Skip to content

wekan

v9.43 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

docker javascript kanban meteor real-time sandstorm
+2 more
snapcraft wekan

Affected surfaces

rce_ssrf

Summary

AI summary

Location detection from map provider links is added, supporting many global providers with coordinate conversion.

Changes in this release

Feature Medium

Adds location detection from map links across many providers.

Adds location detection from map links across many providers.

Source: llm_adapter@2026-06-13

Confidence: high

Feature Low

Allows selecting default map provider via "Open map links at" setting in user profile.

Allows selecting default map provider via "Open map links at" setting in user profile.

Source: granite4.1:30b@2026-06-13-audit

Confidence: low

Feature Low

Handles coordinate order variations (lat,lon vs lon,lat) for non-US providers.

Handles coordinate order variations (lat,lon vs lon,lat) for non-US providers.

Source: granite4.1:30b@2026-06-13-audit

Confidence: low

Feature Low

Applies datum conversion for Chinese map providers (Baidu BD-09, Amap GCJ-02).

Applies datum conversion for Chinese map providers (Baidu BD-09, Amap GCJ-02).

Source: granite4.1:30b@2026-06-13-audit

Confidence: low

Bugfix Medium

Fixes incomplete URL substring sanitization.

Fixes incomplete URL substring sanitization.

Source: llm_adapter@2026-06-13

Confidence: low

Full changelog

v9.43 2026-06-13 WeKan ® release

This release adds the following new features:

  • Add/Edit location popup can also
    detect a location from a map link from many providers,
    grouped by region — USA: Google Maps, Bing Maps, Apple Maps, Waze;
    Europe: OpenStreetMap, HERE WeGo, Yandex Maps, Mapy.cz, 2GIS; Asia: Baidu Maps,
    Amap (Gaode) — plus generic ?q=/?ll= links: paste the link, press "Detect",
    and the latitude, longitude and (when present) the place name/address are
    filled in automatically. Detection handles each provider's real-world URL
    shapes, including percent-encoded commas (e.g. Waze/Yandex ll=...%2C...) and
    alternate forms (HERE share.here.com/l/, Yandex pt=, 2GIS m=), and the
    coordinate order (several non-US providers use lon,lat). For the Chinese
    providers a datum conversion is applied — Baidu uses BD-09 and Amap uses
    GCJ-02, both offset from WGS-84 — so pins land in the right place on the way in
    and out. The popup also has an "Open map links at" setting (OpenStreetMap by
    default) saved to the user profile, with the same region-grouped provider list,
    controlling which map service the location "Open in map" links use.
    Thanks to xet7 and Claude.

and fixes the following bugs:

  • Fix incomplete URL substring sanitization.

Thanks to above GitHub users for their contributions and translators for their translations.

Security Fixes

  • Fix incomplete URL substring sanitization

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track wekan

Get notified when new releases ship.

Sign up free

About wekan

The Open Source kanban, built with Meteor. GitHub issues/PRs are only for FLOSS Developers, not for support, support is at https://wekan.fi/commercial-support/ . New English strings for new features at imports/i18n/data/en.i18n.json . Non-English translations at https://app.transifex.com/wekan/wekan only.

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]