Download Latest Version
wekan-11.72-s390x.zip (286.8 MB)
Get an email when there's a new version of wekan
Binaries in these bundles
Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools. Which source has a given CPU varies from release to release - nodejs.org builds some architectures, unofficial-builds others, and the wekan/node-patches build the ones neither of them does - and not every source publishes a checksum. This is what went into this release, and which downloads were checked against a published SHA256.
| Bundle | Binary | From | Version | Checked | SHA256 |
|---|---|---|---|---|---|
| amd64 | FerretDB | wekan/FerretDB | v1.78.0 | verified | 523a96e832e5947a… |
| amd64 | Node.js | nodejs.org | v24.21.0 | verified | fd8e59d5a511510f… |
| arm64 | FerretDB | wekan/FerretDB | v1.78.0 | verified | d8bb85c7ff49fe02… |
| arm64 | Node.js | nodejs.org | v24.21.0 | verified | 6ad1325edbdb5649… |
| armhf | FerretDB | wekan/FerretDB | v1.78.0 | verified | c4df2f4e6fe8fa9a… |
| armhf | Node.js | wekan/node-patches | v24.21.0 | verified | fcd7558bda05a44b… |
| armv6 | FerretDB | wekan/FerretDB | v1.78.0 | verified | eeb962ba8d7b76d7… |
| armv6 | Node.js | wekan/node-patches | v24.21.0 | verified | ea68d25e1eef47cb… |
| armv7 | FerretDB | wekan/FerretDB | v1.78.0 | verified | c4df2f4e6fe8fa9a… |
| armv7 | Node.js | wekan/node-patches | v24.21.0 | verified | 561b357700e2019c… |
| i386 | FerretDB | wekan/FerretDB | v1.78.0 | verified | c855b2f74a7c8b13… |
| i386 | Node.js | wekan/node-patches | v24.21.0 | verified | d3a55c1b0e22c164… |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.78.0 | verified | 34d45b3eee2f322f… |
| mac-arm64 | Node.js | nodejs.org | v24.21.0 | verified | 6239d4cf92d86448… |
| mac-x64 | FerretDB | wekan/FerretDB | v1.78.0 | verified | 1fd4a358aae472d9… |
| mac-x64 | Node.js | nodejs.org | v24.21.0 | verified | 0ae5a24c24bb7d01… |
| ppc64le | FerretDB | wekan/FerretDB | v1.78.0 | verified | ae5e77d7e26ff668… |
| ppc64le | Node.js | nodejs.org | v24.21.0 | verified | 1936fd64623a2f98… |
| riscv64 | FerretDB | wekan/FerretDB | v1.78.0 | verified | c52b5d9b477d8a73… |
| riscv64 | Node.js | unofficial-builds.nodejs.org | v24.21.0 | verified | 5c4e83d46cc1f8ee… |
| s390x | FerretDB | wekan/FerretDB | v1.78.0 | verified | 5f6e44510345e653… |
| s390x | Node.js | nodejs.org | v24.21.0 | verified | 2ef7e2ecbf7a6c2f… |
A row saying no checksum published is not a failed check - it is a source that publishes nothing to check against. Those are the ones worth fixing at the source.
v11.70 2026-09-11 WeKan ® release
In short: this release adds every way to log in that Meteor's accounts system offers - Google, GitHub, Facebook, X (Twitter), Meteor Developer, Weibo, Meetup and passwordless email codes - configurable with environment variables on every platform and overridable in Admin Panel / People / Login, where a badge beside each field names the source in effect and a change applies without a restart. It also fixes the release bump job, which failed on the generated OpenAPI spec.
This release adds the following new features:
Login - every way to log in that Meteor's accounts system offers.
Google, GitHub, Facebook, X, Meteor Developer, Weibo, Meetup and passwordless login. Thanks to xet7.
Meteor's own accounts packages - accounts-google, accounts-github, accounts-facebook, accounts-twitter, accounts-meteor-developer, accounts-weibo, accounts-meetup and accounts-passwordless - are added, so every login method Meteor's accounts system offers is now in WeKan beside password, 2FA, OIDC, LDAP, CAS and SAML. `models/lib/oauthProviders.js` is the pure catalog of the seven providers: the `OAUTH_<provider>_ENABLED`, `_CLIENT_ID` (`_APP_ID` for Facebook, `_CONSUMER_KEY` for X) and `_SECRET` env vars, each credential also read from a `<name>_FILE` Docker secret; the shared `OAUTH_PROVIDERS_LOGIN_STYLE` (popup or redirect) and `OAUTH_PROVIDERS_MERGE_EXISTING_USERS`; and `PASSWORDLESS_ENABLED`. An Admin Panel value wins over the env var, and a provider is enabled only with the flag AND both credentials. `server/lib/oauthProviders.js` writes Meteor's `ServiceConfiguration` for every enabled provider at startup and whenever the Admin Panel saves, and REMOVES it for a disabled one, so switching a provider off takes effect without a restart. A first login through a provider becomes a WeKan user the way OIDC does, fail-closed: an existing account made by another login method is linked only when merging is on and the provider verified the address; otherwise the login is refused with `oauth-account-conflict` and the attempt is recorded on the new `oauth.account-conflict` canary, so Admin Panel -> Problems shows who tried. Passwordless is refused at both the token-request method and the login attempt while it is off, so the package cannot create accounts or send codes when nobody enabled it. The login form shows one button per enabled provider under the SAML button, and a two-step "Email me a sign-in code" form (address, then code) when passwordless is on; errors land in the same region as the password form. `getAuthenticationsEnabled` reports keys only - no credential ever reaches a browser. `tests/oauthProviders.test.cjs` pins the catalog shape, the env, `_FILE` and Admin Panel resolution, the enabled and takeover decisions, the upsert/remove, the canary, the form and the negative no-secret-on-the-client sweep.Admin Panel override of the OAuth login provider and passwordless env vars. Thanks to xet7.
