v10.34 2026-07-24 WeKan ® release

This release adds the following new features:

• Admin Panel → Problems → Summary now has a Repair button for "Broken cards N". The page
  reported the count and told the admin to "run the repair migration", but there was no
  button anywhere to run one — and no repair in the app could actually clear that count.
  countBrokenCards() counts every card missing a boardId OR a swimlaneId OR a
  listId, while repairAllBoards() walks only NON-ARCHIVED boards and only ever sets
  swimlaneId, so three kinds of counted card could never be repaired by anything: cards
  on an archived board, cards with a missing listId, and cards with no boardId at all.
  The new admin-only repairBrokenCards method runs the standard per-board pass and then
  closes those gaps, assigning the affected cards to their board's first usable
  list/swimlane (creating a default one when the board has none) and resolving each board's
  defaults once rather than once per card. Cards with no boardId cannot be placed on any
  board — guessing would drop a user's card onto an unrelated board — so they are reported
  as unfixable and left alone, never deleted, instead of leaving a count that never reaches
  zero unexplained. What counts as broken now lives in ONE pure module used by both the
  count and the repair, so they can no longer drift apart, with unit and negative tests for
  the rule.
  Thanks to xet7.

• Admin Panel → Problems → CPU usage now shows the CURRENT CPU usage between the page
  title and the Search box. The page listed only PAST high-CPU periods, so it could not
  answer "what is the CPU doing right now?" — the one question an admin opens it to ask.
  The new line shows the system CPU percentage, core count, 1/5/15 minute load average and
  the coarse "what WeKan is doing" label, refreshed every 5 seconds and outlined in red
  while the monitor considers the CPU sustainedly high. It reads the same sample the
  monitor writes its event rows from, so the header and the rows below it can never
  disagree, and with the background monitor disabled (WEKAN_CPU_MONITOR=false) it
  measures between calls using a separate baseline instead of always reading
  0%.
  Thanks to xet7.

and fixes the following bugs:

• Admin Panel → Problems no longer shows a finished board-repair as still running,
  nor counts informational CPU rows as "new problems". On an idle server with far
  fewer than 146 boards the Status page showed "Board data-repair — 146/146 boards"
  running forever (with a matching "Migration or repair" login warning), and the CPU
  area showed dozens of "new problems". The repair actually finishes and writes
  running:false, but the startup pass ALSO fired a non-awaited running:true
  progress write at the last board (boardsDone === boardsTotal); being
  fire-and-forget it could land after the awaited completion write and pin the doc at
  "running, 146/146" — and a process killed mid-repair leaves running:true too. The
  startup pass now persists only intermediate progress (the completion write owns the
  final state), and the Status page asks a pure isStatusActive() instead of reading
  the raw flag: a migration/repair counts as in progress only while it is running AND
  not in a terminal phase AND not already finished by count (done >= total) AND
  updated recently (a running flag with no recent progress write is a crashed run), so
  a doc already stuck on an instance heals itself and the "Migration or repair" warning
  clears with it. The CPU "new problems" count excluded nothing: the monitor writes one
  detected row when a high-CPU period starts and several severity:'info' rows
  (remediated when it ends, mitigation and FerretDB-governor rows), so each brief,
  already-over spike looked like several problems; the count now excludes
  severity:'info' rows — notices that a problem was handled or cleared are not
  problems — while rows with no severity still count, so nothing unclassified is
  dropped.
  Thanks to Alishara and xet7.

• "Map to existing user" for an imported (virtual) member now searches every user
  instead of listing only board members. After importing a Trello board and choosing to
  map users later, the picker offered nothing but the admin: it listed only the ACTIVE
  REAL MEMBERS of the board, and right after an import the real people have no membership
  at all — the placeholders do — so on a board whose only real member is the importing
  admin there was literally nobody to pick, and no search box either. The picker now has a
  search box that goes through the same permission-checked searchUsers method the normal
  add-member typeahead uses, so the same board-membership check and the same #6116
  same-org/team restriction apply; with the box empty it still lists the board's real
  members (which changes no roles at all), and typing searches every real user and labels
  the ones who are not on this board yet. Mapping onto a user who is not a board member
  adds them with the PLACEHOLDER's own role — the role the import recorded for that
  person, never a higher one — and only after passing exactly the checks inviting them
  would: the Admin Panel "roles allowed to invite" setting, the same-org/team restriction,
  and the refusal to add a deactivated account. This also fixes sanitizeUserForSearch
  dropping profile from every search result — it read the Mongo-style paths in its
  allowlist (profile.fullname) as FLAT keys, so both this picker and the add-member
  typeahead showed a blank name with only the username in
  brackets.
  Thanks to AmigaAbattoir and xet7.

