feat(wekan): update image docker.io/wekanteam/wekan v9.41 → v9.43 (#49109)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [docker.io/wekanteam/wekan](https://redirect.github.com/wekan/wekan) |
minor | `c1131bf` → `1cb700c` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/18710) for more information.

Add the preset `:preserveSemverRanges` to your config if you don't want
to pin your dependencies.

---

### Release Notes

<details>
<summary>wekan/wekan (docker.io/wekanteam/wekan)</summary>

###
[`v9.43`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v943-2026-06-13-WeKan--release)

[Compare
Source](https://redirect.github.com/wekan/wekan/compare/v9.42...v9.43)

This release adds the following new features:

- [Add/Edit location popup can
also](https://redirect.github.com/wekan/wekan/commit/84dc493cf7bb26c8fbffffbcb36e691bcdcfcdb9)
  detect a location from a map link from many providers,
  grouped by region — USA: Google Maps, Bing Maps, Apple Maps, Waze;
Europe: OpenStreetMap, HERE WeGo, Yandex Maps, Mapy.cz, 2GIS; Asia:
Baidu Maps,
Amap (Gaode) — plus generic `?q=`/`?ll=` links: paste the link, press
"Detect",
and the latitude, longitude and (when present) the place name/address
are
filled in automatically. Detection handles each provider's real-world
URL
shapes, including percent-encoded commas (e.g. Waze/Yandex
`ll=...%2C...`) and
alternate forms (HERE `share.here.com/l/`, Yandex `pt=`, 2GIS `m=`), and
the
coordinate order (several non-US providers use lon,lat). For the Chinese
providers a datum conversion is applied — Baidu uses BD-09 and Amap uses
GCJ-02, both offset from WGS-84 — so pins land in the right place on the
way in
and out. The popup also has an "Open map links at" setting
(OpenStreetMap by
default) saved to the user profile, with the same region-grouped
provider list,
  controlling which map service the location "Open in map" links use.
  Thanks to xet7 and Claude.

and fixes the following bugs:

- Fix incomplete URL substring sanitization.

Thanks to above GitHub users for their contributions and translators for
their translations.

###
[`v9.42`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v942-2026-06-13-WeKan--release)

[Compare
Source](https://redirect.github.com/wekan/wekan/compare/v9.41...v9.42)

This release adds the following new features:

