Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.

Bundle	Binary	From	Version	Checked	SHA256
amd64	FerretDB	wekan/FerretDB	v1.62.0	verified	42b6031e48a6a44c…
amd64	Node.js	nodejs.org	v24.20.0	verified	2f2c0da162318f0d…
arm64	FerretDB	wekan/FerretDB	v1.62.0	verified	930b33cbc83b35cb…
arm64	Node.js	nodejs.org	v24.20.0	verified	5f4ddab610c1ab20…
armhf	FerretDB	wekan/FerretDB	v1.62.0	verified	2963fdfc690f0cca…
armhf	Node.js	wekan/node-patches	v24.19.0	verified	46509e82e4f08d0d…
armv6	FerretDB	wekan/FerretDB	v1.62.0	verified	58f2f6ddff05b951…
armv6	Node.js	wekan/node-patches	v24.19.0	verified	1a76291e8edfd5c0…
armv7	FerretDB	wekan/FerretDB	v1.62.0	verified	2963fdfc690f0cca…
armv7	Node.js	wekan/node-patches	v24.19.0	verified	1303fbc89fb187c1…
i386	FerretDB	wekan/FerretDB	v1.62.0	verified	96919f54f4dabb29…
i386	Node.js	wekan/node-patches	v24.19.0	verified	c94bc7fc2713b22c…
mac-arm64	FerretDB	wekan/FerretDB	v1.62.0	verified	af5707904580f34f…
mac-arm64	Node.js	nodejs.org	v24.20.0	verified	b7bf7707070b950b…
mac-x64	FerretDB	wekan/FerretDB	v1.62.0	verified	57dc580ad9b7a8bf…
mac-x64	Node.js	nodejs.org	v24.20.0	verified	26fc30891004603d…
ppc64le	FerretDB	wekan/FerretDB	v1.62.0	verified	c93d394f1ce56534…
ppc64le	Node.js	nodejs.org	v24.20.0	verified	341307dcee20d883…
riscv64	FerretDB	wekan/FerretDB	v1.62.0	verified	404bee52f8bb86fa…
riscv64	Node.js	unofficial-builds.nodejs.org	v24.20.0	verified	a149c5bf85f98ff1…
s390x	FerretDB	wekan/FerretDB	v1.62.0	verified	7edbadece06a4921…
s390x	Node.js	nodejs.org	v24.20.0	verified	ca381121cb5a8d38…
win-arm64	FerretDB	wekan/FerretDB	v1.62.0	verified	9318c87775c42b41…
win-arm64	Node.js	nodejs.org	v24.20.0	verified	31c6799744de8a54…
win64	FerretDB	wekan/FerretDB	v1.62.0	verified	25fec66a71c9fe50…
win64	Node.js	nodejs.org	v24.20.0	verified	6cac9ffbca8f6a47…

A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.

v11.15 2026-08-27 WeKan ® release

In short: Three authentication boundaries now prevent OIDC claim-based account takeover, logged-out membership discovery and account-recovery floods. Blocked metadata probes and recovery throttles appear in Problems. Nine translations are now complete, replacing 18,653 English placeholders while preserving human translations, format tokens and markup exactly. Cross-board card moves retain newly created destinations and assign stable positions.

Platform	Binary	From	Version	SHA256
amd64	Node.js	nodejs.org	v24.19.0	14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647
amd64	FerretDB	wekan/FerretDB	v1.53.0	eae1f0a8f73bfc979738bfff7284d40fd1bc55de2cc56514721fc155c3624f7d
arm64	Node.js	nodejs.org	v24.19.0	01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc
arm64	FerretDB	wekan/FerretDB	v1.53.0	bdc50caee3ac28495b42d2130b94a042a9dd6d3a38f732cac02b648f36c891da
mac-arm64	Node.js	nodejs.org	v24.19.0	3f1cf157479c1480352083105e13faf9d008ede98e7e157746b6df940d197b94
mac-arm64	FerretDB	wekan/FerretDB	v1.53.0	cb14ffe93e285903e5a8a9c1821687ddb5b8a979a11c584bf4af534b272c6d3e
mac-x64	Node.js	nodejs.org	v24.19.0	d35e95230f46f6f0751df497c56622c6735e05d5e1fb1630996a005b9d328fe4
mac-x64	FerretDB	wekan/FerretDB	v1.53.0	d97dfa9afa60aa05f25384327de82efe7b71d958ed24c1f66618284294a65cd3

This release fixes the following CRITICAL SECURITY ISSUES:

OIDC identities - access-token metadata cannot replace trusted account identity.

Whitelisted token claims cannot overwrite service-owned fields. Thanks to crypto-nidh and xet7.

[ClaimBleed](https://wekan.fi/hall-of-fame/claimbleed/) blocked access-token claims from replacing the trusted userinfo id, username, email and related service-owned values, which could otherwise link an attacker's OIDC session to a victim. Prototype keys and WeKan's token bookkeeping are protected too, while ordinary whitelisted profile metadata continues to merge. There is no Problems event because every legitimate OIDC login uses this path and a bad claim cannot be distinguished from an administrator's mistaken whitelist. Positive behavioral coverage pins safe metadata and a negative whole-package scan prevents any bulk assignment into `serviceData`.

User metadata - sensitive membership and authentication fields require login.

Logged-out clients cannot subscribe to authentication metadata. Thanks to crypto-nidh and xet7.

[MembershipBleed](https://wekan.fi/hall-of-fame/membershipbleed/) made the `user-authenticationMethod` publication return ready without querying whenever the DDP connection has no authenticated user. This closes enumeration of authentication methods, teams and organizations. Denied probes are safely folded into one MembershipBleed summary in Admin Panel → Problems with their source address. Positive ordering coverage pins the guard before the query, and a negative scan requires every sensitive user publication to retain a login boundary.

Account recovery - unauthenticated email and token methods are bounded by address.

Recovery and verification DDP calls are rate-limited. Thanks to crypto-nidh and xet7.

[ResetBleed](https://wekan.fi/hall-of-fame/resetbleed/) limits each source address to five `forgotPassword` or `resetPassword` calls and ten `verifyEmail` calls per minute, stopping unbounded email floods, enumeration loops and token guessing. Only refused requests are folded into a ResetBleed Problems summary; ordinary recovery use is never logged, and a logging failure cannot weaken the denial. Behavioral tests cover allowed and refused decisions, while negative source coverage prevents any recovery method from escaping the shared callback.

and fixes the following bug:

Move Card keeps newly created destination boards selectable. Thanks to rlach and xet7.

The Move Card and Copy Card dialogs now own an authorization-filtered live destination subscription and query its Minimongo results reactively. A board created through WeKan therefore remains in the selector instead of disappearing behind a cached empty result. The [#2494](https://github.com/wekan/wekan/issues/2494) regression creates the destination board, list and cards through the visible UI, uses the real Move Card dialog, verifies finite unique sort values in the database, and confirms every card remains visible in Chromium, Firefox and WebKit. A negative publication test also pins active membership and excludes unrelated public boards.

and completes the following translations:

Hausa - every interface area now uses Hausa instead of English placeholders.

The remaining Hausa interface is translated. Thanks to xet7.

Across 27 direct-translation batches, 1,317 remaining values gained Hausa activity, board, card, automation, account, search, report, storage, migration and problem-management vocabulary. Whole-locale regression coverage verifies that no English placeholders remain and that named and formatted tokens and HTML tags match English exactly; the human-preference suite proves a future Transifex translation still replaces a direct fill while existing human work cannot be overwritten.

Haitian Creole - the complete interface is available in Kreyòl ayisyen.

Every remaining interface value is translated. Thanks to xet7.

Across 44 direct-translation batches, all 2,167 placeholders gained Haitian Creole wording for activity, workspaces, cards, imports, automation, search, administration, storage and migrations. Whole-locale regression coverage pins zero remaining placeholders and exact token and markup inventories, while the shared negative tests protect human translations from direct fills.

Icelandic - every interface area now has Icelandic wording.

Every remaining interface value is translated. Thanks to xet7.

Across 44 direct-translation batches, all 2,167 placeholders gained Icelandic activity, board, import, automation, search, reporting, storage and migration terms. The locale regression proves completion and exact code-token and markup preservation; shared negative coverage ensures fills cannot replace human translations.

Inuktitut - the complete interface is available in Inuktitut syllabics.

Every remaining interface value is translated. Thanks to xet7.

Across 44 direct-translation batches, all 2,167 placeholders gained Inuktitut wording spanning the full board, card, automation, search, administration, storage and migration interface. Regression coverage checks zero remaining English values, preserves the syllabic-script requirement and compares every code token and HTML tag with English, including negative human-preference tests.

Javanese - every interface area now uses Javanese.

Every remaining interface value is translated. Thanks to xet7.

Across 44 direct-translation batches, all 2,167 placeholders gained Javanese activity, workspace, board, import, automation, search, report, storage and migration vocabulary. Whole-locale regression coverage pins completion and exact placeholders and markup; shared negative tests protect human translations.

Kazakh - every interface area now uses Kazakh and its expected script.

Every remaining interface value is translated. Thanks to xet7.

Across 44 direct-translation batches, all 2,167 placeholders gained Kazakh wording throughout activity, boards, imports, automation, search, reporting, storage and migrations. The locale regression verifies completion, Cyrillic vocabulary and exact code-token and markup inventories; shared negative tests continue protecting human translations.

Greenlandic - the whole interface is now available in Kalaallisut.

Every remaining interface value is translated. Thanks to xet7.

Across 44 direct-translation batches, all 2,167 placeholders gained Greenlandic activity, board, import, automation, search, reporting, storage and migration terms. Whole-locale coverage verifies zero English placeholders and exact token and markup inventories, with shared negative tests preventing replacement of human translations.

Kannada - every interface area now uses Kannada and its native script.

Every remaining interface value is translated. Thanks to xet7.

Across 62 direct-translation batches, all 2,167 placeholders gained Kannada wording for boards, cards, imports, automation, search, administration, storage and migration operations. Regression coverage verifies completion, Kannada script and exact token and markup preservation; shared negative tests protect human translations from direct fills.

Konkani - the complete interface now uses Devanagari Konkani.

Every remaining interface value is translated. Thanks to xet7.

Across 56 direct-translation batches, all 2,167 placeholders gained Konkani activity, board, import, automation, search, reporting, storage, migration and problem-repair vocabulary. The locale regression verifies completion, Devanagari vocabulary and every code token and HTML tag against English; shared negative coverage ensures direct fills cannot overwrite human translations.

Thanks to above GitHub users for their contributions and translators for their translations.