Download Latest Version
wekan-11.72-s390x.zip (286.8 MB)
Get an email when there's a new version of wekan
Binaries in these bundles
Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.
| Bundle | Binary | From | Version | Checked | SHA256 |
|---|---|---|---|---|---|
| amd64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 42b6031e48a6a44c… |
| amd64 | Node.js | nodejs.org | v24.20.0 | verified | 2f2c0da162318f0d… |
| arm64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 930b33cbc83b35cb… |
| arm64 | Node.js | nodejs.org | v24.20.0 | verified | 5f4ddab610c1ab20… |
A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.
v11.19 2026-08-28 WeKan ® release
In short: HostnameBleed regression coverage now checks documented hostnames as exact parsed tokens, resolving two follow-up CodeQL findings in test-only code. Test-matrix reliability covers resumed profile languages, speech scrolling, local Node discovery and bounded reusable AppImage jobs. Translations now merge valid Transifex human work over local fills without uploading machine translations as human, and recover human values displaced after mass filling. The table below is carried over from the release under this one, and is refilled from each build's provenance.tsv when this release is made.
| Platform | Binary | From | Version | SHA256 |
|---|---|---|---|---|
| amd64 | Node.js | nodejs.org | v24.19.0 | 14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647 |
| amd64 | FerretDB | wekan/FerretDB | v1.53.0 | eae1f0a8f73bfc979738bfff7284d40fd1bc55de2cc56514721fc155c3624f7d |
| arm64 | Node.js | nodejs.org | v24.19.0 | 01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc |
| arm64 | FerretDB | wekan/FerretDB | v1.53.0 | bdc50caee3ac28495b42d2130b94a042a9dd6d3a38f732cac02b648f36c891da |
| mac-arm64 | Node.js | nodejs.org | v24.19.0 | 3f1cf157479c1480352083105e13faf9d008ede98e7e157746b6df940d197b94 |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.53.0 | cb14ffe93e285903e5a8a9c1821687ddb5b8a979a11c584bf4af534b272c6d3e |
| mac-x64 | Node.js | nodejs.org | v24.19.0 | d35e95230f46f6f0751df497c56622c6735e05d5e1fb1630996a005b9d328fe4 |
| mac-x64 | FerretDB | wekan/FerretDB | v1.53.0 | d97dfa9afa60aa05f25384327de82efe7b71d958ed24c1f66618284294a65cd3 |
This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:
It compares hostname examples as exact parsed tokens. Thanks to GitHub CodeQL code scanning and xet7.
CodeQL alerts [#437] and [#438] reported incomplete URL substring sanitization in the HostnameBleed regression test. The findings were limited to fixed test data: no request, user input or runtime application path reached these assertions. Parsing the example list and comparing its complete tokens avoids ambiguous URL substring checks while retaining positive coverage and a negative check for the wildcard lookalikes that the original HostnameBleed fix rejects.and improves the following developer tooling:
Test matrix - local tool discovery and bounded workflows keep every stage running against the intended versions.
The WeKan matrix covers resumed languages, speech scrolling and AppImage timeouts reliably. Thanks to xet7.
Persisted profile languages now apply reactively when a stored login finishes resuming, so Chinese and Japanese accessibility checks observe the user's real locale instead of the browser default. The speech-command regression gives its focusable list a deterministic overflow boundary before testing Page Down. GitHub does not allow `timeout-minutes` on a job that calls a reusable workflow, so the release guard now recognizes that syntax and separately proves every job inside the called AppImage workflow has its own timeout. The previously unbounded release lookup and publishing jobs are limited to 15 and 30 minutes.Tests retain an installed local Node across Dockerfile version bumps. Thanks to xet7.
The test runner previously added only the exact Node version named by the Dockerfile to `PATH`. When that version had just advanced beyond the toolchain already downloaded under `.tools`, the plain import stage could not find Node and Playwright version discovery silently selected its obsolete 1.60 fallback for dependencies that required 1.62.1. It now selects the newest installed architecture-matching local Node until setup downloads the exact release. A regression pins the fallback, version-aware ordering and exported path used by every subsequent test stage.and improves the translation workflow:
Translation precedence - human work stays preferred without trusting wrong-language or provenance-unknown values.
Transifex human translations safely take precedence over local fills. Thanks to translators and xet7.
The pull previously treated every committed non-English value as human and force-pushed restored languages, so direct machine/LLM fills could be uploaded to Transifex under false provenance. It also compared against `HEAD`, allowing an uncommitted local fill to be lost before the merge saw it. The workflow now snapshots the complete pre-pull tree, keeps each valid target-language Transifex value, and restores the snapshot wherever Transifex returns English or malformed code tokens. Nothing is pushed automatically. Known Russian-seeded Mongolian values are rejected even though both languages use Cyrillic, and protected `@PH…@` markers are restored without discarding the surrounding human prose. The interrupted pull merged 47 non-English human values across 29 locale files and four new source keys into eleven English variants. All available local fallbacks remain; the result has zero detected wrong-script values, placeholder markers or local translations lost to English.Pre-fill human translations displaced by bad Transifex values return. Thanks to translators and xet7.
A history audit compared every non-English value at the final pre-mass-fill boundary with the current locale files. Of 31 differences, seventeen are newer valid Spanish, Kinyarwanda or Traditional Chinese human translations and remain preferred. Fourteen older human values had regressed: Breton, Occitan, Volapük, Walloon, Wolof and Tamazight received French; Welsh retained an English word; Xhosa gained malformed prose; and three French variants received a broken placeholder example. Those fourteen exact historical values are restored. A reproducible audit pins the reviewed boundary and keys, while the pull merge rejects the known bad fingerprints on recurrence without blocking a future corrected Transifex human translation.Reviewed human values are restored after Transifex markers are decoded. Thanks to translators and xet7.
The first corrected live pull exposed an ordering edge case: eight known bad Welsh, French and Xhosa values arrived with protected `@PH…@` markers, so their bad-value fingerprints did not exist until marker repair ran after the merge. The workflow now performs the reviewed historical-human restoration after that decoding step. The eight regressions from the run were restored, and a test pins the required stage order. A subsequent clean live run pulled all 147 Transifex locales, restored 4,976 local fallback values across 124 files, decoded 43 protected markers in 31 values and restored the eight reviewed human values. It pushed nothing, left no working-tree difference and finished with zero displaced historical translations, machine markers or detected wrong-script values.Unsafe translation push scripts are removed. Thanks to xet7.
The bulk, single-locale and English-copy helpers all force-pushed complete local locale files to Transifex. Because those files intentionally combine human work with direct machine/LLM fallbacks, the helpers could publish provenance-unknown values as human translations and overwrite newer community work. Removing them makes the supported workflow pull-only for target translations; the separate English-source upload remains available. Regression coverage rejects any translation shell script that invokes a target-translation push and also pins the intentional source-only command.Thanks to above GitHub users for their contributions and translators for their translations.
