Releases

[!CAUTION] DO NOT UPDATE TO THIS RELEASE, IT MIGHT BREAK YOUR INSTANCE

Bugfixes

• Fixed the profile provider migration failing on PostgreSQL

[!CAUTION] Due to some bugs with usage on PostgreSQL, we had to pull back this release.

Security fixes

• GHSA-2c27-4x43-jrm6 reports a possible impersonation attack when two auth providers provide the same profile id
• GHSA-g5g7-gfr5-f89m reports a possible crash of the realtime code via an invalid selection.
• GHSA-7p6g-mhrh-286p reports the ability to include unescaped iframes in slides view.
• GHSA-cqg6-86p6-77jm reports a possible timing attack which allows to check whether an email address is registered at the instance.
• GHSA-q9v8-vwgh-x2mc reports missing permissions enforcement for invalid permissions. See GHSA-93w7-49m2-cqwg.
• GHSA-jxrf-wfc5-w77h reports a HTML injection possibility using specially crafted user display names
• GHSA-3fwm-h59w-j268 reports a denial-of-service attack where authenticated users can crash a HedgeDoc instance using a specific note alias
• Several other HTML injection possibilities were fixed

Enhancements

• Added CMD_OAUTH2_USER_PROFILE_PHOTO_ATTR to let OAuth2/OIDC providers supply a profile photo URL, instead of always falling back to a generated avatar
• Updated mermaid to 11.17 which includes many new diagram types

Bugfixes

• Fixed opening links in new tabs did not work for published and slideshow views. This was forgotten with the last fix in 1.12.0.
• Tell the user about an impending data loss immediately after the reconnect.
• Fixed hashtag links opening in new tabs when external link warning is disabled
• Fixed links with the same origin not opening in new tabs when external link warning is enabled
• Fixed crash when importing history entries that already exist
• Fixed text not rendering when placed following a <br> HTML tag
• In “free URL” mode, there is no “409 conflict” anymore when trying to create a note with an alias that parses also as a valid note ID
• Fixed a missing uniqueness constraint in the database for email addresses of local accounts
• Fixed invalid HTML for task lists with checkboxes, clicking the label should now trigger the checkbox as well
• Fixed line numbers in wrapped code blocks being attached to the wrong lines
• Fixed an issue with syntax highlighting in the editor when using $$ math blocks
• Fixed a rendering issue, resulting in wrong checkboxes being toggled sometimes

Node compatability

• Node 26 support was tested and is now supported officially.

Contributors

• Anant Kumar
• Chris Ellrich
• Stephan
• Vaibhav Srivastav

Important changes

⚠️ HedgeDoc 1.12.0 and onwards will require Node 20.17 or later in order to run. Since Node 18 security support was stopped over one year ago, we don’t maintain backwards-compatability for that anymore.

Some syntax highlighting languages have been removed and/or changed. You can find more information in the highlight.js docs.

Enhancements

• Automatically skip the login modal if no form-based login and exactly one external login provider is configured

Bugfixes

• All links will be opened in new tabs instead of the same tab as the note. This was changed when the external link warning was implemented and now the old behavior is restored
• Fixed multiple bugs in the realtime connection handling that could lead to data-loss of users with a flaky connection

Contributors

• Tony Chau
• Lars Kiesow

Security fixes

• GHSA-93w7-49m2-cqwg reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.

Enhancements

• Added external link warning setting (externalLinkWarning in config.json or CMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely
• Added external link whitelist setting (externalLinkWhitelist in config.json or CMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains
• Added support for webp file uploads (for all backends except imgur, since that does not support these)

Bugfixes

• Fixed external link warning for subpath instances
• Restore native browser zoom-in keyboard shortcuts in the editor
• Nested list items render properly again in the preview pane for slides

Refactoring / Clean-up

• Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
• Removed unused allowOrigin (environment variable CMD_ALLOW_ORIGIN) config option.
• Removed unnecessary/duplicate entries in the XSS filtering whitelist

Contributors

• Shivam Shukla
• Tobi

Security fixes

This release contains four security fixes:

• GHSA-6c2w-8w96-3pcv reports a possible HTML injection via the localpart of an email address.
• GHSA-qj78-mjch-wwrv reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
• GHSA-8v9p-5j95-826j reports a possible CSRF attack vector in the GitHub Gist export.
• GHSA-2f9f-w8xq-276v reports a rate-limiting bypass by abusing the CF-Connecting-IP header.

Thanks to Chandler Johnson, taylorodell and alanturing881 for reporting!

Important notices

• When using Cloudflare in front of HedgeDoc, you should set rateLimitUsingCloudflare in the config.json or CMD_RATE_LIMIT_USING_CLOUDFLARE as environment variable to true.

Enhancements

• Added a warning page when clicking external links
• Improve the config.json.example file, which is used by bin/setup
• Allow configuration of login / signup rate-limits
• Allow configuration of Cloudflare usage in regards of rate-limits
• Several improvements in the documentation at https://docs.hedgedoc.org

Bugfixes

• Fix data loss when 5+ users edit a document concurrently, caused by the OT client discarding operations during revision gap recovery (#6342)
• Add defensive null checks to hex2rgb to prevent crashes from non-hex color values

Maintenance

• Dependency updates

Contributors

• Dex Devlon

Bugfixes

• Random colors for user’s cursors and selections are now always in hex format to avoid conversion errors
• Correctly close realtime connections if they disconnect during connection creation
• manage_users CLI does not silently drop errors

Security fixes

This release contains two medium severity security fixes:

• CVE-2026-25642 reports a bug where security headers for upload files were not set correctly.
• GHSA-672m-p72w-gw28 reports potential security issues with limited script execution in uploaded SVG files.

Thanks to @HUSEYNKHANLI and @drkim-dev for reporting!

Maintenance

• Dependency updates
• Enhancements in the documentation at docs.hedgedoc.org

Contributors

• xenein (#6322)

This release is just a fix for the docker container. It does not contain any changes to HedgeDoc itself.

Bugfixes

• Fix the bundled healthcheck in the docker container

Security fixes

This release contains two low severity security fixes:

• GHSA-gmgw-rcmh-7x47 reports potential cross-site side-effects due to not applying sandboxing to iframes.
• CVE-2025-66629 reports a possible CSRF vulnerability when using certain social login providers because the state parameter is not used and checked.

Enhancements

• Add enableUploads (CMD_ENABLE_UPLOADS) config option to restrict uploads to registered users, all users or none to completely disable uploads.
• Allow links to protocols such as xmpp, webcal or geo
• Switch from deprecated shortid to nanoid module, with 10 character long aliases in “public” links
• Ensure compatibility with Node 24
• Protect user history from accidental or malicious deletion by adding a CSRF-like token
• Many enhancements in the documentation at docs.hedgedoc.org

Bugfixes

• Ignore the healthcheck endpoint in the “too busy” limiter
• Send the referrer origin for YouTube embeddings due to their requirement
• Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
• Secure iframes with credentialless and sandbox attributes
• Fix regexes for [time=...], [name=...] and [color=...] shortcodes in lists
• Use state parameter for OAuth2 flows and PKCE where applicable

Node compatibility

• Support for Node 24 was verified. The docker image now uses Node 24 as its base image.

Contributors

• Nora Matthias Schiffer (#6096)
• 4censord (#6102)
• Zachery Faria (#6105)
• pl7ofit (#6106)
• Lars Kiesow (#6107)
• Kim Brose (#6114)
• Achilleas Pipinellis (#6119)
• Andreas Boesen (#6148, #6149)
• Thary (#6155)

Security fixes

This release fixes a security issue of a possible XSS exploit which can be planted via a malicous SVG file upload.

See CVE-2025-32391 for more details

Enhancements

• Add config options CMD_SAML_WANT_ASSERTIONS_SIGNED and CMD_SAML_WANT_AUTHN_RESPONSE_SIGNED for SAML auth, since some instances didn’t comply with the new defaults of @node-saml/passport-saml

PLEASE CHECK THIS IF YOU USE SAML AUTHENTICATION: This release had to set default values for the username and email address attribute mapping for SAML authentication for security reasons. If you use SAML authentication, please make sure to update your SAML configuration accordingly. See: https://docs.hedgedoc.org/configuration/#saml-login CMD_SAML_ATTRIBUTE_USERNAME or CMD_SAML_ATTRIBUTE_EMAIL

Bugfixes

• Check if a valid user id is present when using OAuth2
• Abort SAML login if NameID is undefined instead of logging in with a user named “undefined” (Thanks @Haanifee)
• Set default values for username and email attribute mapping in SAML configuration

This release fixes a security issue where brute-forcing local email/passwords is possible because of missing rate-limits. We recommend upgrading as soon as possible, if you use local logins.

See also https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6w39-x2c6-6mpf

This release changes the default configuration of the HSTS preload attribute to false for compliance with the HSTS preload list requirements. This shouldn’t impact any instance. However, if you intend to use HSTS preloading you should enable the config setting hsts.preload to true or set environment variable CMD_HSTS_PRELOAD=true.

This release deprecates support for Node 18. As the LTS support for 18 runs out in April 2025, the next release will only work with Node 20 and upwards. Consider this your early warning to upgrade any running instances to at least Node 20.

Enhancements

• Add fixed rate-limiting to the login and register endpoints
• Add configurable rate-limiting to the new notes endpoint

Bugfixes

• Fix a crash when cannot read user profile in OAuth (#5850 by @lautaroalvarez)
• Fix CSP Header for mermaid embedded images (#5887 by @domrim)
• Change default of HSTS preload to false for compliance with the HSTS preload list requirements (#5913 by @SvizelPritula)

Contributors

• Dominik Rimpf
• Lautaro Alvarez

This release fixes a security issue when using MySQL/MariaDB. We recommend upgrading as soon as possible, when you use this database.

Please note: This release dropped support for Node 16, which is end-of-life since September 2023. You now need at least Node 18 to run HedgeDoc. We recommend to use the latest LTS release of Node.js.

⚠️ Node 22.7.0 has a regression that breaks UTF-8 encoding. Do not use that version to run HedgeDoc. ⚠️

Security Fixes

• GHSA-pjf2-269h-cx7p: MySQL & free URL mode allows to hide existing notes

Features

• Add disableNoteCreation config option for read-only instances

Enhancements

• Add a pointer to Mermaid 9.1.7 documentation, which is what HedgeDoc 1 supports.
• Compatibility with Node.js 22 is now checked in CI

Bugfixes

• Fix a crash when having numeric-only values in opengraph frontmatter
• Fix unnecessary session creation on healthcheck endpoint
• Fix invalid metadata being sent for minio uploads
• Fix screen readers announcing headings twice
• Fix a crash when receiving unexpected OAuth profile data
• Fix some cases of HedgeDoc not redirecting to the previous page after login
• Fix heading anchor links referencing an invalid URL
• Our meta-marked package is now published to NPM, fixing some installation issues

Contributors

• Axel (translator)
• Eduard (translator)
• Jordi Mallach (translator)
• José M. (translator)
• Meskó Balázs (translator)
• TheInfamousToTo (translator)
• Tobias (translator)
• Úr Balázs (translator)

HedgeDoc has a new slogan! See our announcement for the details.

This release fixes a security issue. We recommend upgrading as soon as possible.

Security Fixes

• CVE-2023-38487: API allows to hide existing notes

Enhancements

• Docker secrets can now be used to provide OAuth2 client secrets (#4196 by @DennisGaida)
• Document how to set up Azure Active Directory authentication (#4413 by @pramitsingh0)
• Add YAML metadata to documentation page (#4371 by @JunedKhan101)

Bugfixes

• Fix non-existing notes being created in some cases, instead of returning a 404 error

Contributors

• Jordi Mallach (translator)
• sujade (translator)

Please note: This release dropped support for Node 14, which is end-of-life since May 2023. You now need at least Node 16 to run HedgeDoc. We recommend to use the latest LTS release of Node.js.

This release switches to Yarn 3 for dependency management, as Yarn 1 has bugs preventing us from upgrading some dependencies. If you install HedgeDoc manually, run bin/setup again for instructions. Other installation methods should not require special actions.

Enhancements

• Extend boolean environment variable parsing with other positive answers and case insensitivity
• Allow setting of documentMaxLength via CMD_DOCUMENT_MAX_LENGTH environment variable (contributed by @jmallach)
• Add dedicated healthcheck endpoint at /_health that is less resource intensive than /status
• Compatibility with Node.js 18 and later
• Add support for the arm64 architecture in the docker image
• Add a config option to disable the /status and /metrics endpoints

Bugfixes

• Fix that permission errors can break existing connections to a note, causing inconsistent note content and changes not being saved (contributed by @julianrother)
• Fix speaker notes not showing up in the presentation view
• Fix issues with upgrading some dependencies by upgrading to Yarn 3
• Fix macOS compatibility of bin/setup script

Contributors

• UwYFmLpoKtYn (translator)
• Pub (translator)
• SnowCode (translator)

Bugfixes

• Fix note titles with special characters producing invalid file names in user export zip file
• Fix night-mode toggle not working when page is loaded with night-mode enabled

Contributors

• Francesco (translator)
• Gabriel Santiago Macedo (translator)

Bugfixes

• Fix migrations deleting all notes when SQLite is used

🚨 This release has a bug that leads to data-loss when using SQLite. We advise users of SQLite databases to skip this release and use 1.9.6. 🚨

Enhancements

• Add dark mode toggle in mobile view
• Replace embedding shortcode regexes with more specific ones to safeguard against XSS attacks

Bugfixes

• Fix a crash when using LDAP authentication with custom search attributes (thanks to @aboettger-tuhh for reporting)
• Fix a crash caused by a long note history when the MySQL database is used
• Fix breaks option not being respected in the publish-view
• Fix missing syntax highlighting in the markdown editor

Contributors

• Bateausurleau (translator)
• Goncalo (translator)
• Ívarr Vinter (translator)
• Oein0219 (translator)
• Pol Dellaiera

Please note: This release dropped support for Node 12, which is end-of-life since April 2022. You now need at least Node 14.13.1 or Node 16 to run HedgeDoc. We don’t support more recent versions of Node.

Enhancements

• Remove unexpected shell call during migrations
• More S3 config options: upload folder & public ACL (thanks to @lautaroalvarez)

Contributors

• Al_x (translator)
• Emmanuel Courreges (translator)
• paranic (translator)
• Quentin PAGÈS (translator)

This release fixes a security issue. We recommend upgrading as soon as possible.

⚠️ Warning: If you deploy HedgeDoc and MariaDB with docker-compose using a checkout of our container repo, you will need to manually convert the character set of the database to utf8mb4 when updating. See the corresponding PR for more information.

Security Fixes

• CVE-2022-24837: Enumerable upload file names

Enhancements

• Libravatar avatars render as ident-icons when no avatar image was uploaded to Libravatar or Gravatar
• Add database connection error message to log output
• Allow SAML authentication provider to be named
• Suppress error message when git binary is not found

Bugfixes

• Fix error that Libravatar user avatars were not shown when using OAuth2 login
• Fix bin/manage_users not accepting numeric passwords (thanks to @carr0t2 for reporting)
• Fix visibility of modals for screen readers
• Fix GitLab snippet export (thanks to @semjongeist for reporting)
• Fix missing inline authorship colors (thanks to @EBendinelli for reporting)

Contributors

• ced (translator)
• deluxghost (translator)
• Dennis Gaida
• Michael Hauer (translator)
• Moritz Schlarb
• Mostafa Ahangarha (translator)
• Sandro
• Sergio Varela (translator)
• Tạ Quang Khôi (translator)
• Tiago Triques (translator)
• tmpod (translator)
• Uchiha Kakashi

Bugfixes

• Fix error in the session handler when requesting /metrics or /status

This release increases the minimum required Node versions to 12.20.0, 14.13.1 and 16. In general, only the latest releases of Node 12, 14 and 16 are officially supported by us, older minor versions can be dropped at any time. We recommend you run HedgeDoc with the latest release of Node 16.

Bugfixes

• Add workaround for incorrect CSP handling in Safari
• Fix crash when an unexpected response from the GitLab API is encountered
• Fix crash when using hungarian language

Contributors

• AIAC (translator)
• Danilo Bargen
• Diem Duong (translator)
• Gergely Polonkai (translator)
• Nikola (translator)
• ProttoyChakraborty
• Sergio (translator)
• Tiago Triques (translator)
• Vincent Dusanek (translator)
• Александр (translator)

Security Fixes

• CVE-2021-39175: XSS vector in slide mode speaker-view
• This release removes Google Analytics and Disqus domains from our default Content Security Policy, because they were repeatedly used to exploit security vulnerabilities.
  If you want to continue using Google Analytics or Disqus, you can re-enable them in the config. See the docs for details

Features

• HedgeDoc now automatically retries connecting to the database up to 30 times on startup
• This release introduces the csp.allowFraming config option, which controls whether embedding a HedgeDoc instance in other webpages is allowed. We strongly recommend disabling this option to reduce the risk of XSS attacks
• This release introduces the csp.allowPDFEmbed config option, which controls whether embedding PDFs inside HedgeDoc notes is allowed. We recommend disabling this option if you don’t use the feature, to reduce the attack surface of XSS attacks
• Add additional environment variables to configure the database. This allows easier configuration in containerized environments, such as Kubernetes

Enhancements

• Further improvements to the frontend build process, reducing the initial bundle size by 60%
• Improve the error handling of the filesystem upload method
• Improve the error message of failing migrations

Bugfixes

• Fix crash when trying to read the current Git commit on startup
• Fix endless loop on shutdown when HedgeDoc can’t connect to the database
• Ensure that all cookies are set with the secure flag, if HedgeDoc is loaded via HTTPS
• Fix session cookies being created on calls to /metrics and /status
• Fix incorrect creation of S3 endpoint domain (thanks to @matejc)
• Remove CDN support, fixing inconsistencies in library versions delivered to the client
• Fix font display issues when having some variants of fonts used by HedgeDoc installed locally
• Fix links between slides not working
• Fix Vimeo integration using a deprecated API

Miscellaneous

• Removed MSSQL support, as migrations from 2018 are broken with SQL Server and nobody seems to use it

Contributors

• Bogdan Cuza (translator)
• Heimen Stoffels (translator)
• igg17 (translator)
• Klorophatu (translator)
• Martin (translator)
• Matija (translator)
• Matthieu Devillers (translator)
• Mindaugas (translator)
• Quentin Pagès (translator)

This release fixes two security issues. We recommend upgrading as soon as possible.

Security Fixes

• CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes
• Fix a potential XSS-vector in the handling of usernames and profile pictures

Enhancements

• Speed up yarn install in production mode (as performed by bin/setup) by marking frontend-only dependencies as dev-dependencies. This also reduces the size of the docker container
• Speed up the frontend-build by using esbuild instead of terser to minify JavaScript
• Improve behavior of the ‘Quote’, ‘List’, ‘Unordered List’ and ‘Check List’ buttons in the editor to automatically apply to the complete first and last line of the selection

Bugfixes

• Correct the 1.8.0 release notes to state that CVE-2021-29475 has been fixed since HedgeDoc 1.5.0.
• Fix crash on startup when useSSL or csp.upgradeInsecureRequests is enabled (thanks to @mdegat01 for reporting)
• Automatically enable protocolUseSSL when useSSL is also enabled
• Fix the ‘Quote’, ‘List’, ‘Unordered List’ and ‘Check List’ buttons in the editor to not duplicate content when only parts of a line are selected (thanks to @AnomalRoil for reporting)
• Fix click handler for numbered task lists (thanks to @xoriade for reporting)