feat(wekan): update image docker.io/wekanteam/wekan v9.49 → v9.53 (#49235)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [docker.io/wekanteam/wekan](https://redirect.github.com/wekan/wekan) |
minor | `d632b48` → `529fb26` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/18710) for more information.

Add the preset `:preserveSemverRanges` to your config if you don't want
to pin your dependencies.

---

### Release Notes

<details>
<summary>wekan/wekan (docker.io/wekanteam/wekan)</summary>

###
[`v9.53`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v953-2026-06-18-WeKan--release)

[Compare
Source](https://redirect.github.com/wekan/wekan/compare/v9.52...v9.53)

This release fixes the following bugs:

- [Fixed Playwright e2e tests all failing because `Meteor` was not a
browser
global](https://redirect.github.com/wekan/wekan/commit/640d8ddadba64fde43c49a28b0fa39e30fbed105).
Every Playwright end-to-end test (all 183, across Chromium, Firefox and
WebKit) failed at
the `waitForMeteor` step with `TimeoutError: page.waitForFunction`,
because
`typeof Meteor` was `undefined` in the browser `window` scope. Under the
Meteor 3.5 +
rspack build, bare `Meteor` references in app code are rewritten by
rspack's ProvidePlugin
into per-module imports, so `Meteor` is no longer placed on `window` the
way the classic
Meteor linker did. The tests call `Meteor.loginWithToken` /
`Meteor.userId` /
`Meteor.subscribe` etc. via `page.evaluate` (which runs in `window`
scope), so they could
never proceed past login. Fixed by re-exposing `window.Meteor = Meteor`
early in
`client/00-startup.js`, restoring the long-standing classic-Meteor
behaviour where `Meteor`
  is a global (also handy in the browser console).
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for
their translations.

###
[`v9.52`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v952-2026-06-18-WeKan--release)

[Compare
Source](https://redirect.github.com/wekan/wekan/compare/v9.51...v9.52)

This release fixes the following CRITICAL SECURITY ISSUE of
[InputBleed](https://wekan.fi/hall-of-fame/inputbleed/):

- [Fixed
InputBleed](https://redirect.github.com/wekan/wekan/commit/8dfb54d9d5d68f120e3aa710c3521a9e9ac9670c):
  incomplete multi-character HTML sanitization in card dependency
import allowed HTML/script element
injection]\(<https://github.com/wekan/wekan/blob/main/client/lib/importDependencies.js>)
(CWE-79 Cross-site Scripting, CWE-80 Improper Neutralization of
Script-Related HTML
Tags, CWE-116 Improper Encoding or Escaping of Output; GitHub CodeQL
code scanning
alert [#&#8203;421](https://redirect.github.com/wekan/wekan/issues/421),
rule `js/incomplete-multi-character-sanitization`, severity High).
`stripHtml()` in `client/lib/importDependencies.js` removed HTML tags
with a single
pass of `/<[^>]*>/g`. That is an incomplete multi-character sanitization
in two ways:
removing one match can splice surrounding text into a new match (so the
replacement
must be looped to a fixed point), and a dangling, unclosed tag that has
no closing
`>` (for example a trailing `<script` or `<svg/onload=...`) is never
matched by the
regex at all and survives untouched — leaving `<script` in the output,
exactly as the
scanner warned. A crafted card-dependency ("Red Strings") import file
(the
WeKan/generic JSON or Miro item titles and connector captions that pass
through
`stripHtml`) could therefore smuggle an HTML/script fragment past the
sanitizer.
Fixed by looping the tag-stripping replacement to a fixed point and then
removing any
remaining stray `<`/`>` characters, so neither a complete nor a partial
tag can
  remain.
  Thanks to GitHub CodeQL, xet7 and Claude.

and fixes the following bugs:

- [Card Details
popup](https://redirect.github.com/wekan/wekan/commit/15fcde99e2105075fe75ed4164a8b116b91d5606):
  removed the redundant empty second popup that appeared at
the top of the page when a card was opened as a popup (for example from
the
Board Table view Edit link or from search results). The card details
content is
always position:fixed, so it renders as its own framed box and escapes
the
generic popup wrapper, leaving that wrapper (with its "Card Details"
title
header, border and background) visible as an empty box. The wrapper is
now
collapsed and made invisible so only the card itself shows. The card's
own close
button now closes the popup (in addition to clicking outside or pressing
Escape).
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for
their translations.

###
[`v9.51`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v951-2026-06-17-WeKan--release)

[Compare
Source](https://redirect.github.com/wekan/wekan/compare/v9.50...v9.51)

This release adds the following improvements:

- [Board Table
view](https://redirect.github.com/wekan/wekan/commit/73b4a97aaafc00baba260cfd16526d78e6372dee):
  the table now has the columns Card, List, Swimlane, Assignees,
Members, Labels, Received, Start, Due and End. The Received, Start, Due
and End
dates are formatted and styled the same way as on the opened card
details and the
Gantt view (reusing the cardReceivedDate / cardStartDate / cardDueDate /
cardEndDate
badge templates), and can be sorted by clicking their column headers.
Clicking a
date opens the date-select popup so it can be changed, and an add (+)
button is
shown for empty dates — both only for board roles that have permission
to change
the card (the same `canModifyCard` check used on card details). A
Received, Start,
Due or End column is hidden when both its "Show at Card" and "Show at
Minicard"
Card Settings are unchecked for the board. The Labels cell now
word-wraps so long
label names no longer overflow across the other columns. Each row also
has a
leftmost "Edit" link (pencil icon + text) styled like the one on the
Admin Panel /
People page; clicking it opens the Card Details popup on top of the
Board Table
  view.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for
their translations.

###
[`v9.50`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v950-2026-06-17-WeKan--release)

[Compare
Source](https://redirect.github.com/wekan/wekan/compare/v9.49...v9.50)

This release adds the following improvements:

- [Board Table
view](https://redirect.github.com/wekan/wekan/commit/a5d7e45200628e3112fd4fa297e26a381b985156):
  render markdown with `+viewer` in the Card, List, Swimlane and
Labels cells, so emoji shortcodes and markdown (for example
`👍`) display
rendered instead of as literal text, and word-wrap the Card, List and
Swimlane
  cells so long text no longer overflows across the other columns.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for
their translations.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImFwcC93ZWthbiIsImF1dG9tZXJnZSIsInJlbm92YXRlL2NvbnRhaW5lciIsInR5cGUvbWlub3IiXX0=-->

charts/stable/wekan/Chart.yaml

@@ -9,7 +9,7 @@ annotations:
   trueforge.org/min_helm_version: "3.14"
   trueforge.org/train: stable
 apiVersion: v2
-appVersion: 9.49.0
+appVersion: 9.53.0
 dependencies:
   - name: common
     version: 29.5.3
@@ -44,5 +44,5 @@ sources:
   - https://hub.docker.com/r/wekanteam/wekan
   - https://wekan.github.io/
 type: application
-version: 21.25.0
+version: 21.26.0
 

charts/stable/wekan/values.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=./values.schema.json
 image:
   repository: docker.io/wekanteam/wekan
-  tag: v9.49@sha256:d632b489a56181ab620410b1c4e6a5975dd021913c7ba45e1496dfad12f3c605
+  tag: v9.53@sha256:529fb26e8a9ded803cc40f238c055c1b9ffb6eaadee8da7633d5d54d82e2bf2b
   pullPolicy: IfNotPresent
 service:
   main: