Download Latest Version
wekan-11.72-s390x.zip (286.8 MB)
Get an email when there's a new version of wekan
Binaries in these bundles
Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.
| Bundle | Binary | From | Version | Checked | SHA256 |
|---|---|---|---|---|---|
| amd64 | FerretDB | wekan/FerretDB | v1.69.0 | verified | d45247243ee7c377… |
| amd64 | Node.js | nodejs.org | v24.20.0 | verified | 2f2c0da162318f0d… |
| arm64 | FerretDB | wekan/FerretDB | v1.69.0 | verified | c55a1e610ea3af12… |
| arm64 | Node.js | nodejs.org | v24.20.0 | verified | 5f4ddab610c1ab20… |
| armhf | FerretDB | wekan/FerretDB | v1.69.0 | verified | 53697744857c4904… |
| armhf | Node.js | wekan/node-patches | v24.20.0 | verified | b8ed7065d44f0afe… |
| armv6 | FerretDB | wekan/FerretDB | v1.69.0 | verified | a4e7ed0c2a1d4df9… |
| armv6 | Node.js | wekan/node-patches | v24.20.0 | verified | d5cefa6f8cc4acb1… |
| armv7 | FerretDB | wekan/FerretDB | v1.69.0 | verified | 53697744857c4904… |
| armv7 | Node.js | wekan/node-patches | v24.20.0 | verified | c04c81e539347f39… |
| i386 | FerretDB | wekan/FerretDB | v1.69.0 | verified | 7e42b7ba806f0a4a… |
| i386 | Node.js | wekan/node-patches | v24.20.0 | verified | bb44927307460dcf… |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.69.0 | verified | 6276ee96db710a8d… |
| mac-arm64 | Node.js | nodejs.org | v24.20.0 | verified | b7bf7707070b950b… |
| ppc64le | FerretDB | wekan/FerretDB | v1.69.0 | verified | f49ef5cf05d35ef1… |
| ppc64le | Node.js | nodejs.org | v24.20.0 | verified | 341307dcee20d883… |
| riscv64 | FerretDB | wekan/FerretDB | v1.69.0 | verified | 3dabafcbe5f48bd4… |
| riscv64 | Node.js | unofficial-builds.nodejs.org | v24.20.0 | verified | a149c5bf85f98ff1… |
| s390x | FerretDB | wekan/FerretDB | v1.69.0 | verified | 25c08eb34c8fe0f2… |
| s390x | Node.js | nodejs.org | v24.20.0 | verified | ca381121cb5a8d38… |
| win-arm64 | FerretDB | wekan/FerretDB | v1.69.0 | verified | 65474b87bf0e4679… |
| win-arm64 | Node.js | nodejs.org | v24.20.0 | verified | 31c6799744de8a54… |
| win64 | FerretDB | wekan/FerretDB | v1.69.0 | verified | ae3f8c4e2697b75d… |
| win64 | Node.js | nodejs.org | v24.20.0 | verified | 6cac9ffbca8f6a47… |
A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.
v11.52 2026-09-06 WeKan ® release
In short: Release builds create the Windows single EXE on Windows, sync variant repositories without replacing their workflows, and leave bounded, named diagnostics for every workflow failure. Build menus return immediately after completed commands while keeping real menu and argument prompts. Mobile regression coverage follows the header and drag-handle structure. Security coverage accounts for all 94 Hall of Fame names, blocks SheetColorBleed CSS injection, reports attributable ScannerBleed and integrity attempts, and prevents weak FerretDB password hashes. Verified recovery checks and restores FerretDB SQLite snapshots or retained MongoDB source, preserves failed requests for retry, verifies history and stored files, and schedules non-urgent checksum work during sustained low CPU usage. Import/export security shares DOMPurify validation across transports and resumes Trello jobs.
