# HedgeDoc changelog

> A self-hosted, web-based collaborative markdown editor.

- Vendor: HedgeDoc
- Category: Productivity
- Official site: https://hedgedoc.org
- Tracked by: What's New (https://whatsnew.fyi/product/hedgedoc)
- Harvested from: GitHub (hedgedoc/hedgedoc)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 1.11.1 — HedgeDoc 1.11.1

- Date: 2026-07-24
- Version: 1.11.1
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.11.1

- **security** — Fix possible corruption of permission values due to missing validation
- **added** — Add external link warning setting (externalLinkWarning in config.json or CMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely
- **added** — Add external link whitelist setting (externalLinkWhitelist in config.json or CMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains
- **added** — Add support for webp file uploads for all backends except imgur
- **fixed** — Fix external link warning for subpath instances
- **fixed** — Restore native browser zoom-in keyboard shortcuts in the editor
- **fixed** — Fix nested list items rendering properly in the preview pane for slides
- **removed** — Remove the old Temp database object and related API endpoints
- **removed** — Remove unused allowOrigin (environment variable CMD_ALLOW_ORIGIN) config option
- **removed** — Remove unnecessary and duplicate entries in the XSS filtering whitelist

###### Security fixes

- [GHSA-93w7-49m2-cqwg](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg) reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.

###### Enhancements

- Added external link warning setting (`externalLinkWarning` in config.json or `CMD_EXTERNAL_LINK_WARNING`) to disable the external link warning page entirely
- Added external link whitelist setting (`externalLinkWhitelist` in config.json or `CMD_EXTERNAL_LINK_WHITELIST`) to skip warning page for certain domains
- Added support for webp file uploads (for all backends except `imgur`, since that does not support these)

###### Bugfixes

- Fixed external link warning for subpath instances
- Restore native browser zoom-in keyboard shortcuts in the editor
- Nested list items render properly again in the preview pane for slides

###### Refactoring / Clean-up

- Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
- Removed unused `allowOrigin` (environment variable `CMD_ALLOW_ORIGIN`) config option.
- Removed unnecessary/duplicate entries in the XSS filtering whitelist

###### Contributors

- [Shivam Shukla](https://github.com/Shivam-Shukla0)
- [Tobi](https://github.com/tldev-de)

### 1.11.0 — HedgeDoc 1.11.0

- Date: 2026-06-18
- Version: 1.11.0
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.0
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.11.0

- **security** — Fix possible HTML injection via the localpart of an email address
- **security** — Fix possible Denial-of-Service attack using the YAML frontmatter parsing
- **security** — Fix possible CSRF attack vector in the GitHub Gist export
- **security** — Fix rate-limiting bypass by abusing the CF-Connecting-IP header
- **added** — Add a warning page when clicking external links
- **added** — Allow configuration of login and signup rate-limits
- **added** — Allow configuration of Cloudflare usage in regards of rate-limits
- **changed** — Improve the config.json.example file used by bin/setup

###### Security fixes

This release contains four security fixes:
- [GHSA-6c2w-8w96-3pcv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv) reports a possible HTML injection via the localpart of an email address.
- [GHSA-qj78-mjch-wwrv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-qj78-mjch-wwrv) reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
- [GHSA-8v9p-5j95-826j](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-8v9p-5j95-826j) reports a possible CSRF attack vector in the GitHub Gist export.
- [GHSA-2f9f-w8xq-276v](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-2f9f-w8xq-276v) reports a rate-limiting bypass by abusing the CF-Connecting-IP header.

Thanks to [Chandler Johnson](https://github.com/chndlrx), [taylorodell](https://github.com/taylorodell) and [alanturing881](https://github.com/alanturing881) for reporting!

###### Important notices

- When using Cloudflare in front of HedgeDoc, you should set `rateLimitUsingCloudflare` in the config.json or `CMD_RATE_LIMIT_USING_CLOUDFLARE` as environment variable to `true`.

###### Enhancements

- Added a warning page when clicking external links
- Improve the config.json.example file, which is used by `bin/setup`
- Allow configuration of login / signup rate-limits
- Allow configuration of Cloudflare usage in regards of rate-limits
- Several improvements in the documentation at <https://docs.hedgedoc.org>

### 1.10.8 — HedgeDoc 1.10.8

- Date: 2026-04-15
- Version: 1.10.8
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.8
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.8

- **fixed** — Fix data loss when 5+ users edit a document concurrently, caused by the OT client discarding operations during revision gap recovery
- **fixed** — Add defensive null checks to hex2rgb to prevent crashes from non-hex color values

###### Bugfixes

- Fix data loss when 5+ users edit a document concurrently, caused by the OT client discarding operations during revision gap recovery ([#6342](https://github.com/hedgedoc/hedgedoc/issues/6342))
- Add defensive null checks to `hex2rgb` to prevent crashes from non-hex color values