• Admin Panel report styles were never loaded, so every report's prev/next pagination
  button rendered with a black background. client/components/settings/adminReports.css
  was not imported anywhere, and package.json sets meteor.mainModule, which disables
  Meteor's eager loading — a CSS file that nothing imports is simply not in the bundle. The
  buttons fell through to the global button { background: var(--theme-accent, #000) } in
  forms.css, which is BLACK when no custom theme colour is set. All prev/next controls in
  WeKan (admin reports, People/Org/Team/Domain, All Boards, board Table view, cron tables)
  now share one themed stylesheet that also covers :focus and :active — forms.css
  styles those at a specificity equal to or higher than a plain .some-pagination button
  rule, so even a loaded stylesheet lost as soon as the button was clicked and pressing
  "next" left it dark grey until it lost focus. Disabled is now the same themed outline
  faded rather than a grey block, and the "3 / 42" page info inherits the surrounding text
  colour instead of a hard-coded #333 that vanishes on dark
  backgrounds.
  Thanks to xet7.

• Admin Panel → Problems → Cards report loads and pages faster. The report already
  paginated server-side (25 rows per page via limit/skip), so it never loaded all cards
  into the browser, but the cardsReport publication sent WHOLE card documents —
  description, customFields, vote/poker sub-documents, every date field — when the table
  renders only six columns, so a 25-row page could be hundreds of kilobytes on boards with
  long descriptions; it now projects only the six columns shown. And every prev/next click
  re-ran the report's count method as well as re-subscribing, paying for a full collection
  count plus a second server round trip even though the total cannot change just because
  you moved to the next page; opening a report and searching in it now recount, plain
  paging does not. Both changes also apply to the files, rules, boards, impersonation and
  recovery reports, which share the same loader.
  Thanks to xet7.

• Six Meteor methods threw Did not check() all arguments during call to '<method>',
  because this app runs with the audit-argument-checks package: a method that RECEIVES
  an argument it never check()s fails the call outright. problemDetailReport(area) had
  the defect but nothing had ever passed it an argument, so it surfaced only when the new
  Admin Panel → Problems → CPU usage header started polling problemDetailReport('cpu')
  every 5 seconds and filled the server log with the exception. Auditing every server
  method for the same defect found five more that ARE called with arguments from the
  client, so those features were failing outright: unlockUser (Admin Panel → People,
  unlocking a locked-out user), runBackup, restoreBackup and saveBackupSchedule
  (Admin Panel → Attachments) and migrateTextDatabase (the MongoDB ↔ FerretDB text
  migration), plus getServiceConfiguration, which has no current client caller. Each now
  checks its arguments against the types its call sites actually pass
  .
  Thanks to xet7.

• Every bundled binary now runs through cpu-exec on Sandstorm and in the snap, so a CPU
  missing an instruction-set feature falls back to qemu-user instead of killing the app
  with SIGILL. cpu-exec (#6458) exists for exactly that — AVX masked by a hypervisor
  (QEMU/KVM/Proxmox), an old CPU, ARMv8.0 on a Raspberry Pi — and with no features
  declared it is a plain exec, which is why the design is to route everything through it.
  Sandstorm SHIPPED cpu-exec and qemu-x86_64 but its grain launcher spawned all eight
  bundled binaries directly (ferretdb, mongod 3.0 twice, niscud, the legacy mongo CLI
  twice, and node for the bridge and the importer), so the safety net sat in the package
  unreachable — on the platform with the least control over its hardware, since a grain
  runs on whatever CPU the host has. The snap routed mongod but not FerretDB
  (ferretdb-control, both the external-DB and SQLite launches) and not node
  (wekan-control, the main application start and both maintenance-page starts). Both are
  routed now, each with a direct-exec fallback so an older deps image or snap revision
  still works; on Sandstorm the guard also requires /bin/bash, since cpu-exec is a bash
  script, and the snap's main start keeps its ulimit -s 65500. Docker and the bundle
  launcher already routed their binaries and were rechecked for other unrouted launches.
  The wiring guard previously asserted only that the Sandstorm build SHIPS cpu-exec —
  exactly how the gap survived — and now asserts that each launcher actually uses
  it.
  Thanks to xet7.

• rebuild-wekan.sh now raises the inotify watch limit when it is too low, and
  .meteorignore stops Meteor watching .tools/ and FerretDB/. Meteor's file watcher
  takes ONE inotify watch per DIRECTORY, and fs.inotify.max_user_watches is per USER,
  shared with every other watcher — an editor is usually the other big consumer. When it
  runs out, Meteor fails with a message that blames the disk and sends people looking in
  the wrong place: inotify_add_watch on '<path>' failed: No space left on device. ENOSPC
  from inotify_add_watch means the WATCH LIMIT is exhausted, not that the disk is full.
  Two non-app trees were 72% of this repo's 41,040 watched directories — .tools/ (20,535
  dirs, 4.1 GB: a full Node install with headers for every openssl arch, a Go toolchain
  with its caches, build logs) and FerretDB/ (9,148 dirs, 3.4 GB: the Go fork checkout).
  Both were already in .gitignore, but the watcher only honours .meteorignore, so
  Meteor kept walking them; excluding them takes the count to 11,213. And
  rebuild-wekan.sh now checks the limit on every run and raises it to 524288 (plus
  max_user_instances to 1024) with sysctl, persisting it to
  /etc/sysctl.d/60-wekan-inotify.conf. It never aborts a build: it is a silent no-op
  when the limit is already high, uses sudo only when it can, prints the exact commands to
  run by hand when it cannot, honours WEKAN_INOTIFY_WATCHES=0 to skip, and returns
  immediately on macOS/BSD, which have no
  inotify.
  Thanks to xet7.

• Drag handles: the "Show desktop drag handles" toggle now works on touch screens, the card
  body pans the board when handles are on, the handle is finger-sized on touch, and tab
  order no longer jumps to invisible controls. The rule was
  isTouchScreen() || preference, so on a touch screen the OR was already true and the
  toggle could never hide the handles — and every handle in the app plus every sortable
  handle selector goes through that one helper. The setting is now three states (on, off,
  never-chosen): an explicit choice always wins, including OFF on touch, and only
  never-chosen lets the device decide, where a touch screen still gets handles by default.
  Handles also decide what a DRAG MEANS, and that half was broken too: .minicard and
  .list-header carried nodragscroll unconditionally, so with handles ON a finger
  dragging across a card neither moved the card (only the handle does) nor panned the board
  — it did nothing; they now opt out only when handles are OFF, i.e. only when the element
  IS the drag source. The handle itself was a 20–28px icon in the bottom-right corner, a
  mouse-sized target that is close to unusable on a wall-mounted infoscreen; on a coarse
  pointer it becomes a 48px full-height strip down the leading edge with the card content
  padded to match, while a mouse keeps the compact corner handle. And the keyboard
  card/list move buttons are focusable but opacity: 0 at the START of the card content,
  so tabbing went card → invisible → invisible → next card; they are now revealed while
  focused.
  Thanks to xet7.

• The quick-access top bar now fits on ONE row on phones. On an iPhone 12 mini (375px) it
  wrapped to two rows — home + logo + mobile/desktop toggle on the first, drag-handle
  toggle + zoom + notifications + user menu on the second. The mobile CSS chose that
  deliberately (a nowrap row overflowed and was clipped), but that treated the symptom: the
  row did not fit because the home link kept its full "All Boards" label — the widest item
  in the bar, and longer still in most languages — the logo was allowed 120px of a 375px
  bar, TWO items had margin-inline-start: auto (an auto margin absorbs all remaining
  space on its line, so the first one filled row 1 and pushed the rest onto row 2), and
  items carried 8px gaps plus 0.5rem margins on both sides on the iPhone path. The row now
  fits: icon-only home link, an 84×20 logo cap, exactly one auto margin, 6px gaps and 3px
  margins — 342px of 375px by the declared sizes. The home label is a bare text node so it
  cannot be selected directly; font-size: 0 on the link collapses it and the icon's own
  size brings the icon back, with the text still in the DOM for screen readers. Both the
  @media path and the .iphone-device path (added by boardBody.js, so present on a board
  page and absent on All Boards) were changed together, or the bar would have changed
  height when navigating between those two
  screens. The "All Boards" label is also
  hidden whenever mobile MODE is on, which is a different thing from a narrow viewport:
  body.mobile-mode comes from the phone/desktop toggle in that same bar, is a deliberate
  user choice and applies at any width, so on a wide screen in mobile mode the label was
  still showing](https://github.com/wekan/wekan/commit/b9f178ef5). Hiding the label needed
  !important and the last word in the file: ELEVEN rules in header.css set a font-size
  on that same link, most of them !important, including three scoped to the All Boards
  page itself (body:not(.board-view) / .wrapper ~) and one setting 16px !important
  — so the first attempt lost to all of them and the label kept showing on exactly the page
  it was reported on. The notification bell also sat in 36px of margin around a 28px icon
  (10px each side of the button plus 0.5rem each side of its wrapper); both layers now give
  2px a side, taking the measured one-row budget from 342px to 320px of
  375px](https://github.com/wekan/wekan/commit/76516a1a2). Finally, the avatar still
  dropped to a second line with space left beside the bell, because a width-based rule
  forced flex-wrap: wrap !important on that bar — added deliberately, "so ~7 items fit in
  two wrapped rows". An !important wrap beats any nowrap, so none of the one-row work
  took effect at small width, and a wrapping flex row breaks BEFORE the last item rather
  than shrinking anything. All eight flex-wrap rules on the bar are now nowrap, and the
  username/full name beside the avatar is hidden at small width too (the template hides it
  unless isMiniScreen, but that also weighs mobile mode and the device, so it can be true
  while the bar is narrow, and a full name is easily 100px+ of a 375px bar). Measured
  budget: 328px of 375px](https://github.com/wekan/wekan/commit/fff495127).
  Thanks to xet7.

• Board tiles and the "+ Add Board" / "+ Add Template Container" tile are now the same,
  shorter height on mobile. A board tile was 8rem (128px) on a phone while the add tile had
  no mobile height at all — it fell back to the desktop min-height: 72px plus 42px of
  padding and then grew further around its wrapped label — so the two were never the same
  height and both wasted vertical space. Both are now a flat 4rem (64px) with
  box-sizing: border-box, so the number is the rendered height rather than a floor that
  padding is added to, and the board tile's 24px/18px vertical padding (what made it tall)
  is cut to 6px. One rule covers every All Boards tab — Starred, Templates, Remaining and
  Workspaces all render the same .board-list
  tiles. Only the add tile actually shrank
  at first, leaving a board icon towering over "+ Add Board" on the Remaining tab: two
  selectors set that height and they are not equally specific —
  .board-list.mobile-view .board-list-item (0,3,0) beat .board-list .board-list-item
  (0,2,0), while the add tile escaped because its own selector is also (0,3,0) and came
  later. Both .mobile-view shapes are now spelled out, and because that 8rem rule sits
  outside any media query — .mobile-view comes from Utils.isMiniScreen(), which weighs
  mobile mode and the device as well as width — the override is repeated outside the media
  query too](https://github.com/wekan/wekan/commit/000a29129). The tiles STILL differed for
  a reason unrelated to either height: the mobile board list is a grid with a fixed height
  and no align-content, so it defaulted to stretch and its single row filled the whole
  column — "+ Add Board" showed a 4rem grey label at the top of a stretched cell, while a
  board's li carries the board colour itself and painted the entire cell. align-content: start plus align-items: start keeps rows at their content height, and the list still
  scrolls because that comes from the fixed height plus overflow-y: auto. The two mobile
  columns are also rebalanced from minmax(84px, 30%) to minmax(140px, 42%): at 30% of a
  375px phone the left menu was ~112px so "Workspaces" and the counts wrapped, while the
  board column had more width than two 4rem tiles need — it is now ~158px of menu and
  ~209px of boards, still fitting two ~96px tiles side by
  side](https://github.com/wekan/wekan/commit/534b80f92).
  Thanks to xet7.

• All Boards on a phone now matches what a wide screen already does: board titles read
  left to right instead of breaking one letter per line, "+ Add Board" spans both columns,
  the folder name and the search box share one row, and the search placeholder is gone. The
  titles broke because space for the single ~26px absolutely-positioned drag handle was
  reserved THREE times on the way down — 32px on the li, 30px in the tile padding and
  30px again on .details — which on a ~96px tile left about nothing for text; it is now
  reserved once, on the innermost container, leaving ~52px. The header wrapped because the
  search box would not shrink (a flex item's default min-width: auto refuses to go below
  its content width), so min-width: 0 plus flex: 1 1 auto lets it take what is left
  beside the title. The "Search boards" placeholder filled the whole box on a phone and is
  replaced by an aria-label, which is what a placeholder should never have been standing
  in for. "+ Add Board" and a board tile
  are then made identical in size: the add tile is one grid cell again rather than spanning
  both columns, and — since .js-add-board carries margin: 8px !important while
  .js-board carries margin: 8px — both are zeroed at small width rather than only one,
  which would have made the add tile the odd one out instead. The grid's own 8px gap
  already separates the cells, so every tile is one 96×64px cell at 375px, add and board
  alike](https://github.com/wekan/wekan/commit/8fd2982ec). The menu title also goes ABOVE
  the search box on a phone rather than beside it: squeezed onto one row, "Remaining" was
  ellipsised to "R.." and the search still had barely any width. They stack again, but
  without the tall empty band that made stacking look wrong before — each part takes
  exactly one full-width row with a fixed 6px row-gap, so the search sits directly under
  the title](https://github.com/wekan/wekan/commit/9d0908e4b).
  Thanks to xet7.

• "Show desktop drag handles" now works on the All Boards page too. It governed swimlanes,
  lists and cards on a board, but board TILES always showed their handle and were always
  draggable from anywhere, so turning handles off did nothing there. The handle markup is
  now behind the same helper in both places it appears, and — the half that matters — so is
  the drag source: with handles ON the handle is the only place a board drag may start, so
  a finger dragging across the rest of the tile scrolls the list instead of picking the
  board up, the same contract cards and lists follow. Boards use HTML5 drag-and-drop rather
  than jQuery sortable, so this could not be done by swapping a handle option: the li
  keeps draggable="true" (a drag can only start from a draggable element, and moving the
  attribute onto the handle would drag the handle rather than the board) and dragstart
  cancels the drag unless it began inside .board-handle. With no handle rendered, the
  title reclaims the 28px reserved for
  it.
  Thanks to xet7.

• Adding a workspace now shows a real input field. The "+" beside Workspaces called
  window.prompt(), which a browser is free to refuse — iOS Safari offers "don't allow
  further prompts" for a page and then suppresses every later one, so the button did
  nothing at all and no input field ever appeared. It now opens a normal WeKan popup with a
  text input and a submit button, the same pattern every other create flow uses; submitting
  it empty keeps the popup open and refocuses the field rather than closing silently, which
  is what a cancelled prompt looked like. This was the only window.prompt() left in the
  client.
  Thanks to xet7.

• Admin Panel tables fit the screen and wrap their text on a phone. Admin Panel / Version
  needed a horizontal scroll to read a value that easily fits on screen — "WeKan Version"
  at the left edge and its version number about a thousand pixels away — because every
  admin table is forced to min-width: 1200px !important with white-space: nowrap cells,
  to guarantee a scrollbar for the wide data tables. Reasonable for those, but a two-column
  table is pushed to 1200px for nothing and nowrap cells can never use a second line. At
  small width the table is now at most as wide as the screen and cells may use as many
  lines as they need, with long unbroken values (version strings, paths, URLs) breaking
  rather than pushing it wide again; the label column keeps a 45% share so it does not
  collapse beside a long value. Horizontal scrolling still works where a table genuinely
  cannot fit.
  Thanks to xet7.

• Search All Boards on a phone now fits the width, scrolls down, and drags with a finger.
  Label Colors ran off the right edge because .global-search-page is
  width: 40%; min-width: 400px — sized for a desktop column — so on a 375px phone the
  block was already wider than the screen and the palette's flex-wrap: wrap had nothing
  to wrap into. The page could not be scrolled down AT ALL because .wrapper, the GLOBAL
  layout element, is given height: 100vh; overflow: hidden by the All Boards stylesheet at
  this width: fine for the boards page, which has its own scroll container, but it applies
  to every page and this one had none, so everything below the fold was unreachable. And
  dragscroll did nothing because dragscrollTouch.js scrolls the nearest .dragscroll
  ancestor that can actually scroll, and no element here carried the class. The help panel
  and the results list are now width-constrained, bounded scroll containers carrying
  .dragscroll; the query form shares the class but is a short fixed header, so it is
  explicitly excluded from becoming a scroll box of its
  own. Giving each panel its own scroll
  box turned out not to work — the panels start BELOW the search form, so their bottoms and
  their scrollbars ended up past the bottom of the clipped wrapper, leaving text cut
  mid-character after "Notes" on iPhone and the list ending at "Differing operators … red
  label." on Fairphone 4. The page now has exactly ONE scroll container: its wrapper is
  tagged global-search-wrapper and is height: auto; min-height: 100vh; overflow-y: auto
  at phone widths, with the panels back to plain content. .dragscroll moved to that
  wrapper and was REMOVED from the panels, which is required rather than tidying —
  dragscrollTouch.js takes the nearest .dragscroll ancestor and gives up if it cannot
  scroll, so leaving the class on a now-static panel would have disabled finger dragging on
  the whole page](https://github.com/wekan/wekan/commit/be07356cc). That single-inner-scroller
  still fought the ancestor: the wrapper box (min-height: 100vh) is taller than its parent
  #content, which is itself a scroller in mobile mode, so both scrolled — on iOS Safari
  the page rubber-banded back to "Differing operators" at the bottom, while Fairphone
  Firefox merely reached the end. The clip is now released WITHOUT adding any scroller
  (.wrapper for this page is height: auto; overflow: visible), leaving #content — the
  page's existing scroller, and what a finger scrolls natively on touch — as the single
  scroller, which cannot fight itself. The .dragscroll class is dropped from the wrapper
  since native scrolling now handles it. A last touch clears iOS Safari's bottom toolbar,
  which was still covering the final line: the scroller #content is calc(100vh - 48px)
  and on iOS 100vh is the large viewport (toolbar hidden), so its bottom edge sits behind
  the toolbar — the wrapper now has calc(120px + env(safe-area-inset-bottom, 0px)) of
  trailing space so the last line scrolls clear of
  it. The bottom stayed unreachable through several attempts because the cause was
  #content, not the wrapper: #content is a flex child, and a flex child defaults to
  min-height: auto — it grows to fit its content and never scrolls, so anything past the
  fold overflowed out of reach. On this page (min-height: 0 on #content, scoped with
  body:has(.wrapper.global-search-wrapper) so no other page is affected) it becomes a
  real scroller, inside a 100dvh body so the bottom tracks Safari's toolbar instead of
  hiding behind the large-viewport 100vh, with overscroll-behavior: contain to stop the
  landscape pull-to-refresh. A finger drag over the grey content area still did nothing
  while the header bars scrolled — because the header sits outside #content, that proved
  the body is the real scroller and #content's own overflow-y: auto was trapping the
  touch; #content is now a pass-through (overflow: visible; flex: 0 0 auto) so the body
  is the single scroller, draggable by a finger
  anywhere](https://github.com/wekan/wekan/commit/762547b92).
  Thanks to xet7.

