feat(wekan): update image docker.io/wekanteam/wekan v9.65 → v9.67 (#49342)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [docker.io/wekanteam/wekan](https://redirect.github.com/wekan/wekan) |
minor | `a453464` → `6a6a5cc` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/18710) for more information.

Add the preset `:preserveSemverRanges` to your config if you don't want
to pin your dependencies.

---

### Release Notes

<details>
<summary>wekan/wekan (docker.io/wekanteam/wekan)</summary>

###
[`v9.67`](https://redirect.github.com/wekan/wekan/blob/HEAD/CHANGELOG.md#v967-2026-06-21-WeKan--release)

[Compare
Source](https://redirect.github.com/wekan/wekan/compare/v9.65...v9.67)

This release fixes the following bugs:

- [Reworked confusing and unreliable list
widths](https://redirect.github.com/wekan/wekan/issues/6409),
[#&#8203;6409](https://redirect.github.com/wekan/wekan/issues/6409): a
list now has **one** width instead of the old
"min width / max width / automatic" trio, and it reliably persists
across reloads (the render now drives the
`--list-width` CSS variable the styles actually use, so a width no
longer reverts to `auto` after reload).
  A new board setting **Personal list widths** chooses the scope:
- **Off (default) — Shared:** the width lives on the list
(`lists.width`), is the same for everyone on the board,
and only members with write access can change it (read-only/comment-only
members no longer see the resize
handle). Shared widths are included in board **export/import** (the
importer previously dropped `lists.width`;
it now preserves width, color and collapsed state, and the board's
list-width scope).
- **On — Personal:** each user keeps their own widths (profile, or
localStorage when not logged in), falling back
to the shared width then the default. The per-list popup is simplified
to a single width value plus an
**Auto list width** toggle (fit lists to content); the advanced per-list
min/max pixel options were removed.
Auto-width follows the same Shared/Personal scope (per-board for
everyone, or per-user) and is carried through
    export/import. Documented in `docs/Features/Lists/Lists.md`.

- `rebuild-wekan.sh` / `rebuild-wekan.bat` menu option 2 ("Build WeKan")
now also clears the rspack dev-build caches
(`_build` and `node_modules/.cache`) in addition to `node_modules` /
`.meteor/local` / `.build`, so the next
`meteor run` recompiles from scratch instead of occasionally serving
stale modules after a `git` checkout/merge.

- `rebuild-wekan.sh` / `rebuild-wekan.bat` now give the Meteor build
tool and Node a larger heap by default
(`TOOL_NODE_FLAGS` and `NODE_OPTIONS` = `--max-old-space-size=8192`) for
every dev-run, test and build option, so
long development sessions and test runs no longer crash with "FATAL
ERROR: ... JavaScript heap out of memory".
Both honor an existing value, so you can lower it on machines with less
RAM.

- [Fixed editing the 2nd/3rd organization or team in Admin Panel ›
People always showing the FIRST
one](https://redirect.github.com/wekan/wekan/issues/6411),
[#&#8203;6411](https://redirect.github.com/wekan/wekan/issues/6411): on
`/people`, clicking *Edit* on any organization or team filled
the form with the first one's values (so you could never edit the
others). The edit/settings popups are opened from
the row with data context `{ org }` / `{ team }`, but their helpers read
`this.orgId` / `this.teamId` (undefined
there) and called `getOrg(undefined)` / `getTeam(undefined)`, which
`findOne({})` resolves to the first document.
The popup helpers, the save handlers and the delete (settings) handlers
now resolve the clicked row's id from the
`{ org }` / `{ team }` context. Verified against a running instance
(each org/team now edits its own values).

- **Fixed boards not rendering at all (blank board view) after the
mongodb/bson 7.3.0 dependency bump.** bson 7.x runs
`const { startupSnapshot } = globalThis?.process?.getBuiltinModule('v8')
?? {}` at module-load time; the optional
chaining stops before the *call*, so in the browser — where a partial
`process` polyfill exists but has no
`getBuiltinModule` — it threw `TypeError: getBuiltinModule is not a
function` while evaluating
`client/components/cards/attachments.js` (`import { ObjectId } from
'bson'`). That aborted the client bundle
bootstrap part-way through `client/imports.js`, so every feature
imported after it (notifications, swimlanes,
rules, …) was never registered and the board view died with `No such
template: notifications`. Added a tiny browser
shim (`client/lib/bsonBrowserShim.js`, imported first in
`client/main.js`) that gives the browser `process` a no-op
`getBuiltinModule`, so bson takes its intended `?? {}` fallback. New
unit tests
(`client/lib/tests/bsonBrowserShim.tests.js`); also hardened the
[#&#8203;5686](https://redirect.github.com/wekan/wekan/issues/5686)
Playwright spec to run against a rendering
board. ([PR
#&#8203;6410](https://redirect.github.com/wekan/wekan/pull/6410))

