v9.67 2026-06-21 WeKan ® release

This release fixes the following bugs:

• Reworked confusing and unreliable list widths, #6409: a list now has one width instead of the old “min width / max width / automatic” trio, and it reliably persists across reloads (the render now drives the --list-width CSS variable the styles actually use, so a width no longer reverts to auto after reload). A new board setting Personal list widths chooses the scope:

  • Off (default) — Shared: the width lives on the list (lists.width), is the same for everyone on the board, and only members with write access can change it (read-only/comment-only members no longer see the resize handle). Shared widths are included in board export/import (the importer previously dropped lists.width; it now preserves width, color and collapsed state, and the board’s list-width scope).
  • On — Personal: each user keeps their own widths (profile, or localStorage when not logged in), falling back to the shared width then the default. The per-list popup is simplified to a single width value plus an Auto list width toggle (fit lists to content); the advanced per-list min/max pixel options were removed. Auto-width follows the same Shared/Personal scope (per-board for everyone, or per-user) and is carried through export/import. Documented in docs/Features/Lists/Lists.md.

• rebuild-wekan.sh / rebuild-wekan.bat menu option 2 (“Build WeKan”) now also clears the rspack dev-build caches (_build and node_modules/.cache) in addition to node_modules / .meteor/local / .build, so the next meteor run recompiles from scratch instead of occasionally serving stale modules after a git checkout/merge.

• rebuild-wekan.sh / rebuild-wekan.bat now give the Meteor build tool and Node a larger heap by default (TOOL_NODE_FLAGS and NODE_OPTIONS = --max-old-space-size=8192) for every dev-run, test and build option, so long development sessions and test runs no longer crash with “FATAL ERROR: … JavaScript heap out of memory”. Both honor an existing value, so you can lower it on machines with less RAM.

• Fixed editing the 2nd/3rd organization or team in Admin Panel › People always showing the FIRST one, #6411: on /people, clicking Edit on any organization or team filled the form with the first one’s values (so you could never edit the others). The edit/settings popups are opened from the row with data context { org } / { team }, but their helpers read this.orgId / this.teamId (undefined there) and called getOrg(undefined) / getTeam(undefined), which findOne({}) resolves to the first document. The popup helpers, the save handlers and the delete (settings) handlers now resolve the clicked row’s id from the { org } / { team } context. Verified against a running instance (each org/team now edits its own values).

• Fixed boards not rendering at all (blank board view) after the mongodb/bson 7.3.0 dependency bump. bson 7.x runs const { startupSnapshot } = globalThis?.process?.getBuiltinModule('v8') ?? {} at module-load time; the optional chaining stops before the call, so in the browser — where a partial process polyfill exists but has no getBuiltinModule — it threw TypeError: getBuiltinModule is not a function while evaluating client/components/cards/attachments.js (import { ObjectId } from 'bson'). That aborted the client bundle bootstrap part-way through client/imports.js, so every feature imported after it (notifications, swimlanes, rules, …) was never registered and the board view died with No such template: notifications. Added a tiny browser shim (client/lib/bsonBrowserShim.js, imported first in client/main.js) that gives the browser process a no-op getBuiltinModule, so bson takes its intended ?? {} fallback. New unit tests (client/lib/tests/bsonBrowserShim.tests.js); also hardened the #5686 Playwright spec to run against a rendering board. (PR #6410)

• Fixed REST API returning HTTP 500 with a stack trace for an invalid request, #5804: posting a comment without the required comment parameter (or to a board that does not exist) returned an HTTP 500 error page. The schema-validation error thrown on insert is a circular object (SimpleSchemaValidationContext → SimpleSchema → …), and serializing it crashed the response writer (Converting circular structure to JSON). Now: the comment parameter is validated and a missing/empty one returns HTTP 400; an unknown board returns HTTP 404 (the board-access checks no longer dereference board.members of a non-existent board); the JSON response writer is crash-proof (falls back to a safe { "error": … } payload instead of throwing); and REST comment errors now use their real status code instead of 200. New unit tests in server/lib/tests/apiResponseHelpers.tests.js. (PR #6406)

• Fixed selecting text in a checklist closing the card, #5686: selecting the text of a checklist item and releasing the mouse outside the card detail pane closed the card. The checklist items template stops mousedown propagation (for item sorting), so the existing cardDetailsIsDragging guard never engaged and the document-level “click outside to close” handler closed the card. The close handler now also keeps the card open whenever a live text selection is anchored inside the card pane (new propagation-independent guard client/lib/cardCloseGuard.js), so a deliberate click on empty board space still closes the card. New unit tests in client/lib/tests/cardCloseGuard.tests.js and a Playwright regression test in tests/playwright/specs/34-checklist-text-selection.e2e.js. (PR #6407)

• Fixed list reordering throwing 403 Access denied for read-only members, #5462: read-only / comment-only board members could still drag-reorder lists, which fired a server write that allow/deny rejected with 403 Access denied (the list then snapped back). Of the three list jQuery-UI sortables in client/components/swimlanes/swimlanes.js, one was not gated on Utils.canModifyBoard(); it now is, consistent with the other two, plus a defense-in-depth guard so a logged-in user without write access can never persist a reorder (anonymous public-board reordering via localStorage is unaffected). The server already enforced this; the fix stops the unauthorized drag and the console error. New Playwright regression test in tests/playwright/specs/35-list-sort-permissions.e2e.js. (PR #6408)

Thanks to GitHub users Atry, mueller-ma and liferadioat for reporting.