Skip to content

wekan

v10.41 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 22h Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

docker javascript kanban meteor real-time sandstorm
+2 more
snapcraft wekan

Summary

AI summary

Fixes server crash when a removed DDP session receives its 101st message.

Full changelog

v10.41 2026-07-27 WeKan ® release

This release fixes the following bugs:

A removed DDP session no longer crashes the server on its 101st message. Thanks to bluetopaz1204, Nissulya and xet7.

From the comments today, on 10.40 with real users: TypeError: self._pendingRemoveFunction is not a function at Session.send, then Main process exited, code=exited, status=1/FAILURE and Scheduled restart job, restart counter is at 4. It is a state-machine hole in Meteor's ddp-server:
_removeSession sets messageQueue = [] and a remove function; the remove
function clears itself and deletes the session but leaves the queue, which is
truthy — so Session.send keeps queueing for a session that no longer exists
and the message past maxMessageQueueLength (100) calls null. It runs from an
Immediate with no try/catch above it, so it is an uncaught exception, and
synced-cron exits the process on one: every user disconnected, new cards only
after a reload, systemd restarting — which reads as "WeKan is slow and the CPU
is high". A queue with no remove function is now dropped instead of pushed to,
so send() takes its ordinary path; the grace-period queue for a real
reconnect and a legitimate overflow both behave as before.
tests/ddpSessionSendGuard.test.cjs replays the upstream state machine,
including that the unguarded version really does throw on the 101st message.

and has one icon set:

One icon set: Font Awesome, and the Grey Icons feature is removed. Thanks to xet7.

WeKan used colourful Unicode emoji as its icon set in 8.00–8.24 only; before
and after, the icons are Font Awesome 4.7. A handful had survived that change —
every notification type, the board star, the vote thumb, the spent-time badge,
the list width toggles, the bookmarks star, the back arrow, the sidebar's plus
and hash, the four date badges, the mobile drag handle, the multi-selection
tick, the gantt day markers — each a different picture on every platform, at a
size and colour the stylesheet does not control. They are Font Awesome glyphs
now, and "Grey Icons" in Member Settings, which existed to grey exactly those
emoji with a MutationObserver over every rendered subtree, is removed whole:
menu entry, handler, method, schema field, publication, stylesheet, the string
in all 147 language files, the API-spec field and the docs mentions. The
language-picker flags stay: Font Awesome 4.7 has no flags.
tests/fontAwesomeIcons.test.cjs fails on an emoji in any template or CSS
content:, and on any leftover of the removed feature.

and has the following developer-facing changes:

"Run ALL tests" now runs all the tests, in build.sh and in build.bat. Thanks to xet7.

Two gaps that together meant most of the suite never ran anywhere. The flow ran
six jobs — mocha, the import regression, the Node E2E harness and the three
browsers — and no npm unit script at all, so everything in test:unit:node and
test:unit:all (the ~165 .cjs guards plus the sticker, Trello and OAuth2
suites) was never executed by "Run ALL tests". Both scripts now have a unit
job that runs meteor npm run test:unit:all, counted, waited for and reported
with its own log. And the scripts themselves were incomplete: 72 suite files
existed that no npm script mentioned — they are all registered now, and
tests/testsAreRegistered.test.cjs fails when a plain-node suite is in no
script or when the flow stops running it. Not verified here: with no node in
this environment those 72 suites have never been executed, so some may fail on
the first real run — that is the information this buys, not a regression it
introduces.

Thanks to above GitHub users for their contributions and translators for their
translations.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track wekan

Get notified when new releases ship.

Sign up free

About wekan

The Open Source kanban, built with Meteor. GitHub issues/PRs are only for FLOSS Developers, not for support, support is at https://wekan.fi/commercial-support/ . New English strings for new features at imports/i18n/data/en.i18n.json . Non-English translations at https://app.transifex.com/wekan/wekan only.

All releases →

Related context

Beta — feedback welcome: [email protected]