Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.

Bundle	Binary	From	Version	Checked	SHA256
amd64	FerretDB	wekan/FerretDB	v1.63.0	verified	c9570b1b849d5066…
amd64	Node.js	nodejs.org	v24.20.0	verified	2f2c0da162318f0d…
arm64	FerretDB	wekan/FerretDB	v1.63.0	verified	019d60c6d2bcee74…
arm64	Node.js	nodejs.org	v24.20.0	verified	5f4ddab610c1ab20…
armhf	FerretDB	wekan/FerretDB	v1.63.0	verified	c1bad8f4e7f25f9b…
armhf	Node.js	wekan/node-patches	v24.20.0	verified	b8ed7065d44f0afe…
armv6	FerretDB	wekan/FerretDB	v1.63.0	verified	136db594daa70e2c…
armv6	Node.js	wekan/node-patches	v24.20.0	verified	d5cefa6f8cc4acb1…
armv7	FerretDB	wekan/FerretDB	v1.63.0	verified	c1bad8f4e7f25f9b…
armv7	Node.js	wekan/node-patches	v24.20.0	verified	c04c81e539347f39…
i386	FerretDB	wekan/FerretDB	v1.63.0	verified	97053d14788ed4e3…
i386	Node.js	wekan/node-patches	v24.20.0	verified	bb44927307460dcf…
mac-arm64	FerretDB	wekan/FerretDB	v1.63.0	verified	a2b66ee8a97c8143…
mac-arm64	Node.js	nodejs.org	v24.20.0	verified	b7bf7707070b950b…
mac-x64	FerretDB	wekan/FerretDB	v1.63.0	verified	97d3963b4dc30ef9…
mac-x64	Node.js	nodejs.org	v24.20.0	verified	26fc30891004603d…
ppc64le	FerretDB	wekan/FerretDB	v1.63.0	verified	ba5550302c335b1a…
ppc64le	Node.js	nodejs.org	v24.20.0	verified	341307dcee20d883…
riscv64	FerretDB	wekan/FerretDB	v1.63.0	verified	8041097ac56de1cd…
riscv64	Node.js	unofficial-builds.nodejs.org	v24.20.0	verified	a149c5bf85f98ff1…
s390x	FerretDB	wekan/FerretDB	v1.63.0	verified	5cd8100052c464d9…
s390x	Node.js	nodejs.org	v24.20.0	verified	ca381121cb5a8d38…
win-arm64	FerretDB	wekan/FerretDB	v1.63.0	verified	d931ecbc30b8aac5…
win-arm64	Node.js	nodejs.org	v24.20.0	verified	31c6799744de8a54…
win64	FerretDB	wekan/FerretDB	v1.63.0	verified	0439d99053a12151…
win64	Node.js	nodejs.org	v24.20.0	verified	6cac9ffbca8f6a47…

A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.

v11.21 2026-08-29 WeKan ® release

In short: File responses and board writes close three security gaps. Database launchers use FerretDB's write-notified OpLog with an explicit standalone fallback, while DEBUGSPEED diagnostics make comparative MongoDB/FerretDB traffic runs measurable, and FerretDB board creation and loading now complete reliably on a restored large dataset despite a small remaining delay. Card date badges share one self-cleaning minute ticker, translations render bundled English without waiting for database overrides, minicard composers and board creation save from the form the user submitted, database selectors no longer accommodate FerretDB query-planner gaps, and Snap assembly uses the correct extracted release bundle on every architecture. Regression coverage now preserves translation placeholders and accepts the bounded delivery time observed with a restored database.

Platform	Binary	From	Version	SHA256
amd64	Node.js	nodejs.org	v24.19.0	14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647
amd64	FerretDB	wekan/FerretDB	v1.53.0	eae1f0a8f73bfc979738bfff7284d40fd1bc55de2cc56514721fc155c3624f7d
arm64	Node.js	nodejs.org	v24.19.0	01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc
arm64	FerretDB	wekan/FerretDB	v1.53.0	bdc50caee3ac28495b42d2130b94a042a9dd6d3a38f732cac02b648f36c891da
mac-arm64	Node.js	nodejs.org	v24.19.0	3f1cf157479c1480352083105e13faf9d008ede98e7e157746b6df940d197b94
mac-arm64	FerretDB	wekan/FerretDB	v1.53.0	cb14ffe93e285903e5a8a9c1821687ddb5b8a979a11c584bf4af534b272c6d3e
mac-x64	Node.js	nodejs.org	v24.19.0	d35e95230f46f6f0751df497c56622c6735e05d5e1fb1630996a005b9d328fe4
mac-x64	FerretDB	wekan/FerretDB	v1.53.0	d97dfa9afa60aa05f25384327de82efe7b71d958ed24c1f66618284294a65cd3

This release fixes the following CRITICAL SECURITY ISSUES:

File responses - stored MIME metadata cannot turn downloads into active content.

Avatar MIME metadata cannot serve browser-executable content. Thanks to crypto-nidh and xet7.

[AvatarMimeBleed](https://wekan.fi/hall-of-fame/avatarmimebleed/) - [GHSA-4mjm-vj9f-p629](https://github.com/wekan/wekan/security/advisories/GHSA-4mjm-vj9f-p629), Moderate, CWE-79 and CWE-434. Both current and CollectionFS-compatible avatar routes trusted their stored MIME type. HTML, XML, SVG or JavaScript content could therefore render under the WeKan origin. A shared policy now serves every browser-executable type as a sandboxed opaque download with `nosniff` and frame denial, while safe images remain inline. No Problems event is emitted because legitimate avatar views use this path and cannot attribute old metadata to an attacker. Behavioral tests cover every dangerous family, and a whole-route negative scan forbids stored MIME fields from reaching `Content-Type` directly.

Legacy attachments apply security headers beyond SVG files. Thanks to crypto-nidh and xet7.

[LegacyAttachBleed](https://wekan.fi/hall-of-fame/legacyattachbleed/) - [GHSA-xcxp-hx9w-q5q9](https://github.com/wekan/wekan/security/advisories/GHSA-xcxp-hx9w-q5q9), Moderate, CWE-79 and CWE-693. The legacy attachment route forced downloads but applied CSP, `nosniff` and frame denial only to SVG filenames, leaving stored HTML, XML and JavaScript MIME types active. It now uses the same centralized opaque-download policy as avatars. There is no attributable Problems event: ordinary legacy downloads use the same path, and logging would blame a viewer for metadata supplied earlier. Positive MIME decisions and the repository-wide negative response-header scan cover the fix.

Board structure - creating a swimlane requires the shared write capability.

Read-only members cannot create default swimlanes. Thanks to crypto-nidh and xet7.

[SwimlaneBleed](https://wekan.fi/hall-of-fame/swimlanebleed/) - [GHSA-2x89-6mq2-834r](https://github.com/wekan/wekan/security/advisories/GHSA-2x89-6mq2-834r), Moderate, CWE-862. `ensureDefaultSwimlane` authorized an insertion with read membership, bypassing the collection's write rule and allowing read-only roles to alter board structure. The method now requires the same shared write capability as every swimlane mutation. Rejected direct calls are bounded and summarized as SwimlaneBleed in Admin Panel → Problems, and logging failure cannot weaken the denial. Tests pin the guard before insertion and forbid read membership or public visibility from authorizing the method.

and improves the following database deployment configuration:

Database launchers - bundled processes use the correct reactive mode.

Keep FerretDB launchers standalone and polling-only. Thanks to xet7.

The bundle, Windows, container entrypoint and every FerretDB v1 Compose backend now clear inherited OpLog settings and start without replica-set arguments. MongoDB 7 keeps its explicit `rs0` connection, while the Meteor 3 multitenancy guide gains an idempotent replica-set initializer and scoped OpLog credentials. Positive and negative regression tests pin the separation.

Enable FerretDB's write-notified OpLog reactivity by default. Thanks to xet7.

The Snap and DEBUGSPEED launcher now start FerretDB as a single-node replica set and give Meteor an OpLog URL, using `oplog,polling` without attempting unsupported change streams. FerretDB wakes idle `awaitData` tails when a write actually appends an OpLog record and emits directly applicable replacement updates, eliminating the SQLite query loop and invalid whole-document `$set` that previously made polling the safer default. Setting `wekan-ferretdb-oplog=false` retains the standalone polling fallback. The [FerretDB write notification fix](https://github.com/wekan/FerretDB/commit/d0d4717e) has broadcast, gate and update-shape coverage. Its follow-up [idle-tail fix](https://github.com/wekan/FerretDB/commit/de4495e1) makes cursors wait before querying and repairs the logical timestamp index on older OpLogs. The [filled-batch fix](https://github.com/wekan/FerretDB/commit/f7aec79e) returns a notified OpLog batch before waiting for another write, so reactive board lists and newly opened boards cannot remain one mutation behind. A restored large-dataset run confirms that creating a board, receiving its tile and opening it now work reliably; a small query delay remains but does not prevent completion. The [projection fix](https://github.com/wekan/FerretDB/commit/99f33658) avoids recursively decoding unrequested large fields during selective collection scans, and its [ID follow-up](https://github.com/wekan/FerretDB/commit/ad9bb910) retains MongoDB's implicit `_id` through the internal projection pipeline. The [distinct optimization](https://github.com/wekan/FerretDB/commit/dcd7e4b1) also decodes only its result path and filter fields instead of every complete candidate document. Its [SQLite pushdown](https://github.com/wekan/FerretDB/commit/27803d83) now constructs minimal result documents and collapses duplicate top-level keys before they cross into Go. Its [indexed follow-up](https://github.com/wekan/FerretDB/commit/42df9f82) selects an existing distinct-key index and labels slow query shapes by their originating command. The [linear deduplication follow-up](https://github.com/wekan/FerretDB/commit/72204026) sorts once and compacts adjacent equal BSON values instead of repeatedly scanning the growing result array; 45,640 unique values now compact in about 5–18 milliseconds instead of consuming 15–17 seconds. The [raw-value SQLite follow-up](https://github.com/wekan/FerretDB/commit/019b354e) deduplicates schema/value pairs before constructing SJSON, reducing the restored 299,539-card `distinct(listId)` SQL workload from 3.60 to 2.94 seconds while preserving all 41,875 BSON-distinct values. The [full-document decoder optimization](https://github.com/wekan/FerretDB/commit/6acac87c) reuses bounded parsed schemas and avoids a streaming decoder allocation for each common scalar. Its [allocation follow-up](https://github.com/wekan/FerretDB/commit/99b02d10) uses direct full-document JSON parsing, strict scalar conversion and preallocated ordered fields, cutting the representative decoder benchmark from 617 to 561 allocations and about 53 KB to 44 KB per document. The [hot-schema and indexed-write optimization](https://github.com/wekan/FerretDB/commit/4427a2e2) replaces the cache's periodic full flush with a bounded 4,096-entry LRU; across the restored 299,539-card dataset it reduced isolated complete decoding from 35.1 seconds to 17.2–19.0 seconds. It also makes SQLite updates and deletes use the existing unique `_id` expression index instead of scanning the collection. The [non-finite numeric pushdown](https://github.com/wekan/FerretDB/commit/48e2d938) keeps the unchanged numeric `$type` plus negated-range repair query inside SQLite: across five restored ordered collections containing about 747,000 documents, it returns zero candidates in 1.9 seconds instead of spending about 30 seconds decoding every document. Ambiguous values remain