# HedgeDoc 1.10.4 — HedgeDoc 1.10.4

- Product: HedgeDoc (https://whatsnew.fyi/product/hedgedoc)
- Vendor: HedgeDoc
- Date: 2025-12-05
- Version: 1.10.4
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.4
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.4

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Apply sandboxing to iframes to prevent potential cross-site side-effects
- **security** — Use state parameter for OAuth2 flows and PKCE where applicable to prevent CSRF vulnerabilities
- **added** — Add enableUploads (CMD_ENABLE_UPLOADS) config option to restrict uploads to registered users, all users, or none
- **added** — Allow links to protocols such as xmpp, webcal, or geo
- **changed** — Switch from deprecated shortid to nanoid module with 10 character long aliases in public links
- **changed** — Ensure compatibility with Node 24
- **added** — Protect user history from accidental or malicious deletion by adding a CSRF-like token
- **fixed** — Ignore the healthcheck endpoint in the too busy limiter
- **fixed** — Send the referrer origin for YouTube embeddings due to their requirement
- **fixed** — Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
- **fixed** — Secure iframes with credentialless and sandbox attributes
- **fixed** — Fix regexes for [time=...], [name=...] and [color=...] shortcodes in lists

###### Security fixes

This release contains two low severity security fixes:
- [GHSA-gmgw-rcmh-7x47](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gmgw-rcmh-7x47) reports potential cross-site side-effects due to not applying sandboxing to iframes.
- [CVE-2025-66629](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6wm6-3vpq-6qvv) reports a possible CSRF vulnerability when using certain social login providers because the `state` parameter is not used and checked.

###### Enhancements
- Add `enableUploads` (`CMD_ENABLE_UPLOADS`) config option to restrict uploads to `registered` users, `all` users or
  `none` to completely disable uploads.
- Allow links to protocols such as xmpp, webcal or geo
- Switch from deprecated shortid to nanoid module, with 10 character long aliases in "public" links
- Ensure compatibility with Node 24
- Protect user history from accidental or malicious deletion by adding a CSRF-like token
- Many enhancements in the documentation at [docs.hedgedoc.org](https://docs.hedgedoc.org)

###### Bugfixes
- Ignore the healthcheck endpoint in the "too busy" limiter
- Send the referrer origin for YouTube embeddings due to their requirement
- Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
- Secure iframes with `credentialless` and `sandbox` attributes
- Fix regexes for `[time=...]`, `[name=...]` and `[color=...]` shortcodes in lists
- Use `state` parameter for OAuth2 flows and PKCE where applicable

###### Node compatibility
- Support for Node 24 was verified. The docker image now uses Node 24 as its base image.

###### Contributors
- [Nora Matthias Schiffer](https://github.com/neocturne) (#6096)
- [4censord](https://github.com/4censord) (#6102)
- [Zachery Faria](https://github.com/ZacheryFaria) (#6105)
- [pl7ofit](https://github.com/pl7ofit) (#6106)
- [Lars Kiesow](https://github.com/lkiesow) (#6107)
- [Kim Brose](https://github.com/HarHarLinks) (#6114)
- [Achilleas Pipinellis](https://github.com/axilleas) (#6119)
- [Andreas Boesen](https://github.com/Happy86) (#6148, #6149)
- [Thary](https://github.com/tharynot) (#6155)