From 6cc533402ac49584e0c2edf0e83fda3ee0dacc1d Mon Sep 17 00:00:00 2001 From: TrueCharts Bot Date: Thu, 18 Jun 2026 01:12:24 +0200 Subject: [PATCH] =?UTF-8?q?feat(wekan):=20update=20image=20docker.io/wekan?= =?UTF-8?q?team/wekan=20v9.49=20=E2=86=92=20v9.53=20(#49235)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker.io/wekanteam/wekan](https://redirect.github.com/wekan/wekan) | minor | `d632b48` → `529fb26` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/18710) for more information. Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies. --- ### Release Notes
wekan/wekan (docker.io/wekanteam/wekan) ### [`v9.53`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v953-2026-06-18-WeKan--release) [Compare Source](https://redirect.github.com/wekan/wekan/compare/v9.52...v9.53) This release fixes the following bugs: - [Fixed Playwright e2e tests all failing because `Meteor` was not a browser global](https://redirect.github.com/wekan/wekan/commit/640d8ddadba64fde43c49a28b0fa39e30fbed105). Every Playwright end-to-end test (all 183, across Chromium, Firefox and WebKit) failed at the `waitForMeteor` step with `TimeoutError: page.waitForFunction`, because `typeof Meteor` was `undefined` in the browser `window` scope. Under the Meteor 3.5 + rspack build, bare `Meteor` references in app code are rewritten by rspack's ProvidePlugin into per-module imports, so `Meteor` is no longer placed on `window` the way the classic Meteor linker did. The tests call `Meteor.loginWithToken` / `Meteor.userId` / `Meteor.subscribe` etc. via `page.evaluate` (which runs in `window` scope), so they could never proceed past login. Fixed by re-exposing `window.Meteor = Meteor` early in `client/00-startup.js`, restoring the long-standing classic-Meteor behaviour where `Meteor` is a global (also handy in the browser console). Thanks to xet7. Thanks to above GitHub users for their contributions and translators for their translations. ### [`v9.52`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v952-2026-06-18-WeKan--release) [Compare Source](https://redirect.github.com/wekan/wekan/compare/v9.51...v9.52) This release fixes the following CRITICAL SECURITY ISSUE of [InputBleed](https://wekan.fi/hall-of-fame/inputbleed/): - [Fixed InputBleed](https://redirect.github.com/wekan/wekan/commit/8dfb54d9d5d68f120e3aa710c3521a9e9ac9670c): incomplete multi-character HTML sanitization in card dependency import allowed HTML/script element injection]\() (CWE-79 Cross-site Scripting, CWE-80 Improper Neutralization of Script-Related HTML Tags, CWE-116 Improper Encoding or Escaping of Output; GitHub CodeQL code scanning alert [#​421](https://redirect.github.com/wekan/wekan/issues/421), rule `js/incomplete-multi-character-sanitization`, severity High). `stripHtml()` in `client/lib/importDependencies.js` removed HTML tags with a single pass of `/<[^>]*>/g`. That is an incomplete multi-character sanitization in two ways: removing one match can splice surrounding text into a new match (so the replacement must be looped to a fixed point), and a dangling, unclosed tag that has no closing `>` (for example a trailing `` characters, so neither a complete nor a partial tag can remain. Thanks to GitHub CodeQL, xet7 and Claude. and fixes the following bugs: - [Card Details popup](https://redirect.github.com/wekan/wekan/commit/15fcde99e2105075fe75ed4164a8b116b91d5606): removed the redundant empty second popup that appeared at the top of the page when a card was opened as a popup (for example from the Board Table view Edit link or from search results). The card details content is always position:fixed, so it renders as its own framed box and escapes the generic popup wrapper, leaving that wrapper (with its "Card Details" title header, border and background) visible as an empty box. The wrapper is now collapsed and made invisible so only the card itself shows. The card's own close button now closes the popup (in addition to clicking outside or pressing Escape). Thanks to xet7. Thanks to above GitHub users for their contributions and translators for their translations. ### [`v9.51`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v951-2026-06-17-WeKan--release) [Compare Source](https://redirect.github.com/wekan/wekan/compare/v9.50...v9.51) This release adds the following improvements: - [Board Table view](https://redirect.github.com/wekan/wekan/commit/73b4a97aaafc00baba260cfd16526d78e6372dee): the table now has the columns Card, List, Swimlane, Assignees, Members, Labels, Received, Start, Due and End. The Received, Start, Due and End dates are formatted and styled the same way as on the opened card details and the Gantt view (reusing the cardReceivedDate / cardStartDate / cardDueDate / cardEndDate badge templates), and can be sorted by clicking their column headers. Clicking a date opens the date-select popup so it can be changed, and an add (+) button is shown for empty dates — both only for board roles that have permission to change the card (the same `canModifyCard` check used on card details). A Received, Start, Due or End column is hidden when both its "Show at Card" and "Show at Minicard" Card Settings are unchecked for the board. The Labels cell now word-wraps so long label names no longer overflow across the other columns. Each row also has a leftmost "Edit" link (pencil icon + text) styled like the one on the Admin Panel / People page; clicking it opens the Card Details popup on top of the Board Table view. Thanks to xet7. Thanks to above GitHub users for their contributions and translators for their translations. ### [`v9.50`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v950-2026-06-17-WeKan--release) [Compare Source](https://redirect.github.com/wekan/wekan/compare/v9.49...v9.50) This release adds the following improvements: - [Board Table view](https://redirect.github.com/wekan/wekan/commit/a5d7e45200628e3112fd4fa297e26a381b985156): render markdown with `+viewer` in the Card, List, Swimlane and Labels cells, so emoji shortcodes and markdown (for example `:thumbsup:`) display rendered instead of as literal text, and word-wrap the Card, List and Swimlane cells so long text no longer overflows across the other columns. Thanks to xet7. Thanks to above GitHub users for their contributions and translators for their translations.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). --- charts/stable/wekan/Chart.yaml | 4 ++-- charts/stable/wekan/values.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/stable/wekan/Chart.yaml b/charts/stable/wekan/Chart.yaml index c28753ed8b8..d5d85587fa1 100644 --- a/charts/stable/wekan/Chart.yaml +++ b/charts/stable/wekan/Chart.yaml @@ -9,7 +9,7 @@ annotations: trueforge.org/min_helm_version: "3.14" trueforge.org/train: stable apiVersion: v2 -appVersion: 9.49.0 +appVersion: 9.53.0 dependencies: - name: common version: 29.5.3 @@ -44,5 +44,5 @@ sources: - https://hub.docker.com/r/wekanteam/wekan - https://wekan.github.io/ type: application -version: 21.25.0 +version: 21.26.0 diff --git a/charts/stable/wekan/values.yaml b/charts/stable/wekan/values.yaml index b13fb832cc6..d2c5011b1a3 100644 --- a/charts/stable/wekan/values.yaml +++ b/charts/stable/wekan/values.yaml @@ -1,7 +1,7 @@ # yaml-language-server: $schema=./values.schema.json image: repository: docker.io/wekanteam/wekan - tag: v9.49@sha256:d632b489a56181ab620410b1c4e6a5975dd021913c7ba45e1496dfad12f3c605 + tag: v9.53@sha256:529fb26e8a9ded803cc40f238c055c1b9ffb6eaadee8da7633d5d54d82e2bf2b pullPolicy: IfNotPresent service: main: