Download Latest Version
wekan-11.72-s390x.zip (286.8 MB)
Get an email when there's a new version of wekan
Binaries in these bundles
Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.
| Bundle | Binary | From | Version | Checked | SHA256 |
|---|---|---|---|---|---|
| amd64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 42b6031e48a6a44c… |
| amd64 | Node.js | nodejs.org | v24.20.0 | verified | 2f2c0da162318f0d… |
| arm64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 930b33cbc83b35cb… |
| arm64 | Node.js | nodejs.org | v24.20.0 | verified | 5f4ddab610c1ab20… |
| armhf | FerretDB | wekan/FerretDB | v1.62.0 | verified | 2963fdfc690f0cca… |
| armhf | Node.js | wekan/node-patches | v24.20.0 | verified | b8ed7065d44f0afe… |
| armv6 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 58f2f6ddff05b951… |
| armv6 | Node.js | wekan/node-patches | v24.20.0 | verified | d5cefa6f8cc4acb1… |
| armv7 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 2963fdfc690f0cca… |
| armv7 | Node.js | wekan/node-patches | v24.20.0 | verified | c04c81e539347f39… |
| i386 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 96919f54f4dabb29… |
| i386 | Node.js | wekan/node-patches | v24.20.0 | verified | bb44927307460dcf… |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | af5707904580f34f… |
| mac-arm64 | Node.js | nodejs.org | v24.20.0 | verified | b7bf7707070b950b… |
| mac-x64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 57dc580ad9b7a8bf… |
| mac-x64 | Node.js | nodejs.org | v24.20.0 | verified | 26fc30891004603d… |
| ppc64le | FerretDB | wekan/FerretDB | v1.62.0 | verified | c93d394f1ce56534… |
| ppc64le | Node.js | nodejs.org | v24.20.0 | verified | 341307dcee20d883… |
| riscv64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 404bee52f8bb86fa… |
| riscv64 | Node.js | unofficial-builds.nodejs.org | v24.20.0 | verified | a149c5bf85f98ff1… |
| s390x | FerretDB | wekan/FerretDB | v1.62.0 | verified | 7edbadece06a4921… |
| s390x | Node.js | nodejs.org | v24.20.0 | verified | ca381121cb5a8d38… |
| win-arm64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 9318c87775c42b41… |
| win-arm64 | Node.js | nodejs.org | v24.20.0 | verified | 31c6799744de8a54… |
| win64 | FerretDB | wekan/FerretDB | v1.62.0 | verified | 25fec66a71c9fe50… |
| win64 | Node.js | nodejs.org | v24.20.0 | verified | 6cac9ffbca8f6a47… |
A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.
v11.20 2026-08-28 WeKan ® release
In short: Translation maintenance commands no longer pass repository filenames through a shell, resolving two CodeQL command-injection findings in standalone tooling. Launchpad snap assembly reuses completed per-architecture bundles and packs them with faster compression, reducing work on scarce builders. Large boards now show card edits and moves immediately without a browser reload. The table below is carried over from the release under this one, and is refilled from each build's provenance.tsv when this release is made.
| Platform | Binary | From | Version | SHA256 |
|---|---|---|---|---|
| amd64 | Node.js | nodejs.org | v24.19.0 | 14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647 |
| amd64 | FerretDB | wekan/FerretDB | v1.53.0 | eae1f0a8f73bfc979738bfff7284d40fd1bc55de2cc56514721fc155c3624f7d |
| arm64 | Node.js | nodejs.org | v24.19.0 | 01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc |
| arm64 | FerretDB | wekan/FerretDB | v1.53.0 | bdc50caee3ac28495b42d2130b94a042a9dd6d3a38f732cac02b648f36c891da |
| mac-arm64 | Node.js | nodejs.org | v24.19.0 | 3f1cf157479c1480352083105e13faf9d008ede98e7e157746b6df940d197b94 |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.53.0 | cb14ffe93e285903e5a8a9c1821687ddb5b8a979a11c584bf4af534b272c6d3e |
| mac-x64 | Node.js | nodejs.org | v24.19.0 | d35e95230f46f6f0751df497c56622c6735e05d5e1fb1630996a005b9d328fe4 |
| mac-x64 | FerretDB | wekan/FerretDB | v1.53.0 | d97dfa9afa60aa05f25384327de82efe7b71d958ed24c1f66618284294a65cd3 |
This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:
Translation Git commands treat repository filenames only as arguments. Thanks to GitHub CodeQL code scanning and xet7.
CodeQL alerts [#439] and [#440] found that the translation merge and English- regression report interpolated Git revisions and locale paths into shell command strings. The supported pull path supplied a snapshot directory and did not reach these commands, but standalone use could interpret shell metacharacters from a contributor-controlled locale filename. Both scripts now invoke Git directly with separate arguments and consume its changed-file list with NUL delimiters. Positive coverage retains normal translation restoration and regression reporting; negative coverage uses a locale filename containing shell syntax and proves neither script executes it.and fixes the following bug:
Large boards refresh after card edits and moves. Thanks to hmeunier95 and xet7.
Lazy card loading kept each sorted, limited window as a one-time snapshot to avoid a FerretDB cursor hang. The snapshot rendered initially, but later card edits and cross-list moves did not publish changes to an already-open board, so the browser showed stale cards until a forced reload. Each window now observes its unrestricted indexed selector and fetches a new bounded snapshot only when a matching card changes. It diffs that snapshot and publishes additions, field changes and removals without overlapping refreshes; the problematic limited live cursor remains unused. Unit coverage checks every diff outcome, including removed fields and unchanged cards, and a forced-lazy browser scenario checks a remote title edit and cross-list move without reload.and improves the following developer tooling:
Launchpad assembles snaps without rebuilding completed bundles. Thanks to xet7.
The s390x, riscv64 and other Launchpad jobs previously downloaded bundles whose dependencies had already been rebuilt and pruned for their target architecture, deleted that completed dependency tree, installed an npm build toolchain and repeated the entire installation through the build-farm proxy. Snap assembly now uses the no-op plugin, retains the prepared dependency tree and omits the unnecessary compiler and npm packages. Both maintained base definitions also select LZO instead of the slower default XZ compression for the large final SquashFS, trading a larger download for faster packing and cold startup. Regression coverage pins the prebuilt-bundle boundary, the absent npm commands and build packages, and the compression choice.Thanks to above GitHub users for their contributions and translators for their translations.