| Platform | Binary | From | Version | SHA256 |
|---|---|---|---|---|
| amd64 | Node.js | nodejs.org | v24.19.0 | 14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647 |
| amd64 | FerretDB | wekan/FerretDB | v1.53.0 | eae1f0a8f73bfc979738bfff7284d40fd1bc55de2cc56514721fc155c3624f7d |
| arm64 | Node.js | nodejs.org | v24.19.0 | 01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc |
| arm64 | FerretDB | wekan/FerretDB | v1.53.0 | bdc50caee3ac28495b42d2130b94a042a9dd6d3a38f732cac02b648f36c891da |
| mac-arm64 | Node.js | nodejs.org | v24.19.0 | 3f1cf157479c1480352083105e13faf9d008ede98e7e157746b6df940d197b94 |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.53.0 | cb14ffe93e285903e5a8a9c1821687ddb5b8a979a11c584bf4af534b272c6d3e |
| mac-x64 | Node.js | nodejs.org | v24.19.0 | d35e95230f46f6f0751df497c56622c6735e05d5e1fb1630996a005b9d328fe4 |
| mac-x64 | FerretDB | wekan/FerretDB | v1.53.0 | d97dfa9afa60aa05f25384327de82efe7b71d958ed24c1f66618284294a65cd3 |
This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:
Stop creating SCRAM-SHA-1 credentials. Thanks to GitHub CodeQL and xet7.
New FerretDB users and password changes now create only salted, 15,000-iteration PBKDF2-SHA-256 credentials. An explicit SCRAM-SHA-1 request is rejected, and the MD5 password-preparation function is removed instead of being hidden behind an ineffective CodeQL annotation, resolving alert 46 (CWE-327, CWE-328 and CWE-916). Existing stored SCRAM-SHA-1 credentials remain readable only for authentication, so an administrator can migrate a legacy account by changing its password. Positive SHA-256 creation/update tests and negative SHA-1 creation/update tests pass with the full FerretDB unit, vet and SQLite/TLS integration suites.Safeguards - Security, recovery, build and mobile regression protections.
Secure and resume import/export operations. Thanks to xet7.
One common server boundary now validates and clones imported and exported object graphs, removes prototype-pollution keys and accessors, rejects cycles and resource-limit abuse, normalizes invalid scalars, strips secret fields from exports, and sends active markup, script URLs and CSS payloads through WeKan's existing DOMPurify sanitizer. UI/DDP, REST, streamed ZIP, Excel-cell and live Trello imports use it, as do canonical and external-format exports. Rejected and sanitized attempts report their source, affected paths, user and address when available in Admin Panel Problems → Security. CSV/TSV formula escaping remains enabled for every row. Live Trello imports now use atomic expiring leases with an in-flight heartbeat, reclaim unfinished jobs on startup, and adopt a board whose durable import activity proves that its side effect completed before a crash. Requests have timeouts and response-size limits, retry transient HTTP 408/425/429/5xx and honour `Retry-After`; SSRF verdicts remain non-retryable. Positive and negative regression tests cover the common boundary, every transport connection, prototype pollution, accessors, cycles, limits, DOM sanitization, spreadsheet formula prefixes, restart reclaim, idempotency, leases, retries and timeouts.Sanitize streamed board exports. Thanks to xet7.
The constant-memory JSON exporter now applies the same shared validation, DOMPurify and secret-removal boundary separately to the board, every streamed collection document, attachment metadata and user. Attachment bytes remain a direct base64 stream, avoiding both executable interpretation and unbounded memory use. Regression coverage prevents this large-board export path from bypassing the common security boundary.Make workflow failures diagnosable. Thanks to xet7.
Every directly executed GitHub Actions job now has a timeout, including the smaller Docker, Flatpak, chart, dependency-review and repair workflows. A stuck external service or command therefore ends as a bounded timeout instead of requiring an unexplained manual cancellation. A repository-wide regression test checks every active workflow: shell commands must have a descriptive step name, explicit nonzero exits must print a nearby `::error::`, every job must be time-bounded, and `continue-on-error` jobs must still print their final result. This keeps both fatal and deliberately tolerated failures visible in the Actions log.Fix Windows and variant release builds. Thanks to xet7.
The Windows single-EXE manifest now normalizes the backslash-separated member names printed by Windows `tar`, so executables, native addons and startup files are included instead of producing an empty C array. An empty manifest fails with its cause before compilation. Regression coverage checks both Windows paths and the fail-closed behavior. Ondra and Gantt repository synchronization now retains each variant's own Actions workflows instead of copying WeKan's release workflows. Their existing Contents token can therefore push ordinary source updates without the unrelated GitHub PAT `workflow` scope, and the variants cannot accidentally run the main release flow.Validate XLSX sheet colors before CSS serialization. Thanks to rbbjinioeq and xet7.