- [Greatly improved import from Trello to
WeKan](https://redirect.github.com/wekan/wekan/commit/899617bd4d83905df05fd8aab1d26630e676fee5):
- Attachments now import. Trello attachment URLs require OAuth to
download, so
WeKan could not fetch them. The Trello import page now has two separate
file
    fields: a **.json** field for a single Trello board, and a
    **.zip** field for a package produced by the
[Trello Card Attachments
Downloader](https://redirect.github.com/wekan/trello-attachments-downloader).
The .zip may contain one *or more* board .json files together with each
board's attachments in a board-name subfolder. The .zip is uploaded over
HTTP
and processed entirely on the server (the attachment bytes never travel
over
the realtime WebSocket, which previously overflowed the connection and
made
the page flicker): WeKan detects every board .json, matches each board
to its
attachment subfolder by name, streams each file straight into the
Default
file storage, imports all boards, then opens All Boards. The upload is
guarded
against abuse — it rejects oversized uploads, zip bombs (too many files
or too
much uncompressed data, per-file size caps) and unsafe entry paths
(absolute
paths or `..` traversal), and never overwrites existing files (stored
under
generated ids). The importer also reads attachments from
`card.attachments`
(newer Trello exports), not only from the action log, and uses the
correct
Meteor-Files insert API (the previous calls were no-ops on Meteor 3).
Single
board imports (the .json file or the pasted JSON, after the map-members
step)
now run through the same server-side HTTP path rather than the realtime
`importBoard` method, so a heavy import can no longer drop the WebSocket
and
get retried in an endless loop (the page flickering with "Invalid frame
header" / repeated "logged out" errors). When importing only a single
board
.json and you have saved Trello API key and token, WeKan uses them on
the
server to download that board's attachments, background image, member
avatars and card stickers from Trello (a .json export often omits
stickers;
avatars only fill in mapped users who have none — an existing avatar is
never
overwritten); each download is best-effort and a failure never aborts
the
import. After a single-board import the new board's data is subscribed
and
    loaded before opening it, so it shows its swimlanes, lists and cards
immediately instead of needing a browser page reload (the HTTP import,
unlike
the old realtime method, does not push the written documents to the
client by
    itself).
- Import Trello-only card features: stickers (shown as Font Awesome
icons on
minicards and the card detail), card cover (color or attachment), card
location (name, address, coordinates with an OpenStreetMap link), and
the
due-date "complete" checkbox shown on the minicard. Trello's two named
sticker packs are renamed and highlighted (the icon keeps its normal
colour)
so they stay distinct: the "taco" pack becomes "mascot" with an
underlined
icon, and the "pete" pack becomes "computer" with a ring around the
icon,
e.g. "pete-ghost" imports as "computer ghost" with a Snapchat-ghost
icon.
Several named stickers that used to share an icon now get their own Font
Awesome 4.7 icon (mascot active => heartbeat, pixel => qrcode, proto =>
flask, embarrassed => meh-o, clean => bath, computer shipped => truck).
- Live Trello API import: paste your Trello API key and token on the
Trello
import page to list all your Trello workspaces and boards, then import
all
    or selected boards together with their attachments (downloaded
server-side). Imported boards are placed under a personal workspace
named
after their Trello workspace, created by name if it does not exist,
under an
optional parent workspace you choose. The API client respects Trello's
rate
limits: it spaces out requests, honours `Retry-After` on HTTP 429,
retries
transient 5xx and network errors with capped exponential backoff, and
reports a clear error on an invalid key/token (401). After a successful
API
import you are taken to the All Boards page where the new boards appear.
- The live API import runs as a background job on the server: you can
navigate
    away and come back to the Trello import page to watch progress, see
per-board results, and read the full error log. Errors are shown in a
selectable text box with a one-click "Copy to clipboard" button (and you
can
still select and copy just part of the text) so they are easy to share
when
fixing issues. If the import stops on a fatal API error (invalid token,
or
rate limit still failing after retries) you can fix the cause and Resume
from where it left off, and a server restart leaves the job paused for
resuming rather than lost. You can also Cancel the import, or Cancel and
delete the boards already imported, to start the whole process over
cleanly.
- You can optionally save your Trello API key and token with the Save
and
Delete buttons on the import page. When saved, they are stored only on
the
server, never sent back to the browser, and are reused automatically
when
you list workspaces or import (so you do not have to paste them again);
a
"saved" indicator is shown, Save can overwrite them with new values, and
Delete clears them from the database. If you do not save them, they are
kept
only in server memory for the running import and re-supplied when you
resume.
- Larger Trello JSON exports can be selected as a file instead of
pasted.
- Keep imported usernames for later mapping. Imported members that match
an
existing WeKan user (by username, or by a previously recorded imported
username) are mapped automatically, and the imported username is
remembered
on that user so future imports map too. Members with no matching WeKan
user
are no longer lost: their usernames are kept on the board, so an admin
can
map them to real users later in Admin Panel / People (Imported
Usernames),
    without having to map everyone up front at import time.
    Thanks to xet7 and Claude.
- Board background images can now be stored in WeKan. A new
`backgrounds` file
storage directory is created alongside `attachments` and `avatars`
(using the
current default storage backend), and Board menu → Board backgrounds
lets a
board admin upload background images, set one as the active board
background,
download, and delete them. Board export now includes the board's
background
  images and re-imports them, and a Trello board's background image is
downloaded and stored on import (so it keeps working even if the
original
  Trello URL later changes). Thanks to xet7 and Claude.
- Stickers can be added to and removed from cards directly in WeKan,
chosen from
a set of Font Awesome icons similar to Trello's stickers (previously
stickers
only arrived via Trello import). The picker also includes every "mascot"
(underlined) and "computer" (ringed) highlighted sticker that a Trello
import
can produce — generated from the same icon mapping the importer uses —
so any
imported sticker can also be added by hand. Stickers show on the
minicard and
  in the card detail. Thanks to xet7 and Claude.
- The Trello-style "complete" checkbox (mark a card complete/incomplete,
independent of the due date) is shown as an animated green checkbox to
the
left of the card title, both on the minicard and in the opened card,
with
"Mark as complete" / "Mark as incomplete" tooltips. It uses the same
animated
checkbox style as Admin Panel / Settings / Announcements and is
vertically
centered with the title text, and the two stay in sync. The minicard and
the
opened-card checkboxes use the same checked style (the board theme's
colour, or
green when no theme is set), so they always look identical. Subtask
checkboxes
and the card-detail custom-field checkbox now use the same animated
checkbox as
checklist items (they previously used static square icons), so every
checkbox
  on a card animates consistently. Thanks to xet7 and Claude.
- Cards can now have multiple locations, similar to multiple members.
The card
detail shows a Location section (after Labels and Stickers) listing each
location with its name, address and an OpenStreetMap link, with an "Add
location" button to add more and a button to edit or remove each one. A
single
location imported from Trello keeps working and is shown in the same
list. The
Add/Edit location popup can also detect a location from any map link
(Google
Maps, OpenStreetMap, Bing Maps, Apple Maps, or generic `?q=`/`?ll=`
links):
paste the link, press "Detect", and the latitude, longitude and (when
present)
the place name/address are filled in automatically. The popup also has
an
"Open map links at" setting (OpenStreetMap by default, or
Google/Bing/Apple
Maps) saved to the user profile, controlling which map service the
location
  "Open in map" links use.
  Thanks to xet7 and Claude.
- The opened card now docks to the top of the window, overlaying the
global and
board header bars, instead of opening downward from the clicked
minicard, and
it can be dragged all the way to the top without its top hiding behind
those
bars. (At 100% zoom the board wrapper no longer sets a `transform:
scale(1)`,
which had made it the containing block for the fixed card and trapped it
below
  the headers.) Thanks to xet7 and Claude.

and fixes the following bugs:

- [Fix Wrong card number after
Import](https://redirect.github.com/wekan/wekan/commit/aabcaa658edc2135dfd035bedea186ddf6b26068).
  Thanks to titver968, xet7 and Claude.
- [Fix Board Export/Import
error](https://redirect.github.com/wekan/wekan/commit/68e0032c6d3b23a195b4051e2853465965e073dc).
Fix import/clone of inconsistent board JSON so the newest WeKan can
import
board exports from any newer or older WeKan version. A syntactically
valid
  export can still be internally inconsistent (a board member whose user
account was deleted is no longer in the export's `users`, cards pointing
at a
missing `listId`, orphaned checklists, or a missing `lists` array). Such
  exports previously failed import as "error-json-malformed" or silently
dropped data (cards with an undefined list never rendered). The importer
now
  skips dangling user references in the member mapper (client
  `wekanMembersMapper`, server `wekanmapper` used by board cloning, and
`WekanCreator`), falls back to the first imported list — creating one
default
list when the export has none — for cards with a dangling `listId`, and
skips
  orphaned checklists whose card is missing. The importer remains
version-agnostic: it never reads `_format`, normalizes old `id` vs `_id`
fields, and ignores the source `boardId`. Added
`tests/wekanCreator.inconsistent.test.js`
  covering these cases.
  Thanks to titver968, xet7 and Claude.
- Fix Trello import returning HTTP 500 on any card that has an
attachment. A
past refactor removed the `links` variable declaration but left its
consumer
  in `models/trelloCreator.js`, so importing an attachment card threw
"ReferenceError: links is not defined". Also fixed a stray `return` that
silently aborted importing the rest of the cards when one attachment URL
was
blocked (now `continue`), and Trello cards no longer all import as card
  number #&#8203;0 (the Trello short number `idShort` is preserved).
  Thanks to xet7 and Claude.
- Fix attachments not importing from WeKan board JSON exports. The
importer
called the old Meteor-Files `Attachments.load/insert(..., cb, true)`
API,
which is a no-op on Meteor 3, so exported base64 attachments were
silently
dropped. It now inserts them with `Attachments.insertAsync`, and one
failed
  attachment no longer aborts importing the rest of the cards.
  Thanks to xet7 and Claude.

Thanks to above GitHub users for their contributions and translators for
their translations.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImFwcC93ZWthbiIsImF1dG9tZXJnZSIsInJlbm92YXRlL2NvbnRhaW5lciIsInR5cGUvbWlub3IiXX0=-->

charts/stable/wekan/Chart.yaml

@@ -9,7 +9,7 @@ annotations:
   trueforge.org/min_helm_version: "3.14"
   trueforge.org/train: stable
 apiVersion: v2
-appVersion: 9.41.0
+appVersion: 9.43.0
 dependencies:
   - name: common
     version: 29.5.3
@@ -44,5 +44,5 @@ sources:
   - https://hub.docker.com/r/wekanteam/wekan
   - https://wekan.github.io/
 type: application
-version: 21.20.0
+version: 21.21.0
 

charts/stable/wekan/values.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=./values.schema.json
 image:
   repository: docker.io/wekanteam/wekan
-  tag: v9.41@sha256:c1131bf5596fb7892a7b5507c99b74789e4886aa98bb2eabbee34ce084aa85cd
+  tag: v9.43@sha256:1cb700c84aec7fcdb5256a8ee88b49ae913f4dead19e1339a64990ac57dcbc40
   pullPolicy: IfNotPresent
 service:
   main: