operation. New regressions hold a receiver promise open and prove the caller continues immediately, verify rejected delivery is isolated, and pin the non-awaited Meteor callback wiring. This closes the older custom-field report against the completed non-blocking path.

The abusive third-party traffic came from Apache’s ProxyRequests On, not from WeKan or its database. Both reverse-proxy examples now set ProxyRequests Off inside the virtual host and no longer grant wildcard proxy access, preventing an unsafe global setting from leaking into the WeKan host. The guide also explains why ProxyMaxForwards does not close an open proxy. Three positive and negative configuration regressions protect those boundaries.

Board membership, comments, dates, attachments, checklists, custom fields and imports now use Fulah. Named and percent placeholders and HTML tags remain exact, and whole-locale invariant coverage leaves 2,116 values.

Card movement, activity summaries, checklist events and workspace controls now use Fulah. Named and percent placeholders, HTML tags and Markdown remain exact, leaving 2,066 values.