WeKan 11.24 restored Meteor’s standard resume-login query, but its release delivery could retain a FerretDB binary from before nested positional projections were fixed. Refreshing either a local-password or SSO session then returned 403 and exposed an empty board shell before the login page appeared. Bundles now reject FerretDB releases older than v1.63.0. Docker records the release represented by its cached binary and replaces a changed requirement atomically instead of retaining an incompatible executable indefinitely. Unit coverage accepts compatible and newer versions, rejects older and unknown versions, and verifies cache replacement; existing authenticated Playwright board tests cover reloads through the UI.

Docker resolves the newest FerretDB release on every start, verifies its published checksum and atomically replaces a differently tagged cached binary. Regression coverage also audits the release workflow: FerretDB and MongoDB Database Tools come from their latest releases, while the Node resolver walks maintained Node versions newest-first and uses the matching newest available node-patches binary when the official sources do not publish that platform.

The PostgreSQL, MySQL, MariaDB and SAP HANA Compose variants previously downloaded FerretDB only when their persistent volume had no executable. They now resolve the concrete newest release on every start, compare it with a release marker, verify the replacement’s published SHA256 and move it into place only after verification. Regression coverage applies the same cache, checksum and atomic-replacement requirements to all five FerretDB v1 Compose files.

The chart deliberately uses ghcr.io/wekan/ferretdb:latest, but IfNotPresent allowed Kubernetes to reuse an older image already cached on a node. Its FerretDB container now uses Always, so every newly started pod asks the registry for the current image. Chart regression coverage pins that policy.