v11.64
Binaries in these bundles
Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.
| Bundle | Binary | From | Version | Checked | SHA256 |
|---|---|---|---|---|---|
| amd64 | FerretDB | wekan/FerretDB | v1.77.0 | verified | 5e9b7ddf38d3f720… |
| amd64 | Node.js | nodejs.org | v24.21.0 | verified | fd8e59d5a511510f… |
| arm64 | FerretDB | wekan/FerretDB | v1.77.0 | verified | 5147b9459c91a8f9… |
| arm64 | Node.js | nodejs.org | v24.21.0 | verified | 6ad1325edbdb5649… |
| armhf | FerretDB | wekan/FerretDB | v1.77.0 | verified | 9e23ba06a16d3db3… |
| armhf | Node.js | wekan/node-patches | v24.20.0 | verified | ace678ca4601db06… |
| armv6 | FerretDB | wekan/FerretDB | v1.77.0 | verified | 8ae23561563addf6… |
| armv6 | Node.js | wekan/node-patches | v24.20.0 | verified | e01021ab2ddd42cd… |
| armv7 | FerretDB | wekan/FerretDB | v1.77.0 | verified | 9e23ba06a16d3db3… |
| armv7 | Node.js | wekan/node-patches | v24.20.0 | verified | a227473dc166e862… |
| i386 | FerretDB | wekan/FerretDB | v1.77.0 | verified | d445d22797fecd59… |
| i386 | Node.js | wekan/node-patches | v24.20.0 | verified | a90b92e80d95c341… |
| mac-arm64 | FerretDB | wekan/FerretDB | v1.77.0 | verified | 4d45d2d4b1dd2bc8… |
| mac-arm64 | Node.js | nodejs.org | v24.21.0 | verified | 6239d4cf92d86448… |
| mac-x64 | FerretDB | wekan/FerretDB | v1.77.0 | verified | b6a37d77bddce56b… |
| mac-x64 | Node.js | nodejs.org | v24.21.0 | verified | 0ae5a24c24bb7d01… |
| ppc64le | FerretDB | wekan/FerretDB | v1.77.0 | verified | d5b72622b2c71eef… |
| ppc64le | Node.js | nodejs.org | v24.21.0 | verified | 1936fd64623a2f98… |
| riscv64 | FerretDB | wekan/FerretDB | v1.77.0 | verified | 7a282177b953dd4e… |
| riscv64 | Node.js | unofficial-builds.nodejs.org | v24.21.0 | verified | 5c4e83d46cc1f8ee… |
| s390x | FerretDB | wekan/FerretDB | v1.77.0 | verified | 93f0b41d7e26a79d… |
| s390x | Node.js | nodejs.org | v24.21.0 | verified | 2ef7e2ecbf7a6c2f… |
| win-arm64 | FerretDB | wekan/FerretDB | v1.77.0 | verified | 9a8229934a22748d… |
| win-arm64 | Node.js | nodejs.org | v24.21.0 | verified | 8779b1bde1d39f8d… |
| win64 | FerretDB | wekan/FerretDB | v1.77.0 | verified | 84fcf3efa1236bdb… |
| win64 | Node.js | nodejs.org | v24.21.0 | verified | 158f7685b44de51f… |
A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.
v11.64 2026-09-09 WeKan ® release
In short: Resizable list width and swimlane height are back. v11.62
had replaced per-user/per-list drag-resize width and the "Set width"/"Set
swimlane height" popups with a hardcoded 240px for every list; that is
reverted at the maintainer's request. Board Settings also gains three
grouped sections (#6680): Swimlane and List, with board-wide
resize-lock and "same width for all lists" admin toggles, and
Card, where Minicard/Card settings move back from their own menus.
FerretDB v1 now stores Infinity/-Infinity doubles like real MongoDB,
patches a High-severity gRPC-Go DoS advisory, and keeps its dependencies
current.
This release reverts the following change:
List and swimlane resizing - restoring the popups and drag handles v11.62 removed.
Revert "Hardcode list width to 240px and remove the width/height set-value popups". Thanks to xet7.
