This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+2 more
Affected surfaces
ReleasePort's take
Light signalThe default Docker Compose configuration now uses FerretDB v1 with embedded SQLite.
Why it matters: Affects Docker deployment configurations; operators using the default compose must be aware of the database change to SQLite‑backed FerretDB.
Summary
AI summaryUpdates default, SQLite, and https://github.com/wekan/wekan/blob/main/server/statistics.js across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Default Docker compose now uses FerretDB v1 with embedded SQLite. Default Docker compose now uses FerretDB v1 with embedded SQLite. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Reorganized rebuild‑wekan.sh/bat menus into category submenus with Docker actions. Reorganized rebuild‑wekan.sh/bat menus into category submenus with Docker actions. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Added design doc for migrating Sandstorm WeKan from MongoDB 3 to FerretDB v1. Added design doc for migrating Sandstorm WeKan from MongoDB 3 to FerretDB v1. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Implemented Sandstorm Admin Panel section showing migration status and disk usage. Implemented Sandstorm Admin Panel section showing migration status and disk usage. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Added grain launcher and deps‑assembly script to build Sandstorm .spk with Node 24 and FerretDB. Added grain launcher and deps‑assembly script to build Sandstorm .spk with Node 24 and FerretDB. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Added "Build from source & start (up -d --build)" action to Docker menus per compose file. Added "Build from source & start (up -d --build)" action to Docker menus per compose file. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Added "Kill all dev servers" option to Dev server submenu. Added "Kill all dev servers" option to Dev server submenu. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Snap now downloads official prebuilt Caddy binary from GitHub releases instead of using Cloudsmith repo. Snap now downloads official prebuilt Caddy binary from GitHub releases instead of using Cloudsmith repo. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Dev server options now stop previous servers before starting, preventing port conflicts. Dev server options now stop previous servers before starting, preventing port conflicts. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed snap build failure caused by unreachable Cloudsmith Caddy repository. Fixed snap build failure caused by unreachable Cloudsmith Caddy repository. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Admin Panel now correctly shows FerretDB as database type instead of MongoDB. Admin Panel now correctly shows FerretDB as database type instead of MongoDB. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Refactor | Low |
Removed dead MongoDB‑driver‑selection subsystem from FerretDB integration. Removed dead MongoDB‑driver‑selection subsystem from FerretDB integration. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Refactor | Low |
Removed obsolete `version:` attribute from all Docker Compose files. Removed obsolete `version:` attribute from all Docker Compose files. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Refactor | Low |
Renamed docker-compose files: `docker-compose-ferretdb-v1-sqlite.yml` -> `docker-compose.yml`; previous MongoDB default `docker-compose.yml` -> `docker-compose-mongodb-v7.yml`. Renamed docker-compose files: `docker-compose-ferretdb-v1-sqlite.yml` -> `docker-compose.yml`; previous MongoDB default `docker-compose.yml` -> `docker-compose-mongodb-v7.yml`. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
v9.85 2026-07-11 WeKan ® release
This release adds the following features and fixes:
-
Docker: FerretDB v1 + SQLite is now the default
docker-compose.yml:The default database for
docker compose up -dis now FerretDB v1 with embedded
SQLite (from https://github.com/wekan/FerretDB) — light and self-contained, no
separate database server. The compose files were renamed accordingly:
docker-compose-ferretdb-v1-sqlite.yml->docker-compose.yml(the new default),
and the previous MongoDB defaultdocker-compose.yml->docker-compose-mongodb-v7.yml.
The other files are unchanged:docker-compose-ferretdb-v2-postgresql.yml(FerretDB 2- PostgreSQL) and
docker-compose-multitenancy.yml(MongoDB multitenancy). To use
MongoDB 7, rundocker compose -f docker-compose-mongodb-v7.yml up -dor rename that
file todocker-compose.yml.rebuild-wekan.sh/rebuild-wekan.batDocker menus now
list FerretDB v1 SQLite first (default) and point at the new filenames, the compose
files' own header comments were updated, and the Docker docs now describe which
compose file maps to which database. The Docker menus also gained a Build from
source & start (up -d --build) action per compose file, which builds the wekan-app
image from the localDockerfile(tagged as the image the compose file references)
and starts that freshly built container instead of a possibly-stale prebuilt image —
useful when a change (e.g. the FerretDB Version-page detection) isn't in the pulled
image yet. Finally, the obsoleteversion:attribute (which Docker Compose v2 warns
about and ignores) was removed from all compose files (docker-compose.yml,
docker-compose-mongodb-v7.yml,docker-compose-ferretdb-v2-postgresql.yml,
docker-compose-multitenancy.yml,.devcontainer/docker-compose.yml, and the
ToroDB docs example).
