New FerretDB users and password changes now create only salted, 15,000-iteration PBKDF2-SHA-256 credentials. An explicit SCRAM-SHA-1 request is rejected, and the MD5 password-preparation function is removed instead of being hidden behind an ineffective CodeQL annotation, resolving alert 46 (CWE-327, CWE-328 and CWE-916). Existing stored SCRAM-SHA-1 credentials remain readable only for authentication, so an administrator can migrate a legacy account by changing its password. Positive SHA-256 creation/update tests and negative SHA-1 creation/update tests pass with the full FerretDB unit, vet and SQLite/TLS integration suites.

One common server boundary now validates and clones imported and exported object graphs, removes prototype-pollution keys and accessors, rejects cycles and resource-limit abuse, normalizes invalid scalars, strips secret fields from exports, and sends active markup, script URLs and CSS payloads through WeKan’s existing DOMPurify sanitizer. UI/DDP, REST, streamed ZIP, Excel-cell and live Trello imports use it, as do canonical and external-format exports. Rejected and sanitized attempts report their source, affected paths, user and address when available in Admin Panel Problems → Security. CSV/TSV formula escaping remains enabled for every row.

Live Trello imports now use atomic expiring leases with an in-flight heartbeat, reclaim unfinished jobs on startup, and adopt a board whose durable import activity proves that its side effect completed before a crash. Requests have timeouts and response-size limits, retry transient HTTP 408/425/429/5xx and honour Retry-After; SSRF verdicts remain non-retryable. Positive and negative regression tests cover the common boundary, every transport connection, prototype pollution, accessors, cycles, limits, DOM sanitization, spreadsheet formula prefixes, restart reclaim, idempotency, leases, retries and timeouts.

The constant-memory JSON exporter now applies the same shared validation, DOMPurify and secret-removal boundary separately to the board, every streamed collection document, attachment metadata and user. Attachment bytes remain a direct base64 stream, avoiding both executable interpretation and unbounded memory use. Regression coverage prevents this large-board export path from bypassing the common security boundary.

Every directly executed GitHub Actions job now has a timeout, including the smaller Docker, Flatpak, chart, dependency-review and repair workflows. A stuck external service or command therefore ends as a bounded timeout instead of requiring an unexplained manual cancellation.

A repository-wide regression test checks every active workflow: shell commands must have a descriptive step name, explicit nonzero exits must print a nearby ::error::, every job must be time-bounded, and continue-on-error jobs must still print their final result. This keeps both fatal and deliberately tolerated failures visible in the Actions log.

The Windows single-EXE manifest now normalizes the backslash-separated member names printed by Windows tar, so executables, native addons and startup files are included instead of producing an empty C array. An empty manifest fails with its cause before compilation. Regression coverage checks both Windows paths and the fail-closed behavior.

Ondra and Gantt repository synchronization now retains each variant’s own Actions workflows instead of copying WeKan’s release workflows. Their existing Contents token can therefore push ordinary source updates without the unrelated GitHub PAT workflow scope, and the variants cannot accidentally run the main release flow.

An XLSX workbook’s unvalidated sheet-tab color was interpolated into the viewer’s complete style.cssText. A board member could append CSS declarations, cover another authorized member’s attachment preview and trigger a CSS resource request when that member opened the workbook (SheetColorBleed, GHSA-crq2-phg8-4xvg; CWE-79 and CWE-116). No script execution, response reading, credential access or authenticated state change was demonstrated.

The vendored viewer now accepts only canonical #RRGGBB immediately before the CSS serialization boundary. Regression coverage retains a valid color and rejects the disclosure payload, short/alpha/named colors, non-hex input and empty values. The security inventory and Hall of Fame now account for all 94 published names.

The same change resolves CodeQL alert 447 in a release-version test by comparing the exact expected Dockerfile string instead of constructing a partly escaped regular expression. That alert did not reach application runtime or untrusted data. SheetColorBleed is normalized during an ordinary preview rather than refused, so there is no attributable attack-only event to report in Problems → Security; logging the preview would falsely identify the viewer rather than the workbook uploader.

