This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+2 more
Affected surfaces
Summary
AI summaryLocation detection from map provider links is added, supporting many global providers with coordinate conversion.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds location detection from map links across many providers. Adds location detection from map links across many providers. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Feature | Low |
Allows selecting default map provider via "Open map links at" setting in user profile. Allows selecting default map provider via "Open map links at" setting in user profile. Source: granite4.1:30b@2026-06-13-audit Confidence: low |
— |
| Feature | Low |
Handles coordinate order variations (lat,lon vs lon,lat) for non-US providers. Handles coordinate order variations (lat,lon vs lon,lat) for non-US providers. Source: granite4.1:30b@2026-06-13-audit Confidence: low |
— |
| Feature | Low |
Applies datum conversion for Chinese map providers (Baidu BD-09, Amap GCJ-02). Applies datum conversion for Chinese map providers (Baidu BD-09, Amap GCJ-02). Source: granite4.1:30b@2026-06-13-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes incomplete URL substring sanitization. Fixes incomplete URL substring sanitization. Source: llm_adapter@2026-06-13 Confidence: low |
— |
Full changelog
v9.43 2026-06-13 WeKan ® release
This release adds the following new features:
- Add/Edit location popup can also
detect a location from a map link from many providers,
grouped by region — USA: Google Maps, Bing Maps, Apple Maps, Waze;
Europe: OpenStreetMap, HERE WeGo, Yandex Maps, Mapy.cz, 2GIS; Asia: Baidu Maps,
Amap (Gaode) — plus generic?q=/?ll=links: paste the link, press "Detect",
and the latitude, longitude and (when present) the place name/address are
filled in automatically. Detection handles each provider's real-world URL
shapes, including percent-encoded commas (e.g. Waze/Yandexll=...%2C...) and
alternate forms (HEREshare.here.com/l/, Yandexpt=, 2GISm=), and the
coordinate order (several non-US providers use lon,lat). For the Chinese
providers a datum conversion is applied — Baidu uses BD-09 and Amap uses
GCJ-02, both offset from WGS-84 — so pins land in the right place on the way in
and out. The popup also has an "Open map links at" setting (OpenStreetMap by
default) saved to the user profile, with the same region-grouped provider list,
controlling which map service the location "Open in map" links use.
Thanks to xet7 and Claude.
and fixes the following bugs:
- Fix incomplete URL substring sanitization.
Thanks to above GitHub users for their contributions and translators for their translations.
Security Fixes
- Fix incomplete URL substring sanitization
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About wekan
The Open Source kanban, built with Meteor. GitHub issues/PRs are only for FLOSS Developers, not for support, support is at https://wekan.fi/commercial-support/ . New English strings for new features at imports/i18n/data/en.i18n.json . Non-English translations at https://app.transifex.com/wekan/wekan only.
Beta — feedback welcome: [email protected]