Release history
wekan releases
The Open Source kanban, built with Meteor. GitHub issues/PRs are only for FLOSS Developers, not for support, support is at https://wekan.fi/commercial-support/ . New English strings for new features at imports/i18n/data/en.i18n.json . Non-English translations at https://app.transifex.com/wekan/wekan only.
All releases
204 shown
Upgrade now
v10.38
Breaking risk
RCE / SSRF
Breaking upgrade
Dependencies
ZipBleed fix + multitenancy
No immediate action
v10.12
Bug fix
Docker healthcheck + Files report fix + Import virtual users
Review required
v9.97
Breaking risk
Breaking upgrade
Breaking changes — review before upgrading.
Upgrade now
v9.90
Security relevant
Auth
RCE / SSRF
MimeBleed fix + admin controls + webhook updates
Config change
v9.85
Breaking risk
Breaking upgrade
FerretDB‑SQLite default, log silence, version fix
Upgrade now
v9.74
Breaking risk
RCE / SSRF
Auth
RBAC
DnsBleed, ExcelBleed, Meteor 3.5, tests, UI fixes
Review required
v9.69
Breaking risk
Auth
Breaking upgrade
Card members edit + board owner fallback + comment move
Review required
v9.68
Breaking risk
Dependencies
Breaking upgrade
Mirroring, Meteor update, deps upgrade, Playwright, mobile fix
v9.18
Bug fix
Notable features
- Build scripts no longer change firewall settings
- Release scripts now update version in the same script
Full changelog
This release adds the following updates:
- Build scripts: Not change firewall settings anymore.
Thanks to xet7. - Release Scripts: Include updating version at same script.
Thanks to xet7.
and fixes the following bugs:
- Try to fix Parallel Snap paths.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.17
Bugfix
Fixed parallel Snap MongoDB port handling.
Full changelog
This fixes the following bugs:
- Try to fix Parallel Snap MongoDB ports.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.16
Bug fix
Fixed uploading attachment to card.
Full changelog
This release adds the following updates:
- Bump fast-uri from 3.1.1 to 3.1.2.
Thanks to dependabot.
and fixes the following bugs:
- Fix login and register to not require page reload by adding router fallback.
Thanks to xet7. - Temporary fix to https://github.com/jamauro/offline/issues/27, waiting for new jam:offline version.
Thanks to xet7. - Fixed uploading attachment to card.
Thanks to xet7. - Fix Parallel Snap MongoDB port and paths, that worked at WeKan 9.07 but later broke.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.15
Bug fix
Fixed crash when userId or user is missing.
Full changelog
This release adds the following updates:
- Update release script to force include required file.
Thanks to xet7.
and fixes the following bugs:
- Fix to run code only if there is userId and user.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.14
Bug fix
Fixed MongoDB ReplicaSet reinitialization during restore and prevented index restoration.
Full changelog
This release fixes the following bugs:
- Snap Candidate: Reinitialize MongoDB ReplicaSet if it needs reconfig. When restoring, don't restore indexes.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.12
Bug fix
Fixed startup race condition by waiting for MongoDB before starting Node.js.
Full changelog
This release fixes the following bugs:
Thanks to above GitHub users for their contributions and translators for their translations.
v9.11
Bugfix
Fixed Snap common directory path issue causing Parallel Snap failures.
Full changelog
This release fixes the following bugs:
- Fix Snap common directory path for Parallel Snap.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.10
Bug fix
Fixed attachment cursor handling and ensured board access checks are awaited.
Full changelog
This release fixes the following bugs:
- Fix attachment cursor handling and await board access check.
Thanks to KhaoulaMaleh.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.09
Security relevant
Security fixes
- Fixed AuthBleed – critical authentication bypass vulnerability
Full changelog
This release fixes the following CRITICAL SECURITY ISSUES of AuthBleed:
- Fixed AuthBleed.
Thanks to Qiulin Deng and xet7.
and adds the following updates:
- Docs: Clarified SECURITY.md.
Part 1,
Part 2.
Thanks to xet7. - Updated GitHub Actions to build release bundles.
Thanks to xet7.
and adds the following tests:
- Added Playwright Tests 2026-05-07: 16 specs. 306/306 passing.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.08
New feature
Notable features
- Added Snap Store listing and revision publishing scripts
Full changelog
This release adds the following updates:
- Release scripts: Add Snap Store scripts to list and publish revisions to channels, because snapcraft.io website currently does not work.
Thanks to xet7.
and fixes the following bugs:
- Upgrade to Meteor 3.5-beta.10, changeStreams, DDP_TRANSPORT=uws.
Thanks to Meteor developers.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.07
Security relevant
Security fixes
- Fix avatars remote code execution (AvatarBleed) — critical security issue
Full changelog
This release fixes the following CRITICAL SECURITY ISSUES of AvatarBleed:
- Fix avatars rce.
Thanks to Trung Nguyen from CyStack Security and xet7.
and fixes the following bugs:
- Fix CleanDark theme.
Thanks to stegoh.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.06
Bug fix
Fixed Snap Candidate WRITABLE_PATH directory permissions bug.
Full changelog
This release adds the following updates:
- Docs: Update lxc commands.
Thanks to xet7. - Docs: Added firewall config for Internet access from LXD Ubuntu container at Fedora Asahi Linux Remix, because building Linux arm64 .zip bundle of WeKan.
Thanks to xet7. - Docs: Added Manual Parallel Snap.
Thanks to xet7.
and fixes the following bugs:
- Fix Snap Candidate WRITABLE_PATH directory permissions at Parallel Snap file path /var/snap/wekan_SOMENAME/common/files/.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.05
Bug fix
Fixed Snap Candidate attachments WRITABLE_PATH bug for Parallel Snap installs.
Full changelog
This release adds the following updates:
- Update version script and dependencies.
Thanks to xet7.
and fixes the following bugs:
- Fix Snap Candidate attachments WRITABLE_PATH for Parallel Snap installs.
Part 1,
Part 2.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.04
Bug fix
⚠ Upgrade required
- Upgrade MongoDB to version 7.0.32 across all deployment methods (standalone, Helm chart, Windows bundle).
Full changelog
This release adds the following updates:
- Upgrade to MongoDB 7.0.32. Update version script..
Thanks to MongoDB developers and xet7. - Upgrade to MongoDB 7.0.32 at Helm Chart.
Thanks to MongoDB developers. - Upgrade to MongoDB 7.0.32 at Windows Bundle docs.
Thanks to MongoDB developers.
and fixes the following bugs:
- Fix can not edit checklist title.
Thanks to xet7. - Fix Cannot delete card checklist title, by removing "Delete" and "Convert to Card" that belong to Checklist Items only. Checklist Menu already has Delete Checklist.
Thanks to rileybroberts and xet7. - Fix: Added space between Card Number and Card Title at Minicard and Opened Card.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.03
New feature
Notable features
- Added board-attachments API endpoint
Full changelog
This release adds the following new features:
- Add missing board‑attachments API endpoint.
Thanks to KhaoulaMaleh.
and adds the following updates:
Thanks to above GitHub users for their contributions and translators for their translations.
v9.02
Bug fix
Minor fixes and improvements.
Full changelog
This release fixes the following bugs:
- Fix mongodb in snap 9.01 on Ubuntu 24.04 crashes because of missing libcrypto.so.1.1.
Thanks to sbaecker.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.01
Breaking risk
Minor fixes and improvements.
Full changelog
This release adds the following updates:
- Updated Docker platforms for what currently builds successfully.
Thanks to xet7. - Docs: Updated s390x page.
Thanks to xet7. - Removed charts, that are moved back to github.com/wekan/charts.
Thanks to xet7. - Moved website to separate repo. Moved docs2 back to docs.
Thanks to xet7. - Disable not working GitHub workflows.
Thanks to xet7. - Fix Snap mongodb port wrong.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v9.00
Bug fix
Notable features
- Fixed UI hangs and data loss by disabling changeStreams
- Fixed MongoDB replicaset setup in docker-compose.yml
- Added permission checks to list width method
Full changelog
This release adds the following updates:
- Bump actions/upload-pages-artifact from 4 to 5.
Thanks to dependabot. - Bump docker/setup-buildx-action from 3 to 4.
Thanks to dependabot. - Bump actions/deploy-pages from 4 to 5.
Thanks to dependabot. - Update release scripts.
Thanks to xet7. - Added back jam packages. Updated dependencies.
Thanks to xet7. - Updated dependencies.
Thanks to xet7. - Update security.md etc.
Thanks to xet7. - Updated HoF.
Thanks to xet7. - Update releases scripts.
Thanks to xet7. - Update release and version scripts.
Thanks to xet7. - Updated dependencies.
Part 1,
Part 2.
Thanks to developers of dependencies. - Updated website.
Thanks to xet7.
and fixes the following bugs:
- Update cards.js.
Thanks to snowsky. - Fix MongoDB replicaset setup at docker-compose.yml.
Thanks to C0rn3j. - Add permission checks to list width method.
Thanks to Raawen-dev. - Fix UI hangs and data loss by disabling changeStreams, until there is new Meteor release that included bugfix to changeStreams.
Thanks to bcook-konza and italojs. - Fix list actions popup overflow.
Thanks to Raawen-dev. - Fix mycards subscription.
Thanks to aminsaidane.
Thanks to above GitHub users for their contributions and translators for their translations.
v8.94
Bug fix
Fixed MongoDB Index errors that prevented docker image startup.
v8.90
Breaking risk
⚠ Upgrade required
- Helm Charts repository changed from wekan/charts to wekan/wekan
- ArtifactHub registry now references wekan/wekan instead of wekan/charts
Breaking changes
- Removed jam:offline, jam:method, and jam:pub-sub packages from the codebase
Full changelog
v8.90 2026-04-16 WeKan ® release
This release adds the following updates:
- Added GitHub Actions builds for Docker and Snap. Moved Helm Charts from charts repo to wekan repo.
Thanks to xet7. - Changed ArtifactHub from wekan/charts repo to wekan/wekan repo.
Thanks to xet7. - Release scripts: Moved more steps to GitHub Actions.
Thanks to xet7.
and fixes the following bugs:
- Removed jam:offline jam:method jam:pub-sub, because they are not used, and they cause too much database usage.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v8.88
Bug fix
Prevents full-collection COLLSCAN queries and ensures standard GridFS indexing for efficient attachment lookups.
v8.84
Mixed
Notable features
- Helm Chart: readiness, liveness, and startup probes now configurable
Full changelog
v8.84 2026-04-15 WeKan ® release
This release adds the following new features:
- Helm Chart: Make readiness, liveness and startup probes configurable.
Thanks to snowsky.
and fixes the following bugs:
- Fix SSO Login OIDC and OpenID Connect.
Thanks to sbaecker and nebulade. - Try to fix Snap Candidate.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v8.83
Breaking risk
Breaking changes
- Removed armhf (32-bit ARM) architecture from release scripts
- Removed armhf (32-bit ARM) architecture from Docker builds
- start-wekan.sh and start-wekan.bat no longer use Change Streams
Full changelog
v8.83 2026-04-14 WeKan ® release
This release adds the following updates:
- Release scripts: Removed armhf, there is no official Node.js binary for it.
Thanks to xet7. - Release scripts: Docker not for armhf, no official Node.js binary for it.
Thanks to xet7. - Release scripts: Fix Node.js 24.x download URL for Snap builds.
Thanks to xet7. - Changed start-wekan.sh and start-wekan.bat to not use Change Streams.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v8.73
Bug fix
Fixed issues including broken Windows release links, inability to save card dates, and LDAP login failures caused by undefined ReactiveCache. Resolved errors in member/assignee selection, checklist reordering, and card/board activity logs. Removed unnecessary exclude-archs from rebuild-wekan.sh.
v8.72
Bug fix
Notable features
- Fixed avatar display for impersonate user in Admin Panel
- Fixed Admin Panel version display to show MongoDB storage engine name and Oplog status
Full changelog
v8.72 2026-04-07 WeKan ® release
This release adds the following new features and fixes:
- Fix Impersonate User. Show/Edit Avatar at Admin Panel/People/People.
Thanks to ahlgrimma, DnT1mmer, robbagithub, norrig and xet7.
and adds the following updates:
- Bump actions/download-artifact from 4 to 8.
Thanks to dependabot. - Bump actions/upload-artifact from 4 to 7.
Thanks to dependabot. - Bump actions/cache from 4 to 5.
Thanks to dependabot. - Bump docker/login-action from 4.0.0 to 4.1.0.
Thanks to dependabot. - Updated release scripts.
Thanks to xet7.
and fixes the following bugs:
- Fix Admin Panel / Version not showing name of MongoDB storage engine and status of MongoDB Oplog enabled.
Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
v8.71
Bug fix
A null pointer was prevented in notification handling, eliminating crashes when a notification lacked expected data. This improves stability and security of the system.
v8.70
Bug fix
Authentication code was refactored to use async upserts, eliminating race conditions and making login operations more reliable.
v8.69
Bug fix
Fixed a bug that prevented Snap from initializing MongoDB's op log, risking data inconsistencies and replication failures. The fix ensures the op log starts correctly, boosting write reliability.
v8.68
Bug fix
MongoDB op log initialization was corrected, preventing start-up failures for snap deployments and ensuring continuous replication works as expected.
v8.67
Bug fix
Fixed GitHub Actions release bundle builds, restoring reliable automated releases for administrators and developers.
v8.65
Bug fix
Fixed CI builds for Docker and GitHub Actions to prevent broken release bundles and test failures.