FerretDB launch paths now integrity-check SQLite before opening it, create staged, compressed and SHA-256-verified snapshots in the same data directory, check free space, restore latest then previous verified generations, and re-run a retained MongoDB migration when no snapshot survives. Snapshot manifests retain byte/hash change evidence, and every outcome reaches Problems → Recovery.

New change-history rows form a SHA-256 predecessor chain. Restore, undo and redo refuse changed, missing or forked history and report the available row, board, username and address evidence in Problems → Security. A low-load background audit also checks whole chains. Regression tests prove there is no direct client publication, REST mutation API or collection write permission for history.

The existing signed attachment/avatar inventory now also scans registered logs and recovery generations. Missing or changed files report expected and observed sizes and checksums in Problems → Security. CPU-intensive background audits wait for consecutive low samples, recheck load between paced operations and defer when the quiet window ends. Problems → Speed shows rolling minimum, average, maximum, sample count and lowest-load time so the chosen maintenance window is visible.

build.sh silently waited for Enter after a release command, and build.bat displayed an acknowledgement pause after release scripts, release commands, command-list output and a missing-Bash error. Those waits did not monitor the command or the remote release; they only consumed an extra line or keystroke.

Both scripts now exit to the shell or command prompt as soon as a selected process finishes. They wait for terminal input only while displaying a menu or a visible question that collects a real command argument. Focused regression coverage checks the prompt and exit control flow in both scripts.

The full test run still expected Mobile Mode to copy list names into the top header, even though that switcher was removed to keep the header height and other swimlanes stable. Another static check searched for the drag handle only inside a removed coarse-pointer media query instead of the mode-based rule used by every browser.

Those checks now pin the current structure. The Firefox browser test also accepts less than half a CSS pixel of glyph-centre rounding; it had failed on a 0.0083-pixel difference while Chromium and WebKit passed. A real positioning regression of half a pixel or more still fails.

The Hall of Fame audit had been looking only in an obsolete companion-repository location, so it silently skipped the real .tools/wekan.fi catalog. The security regression inventory also stopped at 62 vulnerabilities. It now accounts for all 93 published names: 71 have named regression coverage and the remaining 22 older fixes are explicit gaps. Scanner command injection payloads have focused positive and negative coverage, and rejected scanner filenames appear as ScannerBleed in Admin Panel → Problems → Security. Response-only protections remain deliberately silent where normal use cannot be distinguished from an attack.

All three FerretDB launch paths previously ignored a failed backup or restore copy, reported success anyway, and removed a failed restore request. They now report backup-failed, restore-failed or manual-required in Admin Panel → Problems → Recovery, never claim that a failed copy succeeded, and retain failed restore requests for the next restart. The recovery documentation now separates implemented automatic mitigation from operator-requested text-database restore and records the remaining portable integrity-check gap instead of describing an unused decision function as production automation.

The Problems documentation now defines persistent operation records, bounded leases, checkpoints, idempotency keys, startup reclaim, cancellation and terminal failure reporting for background work. It also specifies rate-limit-aware retries and the evidence each recovery outcome must retain, making the remaining implementation work distinguishable from completed automatic recovery. The Problems index links the new contract.

The import/export documentation inventories WeKan, Trello, Jira, Kanboard, Nextcloud Deck, OpenProject, GitHub, GitLab, Gitea, Forgejo, Asana and Zenkit formats against their maintained APIs. It defines per-format field coverage, explicit loss accounting, restart checkpoints, stable source identities, idempotent writes, attachment streaming, external-service timeouts and Retry-After handling.

Every structured transfer now has one documented trust boundary for structural validation, prototype-key rejection, resource limits, DOMPurify cleanup, secret removal and spreadsheet-formula neutralization. The contract requires both sanitized and blocked attempts to retain attributable evidence in Problems → Security and requires every new adapter to reuse the shared boundary.