Download Latest Version
wekan-11.72-s390x.zip (286.8 MB)
Get an email when there's a new version of wekan
Binaries in these bundles
Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.
| Bundle | Binary | From | Version | Checked | SHA256 |
|---|---|---|---|---|---|
| amd64 | FerretDB | wekan/FerretDB | v1.54.0 | verified | cefef799be4d3abd… |
| amd64 | Node.js | nodejs.org | v24.19.0 | verified | 14b342e71204f811… |
| arm64 | FerretDB | wekan/FerretDB | v1.54.0 | verified | d6fc40d8657dc989… |
| arm64 | Node.js | nodejs.org | v24.19.0 | verified | 01443c1e1a29e531… |
| armhf | FerretDB | wekan/FerretDB | v1.54.0 | verified | 82e6a8e078b366ec… |
| armhf | Node.js | wekan/node-patches | v24.19.0 | verified | b55350f3071b765a… |
| armv6 | FerretDB | wekan/FerretDB | v1.54.0 | verified | 14da6f60445fcce2… |
| armv6 | Node.js | wekan/node-patches | v24.19.0 | verified | 128ded0cda638c1f… |
| armv7 | FerretDB | wekan/FerretDB | v1.54.0 | verified | 82e6a8e078b366ec… |
| armv7 | Node.js | wekan/node-patches | v24.19.0 | verified | 8dbe0a9aa8550ad5… |
| i386 | FerretDB | wekan/FerretDB | v1.54.0 | verified | e80b2672d833d38d… |
| i386 | Node.js | wekan/node-patches | v24.19.0 | verified | 3b0b3bbfe27daf58… |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.54.0 | verified | cac5e99177cb9c98… |
| mac-arm64 | Node.js | nodejs.org | v24.19.0 | verified | 3f1cf157479c1480… |
| mac-x64 | FerretDB | wekan/FerretDB | v1.54.0 | verified | 6a12e289a83c32d4… |
| mac-x64 | Node.js | nodejs.org | v24.19.0 | verified | d35e95230f46f6f0… |
| ppc64le | FerretDB | wekan/FerretDB | v1.54.0 | verified | 1cdde969f9d888b9… |
| ppc64le | Node.js | nodejs.org | v24.19.0 | verified | c510c6ce12f07010… |
| riscv64 | FerretDB | wekan/FerretDB | v1.54.0 | verified | 748372f58a70a3d0… |
| riscv64 | Node.js | unofficial-builds.nodejs.org | v24.19.0 | verified | cd1f14af28121480… |
| s390x | FerretDB | wekan/FerretDB | v1.54.0 | verified | bb6028ef6fc61f86… |
| s390x | Node.js | nodejs.org | v24.19.0 | verified | a4792e65962ffa0a… |
| win-arm64 | FerretDB | wekan/FerretDB | v1.54.0 | verified | 37e005e17eb1c3c7… |
| win-arm64 | Node.js | nodejs.org | v24.19.0 | verified | 8502f4a50b458d4c… |
| win64 | FerretDB | wekan/FerretDB | v1.54.0 | verified | 870c892e7bcab272… |
| win64 | Node.js | nodejs.org | v24.19.0 | verified | 57f71ab3652e797d… |
A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.
v11.07 2026-08-22 WeKan ® release
In short: the TenantBleed, AssignedBleed and CalendarBleed security fixes restrict Organization/Team writes to site admins and make REST and iCalendar card creation follow canonical board-role capabilities. Below that: card-history, destination-picker and riscv64 release-build fixes. The binary table is the v11.06 baseline and will be replaced by this release's verified provenance when its platform builds run.
| Platform | Binary | From | Version | SHA256 |
|---|---|---|---|---|
| amd64 | Node.js | nodejs.org | v24.19.0 | 14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647 |
| amd64 | FerretDB | wekan/FerretDB | v1.53.0 | eae1f0a8f73bfc979738bfff7284d40fd1bc55de2cc56514721fc155c3624f7d |
| arm64 | Node.js | nodejs.org | v24.19.0 | 01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc |
| arm64 | FerretDB | wekan/FerretDB | v1.53.0 | bdc50caee3ac28495b42d2130b94a042a9dd6d3a38f732cac02b648f36c891da |
| mac-arm64 | Node.js | nodejs.org | v24.19.0 | 3f1cf157479c1480352083105e13faf9d008ede98e7e157746b6df940d197b94 |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.53.0 | cb14ffe93e285903e5a8a9c1821687ddb5b8a979a11c584bf4af534b272c6d3e |
| mac-x64 | Node.js | nodejs.org | v24.19.0 | d35e95230f46f6f0751df497c56622c6735e05d5e1fb1630996a005b9d328fe4 |
| mac-x64 | FerretDB | wekan/FerretDB | v1.53.0 | d97dfa9afa60aa05f25384327de82efe7b71d958ed24c1f66618284294a65cd3 |
This release fixes the following MODERATE SECURITY ISSUES:
Organizations and Teams - tenant configuration and its DDP permissions.
Organization and Team DDP writes require a site administrator. Thanks to Char0n1507 and xet7.
Any authenticated user could insert, update or remove an Organization or Team document over Meteor/DDP when its `_id` equalled their user id. The collection allow rules treated document identity as authority without requiring site-admin, tenant-admin or membership privileges, exposing tenant configuration and deletion. All six operations now share one site-admin-only decision; legitimate scoped and internal writes continue through their authorization-enforcing server methods. Refused authenticated attempts are rate-limited, attributed and shown in Admin Panel / Problems. See [GHSA-p4cq-83j9-7g73](https://github.com/wekan/wekan/security/advisories/GHSA-p4cq-83j9-7g73) and [TenantBleed](https://wekan.fi/hall-of-fame/tenantbleed/).REST authorization - the shared permission gate for board mutations.
REST mutations enforce the canonical board write capability. Thanks to Char0n1507 and xet7.
An authenticated Only Assigned Comment member could modify any card through the REST API, even when not assigned to it. The shared REST authorization helper duplicated a list of excluded role flags and omitted `isCommentAssignedOnly`, so every card mutation route using it accepted a role whose canonical policy says `write: false`. The helper and both parallel attachment APIs now use the shared role-capability decision. All non-writing roles are denied, while No Comments and the other legitimate writing roles retain access. Refused attempts are rate-limited, attributed and shown in Admin Panel / Problems. See [GHSA-f396-42fx-vr88](https://github.com/wekan/wekan/security/advisories/GHSA-f396-42fx-vr88) and [AssignedBleed](https://wekan.fi/hall-of-fame/assignedbleed/).iCalendar import - creating cards from calendar events through DDP.
ICS imports require the canonical board write capability. Thanks to Char0n1507 and xet7.
An authenticated Comment Only member could call `importIcsToBoard` over Meteor/DDP and create arbitrary cards. The method checked board membership and excluded only read-only roles, so Comment Only, Only Assigned Comment and Worker members reached card insertion despite the role policy denying them write access. The DDP path now uses the same canonical write-capability helper as its REST sibling. Regression coverage denies all five non-writing roles and confirms that the four legitimate writing roles retain access. Refused attempts are rate-limited, attributed and shown in Admin Panel / Problems. See [GHSA-fpm6-r5fg-2mrg](https://github.com/wekan/wekan/security/advisories/GHSA-fpm6-r5fg-2mrg) and [CalendarBleed](https://wekan.fi/hall-of-fame/calendarbleed/).and fixes the following bugs:
Card details - activity history and destination selection.
Opening Activities shows the complete card history and REST returns every comment. Thanks to rmb82 and xet7.
The removed Activities eye left its old per-card `showActivities: false` value in control, so opening the new caret could still request comments only. Opening the section now always requests its complete history. The comments REST endpoint also validates the card against the requested board before selecting all records by their authoritative `cardId`, so older and imported comments with missing or stale denormalized board metadata are no longer omitted without weakening board isolation. Positive and negative regression tests cover both retrieval paths.Move and Copy Card offer board-global lists in every swimlane. Thanks to rmb82 and xet7.
The destination picker treated a list without a `swimlaneId` as shared only by the default swimlane. It now combines board-global lists with the selected swimlane's own lists for every swimlane, while continuing to exclude lists owned by another swimlane. Regression tests cover both cases and the shared picker used by Move Card and Copy Card.and fixes the following developer-tooling bug:
Queued riscv64 snap builds survive the GitHub job limit. Thanks to xet7.
The Release All log showed no riscv64 compiler or recipe failure: Launchpad kept it pending until GitHub cancelled the runner at its six-hour limit. The workflow now gives its local waiter five hours, then leaves the named Launchpad build running and ends cleanly. Its flattened source commit has deterministic dates, so a later job re-run reconnects to that same build instead of adding another one to the queue. Store and GitHub Release publishing remain gated on a downloaded, architecture-checked squashfs snap. Regression tests cover the stable snapshot identity, the pending hand-off and the no-artifact publishing guard.Thanks to above GitHub users for their contributions and translators for their translations.
