sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
4,661 Commits 2 Branches 0 Tags
0e24145095c6066c849d3ba78624cc9067a3552d
Commit Graph

4661 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
renovate[bot]
297f30ecba chore(deps): update dependency mkdocs-material to v9.7.7 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-23 21:34:28 +02:00
renovate[bot]
de588c19be chore(deps): update dependency abcjs to v6.6.4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-23 21:33:49 +02:00
renovate[bot]
44beea5d54 chore(deps): update actions/checkout action to v7.0.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-23 21:31:48 +02:00
Erik Michelson
2391e406cb chore(config): remove unused allowOrigin config option 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-07-22 22:54:36 +02:00
Philip Molares
b03489859a chore(changelog): explain Temp removal 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2026-07-22 22:54:36 +02:00
Philip Molares
cda70628fa refactor: remove wurl dependency 
This was mainly used in now removed code, any other uses were fixed with the URL constructor

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2026-07-22 22:54:36 +02:00
Philip Molares
0749c31100 refactor: remove Temp 
This was a very old way of migrating the history and is no longer needed.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2026-07-22 22:54:36 +02:00
Philip Molares
3f50054609 refactor(xssWhitelist): remove unnecessary whitelist entries 
All the deleted entries are in the default white contained and don't need to be added another time.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2026-07-22 20:20:54 +02:00
Philip Molares
1a7c27470e fix(externalLinks): make external link warning work with subpaths 2026-07-22 20:14:44 +02:00
Erik Michelson
c77d64ad6e refactor: wildcard and strict host link whitelisting 
The previously contributed config option for whitelisting domains
treated all entries like wildcard entries and matched subdomains
too. Since some users don't want this behaviour, this changes the
config option to differentiate between wildcard entries like
"*.example.com" and strict host entries like "example.com".

Since this config option was not released yet, it is safe to
change it without breaking user setups.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-07-19 14:40:36 +02:00
Erik Michelson
0ebf0dbc6b feat: add config option to disable external link warning 
Since it is heavily requested by users, this adds a new config option
to disable the previously introduced external link warning.
Be aware however, that disabling this config option weakens the
security of your HedgeDoc instance and is therefore only recommended
for closed trustworthy user groups.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-07-19 14:40:36 +02:00
Andre Julius
d20619315e docs: Update Arch Linux package link (community -> extra) (#6576) 
Signed-off-by: Andre Julius <noromoron@gmail.com>
 2026-07-19 14:34:54 +02:00
Shivam Shukla
a741859060 fix(editor): restore native browser zoom keyboard shortcuts 
Signed-off-by: Shivam Shukla <lucifer84670@gmail.com>
 2026-07-15 08:59:14 +02:00
Shivam Shukla
f6c1feb26f docs: clarify CMD_PORT is used for URL generation with CMD_PATH 
The docs claimed that host and port are completely ignored when a
UNIX domain socket path is configured. However, the port is still
used for URL generation when urlAddPort is enabled.

Closes #6515

Signed-off-by: Shivam Shukla <lucifer84670@gmail.com>
 2026-07-14 23:17:24 +02:00
odpay
2c5b38e3bd docs: add Zenith Hosting deploy option 
Signed-off-by: odpay <odpay@odpay.net>
 2026-07-10 16:27:37 +02:00
renovate[bot]
a48df18d9a fix(deps): update dependency pg to v8.22.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-04 23:53:46 +02:00
renovate[bot]
3c37dcfa26 fix(deps): update dependency js-yaml to v4.3.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-04 23:53:12 +02:00
renovate[bot]
7215f75624 fix(deps): update dependency nanoid to v3.3.15 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-04 23:52:42 +02:00
renovate[bot]
3889b84ac6 chore(deps): update dependency less to v4.6.7 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-04 23:50:44 +02:00
renovate[bot]
1a4ce7a33a chore(deps): update actions/cache action to v6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-04 23:49:44 +02:00
Erik Michelson
c02dc05bec docs: add CVE numbers to release-notes 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-07-04 22:27:16 +02:00
Tobias Dillig
1e75f7462d feat: add 'image/webp' to allowed upload MIME types 
Signed-off-by: Tobias Dillig <tobias.dillig@frachtwerk.de>
 2026-07-04 22:25:43 +02:00
Tobi
e4d5124211 feat(external-links): add whitelist to bypass redirect page (#6548) 
Signed-off-by: Tobias Dillig <tobias.dillig@frachtwerk.de>
Signed-off-by: Tobi <tldev-de@users.noreply.github.com>
 2026-06-25 17:16:27 +02:00
Will Hawkins
179719473c Minor Typos in Configuration Documentation 
Fix minor typos in Configuration documentation to improve readability.

Signed-off-by: Will Hawkins <whh8b@obs.cr>
 2026-06-23 00:13:32 +02:00
Philip Molares
e0351704c9 docs(release-checklist): add improvments from the 1.11.0 release 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2026-06-19 00:13:47 +02:00
Erik Michelson
f115b2d084 fix(views): fail-safe opengraph tag HTML rendering 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-06-18 23:56:45 +02:00
Erik Michelson
4007201575 chore(deps): update lockfile 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-06-18 23:56:45 +02:00
Erik Michelson
fe15adaf31 chore(release): bump version, update release notes, update authors 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-06-18 23:56:45 +02:00
Erik Michelson
c489497e45 refactor(frontmatter): constrain frontmatter object after parsing 
This change removes the meta-marked dependency which solely was
used for extracting the frontmatter, which is possible as well
with one function. Furthermore, this introduces constraints to
objects resulting from frontmatter parsing and enforces them in
order to prevent attacks like a yaml bomb (massive alias expansion).
This change should resolve a possible DoS attack.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-06-18 23:56:45 +02:00
Erik Michelson
fbd7307f16 fix(gist-export): validate OAuth2 state and redirect URI 
The state of the OAuth2 response was not verified.
In theory an attacker could use this to extract the contents of a note.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-06-18 23:56:45 +02:00
Erik Michelson
dd40a6c04b fix(auth): sanitize email addresses 
Previously, maliciously crafted email addresses
could be used to sneak HTML code into the HedgeDoc
editor, since HedgeDoc uses the local part of the
address as a display name for users.
We're now sanitizing this using DOMPurify.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-06-18 23:56:45 +02:00
renovate[bot]
291b9d592d chore(deps): update linters to v7.3.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 23:10:06 +02:00
renovate[bot]
16d426704f chore(deps): update test packages to v11.7.6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 23:09:32 +02:00
renovate[bot]
209391c7fc chore(deps): pin dependencies 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 23:01:54 +02:00
Erik Michelson
e9a2c514dd fix(ci): include node version in yarn cache 
The dependency set may differ between node versions.
This fixed caching makes it harder for version-specific deps and
might introduce bugs therefore. We now include the node version
in the cache key.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-06-18 23:00:01 +02:00
Erik Michelson
6676d640ba revert: chore(deps): update yarn monorepo to v4.17.0" 
This reverts commit 71a4d19a83.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-06-18 22:54:54 +02:00
renovate[bot]
71a4d19a83 chore(deps): update yarn monorepo to v4.17.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 22:13:45 +02:00
renovate[bot]
d80f26be9a fix(deps): update dependency helmet to v8.2.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 22:00:52 +02:00
renovate[bot]
1851f34d3f fix(deps): update dependency body-parser to v2.3.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:58:14 +02:00
renovate[bot]
32b433fa62 chore(deps): update dependency esbuild-loader to v4.5.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:57:16 +02:00
renovate[bot]
865e5b4180 fix(deps): update dependency pg to v8.21.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:51:05 +02:00
renovate[bot]
b940b52e71 chore(deps): update actions/checkout action to v7 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:50:25 +02:00
renovate[bot]
f443e5bbd4 chore(deps): update dependency pymdown-extensions to v10.21.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:50:12 +02:00
renovate[bot]
be6273ec8f fix(deps): update dependency dompurify to v3.4.11 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:49:36 +02:00
renovate[bot]
528530ebf3 fix(deps): update dependency morgan to v1.11.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:48:22 +02:00
renovate[bot]
0de5c5c1a9 fix(deps): update dependency express to v4.22.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:47:17 +02:00
renovate[bot]
86e20c9c48 fix(deps): update dependency nanoid to v3.3.13 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:44:01 +02:00
renovate[bot]
8046666943 fix(deps): update dependency uuid to v11.1.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:41:15 +02:00
renovate[bot]
7783aa7cc5 fix(deps): update dependency express-rate-limit to v8.5.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:40:46 +02:00
renovate[bot]
8b9463358d chore(deps): update dependency less to v4.6.6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 21:36:00 +02:00