sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

hedgeagent/1.12.0 #1

Open
sa6anw wants to merge 201 commits from hedgeagent/1.12.0 into hedgeagent/1.10.5
pull from: hedgeagent/1.12.0
merge into: sa6anw:hedgeagent/1.10.5
Conversation 0 Commits 201 Files Changed 97 +5249 -4345
sa6anw commented 2026-09-14 18:22:48 +00:00
Owner
Copy Link

Component/Part

Description

This PR fixes/adds/improves/...

Steps

  • Added implementation
  • Added / updated tests
  • Added / updated documentation
  • Added changelog snippet
  • I read the contribution documentation and signed-off my commits to accept the DCO.

Related Issue(s)

### Component/Part <!-- e.g database --> ### Description This PR fixes/adds/improves/... ### Steps <!-- Please tick all steps this PR performs (if something is not necessary, please remove it) --> - [ ] Added implementation - [ ] Added / updated tests - [ ] Added / updated documentation - [ ] Added changelog snippet - [ ] I read the [contribution documentation](https://github.com/hedgedoc/hedgedoc/blob/master/CONTRIBUTING.md) and signed-off my commits to accept the DCO. ### Related Issue(s) <!-- e.g #123 -->
sa6anw added 201 commits 2026-09-14 18:22:51 +00:00
docs: update release-checklist 9cb00262f6 
Add the missings tests that lead to the problem with
HedgeDoc 1.10.4

Signed-off-by: Philip Molares <philip.molares@udo.edu>
fix(deps): update dependency winston to v3.19.0 b0911e4434 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency pymdown-extensions to v10.18 72e38c6bfd 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency aws-sdk to v2.1693.0 4df25c436b 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update linters to v9.39.2 92efa38948 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency less to v4.5.1 35f0b44906 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency pymdown-extensions to v10.19.1 98e9e6cefc 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency mysql2 to v3.16.0 e77b9ced58 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/cache action to v5 b76f397983 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/upload-artifact action to v6 48a207571b 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
docs: Add speaker view and speaker notes to slide-options.md (#6322) cb7588d6fa
chore(deps): update actions/cache action to v5.0.2 eba2b2d711 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency mkdocs-material to v9.7.1 e7055b43a4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
docs: fix number of permissions HD1 has 67b1917467 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
docs: permissions page in the docs references 092e4d428d 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(deps): update dependency body-parser to v2.2.2 7c9d1ec712 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency utf-8-validate to v6.0.6 8725196df6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency eslint-plugin-n to v17.23.2 a2da69ede5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency lodash to v4.17.23 [security] a96e9cbdf9 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency esbuild-loader to v4.4.2 a3b49a6e24 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency mysql2 to v3.16.3 58d436c924 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency connect-session-sequelize to v8.0.5 14edc1a7a5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency jquery-ui to v1.14.2 d2dd6762a7 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/checkout action to v6.0.2 ebf98130d7 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/cache action to v5.0.3 f529214660 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependencies 0e9e2177cf 
renovate was tired, so I did it manually

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): update lockfile 6fc411d17f 
renovate was tired, so I did it manually

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(security): headers were not applied to uploads 74daa0e7a1 
Due to express static overriding the response, applying the extra headers
like CSP and Content-Disposition did not work for files served under the
/uploads route. By reordering, the code this works now.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(security): increase CSP policy by explicitly sandboxing uploads b930fe04ce 
Adding the sandbox attribute tells browsers to apply stricter
restrictions like preventing execution of plugins and scripts.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
feat(security): sanitize SVG files on upload f910000d2b 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(release): bump versions and release notes 145e3ee318 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(docs): update release checklist 2e66e4d5ec 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
docs(features): clarification on locations for light/dark mode (#6355) 7408217b6a 
Signed-off-by: xenein <76600392+xenein@users.noreply.github.com>
fix(editor): always use random hex colors fd4d5bfbd1 
chance.color() can output all valid CSS
values for colors, including rgba() syntax and predefined color
names. Due to the usage of hex2rgb and other methods, this can
break the editor. This commit ensures that all randomly generated
colors are specified in hex format.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): update actions/setup-node action to v6.2.0 6a4ab2bc5b 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency pymdown-extensions to v10.21.1 edf1f62b2e
fix(realtime): aboard finishConnection if user is missing 7e2a783161 
This can happen if the user disconnects during connection creation.

