Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.

Bundle	Binary	From	Version	Checked	SHA256
amd64	FerretDB	wekan/FerretDB	v1.62.0	verified	42b6031e48a6a44c…
amd64	Node.js	nodejs.org	v24.20.0	verified	2f2c0da162318f0d…
arm64	FerretDB	wekan/FerretDB	v1.62.0	verified	930b33cbc83b35cb…
arm64	Node.js	nodejs.org	v24.20.0	verified	5f4ddab610c1ab20…
armhf	FerretDB	wekan/FerretDB	v1.62.0	verified	2963fdfc690f0cca…
armhf	Node.js	wekan/node-patches	v24.20.0	verified	b8ed7065d44f0afe…
armv6	FerretDB	wekan/FerretDB	v1.62.0	verified	58f2f6ddff05b951…
armv6	Node.js	wekan/node-patches	v24.20.0	verified	d5cefa6f8cc4acb1…
armv7	FerretDB	wekan/FerretDB	v1.62.0	verified	2963fdfc690f0cca…
armv7	Node.js	wekan/node-patches	v24.20.0	verified	c04c81e539347f39…
i386	FerretDB	wekan/FerretDB	v1.62.0	verified	96919f54f4dabb29…
i386	Node.js	wekan/node-patches	v24.20.0	verified	bb44927307460dcf…
mac-arm64	FerretDB	wekan/FerretDB	v1.62.0	verified	af5707904580f34f…
mac-arm64	Node.js	nodejs.org	v24.20.0	verified	b7bf7707070b950b…
mac-x64	FerretDB	wekan/FerretDB	v1.62.0	verified	57dc580ad9b7a8bf…
mac-x64	Node.js	nodejs.org	v24.20.0	verified	26fc30891004603d…
ppc64le	FerretDB	wekan/FerretDB	v1.62.0	verified	c93d394f1ce56534…
ppc64le	Node.js	nodejs.org	v24.20.0	verified	341307dcee20d883…
riscv64	FerretDB	wekan/FerretDB	v1.62.0	verified	404bee52f8bb86fa…
riscv64	Node.js	unofficial-builds.nodejs.org	v24.20.0	verified	a149c5bf85f98ff1…
s390x	FerretDB	wekan/FerretDB	v1.62.0	verified	7edbadece06a4921…
s390x	Node.js	nodejs.org	v24.20.0	verified	ca381121cb5a8d38…
win-arm64	FerretDB	wekan/FerretDB	v1.62.0	verified	9318c87775c42b41…
win-arm64	Node.js	nodejs.org	v24.20.0	verified	31c6799744de8a54…
win64	FerretDB	wekan/FerretDB	v1.62.0	verified	25fec66a71c9fe50…
win64	Node.js	nodejs.org	v24.20.0	verified	6cac9ffbca8f6a47…

A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.

v11.17 2026-08-28 WeKan ® release

In short: HostnameBleed, found by GitHub CodeQL, makes tenant-hostname translation coverage compare example domains as exact text. Card titles keep markdown links clickable and mouse text selection native, while comment markdown retains its per-render fallback. REST user deletion now reports the database-confirmed outcome and documents both success and missing-user responses. Translations complete Swati, begin Sesotho and raise the measured essentially-complete total to 197 while protecting target-language vocabulary and code tokens. The table below is carried over from the release under this one, and is refilled from each build's provenance.tsv when this release is made.

Platform	Binary	From	Version	SHA256
amd64	Node.js	nodejs.org	v24.19.0	14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647
amd64	FerretDB	wekan/FerretDB	v1.53.0	eae1f0a8f73bfc979738bfff7284d40fd1bc55de2cc56514721fc155c3624f7d
arm64	Node.js	nodejs.org	v24.19.0	01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc
arm64	FerretDB	wekan/FerretDB	v1.53.0	bdc50caee3ac28495b42d2130b94a042a9dd6d3a38f732cac02b648f36c891da
mac-arm64	Node.js	nodejs.org	v24.19.0	3f1cf157479c1480352083105e13faf9d008ede98e7e157746b6df940d197b94
mac-arm64	FerretDB	wekan/FerretDB	v1.53.0	cb14ffe93e285903e5a8a9c1821687ddb5b8a979a11c584bf4af534b272c6d3e
mac-x64	Node.js	nodejs.org	v24.19.0	d35e95230f46f6f0751df497c56622c6735e05d5e1fb1630996a005b9d328fe4
mac-x64	FerretDB	wekan/FerretDB	v1.53.0	d97dfa9afa60aa05f25384327de82efe7b71d958ed24c1f66618284294a65cd3

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

HostnameBleed: tenant hostname examples are compared as exact text. Thanks to GitHub CodeQL code scanning and xet7.