Admin Panel / People / Login gets a section for Meteor's own accounts-* login services (Google, GitHub, Facebook, X/Twitter, Meteor Developer, Weibo, Meetup) and for passwordless login, built the same way as the LDAP section above it: every `OAUTH_<provider>_ENABLED` / `_CLIENT_ID` / `_SECRET` env var, the shared `OAUTH_PROVIDERS_LOGIN_STYLE` and `OAUTH_PROVIDERS_MERGE_EXISTING_USERS`, and `PASSWORDLESS_ENABLED` can be set there, a value set in the Admin Panel wins over the env var (`models/lib/configResolver.js`), and a badge beside each field says whether the env var, the Admin Panel or nothing is in effect. The secret is stored in `Settings.oauthProviders.<key>.secret` and, like the LDAP bind password, never reaches a browser: the `setting` publication carries only `enabled`, `id`, `loginStyle` and the boolean `secretSet` per provider, an empty secret submission leaves the stored one untouched, and the sources method reports the secret through `hasConfigValue()` as "is set (source)" only. `saveOauthProviderSettings` validates the provider key against the catalog, and both it and `savePasswordlessSettings` are admin-only and call `reconfigureOauthProviders()` so a change takes effect without a server restart. `tests/oauthProvidersAdminOverride.test.cjs` pins the schema, the published field list (secret absent, secretSet present), the admin gate, the key validation, the empty-secret rule, the reconfigure call and the jade badges; the whole-tree secret sweep in `tests/ldapAdminOverrideSecurity.test.cjs` now also matches hyphenated sub-document keys such as `oauthProviders.meteor-developer.secret`.The provider and passwordless settings documented on every platform, with docs. Thanks to xet7.
A setting that exists in the code but not where a user configures WeKan is invisible, so `OAUTH_<provider>_ENABLED` / `_CLIENT_ID` (`_APP_ID` for Facebook, `_CONSUMER_KEY` for Twitter) / `_SECRET` / `_SECRET_FILE` for Google, GitHub, Facebook, Twitter, Meteor Developer, Weibo and Meetup, `OAUTH_PROVIDERS_LOGIN_STYLE`, `OAUTH_PROVIDERS_MERGE_EXISTING_USERS` and `PASSWORDLESS_ENABLED` now appear, commented out with the same explanation, everywhere the `OAUTH2_*` and `SAML_*` settings already do: `docker-compose.yml` and its FerretDB v1 (PostgreSQL, MySQL, MariaDB, SAP HANA), FerretDB v2 and MongoDB variants, the `Dockerfile` and devcontainer `ENV` block (every `*_ENABLED` defaulting to `false`, login style to `popup`), `start-wekan.sh`, `start-wekan.bat`, the Snap's `config` (keys list plus a `DESCRIPTION_`/`DEFAULT_`/`KEY_` triple each, so `snap set wekan oauth-google-enabled='true'` works) and `wekan-help`, the Sandstorm package definition, the stacksmith Docker-secrets reader, `secrets/README.md` and the Helm chart's `values.yaml` in `wekan/charts`. Each comment names the callback URL to register at the provider, `<root_url>/_oauth/<service>`, and says that Admin Panel / People / Login overrides the environment. Two new docs pages: [OAuth Providers](docs/Features/Login/OAuth-Providers.md) (where to create the app at each provider, the callback URL, the variables, the Admin Panel section, login style, merging, troubleshooting) and [Passwordless](docs/Features/Login/Passwordless.md), both linked from the docs index. `tests/oauthProvidersPlatformEnv.test.cjs` pins every variable on every platform, the Snap triples and their kebab-case keys, the Sandstorm defaults, and that the docs pages exist and are linked; the compose-parity suite keeps the five FerretDB v1 files identical.and fixes the following bug:
The release bump job no longer fails on the generated OpenAPI spec. Thanks to xet7.
The bump job of release-all.yml regenerates `public/api/wekan.yml` from the models' JSDoc and renders it with @redocly/cli, which stopped the release with "bad indentation of a mapping entry (1232:2)". A `@param` whose description continues on the next JSDoc lines (the chart export's `chartKey`) was emitted under `description: |` with only its first line indented, so the continuation lines fell out of the block scalar and the whole spec failed to parse. The generator now indents every line. It also stopped warning "unknown type object" for the rules API's trigger/action parameters: OpenAPI 2.0 has no `object` for a path/query/form parameter, so they are emitted as a JSON string. Reproduced locally and verified with the same @redocly/cli render; `tests/openapiParamMultiline.test.cjs` pins the emitter and parses the regenerated spec.and improves the translation workflow:
- Add the OAuth-provider and passwordless login i18n keys to every locale file, with the seven provider names treated as invariant proper nouns by the fill tool. Thanks to xet7.
- Translate the OAuth-provider and passwordless login strings for the major languages and their regional variants, 88 locale files. Thanks to xet7.
- Translate them for the European and Central-Asian languages, 62 locale files, in the language each locale tag names. Thanks to xet7.
- Translate them for the South and Southeast Asian languages, 29 locale files. Thanks to xet7.
- Translate them for the remaining languages, 53 locale files, so no locale has an untranslated string left. Thanks to xet7.
Thanks to above GitHub users for their contributions and translators for their translations.