###### Maintenance

- Dependency updates

###### Contributors
- [Dex Devlon](https://github.com/bxff)

### 1.10.7 — HedgeDoc 1.10.7

- Date: 2026-02-24
- Version: 1.10.7
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.7
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.7

- **fixed** — Random colors for user's cursors and selections are now always in hex format to avoid conversion errors
- **fixed** — Correctly close realtime connections if they disconnect during connection creation
- **fixed** — manage_users CLI no longer silently drops errors

###### Bugfixes

- Random colors for user's cursors and selections are now always in hex format to avoid conversion errors
- Correctly close realtime connections if they disconnect during connection creation
- manage_users CLI does not silently drop errors

### 1.10.6 — HedgeDoc 1.10.6

- Date: 2026-02-04
- Version: 1.10.6
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.6
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.6

- **security** — Fix security headers not being set correctly for upload files
- **security** — Fix potential security issues with limited script execution in uploaded SVG files

###### Security fixes

This release contains two medium severity security fixes:
- [CVE-2026-25642](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-x74j-jmf9-534w) reports a bug where security headers for upload files were not set correctly.
- [GHSA-672m-p72w-gw28](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-672m-p72w-gw28) reports potential security issues with limited script execution in uploaded SVG files.

Thanks to [@HUSEYNKHANLI](https://github.com/HUSEYNKHANLI) and [@drkim-dev](https://github.com/drkim-dev) for reporting!

###### Maintenance

- Dependency updates
- Enhancements in the documentation at [docs.hedgedoc.org](https://docs.hedgedoc.org)

###### Contributors
- [xenein](https://github.com/xenein) (#6322)

### 1.10.5 — HedgeDoc 1.10.5

- Date: 2025-12-06
- Version: 1.10.5
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.5
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.5

- **fixed** — Fix the bundled healthcheck in the docker container

This release is just a fix for the docker container. It does not contain any
changes to HedgeDoc itself.

###### Bugfixes
- Fix the bundled healthcheck in the docker container

### 1.10.4 — HedgeDoc 1.10.4

- Date: 2025-12-05
- Version: 1.10.4
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.4
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.4

- **security** — Apply sandboxing to iframes to prevent potential cross-site side-effects
- **security** — Use state parameter for OAuth2 flows and PKCE where applicable to prevent CSRF vulnerabilities
- **added** — Add enableUploads (CMD_ENABLE_UPLOADS) config option to restrict uploads to registered users, all users, or none
- **added** — Allow links to protocols such as xmpp, webcal, or geo
- **changed** — Switch from deprecated shortid to nanoid module with 10 character long aliases in public links
- **changed** — Ensure compatibility with Node 24
- **added** — Protect user history from accidental or malicious deletion by adding a CSRF-like token
- **fixed** — Ignore the healthcheck endpoint in the too busy limiter
- **fixed** — Send the referrer origin for YouTube embeddings due to their requirement
- **fixed** — Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
- **fixed** — Secure iframes with credentialless and sandbox attributes
- **fixed** — Fix regexes for [time=...], [name=...] and [color=...] shortcodes in lists

###### Security fixes

This release contains two low severity security fixes:
- [GHSA-gmgw-rcmh-7x47](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gmgw-rcmh-7x47) reports potential cross-site side-effects due to not applying sandboxing to iframes.
- [CVE-2025-66629](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6wm6-3vpq-6qvv) reports a possible CSRF vulnerability when using certain social login providers because the `state` parameter is not used and checked.

###### Enhancements
- Add `enableUploads` (`CMD_ENABLE_UPLOADS`) config option to restrict uploads to `registered` users, `all` users or
  `none` to completely disable uploads.
- Allow links to protocols such as xmpp, webcal or geo
- Switch from deprecated shortid to nanoid module, with 10 character long aliases in "public" links
- Ensure compatibility with Node 24
- Protect user history from accidental or malicious deletion by adding a CSRF-like token
- Many enhancements in the documentation at [docs.hedgedoc.org](https://docs.hedgedoc.org)

###### Bugfixes
- Ignore the healthcheck endpoint in the "too busy" limiter
- Send the referrer origin for YouTube embeddings due to their requirement
- Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
- Secure iframes with `credentialless` and `sandbox` attributes
- Fix regexes for `[time=...]`, `[name=...]` and `[color=...]` shortcodes in lists
- Use `state` parameter for OAuth2 flows and PKCE where applicable

###### Node compatibility
- Support for Node 24 was verified. The docker image now uses Node 24 as its base image.

###### Contributors
- [Nora Matthias Schiffer](https://github.com/neocturne) (#6096)
- [4censord](https://github.com/4censord) (#6102)
- [Zachery Faria](https://github.com/ZacheryFaria) (#6105)
- [pl7ofit](https://github.com/pl7ofit) (#6106)
- [Lars Kiesow](https://github.com/lkiesow) (#6107)
- [Kim Brose](https://github.com/HarHarLinks) (#6114)
- [Achilleas Pipinellis](https://github.com/axilleas) (#6119)
- [Andreas Boesen](https://github.com/Happy86) (#6148, #6149)
- [Thary](https://github.com/tharynot) (#6155)

### 1.10.3 — HedgeDoc 1.10.3

- Date: 2025-04-09
- Version: 1.10.3
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.3
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.3

- **security** — Fix a possible XSS exploit that could be planted via a malicious SVG file upload
- **added** — Add config options CMD_SAML_WANT_ASSERTIONS_SIGNED and CMD_SAML_WANT_AUTHN_RESPONSE_SIGNED for SAML auth to accommodate instances not complying with new defaults

###### Security fixes

This release fixes a security issue of a possible XSS exploit which can be planted via a malicous SVG file upload.

See [CVE-2025-32391](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-3983-rrqh-mvx5) for more details

###### Enhancements

- Add config options `CMD_SAML_WANT_ASSERTIONS_SIGNED` and `CMD_SAML_WANT_AUTHN_RESPONSE_SIGNED` for SAML auth, since
  some instances didn't comply with the new defaults of `@node-saml/passport-saml`

### 1.10.2 — HedgeDoc 1.10.2

- Date: 2025-02-14
- Version: 1.10.2
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.2
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.2

- **fixed** — Check if a valid user id is present when using OAuth2
- **fixed** — Abort SAML login if NameID is undefined instead of logging in with a user named "undefined"
- **fixed** — Set default values for username and email attribute mapping in SAML configuration

**PLEASE CHECK THIS IF YOU USE SAML AUTHENTICATION:**
This release had to set default values for the username and email address attribute mapping for SAML authentication for
security reasons.
If you use SAML authentication, please make sure to update your SAML configuration accordingly.
See: https://docs.hedgedoc.org/configuration/#saml-login `CMD_SAML_ATTRIBUTE_USERNAME` or `CMD_SAML_ATTRIBUTE_EMAIL`

###### Bugfixes
- Check if a valid user id is present when using OAuth2
- Abort SAML login if NameID is undefined instead of logging in with a user named "undefined" (Thanks [@Haanifee](https://github.com/Haanifee))
- Set default values for username and email attribute mapping in SAML configuration

### 1.10.1 — HedgeDoc 1.10.1

- Date: 2025-02-02
- Version: 1.10.1
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.1
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.1

- **security** — Add fixed rate-limiting to the login and register endpoints to prevent brute-forcing local email/passwords
- **added** — Add configurable rate-limiting to the new notes endpoint
- **fixed** — Fix a crash when cannot read user profile in OAuth
- **fixed** — Fix CSP Header for mermaid embedded images
- **changed** — Change default of HSTS preload to false for compliance with the HSTS preload list requirements
- **deprecated** — Node 18 support is deprecated and will be removed in the next release; upgrade to Node 20 or upwards

This release fixes a security issue where brute-forcing local email/passwords is possible because of missing rate-limits.
We recommend upgrading as soon as possible, if you use local logins.

See also <https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6w39-x2c6-6mpf>

This release changes the default configuration of the HSTS preload attribute to false for compliance with the
HSTS preload list requirements. This shouldn't impact any instance. However, if you intend to use HSTS preloading
you should enable the config setting `hsts.preload` to `true` or set environment variable `CMD_HSTS_PRELOAD=true`.

This release deprecates support for Node 18.
As the LTS support for 18 runs out in April 2025, the next release will only work with Node 20 and upwards.
Consider this your early warning to upgrade any running instances to at least Node 20.

###### Enhancements
- Add fixed rate-limiting to the login and register endpoints
- Add configurable rate-limiting to the new notes endpoint

###### Bugfixes
- Fix a crash when cannot read user profile in OAuth ([#5850](https://github.com/hedgedoc/hedgedoc/pull/5850) by [@lautaroalvarez](https://github.com/lautaroalvarez))
- Fix CSP Header for mermaid embedded images ([#5887](https://github.com/hedgedoc/hedgedoc/pull/5887) by [@domrim](https://github.com/domrim))
- Change default of HSTS preload to false for compliance with the HSTS preload list requirements ([#5913](https://github.com/hedgedoc/hedgedoc/issues/5913) by [@SvizelPritula](https://github.com/SvizelPritula))

###### Contributors

- [Dominik Rimpf](https://github.com/domrim)
- [Lautaro Alvarez](https://github.com/lautaroalvarez)