v10.38 2026-07-26 WeKan ® release

This release fixes the following CRITICAL SECURITY ISSUES:

• ZipBleed: arbitrary file write when
  restoring a backup archive (zip-slip)
  (f1c89548e).
  Thanks to xet7.
• GHSA-3gcg-g6rf-w2rx:
  an invalid authToken on a board export endpoint crashed the server (40de1799a).
  Thanks to laijunyue for the coordinated disclosure, and xet7.

and adds the following new features:

• Multitenancy: one WeKan server for many domains, with Organizations as the
  tenants (36b899b9d).
  Thanks to xet7.
• Admin Panel / Settings / Visibility: Change color sets the site theme
  (36b899b9d).
  Thanks to xet7.

and reorganises the Admin Panel:

• Admin Panel / Settings is reorganised so every setting sits with the thing it
  is about (fa0da9178).
  Thanks to xet7.
• Every Admin Panel page renders ONE shared left menu
  (e26706799).
  Thanks to xet7.
• Admin Panel / People: Domains, Organizations, Teams and People use the shared
  table page (ccc95bffb).
  Thanks to xet7.
• The Admin Panel Features tab is removed
  (b72a4996d).
  Thanks to xet7.
• Admin Panel / Problems: the Security report is renamed Security Report and
  moved above Broken Cards
  (4df87fd6b).
  Thanks to xet7.
• Admin Panel: the Login and E-mail panes moved from Settings to People, above
  Organizations (47b03ef89).
  Thanks to xet7.
• Every Admin Panel pane opens with the same heading, and the heading is the
  open left-menu entry's own label
  (d23219407).
  Thanks to xet7.
• Admin Panel / Settings / Translation renders through the shared table page
  (docs/Design/Page/Table.md)
  (d23219407).
  Thanks to xet7.
• Version is the FIRST pane of Admin Panel / Settings and the one that opens
  with the page (d23219407).
  Thanks to xet7.
• Admin Panel / Settings / Visibility is four named groups instead of one long
  list (671262ddb).
  Thanks to xet7.
• "Add board members only from the same Organization or Team" moves out of Admin
  Panel / People / Login
  (f0ea1601b).
  Thanks to xet7.
• Admin Panel / People / Login is one "Login: Allow" group of checkboxes
  (40c1c1e71).
  Thanks to xet7.
• Admin Panel / People / E-mail: "Email domain name" is renamed to say what it
  does (f15b37e4e).
  Thanks to xet7.
• Admin Panel / Settings / Visibility: the All Boards rows say only what is
  hidden (2ef34924d).
  Thanks to xet7.
• Each section of Admin Panel / Settings / Visibility has its own Save, directly
  above the rule that closes it
  (9255a6533).
  Thanks to xet7.
• "Product name" appears once in that pane, not twice: the group holds one field
  (bbb1b3ff0).
  Thanks to xet7.
• Admin Panel / Problems: the left menu is grouped under Settings and Reports
  (fc0fe3177).
  Thanks to xet7.
• Admin Panel / People: Domains moves up beside E-mail, the settings it is about
  (d23219407).
  Thanks to xet7.
• Admin Panel / Problems / Broken Cards has the same controls as the other
  reports (fc0fe3177).
  Thanks to xet7.
• No Admin Panel pane repeats the title above it
  (9a0db4343).
  Thanks to xet7.
• Admin Panel / Attachments opens on Backup, which is also the first entry of
  its menu (a9680fa3d).
  Thanks to xet7.
• Admin Panel / Attachments no longer has a Sandstorm pane
  (eba25459a).
  Thanks to xet7.

and updates the following dependencies:

• @aws-sdk/client-s3 3.1090.0 → 3.1095.0 — the S3 / MinIO attachment storage
  client (#6530, 36b54b1f5).
  Thanks to dependabot.
• unzipper 0.12.3 → 0.12.5 — the zip reader behind board import and backup
  restore (#6529, aa7abcf09).
  Thanks to dependabot.
• bson 7.3.0 → 7.3.1 — the BSON codec used with MongoDB and FerretDB (#6527,
  047319fb2).
  Thanks to dependabot.
• @playwright/test 1.61.1 → 1.62.0 in tests/playwright — the browser test
  runner, a development dependency that is not part of the shipped bundle
  (#6528, f7fb32774).
  Thanks to dependabot.
• docker/login-action 4.4.0 → 4.5.1 — the GitHub Actions step that signs in
  to the container registries when a release image is published (#6526,
  d4684448c).
  Thanks to dependabot.

and fixes the following bugs:

