v9.52 2026-06-18 WeKan ® release

This release fixes the following CRITICAL SECURITY ISSUE of InputBleed:

• Fixed InputBleed:
  incomplete multi-character HTML sanitization in card dependency
  import allowed HTML/script element injection](https://github.com/wekan/wekan/blob/main/client/lib/importDependencies.js)
  (CWE-79 Cross-site Scripting, CWE-80 Improper Neutralization of Script-Related HTML
  Tags, CWE-116 Improper Encoding or Escaping of Output; GitHub CodeQL code scanning
  alert #421, rule js/incomplete-multi-character-sanitization, severity High).
  stripHtml() in client/lib/importDependencies.js removed HTML tags with a single
  pass of /<[^>]*>/g. That is an incomplete multi-character sanitization in two ways:
  removing one match can splice surrounding text into a new match (so the replacement
  must be looped to a fixed point), and a dangling, unclosed tag that has no closing
  > (for example a trailing <script or <svg/onload=...) is never matched by the
  regex at all and survives untouched — leaving <script in the output, exactly as the
  scanner warned. A crafted card-dependency ("Red Strings") import file (the
  WeKan/generic JSON or Miro item titles and connector captions that pass through
  stripHtml) could therefore smuggle an HTML/script fragment past the sanitizer.
  Fixed by looping the tag-stripping replacement to a fixed point and then removing any
  remaining stray </> characters, so neither a complete nor a partial tag can
  remain.
  Thanks to GitHub CodeQL, xet7 and Claude.

and fixes the following bugs:

• Card Details popup:
  removed the redundant empty second popup that appeared at
  the top of the page when a card was opened as a popup (for example from the
  Board Table view Edit link or from search results). The card details content is
  always position:fixed, so it renders as its own framed box and escapes the
  generic popup wrapper, leaving that wrapper (with its "Card Details" title
  header, border and background) visible as an empty box. The wrapper is now
  collapsed and made invisible so only the card itself shows. The card's own close
  button now closes the popup (in addition to clicking outside or pressing Escape).
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.