v10.37 2026-07-25 WeKan ® release

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code
scanning:

• js/incomplete-sanitization (High), alert #428, in
  tests/boardHeaderOneLine.test.cjs: the CSS rule bodies were split with
  rule.split('{') and the trailing brace removed with body.replace('}', ''),
  which strips only the FIRST }. The block is now matched with one regex that
  captures selector and body as separate groups, so no brace ends up in the text
  and there is nothing to strip.
• js/incomplete-sanitization (High), alert #427, in
  tests/testsAreRegistered.test.cjs: a file name was spliced into a RegExp
  after escaping only dots, leaving every other metacharacter — the backslash
  above all — able to change the meaning of the pattern. It now goes through an
  escapeRegExp() that escapes the full set, backslash included.
• Both are test helpers, so neither was reachable by an attacker, but both were
  genuinely wrong string handling
  (commit).
• Thanks to GitHub CodeQL (alerts #427 and #428) and xet7.

and resolves the following GitHub Dependabot alerts in npm dependencies:

• brace-expansion 5.0.7 → 5.0.8 (RUNTIME dependency, transitive via minimatch):
  fixes CVE-2026-14257
  (GHSA-mh99-v99m-4gvg, High, CVSS 7.5, alert #119) — expand() bounds how MANY
  results it produces (max, 100000) but not how LONG they get, so chained brace
  groups keep the count under the cap while every result grows one character per
  group. A ~7.5 KB input ('{a,b}'.repeat(1500)) exhausts memory and kills the Node
  process with a fatal, uncatchable out-of-memory error that try/catch cannot
  contain. 5.0.8 bounds the total characters one expand() call may accumulate
  (maxLength, default 4000000) inside the output-building loops, so intermediate
  arrays are bounded too and oversized input is truncated rather than fatal. Patch
  release in the same major line; the only other change is engines.node, which drops
  Node 18 — WeKan builds and ships on Node 24 (Dockerfile NODE_VERSION=v24.18.0, CI
  NODE_VERSION: '24'), so nothing is affected
  (#6523, merge commit).
• postcss 8.5.15 → 8.5.22 (dev dependency; enters only through css-loader, which
  the rspack build uses for .css, and is not itself part of the shipped bundle):
  fixes GHSA-r28c-9q8g-f849
  (High, CVSS 7.5) — postcss follows a /*# sourceMappingURL=... */ comment in the CSS
  it parses and builds the path with path.join(dirname(from), annotation), which
  normalises but does not sandbox .., so a crafted comment discloses arbitrary .map
  files. Affected <= 8.5.17, patched in 8.5.18. nanoid 3.3.12 → 3.3.16 rides along
  as postcss's own dependency
  (#6522, merge commit).
• Both are lock-only changes whose tarball integrity hashes were verified against the
  npm registry, and the brace-expansion lock edit was reproduced independently with
  npm update brace-expansion --package-lock-only, which produced a byte-identical
  diff. elliptic (alert #55, CVE-2025-14505) is still left pinned for the reason
  recorded in v10.14: no fixed version is published upstream — the latest release is
  still 6.6.1 and the advisory lists no patched version. It is a dev-only transitive
  polyfill (@meteorjs/rspack → node-stdlib-browser → crypto-browserify →
  browserify-sign/create-ecdh), no WeKan client module imports node crypto, and
  the built client bundle contains no elliptic/secp256k1/crypto-browserify code
  at all, so it never reaches users.
• Thanks to GitHub Dependabot and xet7.

and has the following developer-tooling fix:

• docs/Security/gh/pull-security-reports.sh reported OK for every endpoint and
  then wrote empty split files and blank counts. gh api --paginate --slurp returns
  ONE ARRAY PER PAGE, so a list endpoint arrives as [[alert,...],[alert,...]];
  nothing flattened that, so .[] yielded PAGES rather than alerts and every
  select(.state == "open") ran against an array. jq failed, its error went to
  /dev/null, and the > redirect left a 0-byte file — not valid JSON, so every
  later step on it failed too and printed nothing. A security report that quietly
  claims there is nothing to see is worse than one that fails. The pages are now
  concatenated (only when every element is itself an array, so single-object
  endpoints like the SBOM are untouched), a failed filter leaves a valid empty array
  plus a readable error instead of truncating the file, the secret-scanning
  redaction validates the redacted copy before deleting the dump that still holds
  live secrets (and removes it on the failure path too), and counts always print a
  number. The same shape had also broken the newest-analysis lookup and the
  codeql-databases dump.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their
translations.