• Clicking a card closes the one that was open; keeping many open is a per-user
  setting (2973240a7).
  Thanks to mimZD and xet7.
• All Boards on a phone sizes its scrollers by the viewport that is actually
  there (89920762a).
  Thanks to mimZD and xet7.
• Choosing a theme now recolours the whole UI, not just the header
  (d72675906).
  Thanks to xet7.
• Admin Panel: the Edit User, Organization and Team popups fit the window, in
  columns (19a5ea0b7).
  Thanks to xet7.
• Admin Panel / Settings / Visibility / Wait Spinner shows the spinner it names,
  spinning (19a5ea0b7).
  Thanks to xet7.
• Admin Panel / Settings / Translation puts its New column on the left
  (19a5ea0b7).
  Thanks to xet7.
• Admin Panel / People / People showed nothing at all — no table, no search box,
  no pager (d23219407).
  Thanks to xet7.
• The right-hand side of an Admin Panel table is no longer off screen
  (d23219407).
  Thanks to xet7.
• An empty Admin Panel table still shows its header, so its New button is there
  (d23219407).
  Thanks to xet7.
• Every control in an Admin Panel table's controls row sits at the same height
  (d23219407).
  Thanks to xet7.
• A long Admin Panel left menu scrolls inside its panel
  (a4990a474).
  Thanks to xet7.
• The build stopped with Can't use the built-in 'if' here on the People page
  (f8793bec4).
  Thanks to xet7.
• Admin Panel / People / E-mail saved neither of the two settings it shows
  (f15b37e4e).
  Thanks to xet7.
• Admin Panel pages no longer repeat the pane name in a bar of their own
  (73cd930a4).
  Thanks to xet7.
• The Admin Panel left menu is back on every page
  (d34d28159).
  Thanks to xet7.
• The password field is back on the Sign In and Register pages
  (696c49038).
  Thanks to xet7.
• A finished MongoDB → FerretDB migration on Snap no longer leaves WeKan on 503
  (aebede877).
  Thanks to S0QR2 and xet7.
• In mobile mode the fixed-size light grey bands around a swimlane are gone
  (6837198bf).
  Thanks to xet7.
• In mobile mode the board fits the width again
  (a5850296a).
  Thanks to xet7.
• In mobile mode the titles and the top bar sit on one line
  (a5850296a).
  Thanks to xet7.
• In mobile mode, clicking the Add List + no longer opens the list as well
  (df27e349d).
  Thanks to xet7.
• In mobile mode the "Add List" + moved into each list header, between the caret
  and the drag handle
  (61979c0f6).
  Thanks to xet7.
• Checked for the same window-resizing bug everywhere else it could hide
  (7dcd9da67).
  Thanks to xet7.
• Elements no longer change size when the browser window is resized
  (d03cd0300).
  Thanks to xet7.
• The second header bar in mobile mode is the same on a phone as in mobile mode
  on a desktop window
  (72315d8f9).
  Thanks to xet7.
• The list title is visible in mobile mode again, both on a phone and on a
  desktop (72315d8f9).
  Thanks to xet7.
• The board in mobile mode reflows sideways again instead of overflowing by a
  sliver (72315d8f9).
  Thanks to xet7.
• The minicard drag handle is below the minicard menu button, on the same edge
  (114a0af31).
  Thanks to xet7.
• Drag-to-scroll now works on both top header bars, not only below them
  (a5246fbf5).
  Thanks to xet7.
• The board title is shown again in mobile mode, and the second header bar now
  reads title, buttons, hamburger
  (a5246fbf5).
  Thanks to xet7.
• The sidebar hamburger keeps its divider at the end of the header bar
  (a5246fbf5).
  Thanks to xet7.
• Lists and cards are full width in mobile mode on a desktop browser too, not
  only on a phone
  (a5246fbf5).
  Thanks to xet7.
• The Sign In and Register pages have real scrollable space below the form again
  (45022e907).
  Thanks to xet7.

and has the following developer-facing changes:

• The Playwright tests address an Admin Panel menu entry by its data-id, not
  by a per-page class
  (b0bffe8c1).
  Thanks to xet7.

• Every paginated admin table renders through ONE shared table page
  (9791993d5).
  Thanks to xet7.

• Every .jade template is now compiled by a test, using the same compiler the
  build uses (a5246fbf5).
  Thanks to xet7.

• The shared left menu is a design of its own — docs/Design/Page/Left-Menu.md
  — beside the table page
  (f14dc6a78).
  Thanks to xet7.

and updates the documentation:

• docs/Design/Multitenancy/Multitenancy.md designs one server for many domains
  (fd12199e9).
  Thanks to xet7.
• The Admin Panel documentation mirrors the Admin Panel menu: a menu path is a
  docs path (1e9e58dab).
  Thanks to xet7.

and fills untranslated strings in every language:

• The new multitenancy and site-theme strings are translated into every language
  (78e2adb69).
  Thanks to xet7.
• Strings untranslated everywhere are filled directly, never overwriting a human
  one (526905483).
  Thanks to xet7.
• Every remaining language is translated, most spoken to least
  (cc71cb28c).
  Thanks to xet7.
• releases/translations/fill_translations.py joins the .mjs of the same
  name: the same rules
  (526905483).
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their
translations.