This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+2 more
ReleasePort's take
Moderate signalThe Wekan v9.86 release changes the DDP transport in docker‑compose, switches FerretDB downloads to per‑architecture binaries, drops the bundled mongosh binary, and updates MongoDB tools sources.
Why it matters: FerretDB now requires architecture‑specific downloads; dropping the bundled mongosh (severity 70) means existing deployments must provide Node.js 24 with the mongodb driver before upgrade.
Summary
AI summaryUpdates https://github.com/wekan/wekan/commit/aa5847f21561957216a34a7f6a61699f427971c8, mongod, and https://github.com/wekan/mongo-tools across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Dependency | Medium |
FerretDB binaries are now downloaded per-architecture instead of a multi‑platform zip. FerretDB binaries are now downloaded per-architecture instead of a multi‑platform zip. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Medium |
MongoDB Database Tools now sourced from `wekan/mongo-tools` fork instead of official site. MongoDB Database Tools now sourced from `wekan/mongo-tools` fork instead of official site. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Deprecation | High |
Drops the bundled `mongosh` binary; uses Node.js 24 + mongodb driver instead. Drops the bundled `mongosh` binary; uses Node.js 24 + mongodb driver instead. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Refactor | Medium |
Changed DDP_TRANSPORT from uws to sockjs in default docker-compose.yml. Changed DDP_TRANSPORT from uws to sockjs in default docker-compose.yml. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Refactor | Low |
Snap default `snapcraft.yaml` switched to base: core24, grade: stable; previous config renamed. Snap default `snapcraft.yaml` switched to base: core24, grade: stable; previous config renamed. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
v9.86 2026-07-11 WeKan ® release
This release fixes the following bugs:
- At default docker-compose.yml, changed DDP_TRANSPORT from uws to sockjs, because uws does not work at s390x.
Thanks to xet7. - FerretDB v1 is now downloaded as an individual per-arch binary, not
ferretdb.zip:
the wekan/FerretDB release now attaches oneferretdb-<arch>(.exeon Windows)
asset per platform instead of a single multi-platformferretdb.zip. Every WeKan
build path now downloads only the one binary for the platform it targets from
https://github.com/wekan/FerretDB/releases/latest/download/ferretdb-<arch>:
release-all.yml(the amd64/arm64/win64/mac/ppc64le/s390x/riscv64 bundle jobs —
the separatebuild-ferretdbjob and itsferretdb-zipartifact are removed),
the defaultdocker-compose.yml, and the Sandstormsandstorm-src/build-deps.sh.
FerretDB itself also moved its Go toolchain to 1.25.11 to clear the Quay.io
stdlibsecurity advisories. Thanks to xet7. - Drop the
mongoshbinary; use bundled Node.js 24 + themongodbdriver instead:
WeKan no longer bundles or downloads the MongoDB Shell anywhere (snap, Windows
bundle). Every scripted database operation it was used for — readinessping,
replica-setinitiate/status, and the v8.43 schema migration — now runs
through the newsnap-src/bin/db-eval(a tiny wrapper around the bundled Node.js
24 + themongodbdriver), so the snap control scripts (wekan-control,
mongodb-control,migration-control), thestart-wekan.sh/start-wekan.bat
launchers, and the portedmigrate-schema-v843.mjsare all mongosh-free. This
removes a large, CVE-prone binary and works identically on every architecture
(including s390x/ppc64le/riscv64, which have no prebuilt mongosh). The legacy
MongoDB 3.2mongoshell (migratemongo, amd64) stays for migration-time reads
only. Thanks to xet7. - MongoDB Database Tools now come from
wekan/mongo-tools, not the MongoDB website:
every WeKan build downloads the per-arch<tool>-<arch>binaries (bsondump,
mongodump, mongoexport, mongofiles, mongoimport, mongorestore, mongostat,
mongotop) built by the wekan/mongo-tools
fork (pure Go, cross-compiled for every architecture) from its newest release,
replacing thefastdl.mongodb.org/downloads.mongodb.comdownloads. They are
embedded in the Linux.zipbundles (amd64/arm64/s390x/ppc64le/riscv64) — and
therefore in the Docker image, which is built from those bundles — the Windows
and macOS bundles, the Snap (mongotoolspart), and the Sandstorm.spk. The
MongoDB 7 server (mongod) is still fetched from MongoDB (amd64/arm64 only), since
MongoDB ships no server for the other architectures; the legacy MongoDB 3.2 CLIs
(migratemongo, amd64) remain only for the one-time MongoDB 3 migration. Thanks to xet7. - Snap: the default
snapcraft.yamlis now thebase: core24,grade: stablebuild:
the previoussnapcraft.yaml(core26,grade: devel) is renamed to
snapcraft-core26.yaml, and the formersnapcraft-core24.yamlbecomes
snapcraft.yaml. Because the default isbase: core24(a released base), it can
be published to the Snap candidate channel, which core26 cannot. The automated
release-all.ymlworkflow publishes the snap to the candidate + beta + edge
channels; the stable channel is published manually later, once it is proven
stable enough. Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
Breaking Changes
- DDP_TRANSPORT default changed from uws to sockjs in docker-compose.yml
- Removed mongosh binary; all database operations now use bundled Node.js 24 + mongodb driver.
- MongoDB Database Tools are now sourced from wekan/mongo-tools repository instead of MongoDB official downloads.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About wekan
The Open Source kanban, built with Meteor. GitHub issues/PRs are only for FLOSS Developers, not for support, support is at https://wekan.fi/commercial-support/ . New English strings for new features at imports/i18n/data/en.i18n.json . Non-English translations at https://app.transifex.com/wekan/wekan only.
Related context
Related tools
Beta — feedback welcome: [email protected]