candidates for the authoritative MongoDB-compatible filter. The [nested-composite decoder optimization](https://github.com/wekan/FerretDB/commit/95156068) also replaces per-document and per-array streaming decoders with complete-value parsing. The representative nested-card workload drops from 561 to 431 allocations and from about 44 KB to 31 KB per document, with median decode time improving from about 179 to 141 microseconds while preserving malformed-input behavior. The [linear document-construction follow-up](https://github.com/wekan/FerretDB/commit/fd73a0a1) uses the document's existing key-count map to distinguish new fields from replacements instead of searching all previously appended fields. The restored 299,539-card collection averages 31.3 fields per document; a representative 40-field decode improves by about 8% without adding allocations. The [SQLite iterator follow-up](https://github.com/wekan/FerretDB/commit/56bb6c6e) also resolves result-column metadata once per query instead of requesting and comparing it for every row. Full card scans avoid nearly 300,000 redundant metadata calls, and each distinct scan avoids one call per returned key. The [schema-covering index optimization](https://github.com/wekan/FerretDB/commit/4e0b3894) appends internal BSON schema expressions to eligible SQLite indexes while retaining their original value prefix and Mongo-visible definition. Existing indexes are upgraded transactionally once. The restored 299,539-card `distinct(listId)` SQL falls from 2.96 seconds to 45 milliseconds using a covering scan, while unique and dotted indexes remain unchanged. Its [compound-index follow-up](https://github.com/wekan/FerretDB/commit/5e5d08c4) also covers every top-level logical key and selects the narrowest index containing the distinct and filter fields. The restored filtered `distinct(swimlaneId, archived)` SQL becomes a 176-millisecond covering scan; its live non-covering stage previously took about 12.2 seconds. FerretDB now also creates a private scalar access path when a numeric corruption check targets a field already present in a declared compound index. SQLite cannot seek a non-leading compound key; the restored 299,539-card `sort` check instead falls from 1.31 seconds to 17 milliseconds after a 1.26-second one-time index build, without changing the MongoDB query or visible index definition. Top-level `$exists` probes now run exactly inside SQLite as well, distinguishing a missing field from explicit BSON null. The schema upgrader's no-match `archived` probe previously decoded all 299,539 cards for 20.6 seconds; its equivalent SQLite scan takes 20 milliseconds and needs no additional index. The DEBUGSPEED launcher now waits for FerretDB to finish one-time database preparation and accept connections before starting Meteor, reporting progress every ten seconds and failing clearly if FerretDB exits or exceeds its bounded readiness timeout. This prevents OpLog startup from crashing WeKan while an index-format migration is still running. During that wait, the normal WeKan port serves the existing blue migration page with the Admin Panel Product name, a rebuilding-indexes explanation and automatic refresh. FerretDB publishes its current database, collection and index atomically, and the page turns that into a progress bar, percentage, current step and total, elapsed time, and estimated time remaining. A configured Product name replaces both application names in all user-facing migration text. The standalone page is stopped and its port released before Meteor starts; source runs keep the Product name current in their writable cache just as Snap already does. Launcher tests pin both modes, while FerretDB unit tests and benchmarks cover projected, distinct and complete decoding, malformed input, cache eviction, SQL filtering and missing keys, numeric and logical fallback safety, implicit and excluded IDs, and every query field retained for filtering and sorting.

