AvatarMimeBleed -
GHSA-4mjm-vj9f-p629,
Moderate, CWE-79 and CWE-434. Both current and CollectionFS-compatible avatar
routes trusted their stored MIME type. HTML, XML, SVG or JavaScript content
could therefore render under the WeKan origin. A shared policy now serves every
browser-executable type as a sandboxed opaque download with nosniff and frame
denial, while safe images remain inline. No Problems event is emitted because
legitimate avatar views use this path and cannot attribute old metadata to an
attacker. Behavioral tests cover every dangerous family, and a whole-route
negative scan forbids stored MIME fields from reaching Content-Type directly.

LegacyAttachBleed -
GHSA-xcxp-hx9w-q5q9,
Moderate, CWE-79 and CWE-693. The legacy attachment route forced downloads but
applied CSP, nosniff and frame denial only to SVG filenames, leaving stored
HTML, XML and JavaScript MIME types active. It now uses the same centralized
opaque-download policy as avatars. There is no attributable Problems event:
ordinary legacy downloads use the same path, and logging would blame a viewer
for metadata supplied earlier. Positive MIME decisions and the repository-wide
negative response-header scan cover the fix.

SwimlaneBleed -
GHSA-2x89-6mq2-834r,
Moderate, CWE-862. ensureDefaultSwimlane authorized an insertion with read
membership, bypassing the collection's write rule and allowing read-only roles
to alter board structure. The method now requires the same shared write
capability as every swimlane mutation. Rejected direct calls are bounded and
summarized as SwimlaneBleed in Admin Panel → Problems, and logging failure
cannot weaken the denial. Tests pin the guard before insertion and forbid read
membership or public visibility from authorizing the method.

The bundle, Windows, container entrypoint and every FerretDB v1 Compose backend
now clear inherited OpLog settings and start without replica-set arguments.
MongoDB 7 keeps its explicit rs0 connection, while the Meteor 3 multitenancy
guide gains an idempotent replica-set initializer and scoped OpLog credentials.
Positive and negative regression tests pin the separation.

