v9.67 2026-06-21 WeKan ® release

This release fixes the following bugs:

• Reworked confusing and unreliable list widths,
  #6409: a list now has one width instead of the old
  "min width / max width / automatic" trio, and it reliably persists across reloads (the render now drives the
  --list-width CSS variable the styles actually use, so a width no longer reverts to auto after reload).
  A new board setting Personal list widths chooses the scope:

  • Off (default) — Shared: the width lives on the list (lists.width), is the same for everyone on the board,
    and only members with write access can change it (read-only/comment-only members no longer see the resize
    handle). Shared widths are included in board export/import (the importer previously dropped lists.width;
    it now preserves width, color and collapsed state, and the board's list-width scope).
  • On — Personal: each user keeps their own widths (profile, or localStorage when not logged in), falling back
    to the shared width then the default. The per-list popup is simplified to a single width value plus an
    Auto list width toggle (fit lists to content); the advanced per-list min/max pixel options were removed.
    Auto-width follows the same Shared/Personal scope (per-board for everyone, or per-user) and is carried through
    export/import. Documented in docs/Features/Lists/Lists.md.

• rebuild-wekan.sh / rebuild-wekan.bat menu option 2 ("Build WeKan") now also clears the rspack dev-build caches
  (_build and node_modules/.cache) in addition to node_modules / .meteor/local / .build, so the next
  meteor run recompiles from scratch instead of occasionally serving stale modules after a git checkout/merge.

• rebuild-wekan.sh / rebuild-wekan.bat now give the Meteor build tool and Node a larger heap by default
  (TOOL_NODE_FLAGS and NODE_OPTIONS = --max-old-space-size=8192) for every dev-run, test and build option, so
  long development sessions and test runs no longer crash with "FATAL ERROR: ... JavaScript heap out of memory".
  Both honor an existing value, so you can lower it on machines with less RAM.

• Fixed editing the 2nd/3rd organization or team in Admin Panel › People always showing the FIRST one,
  #6411: on /people, clicking Edit on any organization or team filled
  the form with the first one's values (so you could never edit the others). The edit/settings popups are opened from
  the row with data context { org } / { team }, but their helpers read this.orgId / this.teamId (undefined
  there) and called getOrg(undefined) / getTeam(undefined), which findOne({}) resolves to the first document.
  The popup helpers, the save handlers and the delete (settings) handlers now resolve the clicked row's id from the
  { org } / { team } context. Verified against a running instance (each org/team now edits its own values).

• Fixed boards not rendering at all (blank board view) after the mongodb/bson 7.3.0 dependency bump. bson 7.x runs
  const { startupSnapshot } = globalThis?.process?.getBuiltinModule('v8') ?? {} at module-load time; the optional
  chaining stops before the call, so in the browser — where a partial process polyfill exists but has no
  getBuiltinModule — it threw TypeError: getBuiltinModule is not a function while evaluating
  client/components/cards/attachments.js (import { ObjectId } from 'bson'). That aborted the client bundle
  bootstrap part-way through client/imports.js, so every feature imported after it (notifications, swimlanes,
  rules, …) was never registered and the board view died with No such template: notifications. Added a tiny browser
  shim (client/lib/bsonBrowserShim.js, imported first in client/main.js) that gives the browser process a no-op
  getBuiltinModule, so bson takes its intended ?? {} fallback. New unit tests
  (client/lib/tests/bsonBrowserShim.tests.js); also hardened the #5686 Playwright spec to run against a rendering
  board. (PR #6410)

• Fixed REST API returning HTTP 500 with a stack trace for an invalid request,
  #5804: posting a comment without the required comment parameter (or
  to a board that does not exist) returned an HTTP 500 error page. The schema-validation error thrown on insert is a
  circular object (SimpleSchemaValidationContext → SimpleSchema → …), and serializing it crashed the response
  writer (Converting circular structure to JSON). Now: the comment parameter is validated and a missing/empty one
  returns HTTP 400; an unknown board returns HTTP 404 (the board-access checks no longer dereference
  board.members of a non-existent board); the JSON response writer is crash-proof (falls back to a safe
  { "error": … } payload instead of throwing); and REST comment errors now use their real status code instead of
  200. New unit tests in server/lib/tests/apiResponseHelpers.tests.js. (PR #6406)

• Fixed selecting text in a checklist closing the card,
  #5686: selecting the text of a checklist item and releasing the
  mouse outside the card detail pane closed the card. The checklist items template stops mousedown propagation
  (for item sorting), so the existing cardDetailsIsDragging guard never engaged and the document-level
  "click outside to close" handler closed the card. The close handler now also keeps the card open whenever a
  live text selection is anchored inside the card pane (new propagation-independent guard
  client/lib/cardCloseGuard.js), so a deliberate click on empty board space still closes the card. New unit
  tests in client/lib/tests/cardCloseGuard.tests.js and a Playwright regression test in
  tests/playwright/specs/34-checklist-text-selection.e2e.js. (PR #6407)

• Fixed list reordering throwing 403 Access denied for read-only members,
  #5462: read-only / comment-only board members could still drag-reorder
  lists, which fired a server write that allow/deny rejected with 403 Access denied (the list then snapped back). Of
  the three list jQuery-UI sortables in client/components/swimlanes/swimlanes.js, one was not gated on
  Utils.canModifyBoard(); it now is, consistent with the other two, plus a defense-in-depth guard so a logged-in
  user without write access can never persist a reorder (anonymous public-board reordering via localStorage is
  unaffected). The server already enforced this; the fix stops the unauthorized drag and the console error. New
  Playwright regression test in tests/playwright/specs/35-list-sort-permissions.e2e.js. (PR #6408)

Thanks to GitHub users Atry, mueller-ma and liferadioat for reporting.