diff --git a/AUTHORS b/AUTHORS index db34dfe3..9c02d192 100644 --- a/AUTHORS +++ b/AUTHORS @@ -117,6 +117,7 @@ Martijnpold Martin Turoci Marvin Gaube Matej Cotman +Mathias Kende Mathias Merscher Matt Fisher Matteo Savatteri @@ -211,3 +212,4 @@ Zearin Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> Ömer Erdinç Yağmurlu 蒼時弦也 +지지 ᚠד (Jiji Freya Daniel) Maslowski diff --git a/docs/content/dev/openapi.yml b/docs/content/dev/openapi.yml index 095daffc..e4919e1f 100644 --- a/docs/content/dev/openapi.yml +++ b/docs/content/dev/openapi.yml @@ -3,7 +3,7 @@ openapi: 3.0.1 info: title: HedgeDoc description: HedgeDoc is an open source collaborative note editor. Several tasks of HedgeDoc can be automated through this API. - version: 1.10.8 + version: 1.11.0 contact: name: HedgeDoc on GitHub url: https://github.com/hedgedoc/hedgedoc diff --git a/docs/content/setup/docker.md b/docs/content/setup/docker.md index c0b780d6..da5e79f3 100644 --- a/docs/content/setup/docker.md +++ b/docs/content/setup/docker.md @@ -29,7 +29,7 @@ services: restart: always app: # Make sure to use the latest release from https://hedgedoc.org/latest-release - image: quay.io/hedgedoc/hedgedoc:1.10.8 + image: quay.io/hedgedoc/hedgedoc:1.11.0 environment: - CMD_DB_URL=postgres://hedgedoc:password@database:5432/hedgedoc - CMD_DOMAIN=localhost diff --git a/docs/content/setup/manual-setup.md b/docs/content/setup/manual-setup.md index 88606687..a94c77c3 100644 --- a/docs/content/setup/manual-setup.md +++ b/docs/content/setup/manual-setup.md @@ -19,7 +19,7 @@ 1. Check if you meet the [requirements at the top of this document](#manual-installation). 2. Download the [latest release](https://hedgedoc.org/latest-release/) and extract it. - Alternatively, you can use Git to clone the repository and checkout a release, e.g. with `git clone -b 1.10.8 https://github.com/hedgedoc/hedgedoc.git`. + Alternatively, you can use Git to clone the repository and checkout a release, e.g. with `git clone -b 1.11.0 https://github.com/hedgedoc/hedgedoc.git`. 3. Enter the directory and execute `bin/setup`, which will install the dependencies and create example configs. 4. Configure HedgeDoc: To get started, you can use this minimal `config.json`: ```json @@ -61,7 +61,7 @@ If you want to upgrade HedgeDoc from an older version, follow these steps: and the latest release. 2. Fully stop your old HedgeDoc server. 3. [Download](https://hedgedoc.org/latest-release/) the new release and extract it over the old directory. - If you use Git, you can check out the new tag with e.g. `git fetch origin && git checkout 1.10.8` + If you use Git, you can check out the new tag with e.g. `git fetch origin && git checkout 1.11.0` 5. Run `bin/setup`. This will take care of installing dependencies. It is safe to run on an existing installation. 6. *:octicons-light-bulb-16: If you used the release tarball for 1.7.0 or newer, this step can be skipped.* Build the frontend bundle by running `yarn install --immutable` and `yarn build`. The extra `yarn install --immutable` is necessary as `bin/setup` does not install the build dependencies. diff --git a/package.json b/package.json index 9a6c499c..3244367d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "HedgeDoc", - "version": "1.10.8", + "version": "1.11.0", "description": "The best platform to write and share markdown.", "main": "app.js", "license": "AGPL-3.0", diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md index 40cd4f15..e688fd4d 100644 --- a/public/docs/release-notes.md +++ b/public/docs/release-notes.md @@ -1,24 +1,28 @@ # Release Notes -## 1.x UNRELEASED +## 1.11.0 2026-06-18 ### Security fixes -This release contains a ... security fix: +This release contains four security fixes: - [GHSA-6c2w-8w96-3pcv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv) reports a possible HTML injection via the localpart of an email address. +- [GHSA-qj78-mjch-wwrv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-qj78-mjch-wwrv) reports a possible Denial-of-Service attack using the YAML frontmatter parsing. +- [GHSA-8v9p-5j95-826j](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-8v9p-5j95-826j) reports a possible CSRF attack vector in the GitHub Gist export. +- [GHSA-2f9f-w8xq-276v](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-2f9f-w8xq-276v) reports a rate-limiting bypass by abusing the CF-Connecting-IP header. -Thanks to [Chandler Johnson](https://github.com/chndlrx) for reporting! +Thanks to [Chandler Johnson](https://github.com/chndlrx), [taylorodell](https://github.com/taylorodell) and [alanturing881](https://github.com/alanturing881) for reporting! + +### Important notices + +- When using Cloudflare in front of HedgeDoc, you should set `rateLimitUsingCloudflare` in the config.json or `CMD_RATE_LIMIT_USING_CLOUDFLARE` as environment variable to `true`. ### Enhancements - Added a warning page when clicking external links - Improve the config.json.example file, which is used by `bin/setup` - Allow configuration of login / signup rate-limits -- Allow configuration of Cloudflare usage in regards rate-limits - -### Bugfixes - -- Made frontmatter parsing resilient to massive YAML alias expansion ("YAML bomb") +- Allow configuration of Cloudflare usage in regards of rate-limits +- Several improvements in the documentation at ## 1.10.8 2026-04-15