v9.82 2026-07-09 WeKan ® release

This release fixes the following bugs:

• Fix #5536: automated rule can now move/link a card to a different board:
  The rules "move card to top/bottom of a list on another board" and "link
  card to another board" actions failed for boards the rule creator did not
  own. The action showed BLANK after creating the rule (the wizard's optimistic
  client inserts landed in minimongo limbo / were rejected by allow-deny for
  non-owner members) — these now create the rule through the server
  rules.createRule method, keeping the action's destination boardId. And
  execution crashed with an "Internal Server Error" because the destination
  swimlane fallback dereferenced ._id on a possibly-undefined swimlane titled
  exactly Default (renamed/translated/deleted on the destination board);
  resolution now uses the board's real default swimlane via a Meteor-free
  resolver models/lib/ruleActionResolve.js, unit tested in
  tests/ruleActionResolve.test.cjs. Thanks to DarthKillian and xet7.
• Fix #4978: board background updates when switching boards via the favorites bar:
  Switching directly between two boards via the favorites bar reused the same
  boardBody template instance, so the one-shot setBackgroundImage() in
  onRendered never re-ran and the previous board's background stuck. It is now
  applied inside a reactive autorun and clears any stale inline background when
  the new board has no image. The decision is a Meteor-free helper
  models/lib/boardBackground.js, unit tested in tests/boardBackground.test.cjs.
  Thanks to dasarne and xet7.
• Fix #4881: Due this week / next week filter respects the start day of week:
  The "Due this week" filter selected next week's cards and ignored the
  configured start weekday, because it derived its window from
  startOf(now(), 'week') — which the native dateUtils never implemented, so
  it returned the date unchanged. A new Meteor-free helper
  models/lib/weekStart.js computes the correct week window for any start day
  of week; the this/next-week buttons now toggle per week too. Unit tested in
  tests/weekStart.test.cjs. Thanks to mimZD and xet7.
• Fix #4946: calendar week numbers respect the defined start day of week:
  In the Calendar view the week-number column was numbered from Sunday
  regardless of the start-day-of-week setting. The calendar now computes the
  number with weekNumberByFirstDay() (in models/lib/weekStart.js) from the
  same firstDay used to lay out the grid, unit tested in
  tests/weekStart.test.cjs. Thanks to helioguardabaxo and xet7.
• Fix #4653: LDAP username with a hyphen no longer becomes a dot:
  With LDAP_UTF8_NAMES_SLUGIFY enabled, limax(text, { separator: '.' })
  turned every non-alphanumeric run — hyphens included — into ., so an LDAP
  username like p.parta-partb became p.parta.partb and the user could not
  log in. The username is now slugified per hyphen-separated segment and
  rejoined with -, preserving hyphens while still transliterating UTF-8. Pure
  helper packages/wekan-ldap/server/usernameSlug.js, unit tested in
  tests/ldapUsernameSlug.test.cjs. Thanks to RowhamD and xet7.
• Fix #4236: Enter adds a new line in the card title, consistent with the description:
  The card title textarea submitted on plain Enter (only Shift+Enter made a new
  line), unlike the description field which inserts a new line on Enter and
  saves on Ctrl/Cmd+Enter. The title now uses the same shared, Meteor-free rule
  isSubmitKey() (models/lib/editorSubmitKey.js): submit only on
  Ctrl/Cmd+Enter, newline otherwise. Unit tested in
  tests/editorSubmitKey.test.cjs. Thanks to listenerri and xet7.
• Fix #4055: ISO week-number regression test (already correct in current code):
  #4055 reported the week number was one/two weeks too high for 2021-10-25..31
  (ISO week 43). That was the old moment-based math; the current native,
  DST-safe getISOWeek() computes it correctly. Added
  tests/isoWeek.test.cjs pinning the reported dates so it cannot regress.
  Thanks to marcungeschikts and xet7.
• Fix #4394: Register / Forgot Password links stay hidden after a failed login:
  Security. With registration / forgot-password disabled in the Admin Panel, the
  links were hidden by a one-shot .hide() that a useraccounts form re-render
  (e.g. an LDAP failed login) dropped, so the links reappeared. The disable
  state is now a class on the stable <body> ancestor with matching CSS, so the
  links are re-hidden on every re-render. Thanks to Alsterdetektive1 and xet7.
• Fix #4494: creating a board from a template no longer breaks subtasks:
  A board created from a template inherited the template's
  subtasksDefaultBoardId / dateSettingsDefaultBoardId; when those pointed at the
  template board itself, subtasks created on the new board were dropped onto the
  TEMPLATE board and linked back across boards. Board.copy() now repoints such
  self-referential defaults to the copy and clears the paired list id so it
  self-heals on the new board. Pure helper models/lib/boardCopyDefaults.js,
  unit tested in tests/boardCopyDefaults.test.cjs. Thanks to Xilef11 and xet7.
