The nextPage and previousPage DDP publications accepted a client-supplied global-search session ID, loaded its stored board selector without checking its owner, and could return private card titles, descriptions and custom-field values to a logged-out or different user. The session ID had to be obtained first, but neither publication enforced the authentication boundary.

Both paths now refuse logged-out clients and perform one owner-scoped lookup using the authenticated user and session ID together. Missing or foreign sessions complete without publishing data. Attributable logged-out probes are folded into a bounded SessionBleed summary in Admin Panel → Problems; ordinary authenticated pagination is never logged. Positive decision tests, a negative whole-publication scan and a live Chromium DDP test cover the boundary.

The i686 launcher no longer gives a 32-bit Node process a 4 GiB V8 heap that exhausts its virtual address space while deserializing the startup snapshot. Automatic selection is capped at 1 GiB for an ELF 32-bit Node, while an explicit NODE_OPTIONS remains authoritative.

The armhf workflow now probes the Node binary inside the image instead of only the outer AppImage runtime. A runner whose kernel can execute the wrapper but lacks /lib/ld-linux-armhf.so.3 therefore uploads the package with an honest unchecked warning; a runnable Node must still pass the real HTTP smoke test. Positive and negative plain-Node coverage pins the heap ceiling, override, inner-runtime probe and smoke-test ordering.

The v11.15 rerun proved that fixing the bundle launcher alone was insufficient: an AppImage wraps the ZIP already attached to that release, so its bundled start-wekan.sh still predated the fix and i686 again died with GC during deserialization.

The generated AppRun now supplies the same 1 GiB V8 ceiling for i686 and armhf before invoking the bundle launcher. This makes a missing AppImage safely rebuildable around an older published ZIP, while ${NODE_OPTIONS} supplied by an administrator still wins. Regression coverage pins that old-bundle boundary and the architecture substitution.

release-all.yml built and published the core ZIP bundles but never called the reusable AppImage workflow, leaving AppImages to a separate manual or missing-assets run. It now calls AppImage.yml immediately after the core GitHub Release has attached its amd64 and arm64 ZIPs. The exact new tag is passed explicitly, release-asset write permission is scoped to the call, and the work runs in parallel with the other post-release formats.

Regression coverage pins the release dependency, reusable-workflow path, tag, publish flag and permission, while the workflow-interface guard proves the called workflow exists and accepts every supplied input.

An accessibility markup change accidentally made .card-details-canvas an empty sibling of the card header and body. Its computed 20-pixel padding still looked correct, but no visible content was inside it, so descriptions and custom fields touched the panel edges.

The canvas once again owns the whole card body. Positive and negative source coverage pins that ownership and rejects the empty-sibling structure, while the Playwright regression reproduces an 1100-pixel desktop panel and verifies the actual content-to-edge gaps rather than trusting the wrapper’s computed style.