This reverts commit 8614949 in full: the
per-user/per-list resizable list width (drag-resize handle, the "Set
width" list-menu popup, the board-settings "Personal list width" sidebar
toggle, and the auto-width mode) and the "Set swimlane height" popup are
restored, along with their schema fields, Meteor methods and tests
(tests/listWidthPopupLayout.test.cjs and
tests/playwright/specs/38-fixed-list-width.e2e.js, both un-deleted). No
commit since v11.62 touched these files, so the revert applied cleanly
with no follow-up fixes needed.
and adds the following feature:
The top header - board-wide resize locks and a shared list width.
Add board-wide list-width/swimlane-height resize locks (#6680). Thanks to Hallsie and xet7.
Three independent toggles, right of the drag-handles toggle, board admins
only: a list-width resize lock (left-right arrow plus the same allowed/
denied check/ban icon pair .js-toggle-desktop-drag-handles already uses),
a swimlane-height resize lock (up-down arrow, same check/ban pair), and a
board-wide "same width for all lists" (same pair again, over a static
columns icon) - the existing per-user Set Width popup's fixed-width mode,
now settable for the whole board so it applies to every viewer, overriding
their personal choice while it is on. Enabling/disabling a toggle is
admin-only on the server (server/permissions/boards.js's default rule);
dragging the shared same-width value itself is allowed for any board
member with write access, through a new sole-field Boards.allow rule
shaped exactly like the existing board-drag-reorder rule, so a
lower-privilege member can never smuggle another board field into that
update. The swimlane-height handle also HIDES entirely while its lock is
on - not just refusing the drag - the same way the list-width handle
already hides for its own lock, so a locked handle does not still draw the
blue drag-height line on hover. tests/listSwimlaneResizeLock.test.cjs
pins the schema, the header wiring, the permission-rule shape, and that
each resize handle actually checks (and hides for) its lock.
and fixes the following bug:
Collapsed lists - the rotated title was not centered across the column width.
Keep a collapsed list's title near the caret, only centered horizontally. Thanks to xet7.
The desktop rule that actually wins (.list.list-collapsed:not(.mobile-view) ..., more specific than the plain one) had text-align: start, leaving
the vertical text flush to one edge of the 30px column instead of centered
across it - the plain/mobile-view rule already had text-align: center
and was never broken. An earlier attempt at this fix also made both rule
sets grow to fill and center across the WHOLE (often 540px) collapsed
column, which moved the title far from the collapse-toggle/drag-handle at
the top (.tools/collapse2.png) - that was reverted back to how it shipped;
"centered" meant horizontally, not down the whole column.
tests/collapsedListTitleCentered.test.cjs pins the text-align fix and
negatively pins that neither rule set grows/centers across the full column
height.
and adds the following feature:
The top header - a collapse button for its own icons.
Add a header-icons collapse toggle beside the board title (#6680 follow-up). Thanks to xet7.
A single button, right after the board title, that hides every icon from
the mobile/desktop toggle through the notification bell: mobile/desktop
mode, drag-handles toggle, the three board-wide resize-lock icons, the
starred-boards group, create-board, the board/all-boards header buttons,
the view menu, the Admin Panel tabs, and notifications. Purely a
per-viewer display preference (a plain Session var, the same shape as
mobileMode() right beside it), not a board setting like the resize
locks. Every icon in that range gets a shared
.js-header-collapsible-icon marker class; the template inclusions that
cannot carry a class of their own are each wrapped in a span that stays
display: contents outside the collapsed state, so introducing it does
not change how those icons behave as flex items when nothing is
collapsed. tests/headerIconsCollapse.test.cjs pins the button's
position, the Session-var shape, that every icon in the range is marked
and nothing outside it is, and both CSS rules.
and fixes the following bug:
Collapsed lists - the rotated title's x-position did not match the caret above it.
Fix collapsed list title x-position not matching the caret above it. Thanks to xet7.