The Snap and DEBUGSPEED launcher now start FerretDB as a single-node replica
set and give Meteor an OpLog URL, using oplog,polling without attempting
unsupported change streams. FerretDB wakes idle awaitData tails when a write
actually appends an OpLog record and emits directly applicable replacement
updates, eliminating the SQLite query loop and invalid whole-document $set
that previously made polling the safer default. Setting
wekan-ferretdb-oplog=false retains the standalone polling fallback. The
FerretDB write notification fix
has broadcast, gate and update-shape coverage. Its follow-up
idle-tail fix makes cursors
wait before querying and repairs the logical timestamp index on older OpLogs.
The filled-batch fix
returns a notified OpLog batch before waiting for another write, so reactive
board lists and newly opened boards cannot remain one mutation behind. A
restored large-dataset run confirms that creating a board, receiving its tile
and opening it now work reliably; a small query delay remains but does not
prevent completion. The
projection fix avoids
recursively decoding unrequested large fields during selective collection
scans, and its ID follow-up
retains MongoDB's implicit _id through the internal projection pipeline.
The distinct optimization
also decodes only its result path and filter fields instead of every complete
candidate document. Its SQLite pushdown
now constructs minimal result documents and collapses duplicate top-level keys
before they cross into Go. Its indexed follow-up
selects an existing distinct-key index and labels slow query shapes by their
originating command. The linear deduplication follow-up
sorts once and compacts adjacent equal BSON values instead of repeatedly
scanning the growing result array; 45,640 unique values now compact in about
5–18 milliseconds instead of consuming 15–17 seconds. The raw-value SQLite
follow-up deduplicates
schema/value pairs before constructing SJSON, reducing the restored
299,539-card distinct(listId) SQL workload from 3.60 to 2.94 seconds while
preserving all 41,875 BSON-distinct values. The full-document decoder
optimization
reuses bounded parsed schemas and avoids a streaming decoder allocation for
each common scalar. Its allocation follow-up
uses direct full-document JSON parsing, strict scalar conversion and
preallocated ordered fields, cutting the representative decoder benchmark from
617 to 561 allocations and about 53 KB to 44 KB per document. The hot-schema
and indexed-write optimization
replaces the cache's periodic full flush with a bounded 4,096-entry LRU; across
the restored 299,539-card dataset it reduced isolated complete decoding from
35.1 seconds to 17.2–19.0 seconds. It also makes SQLite updates and deletes use
the existing unique _id expression index instead of scanning the collection.
The non-finite numeric pushdown
keeps the unchanged numeric $type plus negated-range repair query inside
SQLite: across five restored ordered collections containing about 747,000
documents, it returns zero candidates in 1.9 seconds instead of spending about
30 seconds decoding every document. Ambiguous values remain candidates for the
authoritative MongoDB-compatible filter. The nested-composite decoder
optimization also replaces
per-document and per-array streaming decoders with complete-value parsing. The
representative nested-card workload drops from 561 to 431 allocations and from
about 44 KB to 31 KB per document, with median decode time improving from about
179 to 141 microseconds while preserving malformed-input behavior. The
linear document-construction follow-up
uses the document's existing key-count map to distinguish new fields from
replacements instead of searching all previously appended fields. The restored
299,539-card collection averages 31.3 fields per document; a representative
40-field decode improves by about 8% without adding allocations.
The SQLite iterator follow-up
also resolves result-column metadata once per query instead of requesting and
comparing it for every row. Full card scans avoid nearly 300,000 redundant
metadata calls, and each distinct scan avoids one call per returned key.
The schema-covering index optimization
appends internal BSON schema expressions to eligible SQLite indexes while
retaining their original value prefix and Mongo-visible definition. Existing
indexes are upgraded transactionally once. The restored 299,539-card
distinct(listId) SQL falls from 2.96 seconds to 45 milliseconds using a
covering scan, while unique and dotted indexes remain unchanged. Its
compound-index follow-up
also covers every top-level logical key and selects the narrowest index
containing the distinct and filter fields. The restored filtered
distinct(swimlaneId, archived) SQL becomes a 176-millisecond covering scan;
its live non-covering stage previously took about 12.2 seconds.
FerretDB now also creates a private scalar access path when a numeric corruption
check targets a field already present in a declared compound index. SQLite
cannot seek a non-leading compound key; the restored 299,539-card sort check
instead falls from 1.31 seconds to 17 milliseconds after a 1.26-second one-time
index build, without changing the MongoDB query or visible index definition.
Top-level $exists probes now run exactly inside SQLite as well, distinguishing
a missing field from explicit BSON null. The schema upgrader's no-match
archived probe previously decoded all 299,539 cards for 20.6 seconds; its
equivalent SQLite scan takes 20 milliseconds and needs no additional index.
The DEBUGSPEED launcher now waits for FerretDB to finish one-time database
preparation and accept connections before starting Meteor, reporting progress
every ten seconds and failing clearly if FerretDB exits or exceeds its bounded
readiness timeout. This prevents OpLog startup from crashing WeKan while an
index-format migration is still running. During that wait, the normal WeKan
port serves the existing blue migration page with the Admin Panel Product name,
a rebuilding-indexes explanation and automatic refresh. FerretDB publishes its
current database, collection and index atomically, and the page turns that into
a progress bar, percentage, current step and total, elapsed time, and estimated
time remaining. A configured Product name replaces both application names in
all user-facing migration text. The standalone page is stopped and its port
released before Meteor starts; source runs keep the Product name current in
their writable cache just as Snap already does.
Launcher tests pin both modes, while FerretDB unit tests and benchmarks cover
projected, distinct and complete decoding, malformed input, cache eviction,
SQL filtering and missing keys, numeric and logical fallback safety, implicit
and excluded IDs, and every query field retained for filtering and sorting.

Card dates and date custom fields subscribe to one reactive clock. Each view
unsubscribes when destroyed; duplicate cleanup is harmless, the interval remains
for other subscribers, and the final unsubscribe stops it. Regression tests
exercise teardown and later restart as well as rejecting per-badge intervals.

Each list renders independent add-card composers above and below its cards, but
the bubbled submit handler read the first textarea under the whole list. Saving
the visible bottom composer therefore read the hidden top composer's empty
title, closed the form and sent no database insert. The handler now resolves
the actual submitted form and obtains its title, position, labels, members and
custom fields from that same form. Regression coverage pins both positive form
targeting and the absence of list-wide first-textarea lookup; the existing
Playwright add-card flow covers the rendered save behavior.

The All Boards and popup variants render one included form, but their submit
events remained attached to the parent templates. Blaze scopes an event map to
the template that rendered the matching DOM, so clicking Create never called
the server method and no board reached MongoDB or FerretDB. The shared form now
owns its events and receives its state owner explicitly, preserving visibility,
template-board and header-star behavior. Positive and negative regression
checks pin the event owner, submitted form and all four callers.