See #6101

Signed-off-by: Philip Molares <philip.molares@udo.edu>
docs: add changelog entry 5603af245c 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(release): bump version to 1.10.7 5d00de9892 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
fix(cli): do not silently drop errors in manage_users CLI 5cefc3cfe1 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
docs(release-notes): add section about 1.10.7 f0c0200eb9 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(dependency): fix pymdown-extensions version cdedc8df33 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(deps): update dependency abcjs to v6.6.1 6c91a8728e 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency abcjs to v6.6.2 2adc315f13 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/setup-node action to v6.3.0 11b299d186 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency dompurify to v3.3.2 [security] 8ffea9963a 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency file-type to v21.3.2 [security] c75b02bc66 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency minio to v8.0.7 f5fceed8e2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency rimraf to v6.1.3 32f119f7ac 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency pg to v8.20.0 f7642f37f9 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency mysql2 to v3.20.0 90febd954e 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency mkdocs-material to v9.7.6 cbed25c170 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/upload-artifact action to v7 ee1435748f 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update linters f51f8dcc19 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix: buffer operations in Stale/StaleWithBuffer instead of throwing (#6342) 65bf11554a 
When 5+ users edit concurrently, revision gaps trigger the Stale state
which throws 'Ignored server-side change.' on incoming operations. This
causes document divergence, silent data corruption, and eventually
force-resets that discard local edits.

Changes:
- Stale/StaleWithBuffer.applyServer: buffer incoming operations instead
  of throwing, apply them sequentially after missing ops arrive
- Stale.applyClient: carry pendingOps to StaleWithBuffer on transition
- editor-socketio-server: retry-based force-reset (3 failures) instead
  of immediate nuclear reset on any OT error
- hex2rgb: defensive null checks for old non-hex color records

Signed-off-by: bxff <51504045+bxff@users.noreply.github.com>
fix(ot): use default color constant for hex2rgb fallback c4841575c9 
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(ot): keep pendingOps in StaleWithBuffer during applyClient 5a5e12a693 
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(ot): add minified updated OT library and build:ot script ca31580db5 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): update dependency mkdocs-redirects to v1.2.3 78ff6fc49f 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency express-rate-limit to v8.3.2 7ca140d9a7 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency mysql2 to v3.22.0 e1c28c46e6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency dompurify to v3.4.0 254c1227d2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update yarn to v4.13.0 779682d35f 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency lodash to v4.18.1 954d84129d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency sanitize-filename to v1.6.4 8d10830dc4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency validator to v13.15.35 451ae33f0d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency less to v4.6.4 0432642231 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency pymdown-extensions to v10.21.2 fbd2cdbc2f 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency file-type to v21.3.4 31933a9f7d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency esbuild-loader to v4.4.3 ba91457a51 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency connect-session-sequelize to v8.0.6 5123f3b57d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency turndown to v7.2.4 0b27277612 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/cache action to v5.0.5 325c659e4b 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): lock file maintenance bb32d61a7e 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(release): bump version to 1.10.8 20de73bb65 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(release): update AUTHORS and release notes 8b00b6419c 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(build): success message + executable bit for ot build script b09975a3ba 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
docs(release): update checklist with minor fixes f0f0b3a3b4 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
docs(auth): update authelia configuration guide (#6465) 03775f0f80
chore(deps): update actions/setup-node action to v6.4.0 2abfdb9628 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency dompurify to v3.4.2 cc9194bfca 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
docs(setup): note that the FreeBSD port is unmaintained 193446daed 
Signed-off-by: 지지 ᚠד (Jiji Freya Daniel) Maslowski <info@orangecms.org>
fix(deps): update dependency mysql2 to v3.22.5 c145549af4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency abcjs to v6.6.3 fa00e34635 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
feat(editor): add external link warning page 814271dc0b 
A malicious user could modify a valid looking link (for example of the editor UI)
to point to a malicous site, by using overlays and CSS. Since CSS should stay
enabled, we need to make the user aware of possible risks when leaving the
HedgeDoc instance, in order to protect them from credential-theft.

