Thank you for downloading HedgeDoc 1.12.1

Back to the release list

Details

Released on 2026-11-04
This is the latest release
This is a stable release
View on GitHub

Release notes

Security fixes
- GHSA-2c27-4x43-jrm6 reports a possible impersonation attack when two auth providers provide the same profile id
- GHSA-g5g7-gfr5-f89m reports a possible crash of the realtime code via an invalid selection.
- GHSA-7p6g-mhrh-286p reports the ability to include unescaped iframes in slides view.
- GHSA-cqg6-86p6-77jm reports a possible timing attack which allows to check whether an email address is registered at the instance.
- GHSA-q9v8-vwgh-x2mc reports missing permissions enforcement for invalid permissions. See GHSA-93w7-49m2-cqwg.
- GHSA-jxrf-wfc5-w77h reports a HTML injection possibility using specially crafted user display names
- GHSA-3fwm-h59w-j268 reports a denial-of-service attack where authenticated users can crash a HedgeDoc instance using a specific note alias
- Several other HTML injection possibilities were fixed
Enhancements
- Added CMD_OAUTH2_USER_PROFILE_PHOTO_ATTR to let OAuth2/OIDC providers supply a profile photo URL, instead of always falling back to a generated avatar
- Updated mermaid to 11.17 which includes many new diagram types
Bugfixes
- Fixed opening links in new tabs did not work for published and slideshow views. This was forgotten with the last fix in 1.12.0.
- Tell the user about an impending data loss immediately after the reconnect.
- Fixed hashtag links opening in new tabs when external link warning is disabled
- Fixed links with the same origin not opening in new tabs when external link warning is enabled
- Fixed crash when importing history entries that already exist
- Fixed text not rendering when placed following a <br> HTML tag
- In “free URL” mode, there is no “409 conflict” anymore when trying to create a note with an alias that parses also as a valid note ID
- Fixed a missing uniqueness constraint in the database for email addresses of local accounts
- Fixed invalid HTML for task lists with checkboxes, clicking the label should now trigger the checkbox as well
- Fixed line numbers in wrapped code blocks being attached to the wrong lines
- Fixed an issue with syntax highlighting in the editor when using $$ math blocks
- Fixed a rendering issue, resulting in wrong checkboxes being toggled sometimes
Node compatability
- Node 26 support was tested and is now supported officially.
Contributors

Documentation

Do you need help with installation or upgrade? Read our docs!

Download

Bundled and ready to use
hedgedoc-1.12.1.tar.gz
Just the source code
Source code
Docker
Our docker images are located on quay.io at hedgedoc/hedgedoc.
Debian-based image
You can pull our docker image directly with the command below. It is based on Debian Linux.
```
docker pull quay.io/hedgedoc/hedgedoc:1.12.1
```
Alpine-based image
The alpine-based image is much smaller than the debian-based image, but does not contain glibc resulting in some debugging software not working properly in the container.
```
docker pull quay.io/hedgedoc/hedgedoc:1.12.1-alpine
```