LoginSign Up
← Back to all sparks
H

HedgeDoc

COLLAB
Velocity5.0

Open-source collaborative Markdown note editor for real-time team writing.

hedgedoc.org ↗

HedgeDoc 1.12.1 fixes seven advisories, then gets pulled for a PostgreSQL migration bug

markdowncollaborative-editingsecurity-fixesself-hostedauthentication
◆Current state
HedgeDoc 1.12.1 fixed seven security advisories, including an impersonation attack when two auth providers return the same profile id, a timing leak that revealed registered emails, and unescaped iframes in slides. It was pulled within minutes because a profile provider migration failed on PostgreSQL, and 1.12.2 replaces it. The release also lets OAuth2 and OIDC providers supply profile photos and updates mermaid to 11.17.
◆Where it's heading
The 1.x line remains driven by security response, with advisory batches arriving every one to three months. This release adds a schema migration, and the immediate PostgreSQL breakage shows the risk of mixing data changes into security patches. Small auth and rendering features keep arriving alongside the fixes.
◆Prediction
More advisory batches on the 1.12.x line are likely, given the pattern; the entries do not show when the next major line will replace 1.x.

◆Recent moves

  1. 9d ago

    HedgeDoc 1.12.2

    A one-fix release for the profile provider migration that failed on PostgreSQL. It exists to replace the pulled 1.12.1.

    View source ↗
  2. 9d ago

    HedgeDoc 1.12.1

    Seven advisories in one release, from auth-provider impersonation to email enumeration and a note-alias crash, plus OAuth2 profile photos and mermaid 11.17. It was pulled for a PostgreSQL migration bug, so the fixes reach users through 1.12.2.

    View source ↗
  3. 2mo ago

    HedgeDoc 1.12.0

    1.12.0 raises the floor to Node 20.17 now that Node 18's security support has lapsed, and prunes some highlight.js languages. The substantive change continues the realtime thread — several connection-handling bugs could cost users on flaky links their edits — and login now skips the modal when exactly one external provider is configured.

    View source ↗
  4. 3mo ago

    HedgeDoc 1.11.1

    A permission-validation advisory is fixed, and the external-link warning added one release earlier gains both a whitelist and an off switch. Webp uploads arrive, and the old Temp database object and its endpoints are deleted — the same trim-the-surface habit visible across the line.

    View source ↗
  5. 4mo ago

    HedgeDoc 1.11.0

    Four advisories land at once — HTML injection, a YAML frontmatter denial of service, CSRF in the Gist export, and a rate-limit bypass via CF-Connecting-IP — with a config flag operators behind Cloudflare must set for rate limiting to work correctly. The heaviest security release in the run.

    View source ↗
  6. 7mo ago

    HedgeDoc 1.10.8

    Fixes data loss when five or more users edit concurrently, caused by the operational-transform client discarding operations during revision gap recovery. For a tool whose premise is simultaneous editing, this is the most consequential bug in the run.

    View source ↗