v9.96 2026-07-16 WeKan ® release

This release adds the following updates:

• Releases now include the Sandstorm .spk package (.github/workflows/release-all.yml).
  The release-all workflow got a new build-sandstorm job that runs after the GitHub Release
  is created: it builds the Sandstorm package from the release tag with the same steps as the
  standalone sandstorm.yml workflow and attaches wekan-<version>-sandstorm.spk to the
  Release. The job is non-blocking (continue-on-error), so the experimental Sandstorm build
  never fails or delays the rest of the release. The standalone sandstorm.yml workflow still
  exists for building and testing the .spk on its own without doing a full release. Thanks
  to xet7.

• Bump websocket-driver from 0.7.4 to 0.7.5.
  Thanks to dependabot.

• New general cpu-exec + bundled qemu-user: every WeKan platform now runs binaries that need
  missing CPU features through emulation automatically
  (#6458, snap-src/bin/cpu-exec,
  snap-src/bin/mongodb-control, snap-src/bin/migration-control, .github/workflows/release-all.yml,
  .github/workflows/sandstorm.yml, sandstorm-src/build-deps.sh, releases/ferretdb/start-wekan.sh,
  releases/ferretdb/wekan-entrypoint.sh, docs/Databases/mongodb-avx-qemu.md,
  docs/Databases/mongodb-raspi4-qemu.md). The #6458 report turned out to run inside a hypervisor
  that MASKS AVX — and the snap's old per-tool AVX wrappers (amd64-only, PATH-based) were bypassed
  by every absolute-path mongod invocation. The new cpu-exec helper is one general mechanism
  for all scripts, sandboxes, platforms and CPUs: cpu-exec --features x86_64=avx,aarch64=atomics <binary> [args] checks /proc/cpuinfo and, when a required feature is missing, transparently
  re-runs the binary through a same-architecture qemu-user (bundled first, then system); with no
  declared features it is a plain zero-overhead exec, so every binary can be routed through it
  (WEKAN_REQUIRED_CPU_FEATURES declares requirements externally). The Snap's mongodb-control and
  migration-control now run every mongod 7 through it — so MongoDB works (slower) on CPUs without
  AVX and the migration can READ modern MongoDB data there, with the FerretDB switch/migration
  fallbacks unchanged; aarch64=atomics covers MongoDB's ARMv8.2-A requirement (Raspberry Pi 4
  and older lack it). release-all.yml now ships cpu-exec plus this-arch's static qemu-user in
  every Linux bundle .zip (amd64/arm64/ppc64le/s390x/riscv64 — stripped from the Windows/macOS
  bundles, where qemu-user does not exist), which flows into the Docker image and the Snap
  automatically, and the Sandstorm .spk gets both via build-deps.sh; the bundle launcher and
  Docker entrypoint route node/ferretdb through it. Thanks to a1bert01 and xet7.

• Added regression tests, with negative cases, for all of the fixes below (tests/htmljsArrayContent.test.cjs,
  tests/cardDescriptionDraft.test.cjs, tests/commentDraft.test.cjs, tests/attachmentDeleteGuard.test.cjs,
  tests/ruleMoveAction.test.cjs, tests/snapMigrationRecovery.test.cjs, tests/ferretdbPolling.test.cjs,
  tests/uiDensity.test.cjs, tests/cpuExec.test.cjs — a BEHAVIORAL test that executes the real
  cpu-exec against fake /proc/cpuinfo files and a fake qemu-user, covering direct exec, qemu fallback,
  missing-qemu error, per-arch scoping and env overrides —, tests/cpuExecWiring.test.cjs — pins the
  cpu-exec DELIVERY pipeline: every Linux bundle in release-all.yml embeds cpu-exec plus its own
  arch's qemu-user (arm64/extra arches replace the inherited amd64 one, tolerantly), the Windows and
  macOS bundles strip both, qemu-user-static is installed in every bundle-building job, the Sandstorm
  .spk ships both via build-deps.sh, the Docker entrypoint and bundle launcher route ferretdb/node
  through cpu-exec WITH direct-exec fallbacks for bundles that lack it, and the snap ships it via the
  snap-src helpers part —, tests/subtasksDefaultBoard.test.cjs (see the #6456 entry below), and tests/ferretdbHasData.test.cjs — a BEHAVIORAL test executing the real snap-src/bin/ferretdb-has-data guard (the check that gates every switch to FerretDB) against crafted directories: non-empty .sqlite passes with no -wal sidecar required, while a 0-byte .sqlite from a failed migration, sidecar-only leftovers, a directory named *.sqlite, and empty/missing directories are all rejected — all
  wired into test:unit:node in package.json; plus Go table tests in the wekan/FerretDB fork's
  internal/backends/sqlite/query_test.go and the fork's integration-test fixes (OTel exporter
  skipped with a single log line when no collector is listening, and valid span contexts without a
  collector so TestOtelComment passes — details in the fork's own CHANGELOG Upcoming). The htmljs test exercises the vendored
  compiler's Tag constructor directly (array content vs. attributes, #6459) and the draft tests run the real
  extracted normalize/normalizeTrigger functions; the UI tests guard the #6465 density fixes in the repo's
  CSS-guard style (base font 14px, card details docking right of the board instead of over its own card, compact
  admin table headers, un-clipped zoom pill, one-click board settings cog). The FerretDB Go tests pin the SQLite
  filter-pushdown semantics: which strings are pushdown-safe, exact WHERE/args for _id and top-level equality
  filters, and that dotted paths, operators, non-strings and unsafe strings stay with the in-Go filter. Thanks
  to xet7.

