Download Latest Version
wekan-11.72-s390x.zip (286.8 MB)
Get an email when there's a new version of wekan
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| wekan_9.98_amd64.snap | 2026-07-17 | 393.0 MB | |
| wekan-9.98-riscv64.zip | 2026-07-17 | 307.2 MB | |
| wekan_9.98_arm64.snap | 2026-07-17 | 301.3 MB | |
| wekan-9.98-s390x.zip | 2026-07-17 | 309.5 MB | |
| wekan-9.98-ppc64le.zip | 2026-07-17 | 308.6 MB | |
| wekan-9.98-win64.zip | 2026-07-17 | 291.7 MB | |
| wekan-9.98-sandstorm.spk | 2026-07-17 | 160.8 MB | |
| wekan-9.98-mac-arm64.zip | 2026-07-17 | 302.2 MB | |
| wekan-9.98-amd64.zip | 2026-07-17 | 303.4 MB | |
| wekan-9.98-arm64.zip | 2026-07-17 | 306.2 MB | |
| README.md | 2026-07-17 | 2.3 kB | |
| v9.98 source code.tar.gz | 2026-07-17 | 31.9 MB | |
| v9.98 source code.zip | 2026-07-17 | 32.9 MB | |
| Totals: 13 Items | 3.0 GB | 0 | |
v9.98 2026-07-17 WeKan ® release
This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:
- EscapeBleed: incomplete string escaping when
building a regular expression (GitHub CodeQL code scanning alert [#423], rule
js/incomplete-sanitization, CWE-116 Improper Encoding or Escaping of Output;tests/maximizedCardPosition.test.cjs). Code that turned a CSS declaration into aRegExpescaped only parentheses (str.replace(/[()]/g, '\\$&')) instead of the full regex metacharacter set — an input containing other metacharacters (including a backslash) would not be escaped correctly, so the generated pattern could match the wrong thing. - Fixed by escaping the complete metacharacter set
(
str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')), matching the correct pattern already used elsewhere in the tests. This is test-only code with a fixed, trusted input list, so there was no injection exposure, but the incomplete escape was genuinely wrong. -
Thanks to GitHub CodeQL (code scanning alert [#423]) and xet7 (fix).
-
RandomBleed: biased random ids from a cryptographically secure source (GitHub CodeQL code scanning alert [#422], rule
js/biased-cryptographic-random, CWE-1204 / weak randomness;server/lib/schemaUpgradeSteps.js). The startup schema upgrade generates Meteor-style document ids withcrypto.randomBytes(len)mapped throughbyte % ID_CHARS.length. Because 256 is not a multiple of the 55-character alphabet, that modulo skews generated ids toward the first 36 characters of the alphabet (each ~1.4% more likely than the rest) — reducing entropy of the ids used for the swimlanes/lists/checklist-items the upgrade creates. - Fixed with rejection sampling: bytes at or above the largest multiple of the alphabet size (220) are discarded and resampled, so every character is exactly equally likely; ids stay Meteor-style 17 characters (and exact-length for custom lengths). A negative regression test pins that out-of-range bytes are never wrapped.
- Thanks to GitHub CodeQL (code scanning alert [#422]) and xet7 (fix).
Thanks to above for their contributions.
