v10.14 2026-07-22 WeKan ® release

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

• SpliceBleed: incomplete multi-character
  sanitization when stripping exploit markup from a filename (GitHub CodeQL code scanning
  alert #425, rule js/incomplete-multi-character-sanitization, CWE-116 Improper Encoding or
  Escaping of Output; imports/lib/fileNameDisplay.js). stripExploitPatterns() removed
  HTML/script/XML/template markup from a shown filename in a single pass — so an input crafted
  with nested or interleaved fragments (for example <scr<x>ipt> or <scr{{y}}ipt>) could have
  its inner part removed and the two surviving outer fragments SPLICED together into a fresh
  <script> token that the single pass no longer re-examined (CodeQL: "this string may still
  contain <script").

  • Fixed by applying the removals REPEATEDLY until the string stops changing (a fixpoint
    loop). Each pass only ever deletes text, so the string strictly shrinks and the loop always
    terminates; any dangerous token an earlier removal reveals is then removed too. Blaze {{ }}
    already HTML-escapes every rendered filename, so this is defence-in-depth on the displayed
    text rather than a live XSS, but the incomplete single-pass strip was genuinely wrong.
  • Thanks to GitHub CodeQL (code scanning alert #425) and xet7 (fix).

• IdentityBleed: identity string replacement
  (a no-op replace) (GitHub CodeQL code scanning alert #424, rule js/identity-replacement,
  CWE-116 Improper Encoding or Escaping of Output; tests/securityLog.test.cjs). A test built a
  menu-id regex with id.replace('report-', 'report-') — replacing a substring with itself, a
  no-op that CodeQL flags because it is almost always a mistake for a real transformation.

  • Fixed by dropping the dead replace and matching 'js-' + id directly. Test-only code
    with no runtime exposure, but the no-op was removed for correctness.
  • Thanks to GitHub CodeQL (code scanning alert #424) and xet7 (fix).

This release also resolves the following GitHub Dependabot alerts in the rspack build-toolchain
dev dependencies, without touching the rspack major version so builds are unaffected (both
packages enter only via @rspack/dev-server — the rspack serve dev server — and are not used by
meteor build):

• webpack-dev-server 5.2.5 → 5.2.6 (npm overrides): fixes
  CVE-2026-14631 (DoS via a malformed
  Host/Origin header, alert #113) and
  CVE-2026-14620 (CSRF via the internal
  /webpack-dev-server/open-editor and /invalidate endpoints, alert #114). Patch release in the
  same major line.
• http-proxy-middleware 2.0.9 → 2.0.10 (npm overrides): fixes
  CVE-2026-55602 (a host+path router key
  matched by unanchored substring, so a crafted Host header could route to an unintended backend,
  alert #107). Patch release in the same major line.
• The lock resolves with only those two entries changed; @rspack/cli and @rspack/core stay at
  1.7.11. elliptic (alert #55, CVE-2025-14505) is left pinned because no fixed version is
  published upstream (latest is still 6.6.1, dev-only, Low). The @rspack/cli 1→2 (PR #6497) and
  @babel/parser 7→8 (PR #6484, a runtime dependency) major bumps are deferred pending build/
  runtime testing.
• Thanks to GitHub Dependabot and xet7.

This release also fixes the following bug:

• Case-insensitive # label autocomplete in the card title
  (#5116). Typing #test in the add-card /
  edit-card-title field did not suggest a label named Testing — the label search matched with a
  case-sensitive label.name.indexOf(term), so only #Test matched. The match now lowercases both
  the typed term and the label name/color (matching the @ member autocomplete), extracted into a
  pure, unit-tested models/lib/labelAutocomplete.js. Thanks to rjl9 and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.