and fixes the following bugs:

• Subtasks: creating a subtask crashed with "Exception while invoking method 'addSubtaskCard'"
  (#6456, models/boards.js,
  tests/subtasksDefaultBoard.test.cjs). The lazily-creating getters for the default subtasks
  helper board and its landing list still used the SYNC Boards.insert / Swimlanes.insert /
  Lists.insert / Boards.update APIs, which Meteor 3 removed from the server — so the
  addSubtaskCard method's async path crashed with "insert is not available on the server.
  Please use insertAsync() instead" the first time a board needed its ^Board^ helper board
  created (the list creator additionally read getDefaultSwimline()._id, which on the Meteor 3
  server is a Promise, so it could never have worked). The sync getters are now PURE (no
  creation — also matching the #3868/#2256 rule that only the server may create these), and the
  server-side lazy creation lives in getDefaultSubtasksBoardAsync/getDefaultSubtasksListAsync
  using the async APIs. The never-called date-settings twins, which had the same sync calls and
  no server-only guard at all, are pure getters now too. With a regression test guarding that no
  sync collection writes come back to models/boards.js. Thanks to sjohnen and xet7.

• GUI: the "More" menu of cards was completely empty, so cards could not be deleted from it
  (#6459,
  npm-packages/meteor-jade-loader/lib/vendor/htmljs.js, client/components/lists/listHeader.jade).
  A WeKan-local vm-sandbox patch in the vendored jade compiler's htmljs made
  isConstructedObject(Array) return false (upstream returns true), so a tag whose inline text
  compiles to an ARRAY — the label {{_ 'source-board'}}: and label {{_ 'parent-card'}}: lines in
  cardMorePopup — got its content array mis-assigned as the tag's attributes. At runtime Blaze then
  found a template view object inside the attributes and threw "The basic TransformingVisitor does
  not support foreign objects in attributes" on every render, killing the whole popup — including
  the card Delete link. The tag constructor now treats an array first-argument as content, like
  upstream htmljs. Also fixed the list "More" popup's copy-link input, which was always empty because
  it referenced a rootUrl helper that does not exist (now absoluteUrl). Board and swimlane menus
  intentionally offer archive (delete lives in Sidebar → Archive), so only the card menu was actually
  broken. Thanks to thku and xet7.

• Cards: the "You have an unsaved description" warning could never be cleared by saving
  (#6455, reincarnation of
  #1287, client/components/cards/cardDetails.js,
  client/components/cards/cardDescription.js). Two bugs: closing the description editor only
  avoided adding a draft when the text matched the saved description — it never removed a
  pre-existing draft record, so once the warning appeared, "View it" → Save could not clear it, only
  Discard could. And the comparison matched a per-line-whitespace-stripped draft against the raw
  stored description (or null when empty), so descriptions with Markdown " " hard-breaks
  re-created a phantom draft on every save. Saving now removes the draft record explicitly, and both
  sides of the comparison are normalized the same way. Thanks to C0rn3j and xet7.

• Comments: a comment being written was lost when the card was closed or a click landed outside
  the card (#5547,
  client/components/activities/comments.js). The comment-draft machinery existed (the form even
  prefills from it) but had been disarmed since 2019: the escape handler that saved the draft was
  gated on a "form is open" flag that nothing ever set — the setter was removed back then because the
  handler also cleared the visible text on every outside click. Now the draft is saved continuously
  (debounced) while typing and flushed when the form is torn down, submit removes the draft, and the
  escape handler no longer clears the visible text — so an unfinished comment survives closing the
  card, and reopening the card restores it into the form. Thanks to Finnlife, webenefits and xet7.

