v10.04 2026-07-20 WeKan ® release

This release adds the following new features:

• Safe filename handling everywhere: attachment and avatar names are always shown
  clean — URL-decoded, normalized to generally-used characters (Unicode NFKC plus
  confusable-homoglyph folding, so a typosquatting pаypal.exe with a Cyrillic а is
  shown as paypal.exe), invisible/control/bidi characters removed and HTML/JS/XML
  markup stripped. Uploads are hardened (exploit and EICAR virus-test filenames
  rejected, extension corrected to the real detected type, length capped to a portable
  30 chars), SVG JavaScript and XML-loop content is sanitized at a staging path before
  storage, existing files can be corrected/sanitized on the fly, storage moves check
  free disk space, and migrations fix + disambiguate names. One general cleanFileName
  function via {{cleanFilename}} / {{downloadFilename}}. Design at
  docs/Features/Filename/Filename.md.
  Thanks to xet7.
• Log every filename/content sanitization to Admin Panel / Problems: whenever a name
  or file required sanitization (upload, migration, existing-file corrector, viewing),
  the Security report records WHEN, WHO uploaded it, FOR WHAT REASON (URL-encoding,
  invisible characters, typosquatting, the exploit kind such as JavaScript / XML code /
  XML loop, wrong file type, too long), the filename from → to, and WHERE (board ›
  swimlane › list › card, plus organization and team).
  Thanks to xet7.
• CPU-usage monitor + governor + Admin Panel / Problems / CPU usage report: watch
  system-wide CPU, record only the START and END of each sustained high-CPU period
  with what WeKan/FerretDB were doing, the automatic mitigation taken and whether it
  helped; a governor pauses long batch operations to yield the CPU. On high CPU WeKan
  asks the bundled FerretDB (via its throttle command) to slow down in an adaptive
  feedback loop, FerretDB also self-regulates on its own and reports its own process
  CPU% so a core-peg is visible even when system-wide CPU looks moderate. Design at
  docs/Features/Admin-Panel/Problems/CPU-usage.md.
  Thanks to xet7.
• Automatic adaptive card loading (no admin toggle): WeKan decides per board by size —
  a board over the threshold (default 500 cards, CARDS_LOADING_LAZY_THRESHOLD) loads
  only the visible cards (infinite-scroll windows) plus a live count, so very large
  boards stay fast; smaller boards keep loading every card. The board publication also
  publishes comments/attachments with one board-level cursor instead of one per card
  (an N+1 that pinned FerretDB CPU), with supporting indexes.
  Thanks to xet7.
• Statistics board view (Finnish: Tilastot): a full-width board view alongside
  Swimlanes / Lists / Calendar / Gantt / Table showing the board's card-loading mode,
  counts (swimlanes, lists, cards, archived cards, labels, members, custom fields) and
  a time-spent summary; counts come from the server so they are accurate even in lazy
  mode, and its text can be selected and copied with mouse or finger. Design at
  docs/Features/Board/Sidebar/Status.md.
  Thanks to xet7.
• Admin Panel / Problems documentation reorganized under Admin-Panel/Problems/ with new
  RAM-usage and Disk-usage design specs (log how much RAM+swap / disk is used and record
  only the start and end of each sustained high-usage period, mirroring the CPU-usage
  monitor).
  Thanks to xet7.
• Admin Panel report improvements: paginated, searchable report tables (Files, Rules,
  Boards, Cards, Impersonation) that load one page at a time via index-backed sorts
  instead of the whole collection, theme-following buttons, and the Files report shows
  every filename decoded and cleaned.
  Thanks to xet7.
• Organize docs/Features into categories (Admin-Panel, Board, Cards, Editor, Reports,
  Automation, Lists, Troubleshooting) and update all links.
  Thanks to xet7.

and fixes the following bugs:

• Fix: removing a member from a board now visibly works — the sidebar member list kept
  showing removed members (removeMember keeps the entry with isActive:false), so
  "Remove from board" looked like it did nothing; the list now shows only active members
  (#6479).
  Thanks to mueschel and xet7.
• Fix: opening a board no longer pins FerretDB CPU / takes minutes — the board
  publication opened one live comments cursor and one attachments cursor per card (an
  N+1 that pinned FerretDB/SQLite CPU), now one board-level cursor each plus indexes;
  FerretDB also reports its own process CPU% so Problems shows a core-peg (#6480).
  Thanks to mueschel and xet7.
• Fix: All Boards on mobile is scrollable again and shows at least 2 board icons per
  row — the list was forced min-height:100vh so it grew to fit and was clipped by the
  overflow:hidden wrapper; it now has a bounded height + overflow-y:auto, and the left
  menu is narrowed so the boards get room (#6488).
  Thanks to mimZD and xet7.
• Fix: Rules → Workflow view can create rules again — rulesWorkflow.js used TAPi18n
  without importing it, so building a rule threw ReferenceError and the Add Rule handler
  aborted before saving (#6489).
  Thanks to xet7.
• Fix: Rules list — Delete and "View rule" act on the clicked rule, not the first — the
  buttons live in the rulesList child template but their handlers on the parent
  rulesMain used Template.currentData(), so the rule id was null (delete failed with
  "Match failed", View always opened the first rule); the buttons now carry an explicit
  data-rule-id (#6490).
  Thanks to xet7.
• Fix: a rule's action never executed even though its trigger matched — the trigger
  match required fields a moveCard trigger omits (oldListName), and a Mongo $in does not
  match a missing field unless null is in the list, so the rule silently never fired;
  null is now included for every field, like the cardTitle handling (#6491).
  Thanks to xet7.
• Fix: admin reports load on FerretDB — the paginated report publications returned a
  sorted+limited live cursor, whose limited live observe hangs on FerretDB's OpLog, so
  the report was stuck on the loading spinner; they now publish the page manually so
  ready always fires.
  Thanks to xet7.
• Fix: the paginated admin reports never get stuck on the loading spinner if a report
  subscription fails — they now handle onStop, clearing the spinner and surfacing the
  error.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their
translations.