This commit adds a new interstitial page for external links, that shows the
target URL and asks the user, whether they really want to continue.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
refactor(docs): move media guides f1070734b1 
The media guides should also live in their own folder like the auth guides do as well

Signed-off-by: Philip Molares <philip.molares@udo.edu>
refactor(config): improve config.json.example c77676faee 
Remove all the unnecessary config options, we know have a docs website for quite some time, we don't need this to document options.
Add some sane defaults in regard to anonymous usage and stats

Signed-off-by: Philip Molares <philip.molares@udo.edu>
feat(docs): add production ready page 1fb904a137 
This page explains what you need to consider and configure to make your HedgeDoc instance production ready.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(changelog): changes to config.json.example 523cb8ea1f 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
refactor(docs): fix links d7c1e45814 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
feat(rate-limit): add more config options 8891d75baa 
Allow the admin to specify the rate-limits for user signup / login
Allow the admin to specify if Cloudflare specific rate-limit functionality should be used or not

Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(deps): update actions/checkout action to v6.0.3 07505cdd61 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency js-cookie to v3.0.8 72b3696af5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency less to v4.6.6 8b9463358d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency express-rate-limit to v8.5.2 7783aa7cc5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency uuid to v11.1.1 8046666943 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency nanoid to v3.3.13 86e20c9c48 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency express to v4.22.2 0de5c5c1a9 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency morgan to v1.11.0 528530ebf3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency dompurify to v3.4.11 be6273ec8f 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency pymdown-extensions to v10.21.3 f443e5bbd4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/checkout action to v7 b940b52e71 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency pg to v8.21.0 865e5b4180 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency esbuild-loader to v4.5.0 32b433fa62 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency body-parser to v2.3.0 1851f34d3f 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency helmet to v8.2.0 d80f26be9a 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update yarn monorepo to v4.17.0 71a4d19a83 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
revert: chore(deps): update yarn monorepo to v4.17.0" 6676d640ba 
This reverts commit 71a4d19a83.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(ci): include node version in yarn cache e9a2c514dd 
The dependency set may differ between node versions.
This fixed caching makes it harder for version-specific deps and
might introduce bugs therefore. We now include the node version
in the cache key.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): pin dependencies 209391c7fc 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update test packages to v11.7.6 16d426704f 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update linters to v7.3.0 291b9d592d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(auth): sanitize email addresses dd40a6c04b 
Previously, maliciously crafted email addresses
could be used to sneak HTML code into the HedgeDoc
editor, since HedgeDoc uses the local part of the
address as a display name for users.
We're now sanitizing this using DOMPurify.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(gist-export): validate OAuth2 state and redirect URI fbd7307f16 
The state of the OAuth2 response was not verified.
In theory an attacker could use this to extract the contents of a note.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
refactor(frontmatter): constrain frontmatter object after parsing c489497e45 
This change removes the meta-marked dependency which solely was
used for extracting the frontmatter, which is possible as well
with one function. Furthermore, this introduces constraints to
objects resulting from frontmatter parsing and enforces them in
order to prevent attacks like a yaml bomb (massive alias expansion).
This change should resolve a possible DoS attack.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(release): bump version, update release notes, update authors fe15adaf31 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): update lockfile 4007201575 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(views): fail-safe opengraph tag HTML rendering f115b2d084 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
docs(release-checklist): add improvments from the 1.11.0 release e0351704c9 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Minor Typos in Configuration Documentation 179719473c 
Fix minor typos in Configuration documentation to improve readability.

Signed-off-by: Will Hawkins <whh8b@obs.cr>
feat(external-links): add whitelist to bypass redirect page (#6548) e4d5124211 
Signed-off-by: Tobias Dillig <tobias.dillig@frachtwerk.de>
Signed-off-by: Tobi <tldev-de@users.noreply.github.com>
feat: add 'image/webp' to allowed upload MIME types 1e75f7462d 
Signed-off-by: Tobias Dillig <tobias.dillig@frachtwerk.de>
docs: add CVE numbers to release-notes c02dc05bec 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): update actions/cache action to v6 1a4ce7a33a 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency less to v4.6.7 3889b84ac6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency nanoid to v3.3.15 7215f75624 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency js-yaml to v4.3.0 3c37dcfa26 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency pg to v8.22.0 a48df18d9a 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
docs: add Zenith Hosting deploy option 2c5b38e3bd 
Signed-off-by: odpay <odpay@odpay.net>
docs: clarify CMD_PORT is used for URL generation with CMD_PATH f6c1feb26f 
The docs claimed that host and port are completely ignored when a
UNIX domain socket path is configured. However, the port is still
used for URL generation when urlAddPort is enabled.