[HostnameBleed](https://wekan.fi/hall-of-fame/hostnamebleed/) covers code scanning alerts \#435 and \#436, rule `js/incomplete-hostname-regexp` (CWE-20), in `tests/marathiTranslationProgress.test.cjs`. The test passed `a.example.com` and `kanban.example.org` directly to `RegExp`, so each dot acted as a wildcard. A wrong hostname such as `aXexampleXcom` could therefore satisfy coverage that was meant to require the exact documentation example. The affected code runs only in a translation regression test over hardcoded strings. It is not shipped in the server or browser bundle, accepts no request or user input and denies no operation, so there is no attributable runtime attempt to record in Admin Panel → Problems. The test now uses exact `includes()` comparisons. Positive and negative cases prove literal dots are required, while a repository-wide source guard detects the reported loop-to-`RegExp` shape and confirms it exists nowhere else in tracked first-party JavaScript.

and fixes the following bugs:

Card titles - links, editing and mouse selection remain distinct gestures.

Markdown links in minicard titles remain clickable. Thanks to jullbo and xet7.

The fixed-width transparent edit overlay previously covered the leading half of every title, which swallowed every pixel of a short rendered markdown link. The title container itself is now the edit target, while nested viewer links receive and stop their own click before editing can open. Keyboard access remains on the title container, and its focus semantics are preserved. Positive and negative source tests cover the event boundary; a live Chromium regression edits a title to a markdown link, clicks it, and proves that the editor stays closed.

Mouse dragging in card title editors selects text. Thanks to rmb82 and xet7.

Card sorting and opened-card window dragging previously claimed mouse gestures that began inside a title textarea. Those editors and their controls are now excluded from sorting, and the window-drag handler returns before suppressing the browser's native selection behavior. Source regressions pin both drag boundaries. A live Chromium test drags across an opened-card title, verifies a non-empty selection range and confirms the card window did not move.

Card interaction regressions use stable browser targets. Thanks to jullbo, rmb82 and xet7.

Specs that open a card now activate the shared wrapper-link helper instead of clicking title text, whose intended action is inline editing. The Firefox mouse selection regression keeps both drag coordinates over rendered title text, and the failed-copy negative check uses the stable board canvas rather than a strict union that fails when both healthy regions are visible. The affected title-selection, failed-copy, LTR/RTL card-panel and board-comment paths pass together in a fresh Chromium run. Firefox and WebKit remain covered by the full Docker browser matrix.

Comments and Activities - one markdown render cannot blank surrounding UI.

Comment markdown retains its independent rendering fallback. Thanks to rmb82 and xet7.

The per-render exception boundary already added in `75a23b76a` catches markdown or sanitization failures and returns safe escaped text, so one bad comment does not abort the card comment list or Activities rendering. The reported French emphasis, list and literal greater-than forms now run through the real shipped markdown configuration as explicit regression coverage.

REST API - user deletion responses reflect the authoritative database result.

User deletion confirms removal and reports missing users. Thanks to AhmedLukman and xet7.

The route previously discarded `removeAsync`'s result and returned the requested id even when no account matched. It now returns 200 only when exactly one user was removed, returns a deterministic 404 for zero matches and treats unexpected counts or database failures as internal errors. Repeatable response annotations let the OpenAPI generator document the exact 200 and 404 response bodies. Unit and negative tests cover authorization and every removal outcome, regenerated YAML matches the route source byte for byte, and a live Chromium API test confirms deletion in MongoDB before repeating the request and receiving 404.

and improves the following translations:

Translations - Swati reaches completion, Sesotho begins and measured completion assertions stay current.

Swati is complete. Thanks to xet7.

The remaining 417 Swati strings now cover jobs, storage, migrations, backups, privacy, monitoring, repositories and imports. A same-script vocabulary audit also replaces the Zulu word `ibhodi` with the Swati `libhodi`. Regression coverage proves the locale has no English placeholders, preserves the exact source placeholder and HTML inventories and uses Swati vocabulary. These direct translations have lower confidence than reviewed human work and remain open to correction by Swati speakers.

Sesotho translation begins with core board activity. Thanks to xet7.

The first 50 Sesotho strings translate activity titles and descriptions, members, comments, dates, attachments, labels, checklists, custom fields, archives and imports. Source placeholders remain exact, and a language-specific regression checks Sesotho vocabulary while recording the 2,117 strings still untranslated at this commit.

Translation completion assertions match the measured files. Thanks to xet7.

The translation documentation now reports 197 essentially complete locales, and the Northern Sotho regression expects its measured zero remaining English placeholders. Tests calculate these values from the locale files so stale completion claims fail visibly.

Thanks to above GitHub users for their contributions and translators for their translations.