and improves the following client performance behavior:

Card date badges - one shared clock replaces per-card timers.

Share one minute ticker between card date badges. Thanks to xet7.

Card dates and date custom fields subscribe to one reactive clock. Each view unsubscribes when destroyed; duplicate cleanup is harmless, the interval remains for other subscribers, and the final unsubscribe stops it. Regression tests exercise teardown and later restart as well as rejecting per-badge intervals.

and fixes the following minicard bug:

Minicard composers - saving targets the form the user submitted.

Save the title from the submitted top or bottom composer. Thanks to xet7.

Each list renders independent add-card composers above and below its cards, but the bubbled submit handler read the first textarea under the whole list. Saving the visible bottom composer therefore read the hidden top composer's empty title, closed the form and sent no database insert. The handler now resolves the actual submitted form and obtains its title, position, labels, members and custom fields from that same form. Regression coverage pins both positive form targeting and the absence of list-wide first-textarea lookup; the existing Playwright add-card flow covers the rendered save behavior.

and fixes the following board creation bug:

Shared board forms - every rendered variant submits through its owner.

Create Board submits from the shared rendered form. Thanks to xet7.

The All Boards and popup variants render one included form, but their submit events remained attached to the parent templates. Blaze scopes an event map to the template that rendered the matching DOM, so clicking Create never called the server method and no board reached MongoDB or FerretDB. The shared form now owns its events and receives its state owner explicitly, preserving visibility, template-board and header-star behavior. Positive and negative regression checks pin the event owner, submitted form and all four callers.

and adds the following performance diagnostic tooling:

DEBUGSPEED - opt-in measurements and failure logs explain local database behavior.

Compare MongoDB and FerretDB with opt-in speed diagnostics. Thanks to xet7.

`DEBUGSPEED=true` records bounded process, event-loop and slow DDP handler measurements in Admin Panel → Problems → Speed without recording arguments, credentials or query values. `debug-speed-server.sh` starts WeKan on a chosen localhost port with either Meteor's MongoDB or a freshly compiled FerretDB, and keeps their raw logs together; `debug-speed-test.sh` drives repeatable anonymous or authenticated browser traffic. The [matching FerretDB diagnostics](https://github.com/wekan/FerretDB/commit/83ef2caa) add SQLite query-shape, candidate-row and separate SQL/decode timings while keeping small indexed lookups silent. Static positive/negative guards, FerretDB unit tests, both database startup modes and an anonymous browser traffic run cover the workflow.

Capture FerretDB connection failures in diagnostic logs. Thanks to xet7.

`debug-speed-server.sh` now explicitly starts FerretDB at the safe `info` log level and prints the exact `ferretdb.log` path. The [matching FerretDB change](https://github.com/wekan/FerretDB/commit/a3625856) makes `DEBUGSPEED=true` select that level itself, so connection warnings, errors and existing bounded query-shape diagnostics reach the log even outside this launcher. Debug-level wire messages remain disabled because they may contain user data. Positive launcher and FerretDB unit tests pin the level and path; a negative guard prevents enabling payload-bearing debug logging.

Supervise diagnostic instrumentation and keep its measurements in files. Thanks to xet7.

`debug-speed-server.sh` now owns separate process groups for WeKan/Meteor, FerretDB, terminal log following and a resource watcher. One Ctrl-C stops and reaps all of them, including Meteor's child processes. The watcher records timestamped CPU, RSS, process state, load, available memory and disk space in `resources.tsv` without command arguments or environments. WeKan console output goes to `wekan.log`, while bounded structured timings go only to the private `wekan-debugspeed.jsonl` file beside it, never to Admin Panel → Problems. FerretDB continues to use `ferretdb.log`. Static positive and data-exposure guards cover supervision, file routing and the absence of the Problems logger; shell syntax and a live watcher smoke test cover the executable paths.

Run instrumented FerretDB alone for database restores. Thanks to xet7.

`debug-speed-ferretdb.sh` builds and starts the same DEBUGSPEED-enabled local FerretDB used by the comparative launcher, but deliberately leaves WeKan and Meteor stopped so `mongorestore` does not compete with application writes for SQLite's single write lock. It preserves the existing port, state-directory, log-level and log-directory overrides, records `ferretdb.log`, build output and resource samples together, and stops all supervised processes on one Ctrl-C. Positive tests pin the shared options and cleanup; negative tests ensure the restore-safe launcher cannot start Meteor or enable payload-bearing debug logs.

