v9.76 2026-07-06 WeKan ® release

This release adds the following fixes:

• Fix notification emails linked to /b/undefined/board/<cardId> instead of the real board:
  On the server ReactiveCache.getBoard() is async and returns a Promise, but Cards.board() did not await it,
  so the synchronous Card.originRelativeUrl()/absoluteUrl() interpolated a Promise —
  board._id and board.slug were undefined, producing /b/undefined/board/<cardId> in
  card activity notification emails (the client UI was unaffected because this.board() is
  synchronous there). Fixed by making Card.originRelativeUrl(board)/absoluteUrl(board) accept an
  already-resolved board and fall back to this.boardId (always available synchronously) when the
  board is a Promise, and by passing the awaited board from server/models/activities.js so the
  correct board id and slug are used.
  Thanks to titver968 and xet7.

• Release workflow: publish the Helm chart only after the Docker image is pushed:
  In .github/workflows/release-all.yml the charts job now depends on the docker job
  (needs: docker) instead of running in parallel right after bump. GitHub Actions runs a job
  only when all of its needs jobs succeed, so the wekan/charts Helm chart is published only after
  the multi-arch image is live on Docker Hub / Quay.io / GHCR (and is skipped if docker fails).
  This prevents ArtifactHub from scanning a freshly published chart whose image tag does not exist
  yet and emailing the maintainer about the missing Docker image.
  Thanks to xet7.

• Fix thousands of unsolicited empty "Default" swimlanes created on some boards:
  Board.getDefaultSwimline()/getDefaultSwimlineAsync() self-heal a missing default swimlane by
  reading the board's swimlanes and inserting one if none exist. That check-then-insert is a race:
  concurrent or repeated server calls for a swimlane-less board each saw zero swimlanes and each
  inserted a new one, so some boards accumulated 30 000+ empty "Default" swimlanes and became
  unloadable (the key 'default (en)' returned an object instead of string log is a harmless i18n
  side effect — the title correctly falls back to the string Default). Follow-up to the
  client-side #6382 fix, which only stopped the
  browser from auto-creating them. Fixed by making the server self-heal idempotent: the default
  swimlane is now upserted with a deterministic _id (<boardId>-default), so the _id unique
  index guarantees at most one default swimlane per board no matter how many times, or how
  concurrently, the getters run. archived/type are set explicitly in the $setOnInsert because
  their schema autoValue/defaultValue only fire on insert, not upsert. Note: this prevents new
  duplicates; boards that already accumulated thousands still need a one-off cleanup.
  Thanks to brlin-tw and xet7.

• Reduce card flicker on drag by only writing changed fields on a card move:
  Card.move() wrote boardId/swimlaneId/listId into the update unconditionally, even for a
  same-board drag to another list (the reported case). Keeping boardId in the $set on every drag
  re-ran the boardId-gated Cards.after.update hook that re-syncs the card's checklists and
  checklist items via multi updates, ran the cross-board consistency guard and the
  denyCrossBoardMove deny-rule DB lookup, and invalidated more reactive dependents than
  necessary — server work and reactivity churn that contributed to a ~1s card flicker on large
  boards. Card.move() now writes only the fields that actually change (via the pure
  computeCardMoveModifier helper) and skips the write entirely when a card is dropped back in the
  same place, so a same-board move no longer touches boardId or the cross-board hooks. The
  moveCard/moveCardBoard activity generators already re-check doc.X !== oldX, so trimming the
  modifier does not drop any activity. Note: this reduces the drag-time work behind the flicker; the
  residual reactive re-render cost on very large boards is a separate performance topic.
  Thanks to mimZD and xet7.

• Fix DEFAULT_AUTHENTICATION_METHOD env var ignored, and Admin Panel Layout save hanging:
  Two related problems with the default login authentication method.

  • Env var ignored: the stored setting was only ever seeded as password and
    DEFAULT_AUTHENTICATION_METHOD was never applied, so operators setting it (e.g. Kubernetes/Helm
    DEFAULT_AUTHENTICATION_METHOD: ldap) saw no effect. Startup now applies the env var
    authoritatively: it seeds the value on a fresh install and, on existing installs, keeps the
    stored defaultAuthenticationMethod in sync with the env var on every boot (the operator's env
    is the source of truth), so the method can be configured entirely by env without the Admin Panel.
    The value is normalized (trimmed + lower-cased), so DEFAULT_AUTHENTICATION_METHOD=LDAP works.
  • Layout save hanging / not persisting: the authentication-method <select> is populated by an
    async Meteor.call, so clicking Admin Panel > Layout > Save before it loaded sent an empty
    value for the required defaultAuthenticationMethod field, which silently failed validation —
    the save looked stuck and nothing changed. The save now falls back to the currently stored method
    when the select is empty, so a real value is never overwritten by ''.
    Both paths share one pure helper (resolveDefaultAuthenticationMethod) that never resolves to an empty string.
    Thanks to joe-speedboat and xet7.

• Fix #5808: linking a card to another linked card made both cards inaccessible:
  The "Link to this card" target picker only excluded template cards, so an existing linked card
  (or a card that already links back to the current board) could be chosen as a link target. That
  builds a chain/cycle of linkedId pointers, but the card helpers
  (getTitle/getBoardTitle/getRealId) resolve linkedId only one hop, so such a card
  renders as an empty/broken pointer and becomes effectively inaccessible (the reported freeze). As
  the reporter suggested, the fix prevents the configuration rather than allowing it: only a real
  card — not a linked card/linked board, not one of the linking board's own cards, and not a card
  that links back to one of them — may now be a link target. This is enforced both in the picker's
  query and re-checked at creation time (the options can be stale), via the pure
  isLinkableCardTarget guard, mirroring the existing #3328 parent/subtask cycle guard. Note: this
  stops new inaccessible links; any already-created ones still need manual cleanup.
  Thanks to the reporter and xet7.

• Fix the "Board not found" flicker (stale-while-revalidate for the client board cache):
  While viewing a board, the board view could briefly flash the "Board not found" shell — and on
  WebKit throw a Blaze Can't select in removed DomRange error tearing down the card view. Root
  cause: the client board cache (imports/lib/dataCache.js) re-fetches its value inside a reactive
  computation, and when the board doc is momentarily absent from minimongo (a subscription stops and
  restarts, so Meteor transiently removes the doc) the re-fetch returns undefined and that empty
  value is surfaced immediately. It self-recovers when the subscription re-delivers the doc, so it
  presents as a flicker — reliably reproduced only on Firefox/WebKit, where the reactive-render
  timing hits the window (Chromium did not, which is why it surfaced as browser-specific Playwright
  failures in 14-voting-watchers and 24-feature-issues). Fixed with an opt-in
  stale-while-revalidate mode on DataCache, enabled only for getBoard: a transient miss over
  an already-cached board keeps the last value and re-checks after a short delay, surfacing an empty
  result only if the board is still gone then (a genuine deletion / access loss). First-ever loads
  and caches that did not opt in are unchanged. Core decision extracted to the pure
  shouldDeferCacheMiss helper with unit tests.

Thanks to above GitHub users for their contributions and translators for their translations.