Releases on HedgeDoc - Ideas grow better together

HedgeDoc 1.11.1

Fri, 24 Jul 2026 19:39:28 +0000

Security fixes

GHSA-93w7-49m2-cqwg reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.

Enhancements

Added external link warning setting (externalLinkWarning in config.json or CMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely
Added external link whitelist setting (externalLinkWhitelist in config.json or CMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains
Added support for webp file uploads (for all backends except imgur, since that does not support these)

Bugfixes

Fixed external link warning for subpath instances
Restore native browser zoom-in keyboard shortcuts in the editor
Nested list items render properly again in the preview pane for slides

Refactoring / Clean-up

Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
Removed unused allowOrigin (environment variable CMD_ALLOW_ORIGIN) config option.
Removed unnecessary/duplicate entries in the XSS filtering whitelist

Contributors

HedgeDoc 1.11.0

Thu, 18 Jun 2026 21:56:45 +0000

Security fixes

This release contains four security fixes:

GHSA-6c2w-8w96-3pcv reports a possible HTML injection via the localpart of an email address.
GHSA-qj78-mjch-wwrv reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
GHSA-8v9p-5j95-826j reports a possible CSRF attack vector in the GitHub Gist export.
GHSA-2f9f-w8xq-276v reports a rate-limiting bypass by abusing the CF-Connecting-IP header.

Thanks to Chandler Johnson, taylorodell and alanturing881 for reporting!

HedgeDoc 1.10.8

Wed, 15 Apr 2026 19:35:05 +0000

Bugfixes

Fix data loss when 5+ users edit a document concurrently, caused by the OT client discarding operations during revision gap recovery (#6342)
Add defensive null checks to hex2rgb to prevent crashes from non-hex color values

Maintenance

Dependency updates

Contributors

Dex Devlon

HedgeDoc 1.10.7

Tue, 24 Feb 2026 19:24:44 +0000

Bugfixes

Random colors for user’s cursors and selections are now always in hex format to avoid conversion errors
Correctly close realtime connections if they disconnect during connection creation
manage_users CLI does not silently drop errors

HedgeDoc 1.10.6

Wed, 04 Feb 2026 19:27:41 +0000

Security fixes

This release contains two medium severity security fixes:

CVE-2026-25642 reports a bug where security headers for upload files were not set correctly.
GHSA-672m-p72w-gw28 reports potential security issues with limited script execution in uploaded SVG files.

Thanks to @HUSEYNKHANLI and @drkim-dev for reporting!

HedgeDoc 1.10.5

Sat, 06 Dec 2025 16:45:55 +0000

This release is just a fix for the docker container. It does not contain any changes to HedgeDoc itself.

Bugfixes

Fix the bundled healthcheck in the docker container

HedgeDoc 1.10.4

Fri, 05 Dec 2025 22:36:12 +0000

Security fixes

This release contains two low severity security fixes:

GHSA-gmgw-rcmh-7x47 reports potential cross-site side-effects due to not applying sandboxing to iframes.
CVE-2025-66629 reports a possible CSRF vulnerability when using certain social login providers because the state parameter is not used and checked.

Enhancements

Add enableUploads (CMD_ENABLE_UPLOADS) config option to restrict uploads to registered users, all users or none to completely disable uploads.
Allow links to protocols such as xmpp, webcal or geo
Switch from deprecated shortid to nanoid module, with 10 character long aliases in “public” links
Ensure compatibility with Node 24
Protect user history from accidental or malicious deletion by adding a CSRF-like token
Many enhancements in the documentation at docs.hedgedoc.org

Bugfixes

Ignore the healthcheck endpoint in the “too busy” limiter
Send the referrer origin for YouTube embeddings due to their requirement
Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
Secure iframes with credentialless and sandbox attributes
Fix regexes for [time=...], [name=...] and [color=...] shortcodes in lists
Use state parameter for OAuth2 flows and PKCE where applicable

Node compatibility

Support for Node 24 was verified. The docker image now uses Node 24 as its base image.

Contributors

Nora Matthias Schiffer (#6096)
4censord (#6102)
Zachery Faria (#6105)
pl7ofit (#6106)
Lars Kiesow (#6107)
Kim Brose (#6114)
Achilleas Pipinellis (#6119)
Andreas Boesen (#6148, #6149)
Thary (#6155)

HedgeDoc 1.10.3

Wed, 09 Apr 2025 22:17:33 +0000

Security fixes

This release fixes a security issue of a possible XSS exploit which can be planted via a malicous SVG file upload.

HedgeDoc 1.10.2

Fri, 14 Feb 2025 21:14:11 +0000

PLEASE CHECK THIS IF YOU USE SAML AUTHENTICATION: This release had to set default values for the username and email address attribute mapping for SAML authentication for security reasons. If you use SAML authentication, please make sure to update your SAML configuration accordingly. See: https://docs.hedgedoc.org/configuration/#saml-login CMD_SAML_ATTRIBUTE_USERNAME or CMD_SAML_ATTRIBUTE_EMAIL

HedgeDoc 1.10.1

Sun, 02 Feb 2025 22:12:33 +0000

This release fixes a security issue where brute-forcing local email/passwords is possible because of missing rate-limits. We recommend upgrading as soon as possible, if you use local logins.

HedgeDoc 1.10.0

Sun, 01 Sep 2024 14:38:46 +0000

This release fixes a security issue when using MySQL/MariaDB. We recommend upgrading as soon as possible, when you use this database.

HedgeDoc 1.9.9

Sun, 30 Jul 2023 18:07:27 +0000

HedgeDoc has a new slogan! See our announcement for the details.

This release fixes a security issue. We recommend upgrading as soon as possible.

HedgeDoc 1.9.8

Sun, 04 Jun 2023 19:35:20 +0000

Please note: This release dropped support for Node 14, which is end-of-life since May 2023. You now need at least Node 16 to run HedgeDoc. We recommend to use the latest LTS release of Node.js.

HedgeDoc 1.9.7

Sun, 19 Feb 2023 21:36:11 +0000

Bugfixes

Fix note titles with special characters producing invalid file names in user export zip file
Fix night-mode toggle not working when page is loaded with night-mode enabled

Contributors

Francesco (translator)
Gabriel Santiago Macedo (translator)

HedgeDoc 1.9.6

Sun, 06 Nov 2022 22:10:59 +0000

Bugfixes

Fix migrations deleting all notes when SQLite is used

HedgeDoc 1.9.5

Sun, 30 Oct 2022 21:15:16 +0000

🚨 This release has a bug that leads to data-loss when using SQLite. We advise users of SQLite databases to skip this release and use 1.9.6. 🚨

HedgeDoc 1.9.4

Sun, 10 Jul 2022 20:06:09 +0000

Please note: This release dropped support for Node 12, which is end-of-life since April 2022. You now need at least Node 14.13.1 or Node 16 to run HedgeDoc. We don’t support more recent versions of Node.

HedgeDoc 1.9.3

Sun, 10 Apr 2022 20:19:22 +0000

This release fixes a security issue. We recommend upgrading as soon as possible.

⚠️ Warning: If you deploy HedgeDoc and MariaDB with docker-compose using a checkout of our container repo, you will need to manually convert the character set of the database to utf8mb4 when updating. See the corresponding PR for more information.

HedgeDoc 1.9.2

Fri, 03 Dec 2021 20:05:27 +0000

Bugfixes

Fix error in the session handler when requesting /metrics or /status

HedgeDoc 1.9.1

Thu, 02 Dec 2021 21:18:49 +0000

This release increases the minimum required Node versions to 12.20.0, 14.13.1 and 16. In general, only the latest releases of Node 12, 14 and 16 are officially supported by us, older minor versions can be dropped at any time. We recommend you run HedgeDoc with the latest release of Node 16.

HedgeDoc 1.9.0

Mon, 13 Sep 2021 20:22:51 +0000

Security Fixes

CVE-2021-39175: XSS vector in slide mode speaker-view
This release removes Google Analytics and Disqus domains from our default Content Security Policy, because they were repeatedly used to exploit security vulnerabilities.
If you want to continue using Google Analytics or Disqus, you can re-enable them in the config. See the docs for details

Features

HedgeDoc now automatically retries connecting to the database up to 30 times on startup
This release introduces the csp.allowFraming config option, which controls whether embedding a HedgeDoc instance in other webpages is allowed. We strongly recommend disabling this option to reduce the risk of XSS attacks
This release introduces the csp.allowPDFEmbed config option, which controls whether embedding PDFs inside HedgeDoc notes is allowed. We recommend disabling this option if you don’t use the feature, to reduce the attack surface of XSS attacks
Add additional environment variables to configure the database. This allows easier configuration in containerized environments, such as Kubernetes

Enhancements

Further improvements to the frontend build process, reducing the initial bundle size by 60%
Improve the error handling of the filesystem upload method
Improve the error message of failing migrations

Bugfixes

Fix crash when trying to read the current Git commit on startup
Fix endless loop on shutdown when HedgeDoc can’t connect to the database
Ensure that all cookies are set with the secure flag, if HedgeDoc is loaded via HTTPS
Fix session cookies being created on calls to /metrics and /status
Fix incorrect creation of S3 endpoint domain (thanks to @matejc)
Remove CDN support, fixing inconsistencies in library versions delivered to the client
Fix font display issues when having some variants of fonts used by HedgeDoc installed locally
Fix links between slides not working
Fix Vimeo integration using a deprecated API

Miscellaneous

Removed MSSQL support, as migrations from 2018 are broken with SQL Server and nobody seems to use it

Contributors

Bogdan Cuza (translator)
Heimen Stoffels (translator)
igg17 (translator)
Klorophatu (translator)
Martin (translator)
Matija (translator)
Matthieu Devillers (translator)
Mindaugas (translator)
Quentin Pagès (translator)

HedgeDoc 1.8.2

Tue, 11 May 2021 19:41:11 +0000

This release fixes two security issues. We recommend upgrading as soon as possible.

Security Fixes

CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes
Fix a potential XSS-vector in the handling of usernames and profile pictures

HedgeDoc 1.8.1

Thu, 06 May 2021 20:37:47 +0000

Enhancements

Speed up yarn install in production mode (as performed by bin/setup) by marking frontend-only dependencies as dev-dependencies. This also reduces the size of the docker container
Speed up the frontend-build by using esbuild instead of terser to minify JavaScript
Improve behavior of the ‘Quote’, ‘List’, ‘Unordered List’ and ‘Check List’ buttons in the editor to automatically apply to the complete first and last line of the selection

Bugfixes

Correct the 1.8.0 release notes to state that CVE-2021-29475 has been fixed since HedgeDoc 1.5.0.
Fix crash on startup when useSSL or csp.upgradeInsecureRequests is enabled (thanks to @mdegat01 for reporting)
Automatically enable protocolUseSSL when useSSL is also enabled
Fix the ‘Quote’, ‘List’, ‘Unordered List’ and ‘Check List’ buttons in the editor to not duplicate content when only parts of a line are selected (thanks to @AnomalRoil for reporting)
Fix click handler for numbered task lists (thanks to @xoriade for reporting)

HedgeDoc 1.8.0

Mon, 03 May 2021 20:49:15 +0000

This release fixes multiple security issues. We recommend upgrading as soon as possible.

Please note: This release dropped support for Node 10, which is end-of-life since April 2021. You now need at least Node 12 to run HedgeDoc, but we recommend running the latest LTS release.

HedgeDoc 1.7.2

Fri, 15 Jan 2021 20:25:31 +0000

This release fixes a security issue. We recommend upgrading as soon as possible.

Security Fixes

CVE-2021-21259: Stored XSS in slide mode
An attacker can inject arbitrary JavaScript into a HedgeDoc note.

Bugfixes

Ensure the last line of the markdown editor is not covered by the status bar (thanks to @mhdrone for reporting!)