Install the matching DEBUGSPEED Chromium automatically. Thanks to xet7.

`debug-speed-test.sh` now verifies Playwright's actual Chromium executable, not only its installed npm module, and downloads the matching browser revision when it is absent. The browser cache lives under `.tools/ms-playwright`, consistently with the main Playwright configuration, instead of depending on a populated home-directory cache. Static tests cover detection, installation and the local cache path; a live one-client traffic run completed 17 iterations with no failures.

and fixes the following registration bug:

Account creation - first-user detection stays bounded on large databases.

Registration checks one user instead of scanning every account. Thanks to xet7.

The account-creation hook needs only to know whether any account already exists so it can make the first one administrator, but it counted and decoded the entire users collection. On a restored 14,631-user FerretDB database that made registration take 55 seconds: the account and verification email were created, but the browser timed out and incorrectly displayed “Something went wrong.” A projected one-document lookup now preserves the first-administrator rule without work proportional to the instance's user count. Positive and negative regression checks pin the bounded lookup and forbid a full count in the hook.

and removes the following database-specific application workarounds:

Database compatibility - ordinary selectors work without client exceptions.

Send ordinary MongoDB selectors to every compatible database. Thanks to xet7.

Board card scopes again use their normal null-containing `$in`, client and authorization selectors remain explicit `$and` conjuncts, activity predicates are not flattened, and one-branch visibility still uses `$or`. The matching FerretDB backend fixes now push null and empty `$in`, booleans, `$or`, `$and`, and indexed single-field or compound equality constraints into SQLite. WeKan's tests pin the database-independent selector shapes; FerretDB's unit suite pins the SQL constraints and index choices.

Use Meteor's standard resume-login query and projection. Thanks to xet7.

WeKan no longer replaces Meteor's resume-login handler to avoid a FerretDB positional-projection error. FerretDB now correctly selects an array element for a projection such as `services.resume.loginTokens.$` when the query matches `services.resume.loginTokens.hashedToken`, so Meteor's standard authentication path works unchanged. FerretDB unit tests cover a matching token and a negative no-match case.

and fixes the following client startup bug:

Language startup - bundled text renders before optional overrides arrive.

Render bundled English before loading database translation overrides. Thanks to xet7.

English is already part of the client bundle, but i18n readiness still waited up to ten seconds for the optional custom-translation DDP subscription. A busy restored database therefore printed a default-language timeout even though the English data was present and usable. Bundled English now becomes ready immediately; database overrides load asynchronously and invalidate translation helpers when they arrive. Positive and negative loader tests pin the ordering, fallback and late reactive update.

and fixes the following release tooling bug:

Snap releases - assembly consumes the bundle produced for the release.

Build snaps from the extracted release bundle. Thanks to xet7.

Snapcraft entered `.build` and extracted the archive as `bundle/`, but then looked for `.build/bundle/`, effectively asking for `.build/.build/bundle/`. That made native, variant and Launchpad snap jobs fail while copying Node.js. The Core 24 and staged Core 26 definitions now use the correct relative path, with a regression test that pins the working-directory transition.

and fixes the following regression-suite failures:

Test reliability - assertions follow current behavior without weakening product checks.

The complete suite distinguishes defects from valid runtime behavior. Thanks to xet7.

Protected activity placeholders are restored in sixteen locale files, and a repository-wide token inventory confirms that every locale now matches English. The Traditional Chinese check accepts correct human wording while still rejecting the wrong script. Source guards recognize the current FerretDB `$or`/`$and` pushdown and board publication shapes, while runtime-only files and DEBUGSPEED diagnostics are excluded from documentation and release-menu parity checks. The lazy-board browser test allows 30 seconds for a remote update and move: its focused Chromium run passed in 22.2 seconds, matching Firefox's valid slow path instead of failing at the former ten-second bound.

Thanks to above GitHub users for their contributions and translators for their translations.