In short Updates Sharp image processing and development dependencies, including the MongoDB driver used by the browser tests, Chai assertions and TypeScript ESLint tooling. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Fixes SamlSubjectBleed by binding SAML accounts to their original identity; legacy accounts missing issuer information require administrator verification before SAML access resumes. Confirms the existing ZipBombBleed fix with browser regression coverage, restores Firefox tests on macOS, and expands translations for archiving, date filters and other UI guidance. Security Bind SAML accounts…
In short Administrators choose which optional board views WeKan offers, can keep features from later updates off until approved, and can stream every change to a continuous backup that restores to a chosen moment. Board Settings / Card gives every row a card and a minicard side, shows each Scrum field as its own row and reorders rows by drag and drop, as does Board View. Scrum sprints have no card…
In short A security release. CacheBleed, SyncBleed and CasTokenBleed are fixed, with thirteen more newly named issues such as RepointBleed, TrayBleed and ZipBombBleed, follow-up fixes for earlier Hall of Fame entries, and assigned-only members limited to their own cards on every read path. LDAP certificates are verified by default again, password guessing is braked per account, and Admin Panel → P…
In short A translation test now checks the Trello link by its parsed host, closing GitHub CodeQL alert 547, and the DOMPurify sanitizer is updated to 3.4.16. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Fixes ReplyBleed: a reply to a notification email is now attributed only to the person it was sent to. Carries out the maintainer's 2026-09-30 decisions: incarnations for Scrum records and activities, 90-day compaction of rule email, rule, notification and webhook plans, Sync History linked when written, online History writer recovery, and manual and scheduled Sync through the durable jou…
In short Administrators can now resolve rule emails WeKan could not confirm - resend to unconfirmed recipients only, mark sent or drop - and review legacy rule emails instead of leaving them stuck. Boards import and export as todo.txt, GitLab import and export reach the format contract, and OpenProject watchers and Asana followers become card watchers. Undo and redo apply a raced request once, and…
In short Card updates again run their activity, rule and History hooks while preserving private-field checks. Language, date and Rules controls work across browsers. EVERYTHING gains portable image fixtures and Docker mail connections. Locale files regain missing fallback keys, with translation completeness failures still reported for the remaining untranslated strings. Thanks to above GitHub user…
In short Security blocks private-data disclosure through card and board copying, and card copies reject invalid destinations. Pulse adds an annual archived-card grid. Card text colours code blocks and links the custom URL schemes an administrator allows. Scrum History recovery retains completion evidence, and API callers can retry undo/redo by request ID. Imports from Kanboard, Nextcloud Deck, Ope…
In short Security protects admin-only custom-field values across server reads, writes and exports. SAML login accepts valid responses and displays failures. Sync separates source projects and coordinates concurrent runs and settings changes. Scrum records daily observations, reports measured scope and remaining work, and preserves history in transfers and scoped exports. API diagnostics omit reque…
In short Close the reported LDAP empty-password bypass and the directory group and SAML replay issues found during the authentication audit. Selected boards can also be duplicated with a choice of structure and data. Security Enforce assigned-only permissions in exporter authorization. Thanks to xet7. ExportScopeBleed: board visibility alone allowed assigned-only members to export unassigned priva…
In short Change Language shows each language and its country together on one line: Flag Language (Flag Country), mirrored for RTL. Ordinary text editors are multiline and resizable, follow the Enter preference, and buttons retain their themed text colors. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Board multiselection can duplicate selected boards without their cards. The new action sits directly below Duplicate Board in the right sidebar, and board tiles no longer show an Actions hamburger menu. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Five new flow analytics pages add Aging WIP, blocker analysis, Monte Carlo forecasts, XmR and size-versus-cycle-time charts, with PDF and Excel exports. Dependency edits, undo/redo and optional move reasons now provide a timestamped history for reports. Time reports show hour adjustments by author, and deleting cards or checklists preserves their activity trail. Linked cards can mirror ca…
In short InactiveBleed is fixed: disabled accounts cannot obtain new sessions through REST or keep using revoked credentials. People account creation and the Active control now enforce the administrator's chosen status. Security InactiveBleed: Enforce account deactivation across authentication and existing sessions. Thanks to esbrito81 and xet7. REST login, API authentication, private attachment r…
