v9.97 2026-07-17 WeKan ® release

This release adds the following new features:

• Snap: SELF-HEALING attachments — the fixes below apply themselves automatically on upgrade, no commands needed (#6473, snap-src/bin/attachment-repair (new), snap-src/bin/wekan-control, snap-src/bin/migration-control, snap-src/bin/wekan-force-migrate, releases/migrate-mongodb-to-ferretdb.mjs, snap-src/bin/migrate-mongo3-to-ferretdb.mjs, snapcraft.yaml, snapcraft-core26.yaml). The snap auto-refreshes on ~15k servers, so a fix that needs snap run wekan.migrate typed by hand does not reach most of them — and a full re-migration would be WRONG anyway, because it rebuilds FerretDB from the frozen MongoDB source and would lose boards/cards users created on FerretDB since migrating. Instead, on every start on FerretDB, wekan-control now launches attachment-repair in the background: it starts a temporary source mongod (7.x or the bundled 3.2 reader — the MongoDB data was never modified, so everything is recoverable) and runs the migration importer in a new incremental FILES_ONLY mode that checks what is already migrated and migrates only what is missing: text collections are never touched, every attachment/ avatar whose target record is on fs with the file actually on disk is verified and skipped, records deleted by users since the migration are never resurrected, and only the missing binaries/records are extracted — so on healthy servers the repair is a fast no-op and on #6473-affected servers the attachments simply appear, live, while WeKan runs. It runs once (marker $SNAP_COMMON/.attachments-files-v2-done; a fresh successful migration pre-writes it, snap run wekan.migrate clears it, failures retry on the next start without ever blocking WeKan from starting), and a manual snap run wekan.repair-attachments command is registered too. The importer itself now stamps the migration marker with filesVersion (currently 2) and, when it finds a marker with an older filesVersion — or FILES_ONLY=true in the environment — automatically switches to this incremental repair, so Docker/source installs get the same self-healing by simply re-running the same importer command they migrated with. Verified end-to-end against two live FerretDB instances with the real importer: a broken-migration target (missing CollectionFS record, gridFsFileId-only record, marker without filesVersion) was repaired — record re-created with its card linkage, binary extracted, record repointed — while a board renamed on FerretDB after the migration stayed untouched, and the second run exited immediately as already-migrated. Behavioral tests (positive + negative) drive the real bash script with stubbed snap tooling: tests/attachmentRepair.test.cjs. Thanks to mueschel and xet7.

• All platforms: startup schema upgrade — WeKan now CHECKS on start that data from EVERY old WeKan version has been migrated to the newest database structure, and migrates only what is missing (#6473 follow-up, #1959, #1971, server/lib/schemaUpgradeSteps.js (new), server/startupSchemaUpgrade.js (new), server/migrations/ensureValidSwimlaneIds.js, server/imports.js). WeKan v0.9–v8.00 ran startup migrations; v8.01 disabled them (large databases meant long downtime) in favour of read-time compatibility — which covers the swimlane era but not everything, so text data from old versions could sit invisible in the database. The new startup upgrade reinstates the safety net without the downtime: version-gated (the _wekan_migration marker stores the WeKan version and datetime of the previous successful re-check, so while the version is unchanged a boot costs ONE findOne — a full re-check is mandatory only after a new WeKan release, or WEKAN_FORCE_SCHEMA_UPGRADE=true; opt out with WEKAN_SKIP_SCHEMA_UPGRADE=true), non-blocking (runs in the background, WeKan serves immediately), with a live migration dashboard at /schema-upgrade-status on every platform that shows the Admin Panel product name when one is set (not “WeKan”) plus per-step progress, and fast on big databases (bounded existence probes, distinct() set-joins instead of card scans, and server-side updateMany batches instead of per-document round trips — thousands of cards never mean thousands of queries). Steps, each verified against git show v8.00:server/migrations.js and each idempotent: archived-flag-backfill (docs missing archived never match the archived: false view queries — whole boards/lists/cards were invisible in the Swimlanes and Lists views), swimlane-structure (every board gets a visible swimlane, every list/card a swimlaneId, cards with a dangling listId are rescued to a visible list — and, fixing #1959 and #1971, unarchived cards whose swimlane was DELETED, ARCHIVED or belongs to another board are reassigned to the board’s first visible swimlane, so everything is visible in both the Swimlanes view and the Lists view; the card-insert hook now also validates client-supplied swimlaneIds so new cards can never land under a deleted/archived swimlane again), checklist-items-embedded (pre-v0.79 embedded checklist.items[] extracted to the ChecklistItems collection — the text was in the database but never shown), customfields-boardIds (pre-v2.49 scalar boardId → boardIds array — old custom field definitions and their card values were orphaned), board-allows-defaults (the ~33 defaultValue-true allows* flags backfilled — a missing flag rendered as false and HID existing descriptions/checklists/comments/attachments), board-members-isactive (members without isActive were denied board access), board-permission-lowercase (‘PUBLIC’ boards had silently become member-only), and fs-path-heal (filesystem attachments/avatars whose recorded path predates the current WRITABLE_PATH layout — v6.10-18 uploads/<coll>, v6.19-v8.4x WRITABLE_PATH/<coll>, CFS→ostrio temp files — are located and repointed/copied into the current layout). A step that fails or leaves unresolved work never blocks WeKan from starting and keeps the version un-stamped so the next boot re-checks. 36+ unit tests with negative cases (tests/schemaUpgradeSteps.test.cjs), plus verified end-to-end against a live FerretDB (SQLite) with old-shape seed data: all 8 steps migrate correctly and the second boot is gated to a no-op. Thanks to mueschel and xet7.