An XLSX workbook's unvalidated sheet-tab color was interpolated into the viewer's complete `style.cssText`. A board member could append CSS declarations, cover another authorized member's attachment preview and trigger a CSS resource request when that member opened the workbook (SheetColorBleed, GHSA-crq2-phg8-4xvg; CWE-79 and CWE-116). No script execution, response reading, credential access or authenticated state change was demonstrated. The vendored viewer now accepts only canonical `#RRGGBB` immediately before the CSS serialization boundary. Regression coverage retains a valid color and rejects the disclosure payload, short/alpha/named colors, non-hex input and empty values. The security inventory and Hall of Fame now account for all 94 published names. The same change resolves CodeQL alert 447 in a release-version test by comparing the exact expected Dockerfile string instead of constructing a partly escaped regular expression. That alert did not reach application runtime or untrusted data. SheetColorBleed is normalized during an ordinary preview rather than refused, so there is no attributable attack-only event to report in Problems → Security; logging the preview would falsely identify the viewer rather than the workbook uploader.Add verified recovery and low-load integrity audits. Thanks to xet7.
FerretDB launch paths now integrity-check SQLite before opening it, create staged, compressed and SHA-256-verified snapshots in the same data directory, check free space, restore latest then previous verified generations, and re-run a retained MongoDB migration when no snapshot survives. Snapshot manifests retain byte/hash change evidence, and every outcome reaches Problems → Recovery. New change-history rows form a SHA-256 predecessor chain. Restore, undo and redo refuse changed, missing or forked history and report the available row, board, username and address evidence in Problems → Security. A low-load background audit also checks whole chains. Regression tests prove there is no direct client publication, REST mutation API or collection write permission for history. The existing signed attachment/avatar inventory now also scans registered logs and recovery generations. Missing or changed files report expected and observed sizes and checksums in Problems → Security. CPU-intensive background audits wait for consecutive low samples, recheck load between paced operations and defer when the quiet window ends. Problems → Speed shows rolling minimum, average, maximum, sample count and lowest-load time so the chosen maintenance window is visible.Build menus exit immediately after completed commands. Thanks to xet7.
`build.sh` silently waited for Enter after a release command, and `build.bat` displayed an acknowledgement pause after release scripts, release commands, command-list output and a missing-Bash error. Those waits did not monitor the command or the remote release; they only consumed an extra line or keystroke. Both scripts now exit to the shell or command prompt as soon as a selected process finishes. They wait for terminal input only while displaying a menu or a visible question that collects a real command argument. Focused regression coverage checks the prompt and exit control flow in both scripts.Mobile layout regressions test the current header and subpixel alignment. Thanks to xet7.
The full test run still expected Mobile Mode to copy list names into the top header, even though that switcher was removed to keep the header height and other swimlanes stable. Another static check searched for the drag handle only inside a removed coarse-pointer media query instead of the mode-based rule used by every browser. Those checks now pin the current structure. The Firefox browser test also accepts less than half a CSS pixel of glyph-centre rounding; it had failed on a 0.0083-pixel difference while Chromium and WebKit passed. A real positioning regression of half a pixel or more still fails.Audit security coverage and recovery failure reporting. Thanks to xet7.
The Hall of Fame audit had been looking only in an obsolete companion-repository location, so it silently skipped the real `.tools/wekan.fi` catalog. The security regression inventory also stopped at 62 vulnerabilities. It now accounts for all 93 published names: 71 have named regression coverage and the remaining 22 older fixes are explicit gaps. Scanner command injection payloads have focused positive and negative coverage, and rejected scanner filenames appear as ScannerBleed in Admin Panel → Problems → Security. Response-only protections remain deliberately silent where normal use cannot be distinguished from an attack. All three FerretDB launch paths previously ignored a failed backup or restore copy, reported success anyway, and removed a failed restore request. They now report `backup-failed`, `restore-failed` or `manual-required` in Admin Panel → Problems → Recovery, never claim that a failed copy succeeded, and retain failed restore requests for the next restart. The recovery documentation now separates implemented automatic mitigation from operator-requested text-database restore and records the remaining portable integrity-check gap instead of describing an unused decision function as production automation.Developer documentation - recovery and data-transfer guarantees have an explicit implementation contract and format inventory.