- [Fixed REST API returning HTTP 500 with a stack trace for an invalid
request](https://redirect.github.com/wekan/wekan/pull/6406),
[#&#8203;5804](https://redirect.github.com/wekan/wekan/issues/5804):
posting a comment without the required `comment` parameter (or
to a board that does not exist) returned an HTTP 500 error page. The
schema-validation error thrown on insert is a
circular object (`SimpleSchemaValidationContext` → `SimpleSchema` → …),
and serializing it crashed the response
writer (`Converting circular structure to JSON`). Now: the `comment`
parameter is validated and a missing/empty one
returns **HTTP 400**; an unknown board returns **HTTP 404** (the
board-access checks no longer dereference
`board.members` of a non-existent board); the JSON response writer is
crash-proof (falls back to a safe
`{ "error": … }` payload instead of throwing); and REST comment errors
now use their real status code instead of
`200`. New unit tests in `server/lib/tests/apiResponseHelpers.tests.js`.
([PR #&#8203;6406](https://redirect.github.com/wekan/wekan/pull/6406))

- [Fixed selecting text in a checklist closing the
card](https://redirect.github.com/wekan/wekan/pull/6407),
[#&#8203;5686](https://redirect.github.com/wekan/wekan/issues/5686):
selecting the text of a checklist item and releasing the
mouse outside the card detail pane closed the card. The checklist items
template stops `mousedown` propagation
(for item sorting), so the existing `cardDetailsIsDragging` guard never
engaged and the document-level
"click outside to close" handler closed the card. The close handler now
also keeps the card open whenever a
live text selection is anchored inside the card pane (new
propagation-independent guard
`client/lib/cardCloseGuard.js`), so a deliberate click on empty board
space still closes the card. New unit
tests in `client/lib/tests/cardCloseGuard.tests.js` and a Playwright
regression test in
`tests/playwright/specs/34-checklist-text-selection.e2e.js`. ([PR
#&#8203;6407](https://redirect.github.com/wekan/wekan/pull/6407))

- [Fixed list reordering throwing `403 Access denied` for read-only
members](https://redirect.github.com/wekan/wekan/issues/5462),
[#&#8203;5462](https://redirect.github.com/wekan/wekan/issues/5462):
read-only / comment-only board members could still drag-reorder
lists, which fired a server write that allow/deny rejected with `403
Access denied` (the list then snapped back). Of
the three list jQuery-UI sortables in
`client/components/swimlanes/swimlanes.js`, one was not gated on
`Utils.canModifyBoard()`; it now is, consistent with the other two, plus
a defense-in-depth guard so a logged-in
user without write access can never persist a reorder (anonymous
public-board reordering via localStorage is
unaffected). The server already enforced this; the fix stops the
unauthorized drag and the console error. New
Playwright regression test in
`tests/playwright/specs/35-list-sort-permissions.e2e.js`. ([PR
#&#8203;6408](https://redirect.github.com/wekan/wekan/pull/6408))

Thanks to GitHub users Atry, mueller-ma and liferadioat for reporting.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImFwcC93ZWthbiIsImF1dG9tZXJnZSIsInJlbm92YXRlL2NvbnRhaW5lciIsInR5cGUvbWlub3IiXX0=-->

charts/stable/wekan/Chart.yaml

@@ -9,7 +9,7 @@ annotations:
   trueforge.org/min_helm_version: "3.14"
   trueforge.org/train: stable
 apiVersion: v2
-appVersion: 9.65.0
+appVersion: 9.67.0
 dependencies:
   - name: common
     version: 29.5.3
@@ -44,5 +44,5 @@ sources:
   - https://hub.docker.com/r/wekanteam/wekan
   - https://wekan.github.io/
 type: application
-version: 21.31.0
+version: 21.32.0
 

charts/stable/wekan/values.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=./values.schema.json
 image:
   repository: docker.io/wekanteam/wekan
-  tag: v9.65@sha256:a453464d0f2d8314238e01f9c12d0aa8ea25ef8d45ee7bbf7025a051556ed1e2
+  tag: v9.67@sha256:6a6a5ccfee2df3c83ecf37e735b1e8df681c4d41c8bf512128f4318a3e8b7b83
   pullPolicy: IfNotPresent
 service:
   main: