v10.32 2026-07-23 WeKan ® release

This release fixes the following bugs:

• Fix #6512 for OAuth / OIDC logins: after "Login with Google" (or any redirect-style
  social login) the user is now sent to All Boards instead of being left on the sign-in
  route showing only the language selector until a manual reload. The earlier #6512 fix
  covered only the password/register flow (onSubmitHook); OAuth logins do not go through
  it, so a client Accounts.onLogin handler (fires for every login method after
  Meteor.userId() is set) now navigates home when still on an auth route — guarded so an
  auto-login on a deep-linked board URL is not redirected
  away.
  Thanks to xet7.

• [Fix #6511 and #6514 (and the v10.30–10.31 Docker / Sandstorm / production "board
  maintenance spinner", missing top user/settings bar, and login-form-not-rendering
  reports): the whole client broke with Uncaught Error: ES Modules may not assign module.exports or exports.* followed by Error: No such template: swimlane /
  notifications / boardButtons. imports/collectionHelpers.js — a side-effect shim
  imported FIRST in client/main.js — ended with module.exports = {} while referencing
  the Meteor pseudo-global Package bare; the client rspack build's ProvidePlugin rewrites
  Package into an injected ESM import, marking the file an ES module, and an ES module
  that assigns module.exports throws at evaluation time. That threw before any template
  registered, so Blaze reported "No such template" for the board and header templates, the
  board stayed on the spinner, the top bar was missing and the board went blank grey after
  login. It reproduced on the official root-domain boards.wekan.team and on plain Docker
  with no reverse proxy (ROOT_URL=http://neptun:4001), so it was a global build bug, not a
  reverse-proxy / sub-path issue. collectionHelpers (the first such file) was fixed to
  use export {},
  and then a transitive walk from client/main.js found and converted EVERY remaining
  client-reachable CommonJS helper (~55 files under models/lib, client/lib,
  imports/lib, imports/) from module.exports = { … } to export { … }, so nothing in
  the client bundle assigns module.exports any more — done in
  two
  parts.
  Server-only helpers (the server/lib files Meteor never ships to the client, and the
  fs-using file-storage helpers) stay CommonJS. Their plain-Node .cjs unit tests now use
  await import(…js); the full tests/*.test.cjs suite has no new failures. This is NOT an
  rspack version regression — the lockfile has pinned @rspack/core ~1.7.x since v8.40,
  unchanged between the working v10.17 and the broken v10.27.
  Thanks to mueschel, jullbo, akshat-goel, AmigaAbattoir and xet7.

• Removed the unused jam:offline / jam:method / jam:pub-sub packages. Once the client
  booted (after the ES-module fix above), jam:offline's startup sync threw
  can't access property "remove", localCollections[name] is undefined — it tried to
  reconcile a collection the client never registered, because WeKan uses no jam:offline
.keep() and no jam:method / jam:pub-sub APIs anywhere. These were already removed
  once for the same reason and had been re-added; the offline-warning UI uses
  Meteor.status(), so it is unaffected.
  Thanks to xet7.

• Fixed six pre-existing plain-Node unit-test failures that surfaced while verifying the
  ES-module conversion: five were stale source-guards (a slice window too small, a regex
  matching a pattern quoted in a comment, a moved template button, a widened valid-width
  range, a report-controls count that grew) and one was a real cleanup race —
  streamHeaderToTemp unlinked its partial temp file fire-and-forget while the write
  stream was still opening, so a caller could see the file after the rejection; it now
  removes the file only after the stream
  closes.
  Thanks to xet7.

and updates the following dependencies:

• Pinned @rspack/core, @rspack/cli and @meteorjs/rspack to exact versions (removing
  the ^ caret ranges) so a fresh npm install cannot silently drift the bundler to a
  newer release that changes CommonJS/ES-module handling and breaks the client
  build.
  Thanks to xet7.

and has the following developer-tooling fix:

• rebuild-wekan.sh can now stop a running dev server on a minimal Linux that has neither
  fuser (psmisc) nor lsof installed: free_tcp_port gained an ss fallback that parses
  the owning pid from ss -ltnpH "sport = :PORT" and kills it. Previously it did nothing on
  such a host — while port_in_use (which uses ss) kept reporting the port busy — so the
  menu failed with "Port 3000, 8080 or 3001 is still in use … Stop it manually and retry"
  and the dev server could not restart.
  Thanks to xet7.

and improves the translation workflow:

• Fix #6494 (Transifex human translations were overwritten and the fetch was omitted):
  removed the external machine-translation service (machine-translate.mjs, which called
  LibreTranslate/DeepL and needed a WEKAN_MT_URL / WEKAN_MT_API_KEY). Remaining strings
  that are untranslated everywhere are now translated DIRECTLY (no external service, key or
  password), using each language's existing translations and general kanban terminology as
  the reference, and applied with a new fill-translations.mjs that writes ONLY into
  English-placeholder keys — so a fill can never overwrite a human translation. In the
  releases/translations/ scripts a HUMAN translation is ALWAYS PREFERRED and merged: the
  pull always fetches the newest Transifex translations first, merge-translations.mjs
  keeps a real Transifex translation and restores a committed human translation the pull
  reverted to English (leaving English only where a string is untranslated everywhere), and
  filled strings stay LOCAL — they are never pushed to Transifex as if human. This restores
  the two-way process; verify-human-preference.mjs proves both directions with 10
  cases.
  Thanks to s2ldan and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.