• All Boards in iPhone landscape: the left menu no longer balloons and the folder header no
  longer collides. Landscape is ~844px CSS-wide — above the 800px breakpoint but still an
  iPhone, so the device-width media query applies while the max-width: 800px rules do not.
  That split made the left menu 42% of 844px (~354px), flinging each count chip ~250px
  from its label, and left the folder header ("Remaining" + multi-selection buttons +
  search) on a single row where the buttons overlapped the title. The menu is now
  minmax(140px, min(42%, 210px)) (portrait unchanged at 158px, landscape capped at 210px)
  with the count packed next to its label, and the header's stacking media query carries the
  same device-width branch as the grid so it stacks in landscape
  too.
  Thanks to xet7.

• Board tiles no longer merge on a laptop. The phone equal-tile work had six rule groups
  whose selector lists carried a bare .board-list ... variant next to the intended
  .board-list.mobile-view ... one, so they also hit the desktop float layout where
  .mobile-view is absent — margin: 0 !important on .board-list li.js-board killed the
  8px gap that .board-list li { width: 20%; margin: 8px } relies on, so adjacent coloured
  tiles touched and read as one block. All six are now .mobile-view-only, restoring the
  desktop layout while leaving the phone layout
  unchanged.
  Thanks to xet7.

• The top-bar zoom %, notification bell and user/avatar menu now stay at the END of the
  quick-access bar — the right edge in LTR, the left edge in RTL. They are the last items
  in the bar and the middle starred-boards list normally pushes them there with flex: 1,
  but that list is display: none on a phone, so with nothing filling the middle the group
  bunched at the start with empty bar beside it. A single margin-inline-start: auto
  (logical, so it flips for RTL automatically) on the first item of the group pushes the
  whole group to the end, with the row's other auto margin cleared so they do not split
  apart.
  Thanks to xet7.

• Board tiles on All Boards are now a responsive grid, so widening the window adds more
  boards per row instead of stretching the tiles. Both layouts were fixed-column — desktop
  float: width 20% (5, wrapping to 4) and the mobile grid repeat(2, 1fr) (always 2) — so
  more width just made the tiles wider. They are now
  repeat(auto-fill, minmax(…, 1fr)): desktop minmax(200px, 1fr) (~3 columns at 1000px up
  to ~11 at 2500px) and mobile-view minmax(min(46%, 200px), 1fr) (keeps ~2 columns on a
  narrow phone but scales up on a wider one), with the 8px grid gap replacing the per-tile
  margins. Phones still pin two columns via the small-width media
  queries.
  Thanks to xet7.

• All Boards drag-and-drop and touch targets. A mouse drag can reorder boards again: the
  board list <ul> is a .dragscroll element so the mouse dragscroll library was panning
  it instead of starting the tile's HTML5 drag, and a.js-open-board being a link meant
  grabbing the title dragged the URL — the tile is now .nodragscroll and the link
  draggable="false". With drag handles ON, dragging the handle did nothing because the
  gate checked dragstart.target, which in Chrome/Firefox is the whole draggable li, not
  the handle; the press location is now recorded on mousedown and read in dragstart.
  And "+ Add workspace" is now a 44px touch target instead of a ~20px "+" a finger kept
  missing. Reordering by FINGER did not work yet at this point — board reorder uses HTML5
  drag-and-drop, which browsers do not fire from touch; that is fixed by the touch
  drag-and-drop bridge in a later entry below (a separate, tested change, without discarding
  any of the mouse fixes here).
  Thanks to xet7.