Closes #6515

Signed-off-by: Shivam Shukla <lucifer84670@gmail.com>
fix(editor): restore native browser zoom keyboard shortcuts a741859060 
Signed-off-by: Shivam Shukla <lucifer84670@gmail.com>
docs: Update Arch Linux package link (community -> extra) (#6576) d20619315e 
Signed-off-by: Andre Julius <noromoron@gmail.com>
feat: add config option to disable external link warning 0ebf0dbc6b 
Since it is heavily requested by users, this adds a new config option
to disable the previously introduced external link warning.
Be aware however, that disabling this config option weakens the
security of your HedgeDoc instance and is therefore only recommended
for closed trustworthy user groups.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
refactor: wildcard and strict host link whitelisting c77d64ad6e 
The previously contributed config option for whitelisting domains
treated all entries like wildcard entries and matched subdomains
too. Since some users don't want this behaviour, this changes the
config option to differentiate between wildcard entries like
"*.example.com" and strict host entries like "example.com".

Since this config option was not released yet, it is safe to
change it without breaking user setups.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(externalLinks): make external link warning work with subpaths 1a7c27470e
refactor(xssWhitelist): remove unnecessary whitelist entries 3f50054609 
All the deleted entries are in the default white contained and don't need to be added another time.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
refactor: remove Temp 0749c31100 
This was a very old way of migrating the history and is no longer needed.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
refactor: remove wurl dependency cda70628fa 
This was mainly used in now removed code, any other uses were fixed with the URL constructor

Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(changelog): explain Temp removal b03489859a 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(config): remove unused allowOrigin config option 2391e406cb 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): update actions/checkout action to v7.0.1 44beea5d54 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency abcjs to v6.6.4 de588c19be 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency mkdocs-material to v9.7.7 297f30ecba 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update linters 844c390bbc 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(slide-preview): list items in correct order 9c1b36df95 
This change fixes the displaying of (nested) list items in the preview
pane of the editor. Previously, list items were all treated as inline
blocks and therefore nested list items were placed next to the previous
item instead of below it. Now they align properly as expected.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(deps): update dependency dompurify to v3.4.12 5e112e96df 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency nanoid to v3.3.16 c0cc5ff0bb 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency less to v4.8.0 7ee513b0cc 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency express-rate-limit to v8.6.0 88e73180fd 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency helmet to v8.3.0 3aae6316a7 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/setup-node action to v7 a16f574283 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency mysql2 to v3.23.1 efcb6d472a 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): lock file maintenance 95660a6665 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(release): bump version and adapt release notes for 1.11.1 0a7fc28d8b 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(permissions): ignore unknown permission values 0dda149c7f 
The permission checks did not check for unknown permission values
submitted to the server. This allowed bypassing permission checks
under certain circumstances. However, this is not as critical as
it might sound at first, since checks guard that only the owner
can modify note permissions and the owner already has always
full permission to their note.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
docs: extend release-checklist from 1.11.1 release 16dd9a9faf 
We just released 1.11.1 and noticed some things that need to be changed in the release checklist.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
docs: change mastodon color to brand purple ed7f374434
feat: add auto login to skip sign-in method chooser d05cfe4e9f 
If you combine OIDC with local accounts or if your OIDC provider is an
external company (Facebook, GitHub, …) it makes sense for HedgeDoc to
show a additional login modal so users know that they will leave the
page.

However, if OAuth2/OIDC is a deployment's primary sign-in method and a
local OIDC provider is being used, users expect the common SSO method
being used, and he "Choose method" modal is a redundant extra click.
Essentially, you may have to click login thrice:

- Click login -> modal opens
- Click Login with provider -> provider login opens
- Log in (unless you are logged in already)

This simple patch adds an auto-login configuration, which makes the Sign
In button link straight to the provider's OAuth2 flow, improving the UX
of tHedgeDoc's login.

Signed-off-by: Lars Kiesow <lkiesow@uos.de>
fix: open links in new tab ffcf79ef07 
The addition of external link warning has changed the behavior of
opening links from opening in a new tab to opening in the same tab.
This restores the old behavior and opens all links in a new tab.