v8.64
Bug fix
Fixed a bug that caused GitHub Actions release bundle builds to fail
v8.62
Bug fix
Fixed a bug that caused GitHub Actions release bundles to fail, improving CI reliability for downstream builds.
v8.61
Bug fix
Build and release scripts were tightened to verify directories and repositories, reducing CI failures, and a server crash during comment deletion was fixed, improving stability and data integrity.
v8.60
Maintenance
The Docker build script was refreshed, improving container builds and aligning the CI pipeline with recent changes.
v8.58
Bug fix
Updated build documentation and corrected packaging bugs in Docker, Snap, and zip bundles, improving installation reliability across platforms.
v8.57
Bugfix
A Snap integration bug was corrected, lowering image upload failures and increasing deployment reliability for admins.
v8.56
Bugfix
A Snap installation bug was corrected, ensuring the application starts reliably and preventing installation failures on systems using Snap packages.
v8.55
Bug fix
Added a warning against using npm audit fix --force which breaks builds, updated several dependencies, and fixed bugs affecting card reports, board search, and Snap.
v8.54
Bug fix
The release reverts a refactored async upsert implementation that caused unpredictable behavior, restoring reliable database writes and preventing data inconsistency.
v8.52
Bugfix
The release fixed Docker and Snap deployment bugs, improving reliability of container and snap installations for all users.
v8.50
Bug fix
Uncommented build scripts, upgraded the exceljs library and other dependencies, and corrected workflow indentation to ensure reliable builds and CI runs.
v8.49
Bug fix
Fixed missing @meteorjs/reify module, docker-compose.yml configuration, and Snap packaging issues.
v8.47
Maintenance
Updated attachment and avatar storage paths to use WRITABLE_PATH/files/attachments for more flexible file location management.
v8.46
Maintenance
Updated release scripts and switched docker-compose.yml database backend from FerretDB/PostgreSQL to MongoDB.
v8.45
Maintenance
Updated release scripts and GitHub Actions workflow configurations. Multiple attempts to fix Snap packaging compatibility.
v8.44
Maintenance
Reverted from FerretDB/PostgreSQL to MongoDB 7.x. Updated dependencies and fixed data display without migrations, global search crashes, and myCards crashes.
v8.43
Maintenance
Breaking changes
- Requires Meteor 3.4 and Node.js 22.22
Notable features
- Excel export improvements
- Attachment handling fixes
v8.42
Bugfix
Fixes critical bug where SSO authentication was completely broken and non-functional.
v8.39
New feature
Notable features
- Delete workspace
- Workspace Settings management
v8.38
Maintenance
Updates documentation and fixes empty user list display, missing translations visibility, and button styling inconsistencies.
v8.37
Bugfix
Fixes critical bug preventing card save functionality from working across the platform.
v8.36
Security relevant
Security fixes
- IntegrationBleed RebindBleed vulnerability
Notable features
- Swimlane/list/card copy-move operations
v8.34
Security relevant
Security fixes
- GHSL-2026-035
- GHSL-2026-036
- GHSL-2026-037
Notable features
- Helm Chart ingressClassName support
v8.32
Maintenance
Migrates OIDC, Sandstorm, and CAS authentication modules to async API for Meteor 3.0 compatibility. Updates MongoDB to 7.0.30.
v8.30
Bug fix
Reverts new UI design introduced in v8.29; includes bug fixes and performance improvements.
v8.28
Bug fix
Updates dependencies. Fixes text truncation in quick-access board links, card details CSS, Jade syntax errors, and async operation handling.
v8.27
Bug fix
Updates MongoDB documentation to 7.0.29. Fixes async/await handling in card copy and move dialog operations.
v8.26
Maintenance
Migrates accounts-lockout module to async API. Adds documentation for spreadsheet vs Kanban comparison. Fixes member settings menu and card operations.
v8.24
Maintenance
Adds secure VSCode sandbox for Debian 13; updates to Meteor 2.16. Replaces collection-mutations and speakingurl with lighter alternatives.
v8.23
Maintenance
Migrated dependencies (synced-cron, mousetrap, kadira:dochead), bumped tar package, and fixed default swimlane display and database migration issues.
v8.22
Bug fix
Fixes add member and @mentions functionality in boards and cards.
v8.21
Security relevant
Security fixes
- OrgsTeamsBleed
- ChecklistRESTBleed
- MigrationsBleed2
Notable features
- Show password toggle at Login and Register
v8.20
Security relevant
Breaking changes
- Migrations moved to Admin Panel/Settings/Cron
Security fixes
- Permission checks enforcement on migrations
Notable features
- Toggle Drag Handles feature