This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+2 more
Summary
AI summaryFixed UI alignment, drag‑handle size, admin panel redirect, overflow scrolling, zoom number display, and narrow‑window layout.
Full changelog
v10.39 2026-07-26 WeKan ® release
This release fixes the following bugs:
The notification bell and the avatar sit the same way in both modes. Thanks to xet7.They were placed by whatever margin happened to win: one auto margin on the zoom
pill pushed the pill, the bell and the avatar to the end of the row as a packed
group, so the bell sat against the pill with the empty space beyond it, and the
avatar's distance from the edge was whatever was left — different in mobile mode
and in desktop mode on the same phone. Below 800px the free space is shared
around the bell instead: an auto margin on each side puts it midway between the
zoom pill and the avatar, and the avatar keeps a fixed 12px gap to the right
edge. Both .iphone-device variants are named in the selector list, since that
fallback sets these margins with !important and two classes more, and the
placement would otherwise apply everywhere except the phone it was reported
from.
Two things differed between mobile mode and desktop mode on the same phone. The
board tile's drag handle was a 26px circle in one and a 40px circle in the
other, and on a ~97px tile the big one covered a good part of the tile it sits
on; both are the smaller one now, still well over the ~24px a finger needs. And
a workspace had no readable name in EITHER mode: the row's rule said the name
"must give way to the fixed items around it", and it gave way completely — the
drag handle, folder icon, menu button and count chip come to ~130px at their
desktop paddings, the menu column on a 375px phone is ~145px, and the name was
laid out in the 15px left over. Those items are trimmed to ~90px and the name
has a 3.5em floor it may not shrink below, with an ellipsis when it is long.
tests/allBoardsPhoneRow.test.cjs reads the sizes out of the cascade.
Both old URLs are panes of Admin Panel / Settings now, and both redirected with
FlowRouter.go('setting') called from INSIDE triggersEnter. A trigger runs
while its own route is still entering, and a go() from there is swallowed - so
nothing was rendered at all and whatever page the browser was showing simply
stayed. Playwright caught it on every browser: /information showed All Boards. A
trigger now redirects with the redirect it is handed, and each URL asks for
the pane it used to be a page of, so the bookmark lands where it pointed.
tests/adminOldUrlRedirect.test.cjs pins the redirect form and the pane.
The board titles were laid out two characters per line. Space for the drag
handle - one absolutely-positioned circle - was reserved three times on the way
down: on the list item, on the tile and on the text container, which is more
than a ~97px phone tile has. It is reserved once now, and not at all when drag
handles are off and no handle is rendered. The page could also be dragged
sideways, with the avatar past the right edge: the quick-access bar is nowrap
with overflow: visible and every item flex-shrink: 0, so a row wider than
the screen spilled - and visible overflow is scrollable overflow. The zoom pill,
by far the widest item, gives way instead, and html { overflow-x: hidden } on
a phone is the guarantee. tests/mobileAllBoardsFit.test.cjs pins both.
On a phone the pill was empty and "100" sat to the right of it in tiny type,
half under the notification bell. The pill was allowed to shrink below its own
contents, and a flex item that shrinks past its content does not clip it - the
white background ends where the width says and the text carries on outside it.
The pill is sized by what is in it now, and what is in it is made small instead.
The tiny type was font-size: 0.7em of a 12px bar - about 8px, the smallest
text on the page - now a plain 14px, which is also why the pill stays narrow.
The base rule's 24px height cap, shorter than that text, is lifted so the number
is centred. tests/mobileAllBoardsFit.test.cjs pins all of it.
The phone/desktop toggle writes an explicit choice, and Utils.isMiniScreen()
returns it as-is, so a phone whose user picked DESKTOP mode is not a mini screen
and its body carries no .mobile-mode — while the viewport is still 375px wide.
Three fixes written for one of those two therefore did nothing there. "Create
board" opened 160px in with its right half off the screen, because the geometry
laid it out as a floating box anchored to the button while the CSS made it the
full width; the board bar's hamburger was pushed to a third row of its own; and
the top bar was still wider than the screen, so the avatar was cut off. The
popup is a sheet pinned to the corner at any viewport that narrow, the hamburger
leaves the flow by width as well as by mode, and the drag-handle toggle, the
mode toggle and the logo give back the ~60px the avatar needed.
tests/narrowWindowLayout.test.cjs pins all three.
and improves the changelog and the documentation:
The changelog shows a short description, and hides the long one behind it. Thanks to xet7.Every entry is a <details> now: the <summary> is a short description of what
was done and IS the link to the commit — the hash is in the href, never on the
page — and clicking it reveals the long description, wrapped at 80 columns. 977
entries across every release were converted, the ones the old prose format had
left malformed were repaired rather than carried over, and no URL or heading was
lost. The top of the file became # Platforms (with its collapsible Version
list) and # TODO Later, whose blocks carry no Thanks to because nothing
there is done yet. The rules are written down in
CLAUDE.md, and
tests/changelogFormat.test.cjs checks the whole file against them.
The wekan.fi Hall of Fame page grew a row of
eight cells, one thing in
each — CVE, Icon beside
it, Vulnerability name, Date,
Responsible Security Disclosure by, Stars, Process, Vulnerabilities — with the
Process and Vulnerabilities
cells collapsed behind their own summary, the stars of a row on one
line and the icon beside its
red drop on one, the
reporter's nickname as the link to their
GitHub — checked to exist
before it is linked — and no role note after a
name. All of it is stated in
CLAUDE.md so the next security entry is written to fit rather than reconstructed
from the file.
Thanks to above GitHub users for their contributions and translators for their
translations.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About wekan
The Open Source kanban, built with Meteor. GitHub issues/PRs are only for FLOSS Developers, not for support, support is at https://wekan.fi/commercial-support/ . New English strings for new features at imports/i18n/data/en.i18n.json . Non-English translations at https://app.transifex.com/wekan/wekan only.
Beta — feedback welcome: [email protected]