DEBUGSPEED=true records bounded process, event-loop and slow DDP handler
measurements in Admin Panel → Problems → Speed without recording arguments,
credentials or query values. debug-speed-server.sh starts WeKan on a chosen
localhost port with either Meteor's MongoDB or a freshly compiled FerretDB, and
keeps their raw logs together; debug-speed-test.sh drives repeatable anonymous
or authenticated browser traffic. The
matching FerretDB diagnostics
add SQLite query-shape, candidate-row and separate SQL/decode timings while keeping
small indexed lookups silent. Static positive/negative guards, FerretDB unit
tests, both database startup modes and an anonymous browser traffic run cover
the workflow.

debug-speed-server.sh now explicitly starts FerretDB at the safe info log
level and prints the exact ferretdb.log path. The
matching FerretDB change
makes DEBUGSPEED=true select that level itself, so connection warnings,
errors and existing bounded query-shape diagnostics reach the log even outside
this launcher. Debug-level wire messages remain disabled because they may
contain user data. Positive launcher and FerretDB unit tests pin the level and
path; a negative guard prevents enabling payload-bearing debug logging.

debug-speed-server.sh now owns separate process groups for WeKan/Meteor,
FerretDB, terminal log following and a resource watcher. One Ctrl-C stops and
reaps all of them, including Meteor's child processes. The watcher records
timestamped CPU, RSS, process state, load, available memory and disk space in
resources.tsv without command arguments or environments. WeKan console output
goes to wekan.log, while bounded structured timings go only to the private
wekan-debugspeed.jsonl file beside it, never to Admin Panel → Problems.
FerretDB continues to use ferretdb.log. Static positive and data-exposure
guards cover supervision, file routing and the absence of the Problems logger;
shell syntax and a live watcher smoke test cover the executable paths.

debug-speed-ferretdb.sh builds and starts the same DEBUGSPEED-enabled local
FerretDB used by the comparative launcher, but deliberately leaves WeKan and
Meteor stopped so mongorestore does not compete with application writes for
SQLite's single write lock. It preserves the existing port, state-directory,
log-level and log-directory overrides, records ferretdb.log, build output and
resource samples together, and stops all supervised processes on one Ctrl-C.
Positive tests pin the shared options and cleanup; negative tests ensure the
restore-safe launcher cannot start Meteor or enable payload-bearing debug logs.

debug-speed-test.sh now verifies Playwright's actual Chromium executable, not
only its installed npm module, and downloads the matching browser revision when
it is absent. The browser cache lives under .tools/ms-playwright, consistently
with the main Playwright configuration, instead of depending on a populated
home-directory cache. Static tests cover detection, installation and the local
cache path; a live one-client traffic run completed 17 iterations with no
failures.

The account-creation hook needs only to know whether any account already exists
so it can make the first one administrator, but it counted and decoded the
entire users collection. On a restored 14,631-user FerretDB database that made
registration take 55 seconds: the account and verification email were created,
but the browser timed out and incorrectly displayed “Something went wrong.” A
projected one-document lookup now preserves the first-administrator rule
without work proportional to the instance's user count. Positive and negative
regression checks pin the bounded lookup and forbid a full count in the hook.

Board card scopes again use their normal null-containing $in, client and
authorization selectors remain explicit $and conjuncts, activity predicates
are not flattened, and one-branch visibility still uses $or. The matching
FerretDB backend fixes now push null and empty $in, booleans, $or, $and,
and indexed single-field or compound equality constraints into SQLite. WeKan's
tests pin the database-independent selector shapes; FerretDB's unit suite pins
the SQL constraints and index choices.

WeKan no longer replaces Meteor's resume-login handler to avoid a FerretDB
positional-projection error. FerretDB now correctly selects an array element
for a projection such as services.resume.loginTokens.$ when the query matches
services.resume.loginTokens.hashedToken, so Meteor's standard authentication
path works unchanged. FerretDB unit tests cover a matching token and a negative
no-match case.

English is already part of the client bundle, but i18n readiness still waited
up to ten seconds for the optional custom-translation DDP subscription. A busy
restored database therefore printed a default-language timeout even though the
English data was present and usable. Bundled English now becomes ready
immediately; database overrides load asynchronously and invalidate translation
helpers when they arrive. Positive and negative loader tests pin the ordering,
fallback and late reactive update.

Snapcraft entered .build and extracted the archive as bundle/, but then
looked for .build/bundle/, effectively asking for .build/.build/bundle/.
That made native, variant and Launchpad snap jobs fail while copying Node.js.
The Core 24 and staged Core 26 definitions now use the correct relative path,
with a regression test that pins the working-directory transition.

Protected activity placeholders are restored in sixteen locale files, and a
repository-wide token inventory confirms that every locale now matches English.
The Traditional Chinese check accepts correct human wording while still
rejecting the wrong script. Source guards recognize the current FerretDB
$or/$and pushdown and board publication shapes, while runtime-only files and
DEBUGSPEED diagnostics are excluded from documentation and release-menu parity
checks. The lazy-board browser test allows 30 seconds for a remote update and
move: its focused Chromium run passed in 22.2 seconds, matching Firefox's valid
slow path instead of failing at the former ten-second bound.