• Attachments: deleting an attachment could log a client-side "Removed nonexistent document"
  exception even though the delete succeeded
  (#5282,
  client/components/cards/attachments.js). Same class as the fixed #3252 for comments and
  checklists: under publication churn the attachment document can already be evicted from Minimongo
  when the confirm handler runs, and removing a missing _id throws. The delete now only runs when
  the document is still in the local cache — the comment/checklist guards' missing sibling. Thanks
  to lupuszr and xet7.

• Rules: the "move card to top/bottom" actions did nothing
  (#6472, server/rulesHelper.js,
  client/components/rules/actions/boardActions.js, client/components/rules/rulesImportExport.js,
  server/rulesButton.js, models/lists.js). A pile-up of five bugs, all silent because the
  activity hook swallows rule-action errors: (1) an unresolved destination list (typo'd, renamed,
  case-mismatched, or on another board) crashed on list.cardsUnfiltered — now it falls back to the
  card's current list; (2) the classic rule wizard's generic "move to top/bottom" stored the field as
  listTitle, which the rule engine never reads (listName) — so every such rule created from the
  wizard has never worked; (3) an empty destination list made Math.min()/Math.max() of nothing
  write a corrupt sort: ±Infinity; (4) the rules JSON/CSV import created rules with raw client
  inserts that the board-admin-only allow rules reject into minimongo limbo — it now uses the same
  rules.createRule server method as the wizard, and defaults missing trigger matching fields (e.g.
  userId) to the * wildcard so hand-written JSON matches; (5) rules.createRule let an empty
  boardId: '' from a not-yet-loaded board selector override the real board. Also fixed the
  server-side orphaned-cards fallback in List.cards()/cardsUnfiltered(), which silently never
  applied because an async lookup was read synchronously. Thanks to jmb26240 and xet7.

• GUI: desktop density regressions from the v7.98–v8.18 mobile UI work
  (#6465, client/components/main/layouts.css,
  client/components/cards/cardDetails.css, client/components/main/header.css,
  client/components/settings/peopleBody.jade, client/components/settings/settingBody.css,
  client/components/boards/boardHeader.jade). Restores the WeKan 6.09 desktop look users asked
  for: the base font is back to 14px (the clamp(...2.5vw...) introduced in v7.98 and raised in
  v8.02 resolved to 18px on any window wider than 720px — +28.5% on every font, button and input,
  the "everything is way too big" complaint) and headings back to 22/18/16px; the card details
  window no longer opens as a huge floating sheet ON TOP of its own card — it docks to the right
  edge like the classic side panel (still movable by its drag handle), with 6.09's 20px content
  padding instead of ~48px white borders, a 3px corner radius, and without the v8.18 rule that
  forced ALL card text to the title's size; the All Boards page header band is back to 6.09's
  compact padding; the Admin Panel Organizations/Teams tables no longer explode column widths
  ("Select all / Unselect all" header links are now compact icons and header cells may wrap); the
  zoom pill no longer renders cut off (fixed-pixel pill inside the 28px quick-access row); and
  board settings opens with ONE click from a new cog button in the board header (the sidebar path
  still works). Follow-ups caught by the Playwright suite: archiving or deleting a card now also
  CLOSES its details window (the card id stayed in the openCards session list, so the right-docked
  window kept rendering exactly over the archives sidebar and intercepted its Restore/Delete
  clicks), and an OPEN sidebar now stacks above the card window (z-index 2002 vs 2001) so the
  sidebar is always usable while a card is open. With Playwright coverage: a new spec proves board
  settings opens in one click from the header cog (and that the popup closes again), and the
  archives spec's board-menu click is scoped to the sidebar instance since the cog made the bare
  class selector ambiguous. Note: a missing watch "eye" icon is the Admin Panel → Features →
  Notifications "disable watch" setting, not a regression. Thanks to Mintyt, csonkaoszimt,
  micha141076 and xet7.

• Snap: WeKan served "502 Bad Gateway" forever when mongod could not start — including on CPUs
  without AVX ("Illegal instruction") (#6458,
  #6466, snap-src/bin/mongodb-control,
  snap-src/bin/migration-control). MongoDB 5.0+ x86_64 binaries require AVX; on CPUs without it
  mongod dies instantly with SIGILL (exit 132). mongodb-control never checked the mongod fork's
  exit status: it pinged the dead port for ~10 minutes, snapd restarted the service, and the cycle
  repeated forever — same limbo as when the data files are still MongoDB 3.x ("This version of
  MongoDB is too recent"). Now there is an AVX pre-flight and the fork/final-start exit codes are
  checked: if a COMPLETED FerretDB migration exists the snap switches to it; otherwise the
  MongoDB → FerretDB migration is (re)run — FerretDB is pure Go + SQLite and the 3.x reader uses
  the bundled MongoDB 3.2 tools, so neither needs AVX — with a 3-attempt counter so a persistently
  failing migration cannot ping-pong, and clear log guidance (snap run wekan.migrate).
  migration-control also skips the pointless mongod 7 probe when AVX is missing. Thanks to kiarn
  and xet7.

• Snap: a migration that finished with a few per-item errors ("Avatars Errors") deleted the
  fully-copied FerretDB database and left the snap serving 502 Bad Gateway
  (#6466, snap-src/bin/migrate-mongo3-to-ferretdb.mjs,
  releases/migrate-mongodb-to-ferretdb.mjs, snap-src/bin/migration-control). Both importers
  treated ≥10 logged errors of ANY kind as failure — but per-item errors (one document that fails
  JSON parsing, one avatar that fails to extract) don't invalidate everything that DID copy. The
  failure path then discarded the whole migrated SQLite, set migrate=off, and "fell back" to
  MongoDB — impossible for a 6.09 upgrade, whose 3.x data files the bundled mongod 7 cannot open,
  producing the reported endless db-eval.mjs ping loop and 502. Per-item errors are now logged
  but non-fatal (only real failures — disk full, unreachable target/source — still fail), and a
  failed 3.x-source migration keeps the partial FerretDB SQLite plus its checkpoint and RESUMES on
  the next start instead of deleting hours of copied data. Thanks to Nissulya, S0QR2, lezioul,
  usrflo and xet7.

• Snap/Bundle: FerretDB v1 pinned 250–400% CPU and boards took minutes to load after migration
  (#6467,
  #6468, snap-src/bin/wekan-control,
  releases/ferretdb/start-wekan.sh, and the wekan/FerretDB fork). Two sides. WeKan side: with
  FerretDB there is no oplog, so Meteor observes every query by POLLING — and its defaults re-run
  every observed query 50 ms after ANY write and at least every 10 s, which on an active board
  multiplies into hundreds of full queries per second; with FerretDB the snap and the bundle
  launcher now default to METEOR_POLLING_THROTTLE_MS=2000 / METEOR_POLLING_INTERVAL_MS=30000
  (overridable; own changes still appear instantly, other users' changes may take ~2 s longer).
  FerretDB side (fork v1.28): real filter pushdown so {boardId: X} uses the SQLite expression
  indexes instead of decoding the whole 53k-card collection per query, a connection pool cap of
  2×CPUs (was 100 — dozens of concurrent full scans thrashing the pure-Go SQLite mutexes were the
  reported 821k futex calls/30 s), and inserts no longer take the registry's global write lock.
  Thanks to anlx-sw, markusst1982 and xet7.

• LDAP: group search filters were double-escaped and broke group filtering
  (#6460,
  PR #6469, packages/wekan-ldap/server/ldap.js).
  The group filter was post-processed with a global backslash-doubling replace, a leftover
  workaround from the ldapjs era that predates the proper escapedToHex hex escaping. It turned
  already-correct RFC 4515 escapes like \5c and \28 (an AD DN with an escaped comma, a group
  name with parentheses) into \\5c/\\28, which ldapts' strict filter parser rejects with
  "Invalid escaped hex character" — so group filtering, admin-status sync and role sync failed
  for exactly those directories. The redundant replace is removed; injection protection is
  unchanged (escapedToHex still hex-escapes the username). Thanks to ChristianMa97.

• LDAP: enabling org/team sync made every LDAP login fail with 'forbidden'
  (#6461,
  PR #6470, packages/wekan-ldap/server/loginHandler.js,
  packages/wekan-ldap/server/sync.js). On the server, a nested Meteor.callAsync inherits the
  current method invocation's connection, so when the login handler called the
  setUserOrgsTeamsFromLdap method, its admin guard saw the client's login connection with no
  logged-in user yet and rejected the sync — and the unhandled rejection failed the whole login.
  (The nightly cron sync runs outside a method invocation, so it was unaffected — which is why
  this hid.) The login-time sync call now clears the inherited invocation context so it is a true
  server-to-server call, and org/team sync is additionally wrapped so an optional-enrichment
  failure is logged instead of blocking login. The same PR also throws the account-creation error
  from addLdapUser at the right point (it was previously used as a user object first), fixes
  external-avatar localization to use Avatars.writeAsync (the callback-style write no longer
  exists in ostrio:files 3.x, so localizing avatars silently did nothing), and adds */?
  wildcard support with unit tests to the LDAP_SYNC_ORGANIZATIONS_GROUPS /
  LDAP_SYNC_TEAMS_GROUPS allowlists. Thanks to ChristianMa97 and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.