Centering the title horizontally (above) was not enough: it still sat
~13px right of the collapse-toggle caret (.tools/collapse3.png). Root
cause was an unrelated, generic .list-header .list-header-name rule that
sets min-width: 56px for ordinary (non-collapsed) list headings.
min-width is a separate property from width, so it survives the
cascade even where a more specific collapsed-list rule wins on width
itself - it silently clamped the rotated title's box to 56px regardless
of the 30px collapsed column, since the final used width is
clamp(min-width, width, max-width). Fixed by overriding min-width
back to 0 in every collapsed-title h2.list-header-name rule: the
plain/mobile-view rule, the desktop :not(.mobile-view) rule, and its
three @media (min-width: 768/1024/1200px) duplicates. Verified with a
Playwright measurement of the caret's and title's horizontal centers
matching after the fix; tests/collapsedListTitleCentered.test.cjs pins
that every one of those rules cancels the clamp, and that the generic
56px rule this works around still exists (so the test does not go stale
if that rule is ever removed).
and reorganizes the following board settings:
Board Settings - Swimlane, List and Card, grouped together.
Move swimlane/list resize settings and card settings into Board Settings. Thanks to xet7.
The list-width and swimlane-height resize-lock toggles and the board-wide
"same width for all lists" toggle, header icons since #6680, move into
Board Settings / Swimlane and Board Settings / List instead - with
the rest of a board's settings, reached from the board's cog menu, rather
than living as icons in the header. Minicard and Card settings (the
shared table of two dozen display settings) move back into Board
Settings / Card: they had been split across the card's own menu ("Show
on Card") and the minicard's own menu ("Show on Minicard"), one column of
the same table each. Both menu entries, their wrapper popups, and the
cardMenuSource module that only existed to tell those two menus apart
are removed; the shared settings table itself is unchanged, now opened
directly from Board Settings with both columns shown side by side.
Swimlane and List stay board-admin only, the same restriction the resize
locks already had; Card is open to any board member, matching who could
reach it before - a non-admin still gets the one PERSONAL row in that
table ("Labels text") rather than the admin-only rows, the same fallback
showOnMinicardPopup used to give them. All three reuse existing,
already-translated words ("Swimlane", "List", "Card"/"Card Settings") via
Popup.open's titleKey, rather than adding new *Popup-title keys that
would need translating into 147 languages. The group sits between two
<hr> rules in Board Settings, as its own section.
tests/boardSettingsSwimlaneListCard.test.cjs pins the new layout and the
personal-row fallback.
Restore the Show on Card/Minicard/Description column headings, on Card. Thanks to xet7.
The column headings above the settings table were removed once (commit
02025aa) because the popup used to flow its rows into several
side-by-side columns whenever only Card or only Minicard was shown, so
the heading sat above the first of those columns and read as if it named
that one alone. Board Settings / Card always shows both columns in a
single list of rows now, so that ambiguity is gone, and the heading is
back: "Show on Card" / "Show on Minicard" / "Description", reusing the
same already-translated keys as before. It is an ordinary
.card-settings-row this time, not the old separate
.card-settings-grid/sticky-header markup, so the same CSS that hides a
column for the still-supported side="card"/"minicard" case hides the
matching heading with it, and personalOnly (what a non-admin gets)
hides the whole heading along with every other non-personal row.
Remove the duplicate hr above Move Board to Archive. Thanks to xet7.
The Swimlane/List/Card group's own closing hr and the Archive Board
group's opening hr sat back to back, drawing two rules where one was
enough.
On Card, the Show on Minicard column reads left of Show on Card. Thanks to xet7.
CSS order on the grid items, not a markup change: column 1 (card) and
column 2 (minicard) keep their original DOM order, so the
show-card-only/show-minicard-only nth-child hiding rules still target
the right element regardless of side. Only the visual position of the two
swaps; Description (column 3) gets an explicit order too, so it is not
pulled in front by the order: 0 an unordered item would otherwise
share.
and fixes the following bugs:
Edit Custom Fields popup - a rule with nothing above it to separate.
No rule above Add when there are no custom fields yet. Thanks to xet7.
The hr between the field list and "Add custom field" was unconditional,
so a board with no custom field yet drew a rule with an empty list above
it - two lines doing the work of an empty one. It is now conditional on
board.customFields.length.