In short Board drag settings independently enable dragging for each object type. Mixed multi-selection moves lists, swimlanes, cards and checklist content together, including folded containers. Minicard checklists show progress and support item reordering and transfers across lists and swimlanes. Checklist drag-and-drop saves the new item order and matches the visible drop placeholder. Thanks to a…
In short Admin Panel / People opens Email and provides separate login settings, including SAML environment overrides, metadata and logout configuration. SSO stops automatically retrying failed OIDC callbacks. Login buttons share blue backgrounds and white text/icons. Release notes omit empty categories. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Files Report previews and downloads work for site administrators even when they are not members of the attachment's private board. Preview and download controls also fit within narrow table cells. ZIP previews list archive contents from Files Report and opened cards. Security No security changes. Translations No translation updates. Thanks to above GitHub users for their contributions and…
In short Dependency installation works again after the S3 upload library update. The recent Dependabot merges have a documented security and telemetry review, with focused regression checks for the repaired dependency pair. Test maintenance restores checks for the current UI, documentation and translations, and local release preparation uses the same npm version as CI. Security No security changes…
In short Developer tooling updates Rsdoctor to fix source disclosure through its report server. Dependency updates work again with published Meteor Node stubs and restored Dependabot coverage for build tools. Security Patch Rsdoctor and restore dependency updates. Thanks to xet7. Update Rsdoctor from 1.5.9 to 1.6.4 for CVE-2026-61782. The affected report server can expose source and build metadata…
In short Snap builds recover from stale package URLs during stage-package downloads as well as base setup. Recovery refreshes the container and retries once, while unrelated failures remain fatal. Security No security changes. Translations No translation updates. Thanks to above GitHub users for their contributions and translators for their translations. More details at ChangeLog
In short Release preparation checks changelog summaries before changing versions or creating tags. The missing v11.96 summary is restored so release notes can be generated and platform builds can proceed. Security No security changes. Translations No translation updates. Thanks to above GitHub users for their contributions and translators for their translations. More details at ChangeLog
v11.96
In short Mac app builds finish their smoke tests without hanging during shutdown. Board Settings places Date below Change Background Image and uses matching Swimlane and List icons. Security No security changes. Translations No translation updates. Thanks to above GitHub users for their contributions and translators for their translations. More details at ChangeLog
In short Linux packages include the library needed by Node.js. Board invitations no longer disable accounts through a rejected client write, and signed-out login avoids a protected metadata subscription. Release packaging fixes Mac archive verification, Docker scanning and foreign native addons inherited by platform bundles. Security No security changes. Translations No translation updates. Thanks…
In short Login error responses no longer disclose internal stack traces, and the local identity test server rejects expensive or malformed OAuth headers. Release All and Release All Missing now share shell and Windows menus across the six repositories. Automated dependency checks stop on detected risk indicators; ordinary hash changes need no AI approval. Security No security changes. Translations…
v11.91
In short GitHub release workflows now keep Snap publication moving when the store returns temporary server errors, while still failing fast on invalid uploads and credential problems. Security No security changes. Translations No translation updates. Thanks to above GitHub users for their contributions and translators for their translations. More details at ChangeLog
In short Snap Store uploads now retry temporary server failures across all release paths. Invalid files and credential failures still stop immediately. Security No security changes. Translations No translation updates. Thanks to above GitHub users for their contributions and translators for their translations. More details at ChangeLog
In short Add a source-based development server using Meteor's bundled MongoDB. Fix mobile navigation, card destinations, login redirects, notification alerts and card closing. Expand serial browser coverage and stop test runs at the first failure when requested. Reject recurring wrong-language translations while preserving valid human updates. Reduce development startup warnings and clean up attac…