- PostgreSQL) and
-
rebuild-wekan.sh / rebuild-wekan.bat: reorganized into category submenus + Docker start/logs/stop:
The long flat menu is now grouped into a short top-level menu — Setup,
Dev server, Tests, Docker, Tools, Quit — each opening a small
submenu with0) Back, so you read only a handful of items at a time and labels
are shorter (the category provides the context). Docker is a two-stage submenu:
pick a backend (MongoDBdocker-compose.yml, FerretDB v1 SQLite, FerretDB v2
PostgreSQL, MongoDB Multitenancy), then an action — Start (up -d),
Follow logs (logs -f) or Stop (down) — which removes the previous
repetition of 12 near-identical entries. The.shauto-detectsdocker compose
vs legacydocker-compose. All existing actions are unchanged, just regrouped. -
rebuild-wekan.sh / rebuild-wekan.bat: Dev server options now stop the previous
server (including the rspack :8080 dev server) before starting, plus a new "Kill
all dev servers" option, and docs updated for the new menu:Every Dev server option (
localhost:3000,+ trace warnings,+ bundle visualizer,CURRENT-IP:3000,CURRENT-IP:3000 + MONGO_URL 27019, and
CUSTOM-IP:PORT) now stops any Meteor dev server already running before starting a
fresh one, so re-running a dev option no longer fails because a port is taken — no
need to hunt down and kill the old processes yourself. Crucially it frees both
the app port and the rspack dev-server port8080:meteor runstarts an rspack
dev server on 8080 that can outlive themeteorparent, and a leftover one made the
restart crash withError: listen EADDRINUSE ... :8080. Port detection now checks the
listening socket directly (ss/lsof, with a bash/dev/tcpfallback that needs no
external tools, andnetstaton.bat) instead of an HTTP probe, so it also catches
a server that is still building. A new Dev server -> Kill all dev servers option
frees every dev/test port the scripts use at once — the dev app (3000) and its Mongo
(3001), the Mocha test server (3100) and its Mongo (3101), a Sandstorm standalone dev
server (4000) and its Mongo (4001), and the rspack dev server (8080) — killing meteor,
the rspack watcher and Meteor's bundled--replSet meteorMongos (never a
production/system Mongo). Both scripts escalate to SIGKILL if a port does not free up.
Also updated the build-from-source docs (README.md, Build-from-source.md,
Build-and-Create-Pull-Request.md, Emoji.md, and the two Sandstorm developer docs) to
the new two-level menu (Setup -> Install dependencies, Setup -> Build WeKan,
Dev server -> localhost:3000) and fixed a stale dev-server port
(localhost:4000->3000). -
FerretDB: quieter logs, and removed a dead MongoDB-driver-selection subsystem:
On FerretDB (SQLite), the driver debug logs revealed a second, TLS-enabled Mongo
monitor connection retrying every ~0.5s and being rejected by the plaintext FerretDB
port, which FerretDB logged at WARN (Connection stopped … invalid message length/
before secure TLS connection was established) — harmless (WeKan runs fine on the real
plaintext connection) but very noisy. FerretDB is now started with--log-level=error
in all bundled launch points (Docker entrypoint, snapferretdb-control, the release
start-wekan.sh, and thedocker-compose-ferretdb-v1-sqlite.ymlexample), which drops
the per-connection WARN spam. Separately removed a dead, unused "MongoDB Driver System"
(server/mongodb-driver-startup.js+models/lib/{meteorMongoIntegration,mongodbConnectionManager,mongodbDriverManager}.js)
— an abandoned attempt to auto-detect MongoDB 3.0–8.0 and pick versioned driver packages
that were never even installed; WeKan uses the mongodb-7 driver via Meteor. -
Fix snap build failing on the
caddypart (Cloudsmith unreachable on Launchpad):The snap installed Caddy from the Cloudsmith apt repo
(curl … dl.cloudsmith.io … | gpg --dearmor), which fails on the Launchpad remote
builders — their network is restricted to a fetch proxy that can't reach Cloudsmith, so
gpggot no key (no valid OpenPGP data found) and thecaddyoverride-buildfailed
with code 2 on both arches, all attempts. Bothsnapcraft.yamlandsnapcraft-core24.yaml
now download the official prebuilt Caddy static binary from GitHub releases (per-arch,
latest stable with a pinned fallback) instead. WeKan uses only built-in Caddy directives,
so vanilla Caddy is sufficient — no apt repo, nogpg, noxcaddy/custom-module build. -
Fix Admin Panel / Version showing "MongoDB" when running on FerretDB:
The database detection only recognised a
buildInfo.ferretdbsub-document, but the
wekan/FerretDB v1 fork reports its identity as a top-levelferretdbVersionstring
(e.g.v1.24.2-60-gb5523566) plusferretdbFeatures, with its git commit ingitVersion.
So the Version page showedDatabase type: MongoDBand hid the FerretDB rows. Detection now
handles both shapes (server/statistics.js),
so it showsDatabase type: FerretDB, theFerretDB versionandFerretDB commitrows, and
theSQLitestorage engine. (FerretDB v1'sversion: 7.0.42is the MongoDB version it emulates.) -
Design doc: WeKan on Sandstorm (Meteor 3.5 / Node 24) with MongoDB 3 → FerretDB migration:
Added docs/Platforms/FOSS/Sandstorm/Meteor3/Migration.md
describing how to build a modern Sandstorm.spk(Node 24, replacing meteor-spk
0.6.0's Node 14) that runs on FerretDB v1 (embedded SQLite) instead of MongoDB 3.0,
migrating an existing grain's MongoDB 3.0 data on first launch — reusing the snap's
provenmigrate-mongo3-to-ferretdblogic (mongoexport read → FerretDB insert;
CollectionFS/Meteor-Files GridFS attachments+avatars → filesystem). Includes the
grain sandbox (seccomp) compatibility analysis, the rewrittenstart.js, and a new
isSandstorm-only Admin Panel / Attachments / Sandstorm section (migration status,
raw-MongoDB disk usage, and a guarded delete-raw-MongoDB-files action). Implementation
of the in-app pieces follows. -
Sandstorm: Admin Panel / Attachments / Sandstorm (migration status + free raw-MongoDB disk space):
Implemented the in-app pieces from the design above. When WeKan runs inside a
Sandstorm grain (isSandstorm), a new Sandstorm section appears in Admin
Panel / Attachments showing whether the one-time MongoDB 3 → FerretDB v1
migration succeeded, and the disk space the raw MongoDB 3 database files, the
FerretDB SQLite, and the attachments/avatars currently use inside the grain.
An admin can delete the now-redundant raw MongoDB files to free disk space —
guarded so it only runs after a confirmed-successful migration, behind a
confirmation. New admin-gated server methodssandstormMigrationStatus/
sandstormDeleteRawMongo(server/methods/sandstormMigration.js);
the migration importer now writes amigration-status.jsonthe panel reads. -
Sandstorm: grain launcher + spk build tooling (Node 24 / FerretDB, no releases.wekan.team):
Added the grain launcher sandstorm-src/start.js:
on first launch it runs the migration chain for whatever an existing grain holds —
niscu (MongoDB 2.x) → MongoDB 3.0 (the preserved legacy path for very old grains) then
MongoDB 3.0 → FerretDB v1 — then runs WeKan (Node 24) on FerretDB. Migration support from
old versions is permanent (niscud + mongod 3.0 are kept). Added the deps-assembly script
sandstorm-src/build-deps.sh
which builds a modernmeteor-spk.depson top of upstream meteor-spk 0.6.0
(dl.sandstorm.io) — swapping in Node 24, adding FerretDB + the Mongo 3.x CLIs + the
launcher/importer, keeping niscud — with extra binaries fetched from GitHub releases
(the retiredreleases.wekan.team/ oldprojects.7zare no longer used).sandstorm.yml
now calls it, andWRITABLE_PATHinsandstorm-pkgdef.capnpis/var/files. Build/CI only —
not yet packed/tested end-to-end in a grain.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
Breaking Changes
- Default `docker-compose.yml` now uses FerretDB v1 with embedded SQLite; previous MongoDB default moved to `docker-compose-mongodb-v7.yml`.
- `version:` attribute removed from all compose files (Docker Compose v2 no longer supports it).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About wekan
The Open Source kanban, built with Meteor. GitHub issues/PRs are only for FLOSS Developers, not for support, support is at https://wekan.fi/commercial-support/ . New English strings for new features at imports/i18n/data/en.i18n.json . Non-English translations at https://app.transifex.com/wekan/wekan only.
Related context
Related tools
Beta — feedback welcome: [email protected]