• Migration speed: batched writes and preloaded lookups instead of per-document round trips (5-hour migrations reported; releases/migrate-mongodb-to-ferretdb.mjs). The text phase now copies each batch with ONE unordered insertMany round trip (falling back to per-document replaceOne upserts only for batches that hit duplicates on resumed/re-run migrations), and the attachment/avatar phases preload the target’s metadata records once per bucket instead of one findOne per file (bounded: collections over 100k records fall back to per-file lookups). The startup schema upgrade uses the same philosophy (distinct()/updateMany). Thanks to mueschel and xet7.

and fixes the following bugs:

• OAuth2/OIDC: OAUTH2_LOGIN_STYLE=redirect was ignored — a popup always opened (#5695, packages/wekan-oidc/oidc_client.js, server/authentication.js, server/models/settings.js, client/components/main/layouts.js). The setting was stored correctly in the OIDC service configuration, but the login button always passed loginStyle: 'popup', and Meteor’s OAuth._loginStyle gives the caller’s option precedence — so the admin’s redirect setting silently lost on every login (and the Meteor-internal loginStyle option even leaked into the provider’s authorization URL). The client now honors a configured loginStyle: 'redirect' over the button’s generic popup default (explicit caller choices still win; Safari-private-mode popup fallback kept) and no longer leaks the option to the provider. Also repaired the existing OIDC_REDIRECTION_ENABLED=true “go straight to the provider” feature, which was doubly broken since the Meteor 3 port: isOidcRedirectionEnabled inspected a Promise (always false), and the client handler assigned an undeclared variable (strict-mode ReferenceError). Behavioral tests drive the real client code in a VM against Meteor’s loginStyle precedence: tests/oauth2LoginStyle.test.cjs (12 tests, positive + negative). Thanks to ArturRuta and xet7.

• Deleting a user left “ghost users” on boards and cards (#1289, models/users.js, new models/lib/userDeletionCleanup.js): every deletion path (admin method, self-service delete, DELETE /api/users/:userId) removed only the user document, leaving dangling references — empty-avatar board members that could not be removed, stale card members/assignees/watchers, orphaned avatar files — reproducible for 8 years. A server-side Users.after.remove hook now prunes boards.members/watchers, cards.members/assignees/watchers, lists.watchers and the user’s avatar files on every deletion path; activities and comments are deliberately kept for history (their rendering is already null-guarded). Tests: tests/userDeletionCleanup.test.cjs (6). Thanks to chotaire and xet7.

• Swimlanes jumped up and down when starting/ending a card drag (#2877, client/components/boards/boardBody.css): drag start hid every list’s ”+ Add Card” composer link with display: none, collapsing its row — lists shrank, auto-height swimlanes shrank, and every swimlane below jumped up ~23px (and back down on drop), shifting the drop target under the cursor mid-drag (root cause proven by frame-diffing the issue’s own GIF). The composer now hides with visibility: hidden, keeping its layout box, so nothing moves; collapsed multi-selection cards stay collapsed intentionally (they preview the post-drop list). Tests: tests/swimlaneDragJump.test.cjs (8). Thanks to xet7.

• Dragging a card toward an off-screen list never auto-scrolled the board (#443, client/components/lists/list.js, new imports/lib/boardAutoScroll.js): the horizontal auto-scroll targeted .board-canvas, which only overflows vertically since the swimlane layout — its scrollLeftMax was always 0, so the guard never fired and users had to drop on an intermediate list and scroll by hand. Edge-proximity auto-scroll now drives the .js-lists lane actually under the pointer (clamped, overshoot-safe), with vertical scrolling kept on the canvas. Tests: tests/boardAutoScroll.test.cjs (15, incl. a proof the old no-overflow target could never scroll). Thanks to anhenghuang, AlexanderS and xet7.

• Board Rules: the Card Title Filter did nothing on several triggers — and rules created via the REST API never fired at all (#2345, #2674, client/components/rules/triggers/boardTriggers.js, .jade, server/rulesHelper.js, server/models/rules.js, new models/lib/ruleCardTitleFilter.js, docs/API/Rules.md, docs/API/REST-API.md, api.py): the generic moved/archive trigger builders never saved the filter (and a trigger doc MISSING the field can never satisfy the matcher’s $in, so those rules fired for nothing); a set filter never showed in the rule details; archive activities carry no card title so their filters compared against undefined; and REST-created rules skipped the wildcard defaulting entirely — the exact “remove user when moved away” rule from #2674 silently never ran. Filters are now stored (empty → *), shown in the rule description, matched with the title resolved from the card when the activity lacks it, legacy field-less triggers keep matching, the API normalizes missing matching fields to wildcards and validates types, and the rule actions no longer crash on unresolvable usernames or member-less cards. The Rules REST API is now documented (docs/API/Rules.md) and listed in api.py’s help with the #2674 two-rule example. Tests: tests/rulesCardTitleFilter.test.cjs (12) and tests/rulesApiTriggerNormalize.test.cjs (19). Thanks to InfoSec812, sfahrenholz and xet7.

• Sandstorm: username uniqueness probe was case-sensitive and raced concurrent logins (#574, sandstorm.js, new models/lib/sandstormUsername.js): deriving max, max1, … from the preferred handle matched exact case only (an existing Max did not stop a new max) and the check-then-set window let a concurrent insert claim the name first, aborting the hook with E11000. The probe is now an anchored, escaped, case-insensitive regex and the claim retries the next number on a duplicate-key loss. Tests: tests/sandstormUsername.test.cjs (11). Thanks to mitar and xet7.

• Inviting a second user whose email shares a local part failed with a bare “403” (#619, server/models/users.js, new models/lib/inviteeUsername.js): inviting cats@foo.com creates user “cats”; inviting cats@facebook.com then crashed into Meteor’s raw 403 Username already exists. The invitee’s username now probes cats, cats1, cats2, … to the first free variant, and exhaustion raises the translated error-username-taken instead of a number. Tests: tests/inviteeUsername.test.cjs (11, incl. the literal reported scenario). Thanks to lemoer and xet7.

• Date pickers ignored the configured default time and stored 12:00 (#1502, client/lib/datepicker.js, new imports/lib/datePickerTime.js): the due-date picker configures a 17:00 default (and now() for received/start/end), but an inverted guard applied it only when the card ALREADY had a date — exactly when it is unnecessary — so empty time fields fell back to a hard-coded 12:00 on save. The default now pre-fills empty pickers and backs the submit fallback; existing dates keep their own time. The issue’s original AM/PM parse mismatch was already resolved by the native date/time inputs (79b94824e). Tests: tests/datePickerDefaultTime.test.cjs (10). Thanks to Vlasterx, saschafoerster, suncobran and xet7.

• Dragging a card while someone added a card to the target list dropped it into the WRONG swimlane (#2769, new client/lib/cardDragGeometry.js, client/components/lists/listBody.js): jQuery UI sortable snapshots container geometry at drag start; a mid-drag DOM insertion (another user’s new card, or the drag’s own composer auto-close) shifted every swimlane below while the cached rectangles stayed put — the drop landed in the neighbouring swimlane with no visible placeholder. A MutationObserver now refreshes the active drag’s geometry on real mid-drag layout changes (sortable’s own churn filtered out). Tests: tests/cardDragGeometry.test.cjs (13). Thanks to hever and xet7.

• Board import lost card dates (#1992, models/wekanCreator.js, new models/lib/importedCardDates.js): the importer derived createdAt only from a createCard activity (absent in Sandstorm/pruned exports — dates silently reset to import time) and never imported receivedAt/endAt at all. All five date fields now restore with sane fallbacks (activity → the card’s own exported date → import time), and the card creator falls back to the exported userId. The missing-cards half of the report was already fixed by 68e0032c6. Tests: tests/importedCardDates.test.cjs (13). Thanks to xet7.

• Archiving a swimlane made its cards disappear — and restore brought back an empty swimlane (#2292, models/swimlanes.js, new models/lib/swimlaneArchive.js): only the swimlane document was flagged; its unarchived cards became invisible everywhere (board views render unarchived swimlanes, Archive lists archived docs). Archiving a swimlane now archives its cards (mirroring lists), and restore brings back exactly the cards archived WITH it — individually archived cards stay archived. Tests: tests/archiveSwimlaneCards.test.cjs (11). Thanks to Cactusbone and xet7.

• “Move/Copy selection to board” wrote sort: NaN to every card (#2494, imports/reactiveCache.js): the client-side noCache card lookup returned a PROMISE since the Meteor 3 port, so the max-sort read was undefined and every moved card got NaN — cards appeared and disappeared and could not be reordered. The uncached client path is synchronous minimongo again. Tests: tests/reactiveCacheNoCacheCard.test.cjs (8, incl. a proof the pre-fix routing yields NaN). Thanks to Vermeille and xet7.

• Subtask “View it” did nothing when the subtask lives on another board (#1853, client/components/cards/subtaskViewHelpers.js, subtasks.js): the original crash (board._id of undefined) had become a silent no-op guard — when the deposit board is not in minimongo the button just did nothing. Navigation now falls back to the subtask’s own boardId (the route loads the board), and truly broken subtasks warn instead of dying. Tests: tests/subtaskViewNavigation.test.cjs (11). Thanks to Vanclief and xet7.

• Labels/members could not be dragged onto cards added after the board rendered (#1554, client/components/lists/list.js): the droppable-initializing autorun lost its reactive dependency in 7673c77c5 (2023), so it ran once per list render and later-added minicards silently rejected sidebar drags until the board was re-entered (“works after search-and-back”). Dependency restored via the ReactiveCache. Tests: tests/labelDragDroppable.test.cjs (3). Thanks to Miffe and xet7.

• “Add filtered cards to selection” swept cards from OTHER boards into bulk actions (#2306, client/lib/filter.js, client/lib/multiSelection.js, new models/lib/boardScopedSelection.js): the filter selector carried no boardId, and minimongo legitimately holds foreign-board cards (linked boards, dialogs, notifications) — a bulk archive could silently mutate other boards. The selection and its bulk-action selector are now board-scoped, and foreign ids are rejected at insertion. Tests: tests/boardScopedSelection.test.cjs (17, incl. the exact reported repro). Thanks to IcedQuinn and xet7.

• REST API: login tokens could never be revoked (#1437, server/apiAuthRoutes.js, new models/lib/apiLogout.js): every POST /users/login minted another ~90-day resume token with no way to invalidate any of them. New POST /users/logout revokes the presented token (or all of the user’s tokens with {"all": true}), always scoped to the authenticated user. Tests: tests/apiLogout.test.cjs (12). Thanks to ppouliot and xet7.

• Editing one checklist item and clicking another left BOTH edit forms open — and submitting overwrote the new item’s title with the previous item’s text (#2418, client/lib/inlinedform.js, new client/lib/inlinedFormManager.js): since a 2021 change, the “close the previously opened inline form” call was a silent no-op (the escape action is disabled for click execution), and the submit handlers grab the template’s FIRST textarea — with two forms open the wrong form’s text was saved. Subtasks reproduced the full bug; checklists’ workaround corrupted the open-form tracker so Escape closed the whole card pane. A small state manager restores the single-open-form invariant (opening a form closes the previous one, without closing popups — preserving the 2021 intent). Tests: tests/inlinedFormSingleOpen.test.cjs (9, incl. the exact reported repro chain). Thanks to Beebo89 and xet7.

• Advanced Filter never matched date custom fields (#2989, client/lib/filter.js, new imports/lib/advancedFilter.js): the tokenizer treated every / as a regex delimiter even inside quotes, so 'Date de fin' == '06/04/2020' broke tokenizing and the filter silently did nothing; and date custom fields store Date OBJECTS while the selectors compared strings/parseInt — ==/</> could never match and != matched everything. Dates typed in the user’s date format (day-first respected) now build half-open Date-range selectors (== means “that day”), with the legacy behavior untouched for non-date fields. Tests: tests/advancedFilterDate.test.cjs (14, incl. a proof the old selector shape never matched a stored Date). Thanks to k1ng440 and xet7.

• Cards could not be reordered by drag in lists full of subtask cards — with silent data loss on multi-selection drops (#3826, server/models/cards.js, client/components/lists/list.js, new models/lib/cardSortRepair.js): addSubtaskCard inserted EVERY subtask card with the constant sort: -1, so such lists contained only tied sorts; dropping between two equal sorts computes a zero increment, the move modifier came out empty and the card snapped back — and a multi-selection drop wrote the SAME sort to every selected card, permanently destroying their order. Subtask cards now append with a unique sort, and the drop handler detects degenerate (tied/inverted) gaps and repairs the siblings’ sorts to a strict order before recomputing the drop index. Tests: tests/subtaskCardReorder.test.cjs (14). Thanks to jayki and xet7.

• Cross-board subtask full path disappeared after refresh (#3453, server/publications/boards.js, new server/lib/subtaskAncestors.js): the board publication shipped only the DIRECT parent cards, while the full-path label walks the whole ancestor chain client-side — after F5 the grandparents were missing from minimongo and the path truncated/vanished. The publication now walks and publishes the full ancestor chain (batched per level, cycle-safe, tolerant of deleted ancestors). Tests: tests/subtaskAncestors.test.cjs (11). Thanks to MPeti1 and xet7.

• Linked cards: phantom empty custom-field rows and a template TypeError on every render (from #3748, models/cards.js, new models/lib/customFieldsWD.js): a linked card keeps the ORIGINAL board’s custom-field snapshot; unresolvable definitions rendered as empty {} placeholders — a phantom row per entry and Cannot read properties of undefined (reading 'type') from the card details template (also reachable on normal cards with deleted definitions). Unmatched entries are now skipped. The rest of #3748 is by design: linked cards are pointers that mirror the original; label/custom-field ids are board-scoped, and name-based inheritance is the COPY feature. Tests: tests/customFieldsWD.test.cjs (9). Thanks to peterbecich and xet7.

• Archive sidebar: Restore/Delete links floated ambiguously between two archived cards (#3199, client/components/sidebar/sidebarArchives.jade, sidebar.css): each card and its links were loose siblings with near-equal spacing above and below, so the links seemed to belong to the card underneath. Each archived card is now grouped with its own links in one container with a clear separator gap below (RTL-safe logical properties, theme-neutral). Tests: tests/archiveLinkGrouping.test.cjs (9). Thanks to fxkr and xet7.

• Attachments uploaded inside card comments: listing in the card’s Attachments section is now guaranteed and regression-locked (#3843, new models/lib/attachmentMeta.js, client/lib/utils.js): the rich comment editor already uploads into the same Attachments collection with the same card meta as the Attachments popup, so they DO list — but nothing pinned that invariant and the meta was built in two places. One shared, null-safe builder now feeds both paths, with tests pinning that gallery queries key on meta.cardId with no source filter (and that board backgrounds stay excluded). Tests: tests/commentAttachmentsList.test.cjs (12). Thanks to jghaanstra and xet7.

• Maximized card rendered at the wrong place after scrolling in Swimlanes view (#4822, client/components/cards/cardDetails.css): the legacy maximized-pane CSS had no position of its own, so the pane stayed an in-flow item inside the scrolled board canvas (off-screen after scrolling down); the desktop-mode floating-window rules also out-specified every maximize geometry rule, and inline drag offsets survived maximizing. The maximized pane is now viewport-fixed with explicit insets that beat both the floating-window rules and stale drag offsets (drag position is restored on minimize), RTL-safe via logical properties. A cascade-resolver regression test pins the behavior against the real stylesheet and fails on the pre-fix CSS: tests/maximizedCardPosition.test.cjs (11 tests). Thanks to pravdomil and xet7.

• LDAP group filter locked out admins and rejected multiple groups (#4036, packages/wekan-ldap/server/ldap.js): with LDAP_GROUP_FILTER_ENABLE=true, only members of the single LDAP_GROUP_FILTER_GROUP_NAME group could log in — an admin who was only in LDAP_SYNC_ADMIN_GROUPS could not log in at all, and a comma-separated group list produced the literal filter (cn=A,B) that matches nothing. The filter now ORs across every comma-separated group name and, when admin sync is enabled, also admits the admin-sync groups. Thanks to zeisss-mercedes and xet7.

• Board invitation emails could carry a dead invitation code — and signup then failed with “The invitation code doesn’t exist” (#4043, server/models/settings.js, server/models/users.js, new models/lib/invitationCodeEmail.js): re-inviting an unregistered user re-sent the SAME stale code (invalidated by an earlier OAuth2 signup or deleted account) instead of regenerating it; a failed SMTP send deleted a previously delivered, still-valid code; codes were mailed without checking they exist and are valid; the invitee address was only lowercased client-side; and the signup hook deleted the code BEFORE the account insert was committed, so a failed insert burned the code for every retry. Re-invites now regenerate stale codes (still-valid ones are kept so earlier emails keep working), sends fail loudly on unusable codes, rollback only removes codes the failed send itself created, and consumption happens only after a successful signup. Tests: tests/invitationCodeEmail.test.cjs (14). Thanks to jkoenig134 and xet7.

• Japanese/Chinese UI: the add-card button and footer links wrapped mid-word (#4023, client/components/forms/forms.css): CJK text has no spaces, so the narrow add-card composer footer broke 追加 / リンク / 検索 / テンプレート between any two characters. The composer/edit footers now use word-break: keep-all with flex-wrap: wrap (wrapping between links, never inside a word) and white-space: nowrap on the button and each link group; Latin wrapping is unchanged and the negative tests pin that no global word-break was introduced. Tests: tests/cjkLabelWrap.test.cjs (9). Thanks to yuki-snow1823, Sylvain2703 and xet7.

• Users added to a team AFTER the team was assigned to a board never became board members — and the Admin Panel bulk team add/remove silently did nothing (#4593, server/models/users.js, client/components/settings/peopleBody.js, new models/lib/teamBoardMemberSync.js): assigning a team to a board snapshotted its then-current members, so later joiners could see the board via publications but every authority gate (hasMember, card/list mutations, attachment downloads, export) denied them; and the Admin Panel “Add/Remove team to selected users” used a direct client-side Users.update that server permissions silently deny. editUser/createUser now add new team members to all boards their teams are assigned to (never touching existing member entries, skipping template boards), and the bulk actions go through the admin editUser method. Tests: tests/teamBoardMemberSync.test.cjs (13). Thanks to szymonsztuka and xet7.

• LDAP background sync only worked once per user (#4654, packages/wekan-ldap/server/ldap.js, sync.js, new userIdFilter.js): getUserById crashed or built the invalid filter (|(=user)) when LDAP_UNIQUE_IDENTIFIER_FIELD was unset/empty (it never consulted LDAP_USER_SEARCH_FIELD, where the stored id actually comes from), and the username sync passed $set as query OPTIONS to findOneAsync — logging “Syncing user username” while writing nothing. New shared buildUserIdFilter() ORs across both configured fields, idAttribute is persisted on new LDAP users, and the username sync actually updates. Tests: tests/ldapUserIdFilter.test.cjs (11). Thanks to fabianrbz and xet7.

• All Boards page: per-list card counts and member avatars never showed (#5174, #4825, new models/lib/boardTileData.js, server/publications/boards.js, client/components/boards/boardsList.js, .jade): the helpers were stubbed to [] to stop the #4214 reactive “icons dance”, and the gating flags were never published. New non-reactive getAllBoardsTileData method (one boards query, one lists query, one grouped card count) fetched once per page visit; per-board “Show card count per list”/“Show Board members avatars” settings enforced strictly both ways. Tests: tests/boardTileData.test.cjs (17). Thanks to mueschel, Miuler and xet7.

• Lists rendered with different widths by default (#5659, new models/lib/listWidth.js, client/components/lists/list.js, listHeader.js, models/users.js): the default width was duplicated in four resolution paths that disagreed (270 vs 272), so lists on the same (public) board could differ with no customization. Single source of truth (272), all paths normalize out-of-range values the same way; customized widths still win. Tests: tests/listWidthDefaults.test.cjs (12). Thanks to butteredCat-2021 and xet7.

• Declining a board invitation kept the board active in the member’s overview (#4730, server/models/boards.js, new models/lib/boardInvites.js): the decline flow called quitBoard (deactivate) then acceptInvite, which unconditionally REACTIVATED membership — it also let any removed member re-add themselves. quitBoard now clears the pending invitation (and works for stale-invite-only users); acceptInvite only activates when an invitation actually exists. Tests: tests/boardInvites.test.cjs (11). Thanks to Griiimm and xet7.

• After migrating a user from password to LDAP, the old local password still logged in (#4419, new server/lib/ldapPasswordLoginGuard.js, server/authentication.js): a validateLoginAttempt hook now rejects password-service logins for authenticationMethod: 'ldap' users while LDAP is enabled — respecting the LDAP_LOGIN_FALLBACK=true feature, never touching other services or session resumes, and opt-out-able with LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN=true so no deployment is hard-locked. Tests: tests/ldapPasswordLoginGuard.test.cjs (12). Thanks to preciousamorc and xet7.

• LDAP_ENCRYPTION=true (the documented value) silently connected WITHOUT encryption (#4158, new packages/wekan-ldap/server/encryptionSetting.js, ldap.js, docs/Login/LDAP.md): only the undocumented ssl/tls values did anything, and any other value (including true, which JSON-parses to a boolean) meant silent plaintext. Now true→LDAPS, starttls→STARTTLS, legacy ssl/tls keep their historical meanings with a deprecation notice, and unknown values log a clear warning listing the accepted ones. Tests: tests/ldapEncryptionSetting.test.cjs (22). Thanks to farwayer and xet7.

• OIDC login onto an existing account wiped the profile — avatars and templates disappeared (#4560, server/models/users.js): the OAUTH2_MERGE_EXISTING_USERS merge path replaced the whole profile with the OIDC-derived one, losing avatarUrl, templatesBoardId (+ template swimlanes), language and preferences. The merge now preserves the stored profile and only fills gaps/updates the asserted fullname; the fail-closed linking rules (GHSA-mp7g-hj5q-gxhq) are untouched. Tests: tests/oidcProfileMerge.test.cjs (7, fails on pre-fix code). Thanks to LeoLu-eng and xet7.

• OAuth2/OIDC: concurrent logins could contaminate each other’s user data — users saw stale or missing emails/username/teams, and the database could disagree with the UI (#4897, packages/wekan-oidc/oidc_server.js, packages/wekan-oidc/loginHandler.js). The OIDC server flow kept profile, serviceData and userinfo as MODULE-SCOPE variables shared by every login of every user: fields the current login did not overwrite leaked from the previous user’s login (refreshToken, whitelisted id-token claims, branch-dependent email), and because the handler awaits the token/userinfo requests, two interleaved logins wrote into the SAME objects — a login could complete carrying another user’s id/email/username, updating the wrong user document. The PROPAGATE_OIDC_DATA group/attribute path additionally ran on implicit GLOBALS (teamArray, isAdmin, user_email, …) with awaits between assignment and use, so concurrent logins could write one user’s email/teams/admin flag onto another user’s document — real database corruption, matching the “web interface shows different data vs mongodb” report. All login state is now per-login locals, the login handler compares actual values (the old username/fullname comparisons compared a string to an object, always true), and a regression test proves isolation under concurrent logins and fails against the pre-fix code: tests/oidcLoginStateIsolation.test.cjs (11 tests, positive + negative). Thanks to gerardo-junior and xet7.

• Snap/Docker: after the MongoDB → FerretDB migration ALL CollectionFS-era attachments were missing (#6473, releases/migrate-mongodb-to-ferretdb.mjs, snap-src/bin/migrate-mongo3-to-ferretdb.mjs, snap-src/bin/migrate-gridfs-to-fs.mjs). Real CollectionFS (old WeKan’s FS.Store.GridFS('attachments')) stores each file’s GridFS id at copies.<bucket>.key (copies.attachments.key / copies.avatars.key) — but the importers only looked at original.gridFsFileId, gridFsFileId and copies.gridfs.key, none of which exist in that layout. So the modern importer “skipped” every file silently and the MongoDB 3.x importer extracted the binaries but never created an attachment record (and the records it did create lost their meta.cardId/boardId, which CollectionFS keeps at the record’s TOP level — an attachment without meta.cardId shows on no card). Either way the migration reported success with zero attachments visible. A new shared resolveCfsGridFsId() resolves the id from all four layouts (original.gridFsFileId, gridFsFileId, copies.<bucket>.key, copies.gridfs.key, then any copies.*.key), the modern importer now drives extraction from cfs_gridfs.<bucket>.files itself (so a missing/empty cfs.<bucket>.filerecord collection no longer skips everything — binaries without a filerecord are still extracted to disk), the mongo3 importer copies the top-level boardId/cardId/listId/swimlaneId/ userId into meta, and filerecords whose binary cannot be located are reported as errors on the migration dashboard instead of being silently dropped. If you already migrated and attachments are missing, run the migration again: snap run wekan.migrate (the source MongoDB data was never modified). Behavioral positive/negative tests: tests/migrationAttachmentExtraction.test.cjs. Thanks to mueschel and xet7.

• Snap/Docker: Meteor-Files attachments stored in GridFS without a storage: 'gridfs' flag were left pointing at a GridFS that no longer exists after migration (#6473, releases/migrate-mongodb-to-ferretdb.mjs, snap-src/bin/migrate-gridfs-to-fs.mjs). WeKan’s own getFileStrategy serves a version from GridFS when its storage flag says 'gridfs' or it carries a versions.*.meta.gridFsFileId reference — those reference-only records worked fine on MongoDB, but the migration’s file phase only matched versions.original.storage: 'gridfs', so their binaries were never extracted and the record kept pointing into the void (404 after the switch). The record scan now matches both forms (and every version, not just original), and a second, bucket-driven sweep walks <bucket>.files by its metadata.fileId back-reference (the way WeKan writes GridFS uploads), recovering binaries even when the record’s flags say nothing about GridFS. Any GridFS-flagged version whose binary genuinely cannot be located is reported on the dashboard. Thanks to mueschel and xet7.

• Admin Panel > Attachments showed “/data” as the Filesystem Storage path on every platform (#6473, client/components/settings/attachments.js, client/components/settings/settingBody.js, server/models/attachmentStorageSettings.js, models/lib/attachmentStoragePath.js). The Blaze helpers computed the path from process.env.WRITABLE_PATH in the browser, where process.env never has it, so the page always fell back to “/data” — a path that does not exist on a Snap install (the real path is /var/snap/wekan/common/files/attachments), sending admins hunting for a directory that was never there. The client now asks the server via a new admin-only getAttachmentStoragePaths method, whose Snap-aware computation (shared, dependency-free models/lib/attachmentStoragePath.js — WRITABLE_PATH already ends in /files on Snap, /files is appended elsewhere) is also used for the settings document’s default filesystem path, which pointed at /data/attachments instead of /data/files/attachments on Docker. Unit tests with negative cases: tests/attachmentStoragePath.test.cjs. Thanks to mueschel and xet7.

• Snap: snap run wekan.database ferretdb looked like it re-ran the migration — it only switches databases (#6473, snap-src/bin/wekan-database). Running it while already on FerretDB printed “WeKan now uses FerretDB (SQLite).” and users reasonably read that as “migration done” while their attachments stayed missing. It now says when nothing was switched, states that the command does NOT migrate data, and names the command that does: snap run wekan.migrate. Thanks to mueschel and xet7.

• FerretDB (SQLite) rejected documents with literal dotted field names, silently dropping them during migration (#6473, wekan/FerretDB internal/types/document_validation.go). MongoDB has accepted documents with literal . in field names since 3.6, and data migrated from a real MongoDB can legitimately contain them — but FerretDB v1’s document validation rejected every such document (“invalid key: … (key must not contain ’.’ sign)”), and since per-item migration errors are deliberately non-fatal (#6466), those documents simply went missing. Fixed in the bundled wekan/FerretDB fork: dotted keys are stored and round-tripped literally with MongoDB’s own semantics (query/update paths still treat . as a path separator), while the other key rules ($ prefix, duplicates, UTF-8) still reject. Verified end-to-end against a live FerretDB (SQLite): insert, nested $set, round-trip, and the negative cases. Thanks to mueschel and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.