HedgeDoc 1.10.4

1.10.4

HedgeDoc 1.10.4

Added 3
  • Add enableUploads (CMD_ENABLE_UPLOADS) config option to restrict uploads to registered users, all users, or none
  • Allow links to protocols such as xmpp, webcal, or geo
  • Protect user history from accidental or malicious deletion by adding a CSRF-like token
Changed 2
  • Switch from deprecated shortid to nanoid module with 10 character long aliases in public links
  • Ensure compatibility with Node 24
Fixed 5
  • Ignore the healthcheck endpoint in the too busy limiter
  • Send the referrer origin for YouTube embeddings due to their requirement
  • Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
  • Secure iframes with credentialless and sandbox attributes
  • Fix regexes for [time=...], [name=...] and [color=...] shortcodes in lists
Security 2
  • Apply sandboxing to iframes to prevent potential cross-site side-effects
  • Use state parameter for OAuth2 flows and PKCE where applicable to prevent CSRF vulnerabilities
Security fixes

This release contains two low severity security fixes:

  • GHSA-gmgw-rcmh-7x47 reports potential cross-site side-effects due to not applying sandboxing to iframes.
  • CVE-2025-66629 reports a possible CSRF vulnerability when using certain social login providers because the state parameter is not used and checked.
Enhancements
  • Add enableUploads (CMD_ENABLE_UPLOADS) config option to restrict uploads to registered users, all users or none to completely disable uploads.
  • Allow links to protocols such as xmpp, webcal or geo
  • Switch from deprecated shortid to nanoid module, with 10 character long aliases in "public" links
  • Ensure compatibility with Node 24
  • Protect user history from accidental or malicious deletion by adding a CSRF-like token
  • Many enhancements in the documentation at docs.hedgedoc.org
Bugfixes
  • Ignore the healthcheck endpoint in the "too busy" limiter
  • Send the referrer origin for YouTube embeddings due to their requirement
  • Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
  • Secure iframes with credentialless and sandbox attributes
  • Fix regexes for [time=...], [name=...] and [color=...] shortcodes in lists
  • Use state parameter for OAuth2 flows and PKCE where applicable
Node compatibility
  • Support for Node 24 was verified. The docker image now uses Node 24 as its base image.
Contributors
View original

Upgraded? How did it go?

Discussion