v9.98 2026-07-17 WeKan ® release

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

• EscapeBleed: incomplete string escaping when building a regular expression (GitHub CodeQL code scanning alert #423, rule js/incomplete-sanitization, CWE-116 Improper Encoding or Escaping of Output; tests/maximizedCardPosition.test.cjs). Code that turned a CSS declaration into a RegExp escaped only parentheses (str.replace(/[()]/g, '\\$&')) instead of the full regex metacharacter set — an input containing other metacharacters (including a backslash) would not be escaped correctly, so the generated pattern could match the wrong thing.

  • Fixed by escaping the complete metacharacter set (str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')), matching the correct pattern already used elsewhere in the tests. This is test-only code with a fixed, trusted input list, so there was no injection exposure, but the incomplete escape was genuinely wrong.
  • Thanks to GitHub CodeQL (code scanning alert #423) and xet7 (fix).

• RandomBleed: biased random ids from a cryptographically secure source (GitHub CodeQL code scanning alert #422, rule js/biased-cryptographic-random, CWE-1204 / weak randomness; server/lib/schemaUpgradeSteps.js). The startup schema upgrade generates Meteor-style document ids with crypto.randomBytes(len) mapped through byte % ID_CHARS.length. Because 256 is not a multiple of the 55-character alphabet, that modulo skews generated ids toward the first 36 characters of the alphabet (each ~1.4% more likely than the rest) — reducing entropy of the ids used for the swimlanes/lists/checklist-items the upgrade creates.

  • Fixed with rejection sampling: bytes at or above the largest multiple of the alphabet size (220) are discarded and resampled, so every character is exactly equally likely; ids stay Meteor-style 17 characters (and exact-length for custom lengths). A negative regression test pins that out-of-range bytes are never wrapped.
  • Thanks to GitHub CodeQL (code scanning alert #422) and xet7 (fix).

Thanks to above for their contributions.