Repository navigation
Releases
Releases · hedgedoc/hedgedoc
[WITHDRAWN] HedgeDoc 1.12.2
1.12.2
ErikMichelson
Erik Michelson
This tag was signed with the committer’s verified signature.
Caution
DO NOT UPDATE TO THIS RELEASE, IT MIGHT BREAK YOUR INSTANCE
Bugfixes
- Fixed the profile provider migration failing on PostgreSQL
[WITHDRAWN] HedgeDoc 1.12.1
1.12.1
ErikMichelson
Erik Michelson
This tag was signed with the committer’s verified signature.
e5f937d
This commit was signed with the committer’s verified signature.
Caution
Due to some bugs with usage on PostgreSQL, we had to pull back this release.
Security fixes
- GHSA-2c27-4x43-jrm6 reports a possible impersonation attack when two auth providers provide the same profile id
- GHSA-g5g7-gfr5-f89m reports a possible crash of the realtime code via an invalid selection.
- GHSA-7p6g-mhrh-286p reports the ability to include unescaped iframes in slides view.
- GHSA-cqg6-86p6-77jm reports a possible timing attack which allows to check whether an email address is registered at the instance.
- GHSA-q9v8-vwgh-x2mc reports missing permissions enforcement for invalid permissions. See GHSA-93w7-49m2-cqwg.
- GHSA-jxrf-wfc5-w77h reports a HTML injection possibility using specially crafted user display names
- GHSA-3fwm-h59w-j268 reports a denial-of-service attack where authenticated users can crash a HedgeDoc instance using a specific note alias
- Several other HTML injection possibilities were fixed
Enhancements
- Added
CMD_OAUTH2_USER_PROFILE_PHOTO_ATTRto let OAuth2/OIDC providers supply a profile photo URL, instead of always falling back to a generated avatar - Updated mermaid to 11.17 which includes many new diagram types
Bugfixes
- Fixed opening links in new tabs did not work for published and slideshow views. This was forgotten with the last fix in 1.12.0.
- Tell the user about an impending data loss immediately after the reconnect.
- Fixed hashtag links opening in new tabs when external link warning is disabled
- Fixed links with the same origin not opening in new tabs when external link warning is enabled
- Fixed crash when importing history entries that already exist
- Fixed text not rendering when placed following a
<br>HTML tag - In "free URL" mode, there is no "409 conflict" anymore when trying to create a note with an alias that parses also as a valid note ID
- Fixed a missing uniqueness constraint in the database for email addresses of local accounts
- Fixed invalid HTML for task lists with checkboxes, clicking the label should now trigger the checkbox as well
- Fixed line numbers in wrapped code blocks being attached to the wrong lines
- Fixed an issue with syntax highlighting in the editor when using
$$math blocks - Fixed a rendering issue, resulting in wrong checkboxes being toggled sometimes
Node compatability
- Node 26 support was tested and is now supported officially.
Contributors
HedgeDoc 1.12.0
Important changes
Since Node 18 security support was stopped over one year ago, we don't maintain backwards-compatability for that anymore.
Some syntax highlighting languages have been removed and/or changed. You can find more information in
the highlight.js docs.
Enhancements
- Automatically skip the login modal if no form-based login and exactly one external login provider is configured
Bugfixes
- All links will be opened in new tabs instead of the same tab as the note. This was changed when the external link warning was implemented and now the old behavior is restored
- Fixed multiple bugs in the realtime connection handling that could lead to data-loss of users with a flaky connection
Contributors
HedgeDoc 1.11.1
Security fixes
- GHSA-93w7-49m2-cqwg reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.
Enhancements
- Added external link warning setting (
externalLinkWarningin config.json orCMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely - Added external link whitelist setting (
externalLinkWhitelistin config.json orCMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains - Added support for webp file uploads (for all backends except
imgur, since that does not support these)
Bugfixes
- Fixed external link warning for subpath instances
- Restore native browser zoom-in keyboard shortcuts in the editor
- Nested list items render properly again in the preview pane for slides
Refactoring / Clean-up
- Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
- Removed unused
allowOrigin(environment variableCMD_ALLOW_ORIGIN) config option. - Removed unnecessary/duplicate entries in the XSS filtering whitelist
Contributors
HedgeDoc 1.11.0
Security fixes
This release contains four security fixes:
- GHSA-6c2w-8w96-3pcv reports a possible HTML injection via the localpart of an email address.
- GHSA-qj78-mjch-wwrv reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
- GHSA-8v9p-5j95-826j reports a possible CSRF attack vector in the GitHub Gist export.
- GHSA-2f9f-w8xq-276v reports a rate-limiting bypass by abusing the CF-Connecting-IP header.
Thanks to Chandler Johnson, taylorodell and alanturing881 for reporting!
Important notices
- When using Cloudflare in front of HedgeDoc, you should set
rateLimitUsingCloudflarein the config.json orCMD_RATE_LIMIT_USING_CLOUDFLAREas environment variable totrue.
Enhancements
- Added a warning page when clicking external links
- Improve the config.json.example file, which is used by
bin/setup - Allow configuration of login / signup rate-limits
- Allow configuration of Cloudflare usage in regards of rate-limits
- Several improvements in the documentation at https://docs.hedgedoc.org
HedgeDoc 1.10.8
Bugfixes
- Fix data loss when 5+ users edit a document concurrently, caused by the OT client discarding operations during revision gap recovery (#6342)
- Add defensive null checks to
hex2rgbto prevent crashes from non-hex color values
Maintenance
- Dependency updates
Contributors
HedgeDoc 1.10.7
Bugfixes
- Random colors for user's cursors and selections are now always in hex format to avoid conversion errors
- Correctly close realtime connections if they disconnect during connection creation
- manage_users CLI does not silently drop errors
HedgeDoc 1.10.6
Security fixes
This release contains two medium severity security fixes:
- CVE-2026-25642 reports a bug where security headers for upload files were not set correctly.
- GHSA-672m-p72w-gw28 reports potential security issues with limited script execution in uploaded SVG files.
Thanks to @HUSEYNKHANLI and @drkim-dev for reporting!
Maintenance
- Dependency updates
- Enhancements in the documentation at docs.hedgedoc.org
Contributors
HedgeDoc 1.10.5
This release is just a fix for the docker container. It does not contain any
changes to HedgeDoc itself.
Bugfixes
- Fix the bundled healthcheck in the docker container
HedgeDoc 1.10.4
Security fixes
This release contains two low severity security fixes:
- GHSA-gmgw-rcmh-7x47 reports potential cross-site side-effects due to not applying sandboxing to iframes.
- CVE-2025-66629 reports a possible CSRF vulnerability when using certain social login providers because the
stateparameter is not used and checked.
Enhancements
- Add
enableUploads(CMD_ENABLE_UPLOADS) config option to restrict uploads toregisteredusers,allusers or
noneto completely disable uploads. - Allow links to protocols such as xmpp, webcal or geo
- Switch from deprecated shortid to nanoid module, with 10 character long aliases in "public" links
- Ensure compatibility with Node 24
- Protect user history from accidental or malicious deletion by adding a CSRF-like token
- Many enhancements in the documentation at docs.hedgedoc.org
Bugfixes
- Ignore the healthcheck endpoint in the "too busy" limiter
- Send the referrer origin for YouTube embeddings due to their requirement
- Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
- Secure iframes with
credentiallessandsandboxattributes - Fix regexes for
[time=...],[name=...]and[color=...]shortcodes in lists - Use
stateparameter for OAuth2 flows and PKCE where applicable
Node compatibility
- Support for Node 24 was verified. The docker image now uses Node 24 as its base image.