• All Boards drag-reorder now persists and can move a board to the end, and the header is
  decluttered. Dropping one board onto another threw INVALID [400] because
  profile.boardSortIndex (written on reorder) had no schema entry while the user
  profile enumerates its subfields — a schema field is added. Dropping on a board can
  only place it BEFORE that board, so a dashed "drop here to move to the end" placeholder
  follows the drag: while a board is dragged, an empty gap opens up before or after the tile
  under the cursor — anywhere in the current view (Starred / Templates / Remaining / a
  workspace), the end included — showing where it will land, backed by a pure
  computeReorderedIds(..., after) that inserts on either side and no-ops a drop into the
  board's own slot; the drop reads the gap's real DOM position (so releasing OVER the gap
  works — the placeholder is not a board tile, which had made the board snap back to its
  original position). Hovering anywhere on a board icon opens the gap at THAT icon's slot
  (drop to take its place), rather than needing to aim the icon's left half; only the last
  icon's trailing half inserts after, to keep the end reachable. The dragged icon is taken
  out of the grid flow while dragging (the other icons reflow as if it were gone), so the
  gap lands exactly where the icon will go rather than one slot to the left, and the drag
  ghost is centred on the cursor (setDragImage) so the gap opens for the icon the ghost is
  over rather than needing to aim the target's left edge. And the
  current folder's NAME beside its icon in the header ("Starred"/"Remaining"/a workspace
  name) is hidden — redundant with the icon, the highlighted menu row and the "My Boards"
  title, and it crowded the Multi-Selection / Sort / search controls — kept for screen
  readers only. The section icon left of the Multi-Selection button is now the same Font
  Awesome glyph and colour as the matching left-menu item (fa-star / fa-clipboard /
  fa-folder / fa-folder-open, #4d4d4d) instead of a Unicode
  emoji.
  Thanks to xet7.

• Board icons can now be reordered by FINGER, not just with a mouse — and the same fix
  makes every other HTML5 drag-and-drop in WeKan work from touch. HTML5 drag-and-drop
  (draggable="true" + dragstart/dragover/drop) is never fired from touch by any browser,
  so on a touchscreen the board-icon reorder above, the workspace drag-to-share and the
  card/rule drags could only be driven with a mouse. Rather than rewrite reorder onto
  jQuery-UI-sortable (which would have discarded every mouse fix in the two entries above), a
  small bridge, client/lib/dragDropTouch.js, makes a finger drive the SAME handlers: a
  long press (250 ms) on a draggable element starts a synthetic drag that dispatches real,
  bubbling dragstart/dragenter/dragover/dragleave/drop/dragend events with a dataTransfer
  shim, so the delegated handlers run unchanged. It is deliberately safe beside the existing
  touch scrolling — a quick swipe on a draggable tile still scrolls, and it only calls
  preventDefault once a drag is actually under way; it fires a mousedown on the pressed
  element first so the reorder's handle gate (which records the press location) works from
  touch too; it honours setDragImage so the ghost is centred on the finger as it is on the
  cursor; and it leaves form fields and jQuery-UI sortables (lists / swimlanes / cards,
  already covered by touch-punch) alone. Loaded globally, with source-guard tests pinning the
  scroll-coexistence and handle-gate properties.
  Thanks to xet7.

• All Boards header on a phone: the section icon and the Multi-Selection / Sort buttons now
  share ONE row with the Search box on its own row below, instead of the section icon
  sitting alone on a wasted first line; the blue Sort button always shows a sort icon (the
  plain fa-sort glyph, as a direct i.fa child like the Multi-Selection button beside it,
  rather than the wrapped fa-sort-alpha-asc that showed as a blank blue square); and on the
  narrow left menu each workspace NAME keeps a small floor of width so at least the first few
  characters stay visible (with the trailing menu button and count shrinking first), so a
  workspace can be told apart while it is dragged — an unnamed workspace still shows just its
  icon.
  Thanks to xet7.

and removes the following dead code:

• Removed the cron migration subsystem: it never ran and had no UI, yet every logged-in
  client paid for it. initializeCronJobs() was NEVER called, so its SyncedCron.add()
  registrations and the 5-second job-queue processor never started; the board-migration
  detector sat behind a commented-out startup hook noting "Automatic migration detector
  is disabled — migrations only run when opening boards"; and the Admin Panel had no Cron
  page at all — no route, no menu button, no template ever included, and every helper and
  event for it commented out. Despite that, imports/cronMigrationClient.js WAS imported
  by client/imports.js, so every client subscribed to three publications and polled
  cron.getMigrationProgress every 10 seconds forever for a feature with no user
  interface. Migrations already run and are already reported through the paths that work:
  Admin Panel → Attachments and the on-board-open repair, both driven by the shared
  migrationProgress overlay mounted app-wide, plus the in-progress list on Admin Panel →
  Problems → Summary. Removed the templates and styles, the client module, the
  cronJobStatus model, the cron migration manager (28 admin-gated cron.* methods no UI
  called), the job storage, the board-migration detector and the three publications that
  fed only the deleted client module. server/cron/syncedCron.js is KEPT — it is
  SyncedCron itself, used by the backup schedule and scheduled rules. The Problems
  in-progress list no longer reads cronJobStatus, because a leftover status:'running'
  doc from an older version would now have nothing to clear it and would report a
  migration running forever.
  Thanks to xet7.

and has the following developer-tooling changes:

• rebuild-wekan.sh Dev server menu can now run on a custom port with a custom ROOT_URL
  host. It could only offer localhost:3000, the current IP, or a custom IP:PORT, so running
  on a different local port with a different ROOT_URL host meant editing the script.
  ROOT_URL is not cosmetic — Meteor builds absolute URLs from it (e-mail links, OAuth
  redirects, attachment URLs) — so a subdomain setup has to be told about it. The host
  answer takes either form: a bare label becomes <label>.localhost (browsers and
  systemd-resolved resolve *.localhost to 127.0.0.1 with no /etc/hosts entry), and
  anything containing a dot is used as-is with a note that it must resolve locally. A
  a bad port falls back to 3000, the chosen port is freed first like the other dev options,
  and WEKAN_DEV_PORT / WEKAN_DEV_ROOT_URL skip the prompts so it can be scripted. The
  listen port and ROOT_URL are treated as the different things they are: the port is
  appended ONLY when the dev server is browsed directly, so https://wekan.example.com
  stays exactly that instead of becoming http://wekan.example.com:4000 — behind a Caddy
  proxy the public URL has no port, is https, and nothing listens on that host:port at
  all.
  Thanks to xet7.

• releases/release-all.sh now repoints stale CHANGELOG commit links before releasing.
  Every bullet links the commit it describes, and those links are written BEFORE the
  release, so anything that rewrites history in between — a rebase onto an upstream
  change, an amend, a squash — changes the hashes and every link in the not-yet-released
  section 404s once pushed (which is exactly what happened to all eight links of this
  section). As its first local step, before the Upcoming heading is renamed and before the
  release commit is made, the script now leaves alone any hash that is still an ancestor of
  HEAD, and resolves a stale one by reading the OLD commit's subject (the pre-rewrite
  object is still in the clone) and finding the commit on this branch with exactly that
  subject — the rewritten copy of the same commit. The substitution is bounded to the
  section being released, so the same hash quoted in an older, already-pushed entry is
  never touched; it works whether or not the heading has already been renamed; and
  anything it cannot resolve is reported as a WARNING and left as-is, because a broken doc
  link is never a reason to abort a
  release.
  Thanks to xet7.

• Added docs/Security/gh/pull-security-reports.sh, which downloads every security and
  code-quality report GitHub exposes for a repo — open AND closed — into a timestamped run
  directory with one subdirectory per category of the GitHub Security tab
  (CodeQuality/StandardFindings, CodeQuality/AIFindings, CodeScanning,
  Dependabot/Vulnerabilities, Dependabot/Malware, SecretScanning, Advisories,
  DependencyGraph), each split into open/ and closed/, as raw JSON plus readable
  per-rule / per-file / per-severity text summaries. Each category is fetched ONCE with no
  state filter and split locally, so open + closed are a partition of one snapshot rather
  than two requests taken at different moments, and a failing endpoint is recorded and
  skipped instead of aborting the run. The live credential the secret-scanning API returns
  is deleted before anything is written, and the reports directory is gitignored because
  these files describe unfixed vulnerabilities. Needed because the VSCode Flatpak sandbox
  has neither gh nor network access to
  api.github.com.
  Thanks to xet7.

• Five mocha suites that sat in the tree looking like they ran, but were not, are now
  actually run, and a guard keeps it that way. meteor.testModule points at the two
  lib/tests/index.js files, which list their suites with explicit imports, and five suites
  were never added to those lists (server/lib/tests had 49 suite files but 48 imports).
  Two are *bleed security regression suites — checklistbleed (cross-board checklist /
  checklist-item move denial) and proxybleed (header-login trusted-source and request-IP
  handling) — exactly the kind of test whose silent absence lets a fixed vulnerability come
  back unnoticed; the other three are filenameTruncation, alwaysShowCodeAsText and
  renderLinksPlainText. All five are now imported (every symbol they use was checked to still
  exist first), and tests/testsAreRegistered.test.cjs now fails if any *.tests.js in
  either directory is not imported by its index — naming the two *bleed suites explicitly so
  a future tidy-up cannot drop them again quietly. This also deletes three files nothing
  loads: client/components/main/responsiveFixes.css (imported by nothing, so never bundled
  — meteor.mainModule disables eager loading) and the empty models/backgrounds.js /
  models/backgrounds.server.js / server/permissions/backgrounds.js tombstones, left over
  from board backgrounds becoming board-level Attachments; the live
  server/boardBackgrounds.js and server/publications/backgrounds.js are different files
  and are untouched.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.