List Actions and Swimlane Actions - two menu entries for things a drag already does.
Hide List Actions / Set width and Swimlane Actions / Set Swimlane height. Thanks to xet7.
Both are still reachable by dragging the resize handle (unless Board
Settings / List or Board Settings / Swimlane has locked that), and the
board-wide fixed-width value now lives in Board Settings / List - a menu
entry for the same thing was a second place to look for it. The
underlying popups (setListWidthPopup, setSwimlaneHeightPopup) are
untouched, only the menu entries that opened them are removed. Removing
"Set width" left its own group empty, so the group (and its enclosing
hr) is removed entirely; removing "Set Swimlane height" left "Select
color" as the only row of its group, so that group's hr moves inside
the same admin-only check as the color entry itself, rather than leaving
a dangling hr (or an empty list) for a non-admin.
and updates the following FerretDB v1 dependencies and fixes:
FerretDB v1 - infinity-value storage, a gRPC security fix, and current dependencies.
Allow storing Infinity/-Infinity doubles, matching MongoDB. Thanks to xet7.
mongorestore restoring a wekan cards collection with a sort: -Infinity value failed one document with invalid value: { "sort": -Inf } (infinity values are not allowed), even though real MongoDB stores
+Inf/-Inf doubles without complaint. The root cause was one level down
from that check: sjson (the JSON-based encoding documents are stored as)
already special-cased NaN as the string "NaN" because Go's
encoding/json cannot marshal NaN/Inf floats directly, but never did the
same for Infinity, so document validation rejected it outright rather
than hand the storage layer a value it could not round-trip. Infinity is
now encoded the same way NaN already was, and the document-validation
rejection - along with the matching restriction on a $mul that
overflows to infinity - is removed now that storage supports it. Unit
and integration tests cover the insert/read/update round-trip against a
live server.
Bump tools/go.mod's indirect grpc-go to 1.83.2 (GHSA-2v4p-qf9q-27wj). Thanks to xet7.
Dependabot alert 47: a gRPC-Go server configured with
xds.NewGRPCServer() crashes (High severity, Denial of Service) on a
crafted request missing both the :authority and Host headers,
affecting google.golang.org/grpc >= 1.83.0, < 1.83.2. The root module
and integration/go.mod were already on the patched 1.83.2, but
tools/go.mod - a separate module pulling grpc in indirectly through
golang.org/x/pkgsite - was missed and stayed on the vulnerable 1.83.1.
go mod verify and go list -m all both succeed with the updated graph.
Sync integration/go.mod after the ferretdb dependency-group bump. Thanks to xet7.
The "ferretdb" dependency-group update brought the root module's
go.mod/go.sum current, but left integration's pointing at the old
indirect-dependency versions, so go build ./integration/... failed with
"updates to go.mod needed; to update it: go mod tidy". Running it there
brings both modules back in sync.
Update gRPC to 1.83.2 in the root and integration modules. Thanks to dependabot and xet7.
google.golang.org/grpc moves from 1.83.1 to 1.83.2 in both the root
module and integration. Module checksums verify and the affected
packages build.
Update the mongo and golang build images. Thanks to dependabot and xet7.
The mongo image used by build/deps moves from 8.3.8 to 8.3.9, and the
golang image used by build/ferretdb moves from 1.27.0 to 1.27.1.
Update the "ferretdb" dependency group. Thanks to dependabot and xet7.
Seven updates: github.com/SAP/go-hdb (1.18.2 → 1.18.3),
github.com/go-sql-driver/mysql (1.10.0 → 1.10.1),
github.com/prometheus/client_model (0.6.2 → 0.6.3),
github.com/prometheus/common (0.70.1 → 0.71.0), golang.org/x/crypto
(0.55.0 → 0.56.0), golang.org/x/sys (0.47.0 → 0.48.0) and
modernc.org/sqlite (1.57.0 → 1.58.0, pulling in newer
modernc.org/libc/modernc.org/memory). Module checksums verify and a
binary containing the SQLite, PostgreSQL, MySQL and HANA handlers builds
successfully.