• Fix #4249: filter by card title now works for renamed linked cards:
  Renaming a linked card wrote the new title only to the linked target, leaving
  the linking card's own title field stale; filter-by-title queries the own
  field, so linked cards dropped out of title filters after a rename.
  Card.setTitle() now also writes the linking card's own title. Pure helper
  models/lib/linkedCardTitle.js, unit tested in
  tests/linkedCardTitle.test.cjs. Thanks to Ben0it-T and xet7.
• Fix #3606: activity feed no longer shows "edited/deleted comment undefined":
  The feed passed the comment id (absent on old activities, and gone for a
  deleted comment) into the activity string. Edit/delete activities now store
  the comment text and render it via Activities.commentDisplayText(), which
  falls back to the live comment text and then to an empty string — never
  "undefined". Pure helper models/lib/commentActivity.js, unit tested in
  tests/commentActivity.test.cjs. Thanks to janchuelo and xet7.
• Fix #3624: new_swimlane REST API appends the swimlane last and accepts a sort:
  POST /api/boards/:boardId/swimlanes set the sort to the swimlane count, so a
  new swimlane appeared FIRST when existing sort values were non-contiguous. It
  now appends at max(existing sort)+1 and honors an optional explicit sort in
  the body. Pure helper models/lib/swimlaneSort.js, unit tested in
  tests/swimlaneSort.test.cjs. Thanks to tamasberesoebb and xet7.
• Fix #3185: copying a card (or template) now copies its subtasks' checklists:
  Copying a card inserted each subtask as a bare card document, so the subtasks'
  checklists (and items) were dropped and the copied subtasks came out empty.
  Card.copy() now copies each subtask's checklists onto the new subtask. Pure
  helper models/lib/subtaskCopy.js, unit tested in tests/subtaskCopy.test.cjs.
  Thanks to ramses345 and xet7.
• Fix #5439: list scrollbar is always visible on desktop and mobile browsers:
  List bodies used overflow-y: auto, so overlay scrollbars (macOS/iOS/Android/
  Firefox) auto-hid. The list body now keeps a scrollbar visible across all
  engines — overflow-y: scroll, ::-webkit-scrollbar (Chrome/Safari/Edge/
  mobile WebKit), scrollbar-width/scrollbar-color (Firefox/Gecko) and
  scrollbar-gutter: stable. Cross-browser rules in models/lib/scrollbarCss.js,
  applied in client/components/lists/list.css, unit tested (builder contract +
  applied CSS, positive + negative) in tests/scrollbarCss.test.cjs. Thanks to xet7.
• Fix #6444: RTL — typing a card title no longer garbles other lists' minicard titles:
  In an RTL language (e.g. Arabic) the board root is dir="rtl", and both the
  minicard title (a dir="auto" .viewer) and the add-card composer textarea
  were dir="auto" with no bidi isolation, so they shared the surrounding
  bidirectional context. Typing a strong RTL character into one list's composer
  re-resolved that shared context and visibly reflowed the displayed minicard
  titles of the OTHER lists (no data change, reverted on refresh). Each title and
  the composer now use unicode-bidi: isolate. Locked in (positive + negative)
  by tests/minicardBidiIsolation.test.cjs; browser RTL behaviour is covered by
  tests/playwright/specs/18-rtl-layout.e2e.js. Thanks to xet7.
• Fix the Playwright CI test failures introduced by the #3624 and #4236 fixes above:
  Two browser tests failed on Chromium, Firefox and WebKit after this release's
  changes. (1) 23-rest-api-more.e2e.js:209 (swimlanes CRUD): the #3624 change
  pulled models/lib/swimlaneSort in via a function-scoped
  require('/models/lib/swimlaneSort'); unlike the file's top-level
  app-absolute imports, that new module was not statically bundled, so
  POST /api/boards/:boardId/swimlanes threw, was swallowed by its try/catch,
  and returned an error object with no _id — the test then read .title off a
  null swimlane. Fixed by importing nextSwimlaneSort at the top of
  server/models/swimlanes.js (same convention as its other imports); the
  behaviour is unchanged. (2) 02-cards-open-view.e2e.js:93 (editing the card
  title): #4236 deliberately made plain Enter insert a newline in the card title
  (Ctrl/Cmd+Enter saves), but the CardPage page object still saved with plain
  Enter, so the title never persisted and the read timed out — updated to save
  with Control+Enter. The server-side Mocha, import-regression and Node E2E
  jobs were already green; this makes the Playwright jobs green too. Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.