HedgeDoc 1.12.0

Important changes

⚠️HedgeDoc 1.12.0 and onwards will require Node 20.17 or later in order to run.
Since Node 18 security support was stopped over one year ago, we don't maintain backwards-compatability for that anymore.

Some syntax highlighting languages have been removed and/or changed. You can find more information in
the highlight.js docs.

Enhancements

• Automatically skip the login modal if no form-based login and exactly one external login provider is configured

Bugfixes

• All links will be opened in new tabs instead of the same tab as the note. This was changed when the external link warning was implemented and now the old behavior is restored
• Fixed multiple bugs in the realtime connection handling that could lead to data-loss of users with a flaky connection

Contributors

• Tony Chau
• Lars Kiesow

HedgeDoc 1.11.1

Security fixes

• GHSA-93w7-49m2-cqwg reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.

Enhancements

• Added external link warning setting (externalLinkWarning in config.json or CMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely
• Added external link whitelist setting (externalLinkWhitelist in config.json or CMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains
• Added support for webp file uploads (for all backends except imgur, since that does not support these)

Bugfixes

• Fixed external link warning for subpath instances
• Restore native browser zoom-in keyboard shortcuts in the editor
• Nested list items render properly again in the preview pane for slides

Refactoring / Clean-up

• Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
• Removed unused allowOrigin (environment variable CMD_ALLOW_ORIGIN) config option.
• Removed unnecessary/duplicate entries in the XSS filtering whitelist

Contributors

• Shivam Shukla
• Tobi

HedgeDoc 1.11.0

Security fixes

This release contains four security fixes:

• GHSA-6c2w-8w96-3pcv reports a possible HTML injection via the localpart of an email address.
• GHSA-qj78-mjch-wwrv reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
• GHSA-8v9p-5j95-826j reports a possible CSRF attack vector in the GitHub Gist export.
• GHSA-2f9f-w8xq-276v reports a rate-limiting bypass by abusing the CF-Connecting-IP header.

Thanks to Chandler Johnson, taylorodell and alanturing881 for reporting!

Important notices

• When using Cloudflare in front of HedgeDoc, you should set rateLimitUsingCloudflare in the config.json or CMD_RATE_LIMIT_USING_CLOUDFLARE as environment variable to true.

Enhancements

• Added a warning page when clicking external links
• Improve the config.json.example file, which is used by bin/setup
• Allow configuration of login / signup rate-limits
• Allow configuration of Cloudflare usage in regards of rate-limits
• Several improvements in the documentation at https://docs.hedgedoc.org

HedgeDoc 1.10.8

Bugfixes

• Fix data loss when 5+ users edit a document concurrently, caused by the OT client discarding operations during revision gap recovery (#6342)
• Add defensive null checks to hex2rgb to prevent crashes from non-hex color values

Maintenance

• Dependency updates

Contributors

• Dex Devlon

HedgeDoc 1.10.7

Bugfixes

• Random colors for user's cursors and selections are now always in hex format to avoid conversion errors
• Correctly close realtime connections if they disconnect during connection creation
• manage_users CLI does not silently drop errors

HedgeDoc 1.10.6

Security fixes

This release contains two medium severity security fixes:

• CVE-2026-25642 reports a bug where security headers for upload files were not set correctly.
• GHSA-672m-p72w-gw28 reports potential security issues with limited script execution in uploaded SVG files.

Thanks to @HUSEYNKHANLI and @drkim-dev for reporting!

Maintenance

• Dependency updates
• Enhancements in the documentation at docs.hedgedoc.org

Contributors

• xenein (#6322)

HedgeDoc 1.10.5

This release is just a fix for the docker container. It does not contain any
changes to HedgeDoc itself.

Bugfixes

• Fix the bundled healthcheck in the docker container

HedgeDoc 1.10.4

Security fixes

This release contains two low severity security fixes:

• GHSA-gmgw-rcmh-7x47 reports potential cross-site side-effects due to not applying sandboxing to iframes.
• CVE-2025-66629 reports a possible CSRF vulnerability when using certain social login providers because the state parameter is not used and checked.

Enhancements

• Add enableUploads (CMD_ENABLE_UPLOADS) config option to restrict uploads to registered users, all users or
  none to completely disable uploads.
• Allow links to protocols such as xmpp, webcal or geo
• Switch from deprecated shortid to nanoid module, with 10 character long aliases in "public" links
• Ensure compatibility with Node 24
• Protect user history from accidental or malicious deletion by adding a CSRF-like token
• Many enhancements in the documentation at docs.hedgedoc.org

Bugfixes

• Ignore the healthcheck endpoint in the "too busy" limiter
• Send the referrer origin for YouTube embeddings due to their requirement
• Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
• Secure iframes with credentialless and sandbox attributes
• Fix regexes for [time=...], [name=...] and [color=...] shortcodes in lists
• Use state parameter for OAuth2 flows and PKCE where applicable

Node compatibility

• Support for Node 24 was verified. The docker image now uses Node 24 as its base image.

Contributors

• Nora Matthias Schiffer (#6096)
• 4censord (#6102)
• Zachery Faria (#6105)
• pl7ofit (#6106)
• Lars Kiesow (#6107)
• Kim Brose (#6114)
• Achilleas Pipinellis (#6119)
• Andreas Boesen (#6148, #6149)
• Thary (#6155)

HedgeDoc 1.10.3

Security fixes

This release fixes a security issue of a possible XSS exploit which can be planted via a malicous SVG file upload.

See CVE-2025-32391 for more details

Enhancements

• Add config options CMD_SAML_WANT_ASSERTIONS_SIGNED and CMD_SAML_WANT_AUTHN_RESPONSE_SIGNED for SAML auth, since
  some instances didn't comply with the new defaults of @node-saml/passport-saml

HedgeDoc 1.10.2

PLEASE CHECK THIS IF YOU USE SAML AUTHENTICATION:
This release had to set default values for the username and email address attribute mapping for SAML authentication for
security reasons.
If you use SAML authentication, please make sure to update your SAML configuration accordingly.
See: https://docs.hedgedoc.org/configuration/#saml-loginCMD_SAML_ATTRIBUTE_USERNAME or CMD_SAML_ATTRIBUTE_EMAIL

Bugfixes

• Check if a valid user id is present when using OAuth2
• Abort SAML login if NameID is undefined instead of logging in with a user named "undefined" (Thanks @Haanifee)
• Set default values for username and email attribute mapping in SAML configuration