Signed-off-by: Tony Chau <90050474+fo5for@users.noreply.github.com>
fix(realtime): check for online users before clearing note da2c065e59 
The disconnect handler for the realtime connection checks whether the
disconnecting socket was the last user for that note. If that's the
case and the note had unsaved changes, it persists them to the database
which is an async progress. In the callback of this async progress, the
note and all its pending changes (should be empty) are deleted.
However, when the user reconnects quickly because of a flaky
connection, it could happen that they create new pending changes before
the database saving finished. As there was no additional "no-users"
check before clearing the note, this could lead to content loss.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(socket.io): remove deprecated cookie option from server-side d1ad8d71fe 
See docs at: https://socket.io/docs/v4/server-options/#cookie

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(realtime): proper reconnect handling for socket.io 766d00c4d9 
Socket.IO seems to include an own reconnect mechanism for some time.
HedgeDoc however built an own reconnect mechanism on top of that.
Since the 'reconnect' event was dropped for socket.io 4.x, the
reconnect-cleanup code didn't run anymore.

This commit fixes this by:
- removing the manual reconnect interval,
- putting the reconnect handler into the correct place,
- setting reconnection options on the server side

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(deps): update dependency dompurify to v3.4.14 b2cb53143a 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency express-rate-limit to v8.6.2 66732eff2d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency js-yaml to v4.3.1 9586121695 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency mysql2 to v3.23.4 d9e2e6674b 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency nanoid to v3.3.18 28e8e34c79 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency abcjs to v6.7.0 f181334990 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
update docs/content/setup/manual-setup.md: node 18 -> 20 1464fc87cf 
The changelog 1.10.1 2025-02-02 deprecates Node 18 and says that future
releases will require Node 20.

<c02dc05bec/public/docs/release-notes.md (-1101--2025-02-02)>

Signed-off-by: Andreas Boesen <boesen@belwue.de>
chore(deps): update dependency less to v4.9.0 a83e074ab1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency mocha to v11.8.0 03314ae9c4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency pg to v8.23.0 07d5997bb4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
ci: drop node 18 37b23c86c5 
node 18 is deprecated and we already announce that HedgeDoc won't work with it anymore.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
fix(deps): update dependency markdown-it to v14 [security] 9b008ccbab 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency cheerio to v1 5504ac52b2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency markdown-it-emoji to v3 286add5d0d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix: update imports for updated markdown-it-plugins 8340e3f3a2 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(deps): update dependency mariadb to v3.5.3 d62e095553 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency is-svg to v6 01e1b6bd4d 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(image-upload): make imageRouter ESM ready b7c46b0a90 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(deps): update dependency formidable to v3 f2b50dd290 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
refactor: formidable usage 65b39de212 
Instead of a single image or an array formidable now always returns an array of files.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(deps): update dependency globals to v17 9a91b286ea 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency remark-preset-lint-markdown-style-guide to v6 10dd207ff4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update dependency pymdown-extensions to v11 c66f4c2ec2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update dependency scrypt-kdf to v4 6ea80ef636 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update scrypt import to ESM 074f7251e9 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(deps): update dependency umzug to v3 dcdf30b4c4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
refactor: umzug 788676aba4 
allow umzug v3 to work with the umzug v2 migrations

Signed-off-by: Philip Molares <philip.molares@udo.edu>
chore(deps): update dependency highlight.js to v11 95ba7f6fb5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(renderer): upgrade styles and API of highlight.js dddd3a7ed5 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): upgrade archiver to 8.0.0 486fcfef67 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
chore(deps): upgrade uuid to 14.0.2 0e24145095 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(upload): invalid check for upload content 02c6c08bd3 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
fix(deps): update dependency markdown-it to v14.3.0 43f414adc4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): lock file maintenance 47a7cdf3f3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(release): bump version numbers, authors, etc b933504071 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Add Invite Agent action to editor menu and allow CSP connect-src 0482e5b3c0
Docker file och compose 734171ded4
Docker file och compose 1e2e22d238
Update README.md 34f6bb5d0f
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin hedgeagent/1.12.0:hedgeagent/1.12.0
git checkout hedgeagent/1.12.0
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
sa6anw
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sa6anw/hedgedoc-hedgeagent#1
Delete Branch "hedgeagent/1.12.0"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?