# HedgeDoc 1.11.1 — HedgeDoc 1.11.1

- Product: HedgeDoc (https://whatsnew.fyi/product/hedgedoc)
- Vendor: HedgeDoc
- Date: 2026-07-24
- Version: 1.11.1
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.11.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix possible corruption of permission values due to missing validation
- **added** — Add external link warning setting (externalLinkWarning in config.json or CMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely
- **added** — Add external link whitelist setting (externalLinkWhitelist in config.json or CMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains
- **added** — Add support for webp file uploads for all backends except imgur
- **fixed** — Fix external link warning for subpath instances
- **fixed** — Restore native browser zoom-in keyboard shortcuts in the editor
- **fixed** — Fix nested list items rendering properly in the preview pane for slides
- **removed** — Remove the old Temp database object and related API endpoints
- **removed** — Remove unused allowOrigin (environment variable CMD_ALLOW_ORIGIN) config option
- **removed** — Remove unnecessary and duplicate entries in the XSS filtering whitelist

###### Security fixes

- [GHSA-93w7-49m2-cqwg](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg) reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.

###### Enhancements

- Added external link warning setting (`externalLinkWarning` in config.json or `CMD_EXTERNAL_LINK_WARNING`) to disable the external link warning page entirely
- Added external link whitelist setting (`externalLinkWhitelist` in config.json or `CMD_EXTERNAL_LINK_WHITELIST`) to skip warning page for certain domains
- Added support for webp file uploads (for all backends except `imgur`, since that does not support these)

###### Bugfixes

- Fixed external link warning for subpath instances
- Restore native browser zoom-in keyboard shortcuts in the editor
- Nested list items render properly again in the preview pane for slides

###### Refactoring / Clean-up

- Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
- Removed unused `allowOrigin` (environment variable `CMD_ALLOW_ORIGIN`) config option.
- Removed unnecessary/duplicate entries in the XSS filtering whitelist

###### Contributors

- [Shivam Shukla](https://github.com/Shivam-Shukla0)
- [Tobi](https://github.com/tldev-de)