sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

hedgeagent/1.12.0 #1

Open
sa6anw wants to merge 201 commits from hedgeagent/1.12.0 into hedgeagent/1.10.5
pull from: hedgeagent/1.12.0
merge into: sa6anw:hedgeagent/1.10.5
Conversation 0 Commits 201 Files Changed 97 +19 -13
6 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit fe15adaf31 - Show all commits

2
AUTHORS
View File

@@ -117,6 +117,7 @@ Martijnpold <martijntje7@gmail.com>
Martin Turoci <martinturoci@gmail.com> Martin Turoci <martinturoci@gmail.com>
Marvin Gaube <dev@marvingaube.de> Marvin Gaube <dev@marvingaube.de>
Matej Cotman <matej.cotman@eficode.com> Matej Cotman <matej.cotman@eficode.com>
Mathias Kende <mathias@kende.fr>
Mathias Merscher <Mathias.Merscher@dg-i.net> Mathias Merscher <Mathias.Merscher@dg-i.net>
Matt Fisher <matt.fisher@nsidc.org> Matt Fisher <matt.fisher@nsidc.org>
Matteo Savatteri <matteosavatteri@lcm.mi.infn.it> Matteo Savatteri <matteosavatteri@lcm.mi.infn.it>
@@ -211,3 +212,4 @@ Zearin <Zearin@users.noreply.github.com>
Éric Gaspar <46165813+ericgaspar@users.noreply.github.com> Éric Gaspar <46165813+ericgaspar@users.noreply.github.com>
Ömer Erdinç Yağmurlu <omeryagmurlu@gmail.com> Ömer Erdinç Yağmurlu <omeryagmurlu@gmail.com>
蒼時弦也 <elct9620@frost.tw> 蒼時弦也 <elct9620@frost.tw>
지지 ᚠד (Jiji Freya Daniel) Maslowski <info@orangecms.org>

2
docs/content/dev/openapi.yml
View File

@@ -3,7 +3,7 @@ openapi: 3.0.1
info: info:
title: HedgeDoc title: HedgeDoc
description: HedgeDoc is an open source collaborative note editor. Several tasks of HedgeDoc can be automated through this API. description: HedgeDoc is an open source collaborative note editor. Several tasks of HedgeDoc can be automated through this API.
version: 1.10.8 version: 1.11.0
contact: contact:
name: HedgeDoc on GitHub name: HedgeDoc on GitHub
url: https://github.com/hedgedoc/hedgedoc url: https://github.com/hedgedoc/hedgedoc

2
docs/content/setup/docker.md
View File

@@ -29,7 +29,7 @@ services:
restart: always restart: always
app: app:
# Make sure to use the latest release from https://hedgedoc.org/latest-release # Make sure to use the latest release from https://hedgedoc.org/latest-release
image: quay.io/hedgedoc/hedgedoc:1.10.8 image: quay.io/hedgedoc/hedgedoc:1.11.0
environment: environment:
- CMD_DB_URL=postgres://hedgedoc:password@database:5432/hedgedoc - CMD_DB_URL=postgres://hedgedoc:password@database:5432/hedgedoc
- CMD_DOMAIN=localhost - CMD_DOMAIN=localhost

4
docs/content/setup/manual-setup.md
View File

@@ -19,7 +19,7 @@
1. Check if you meet the [requirements at the top of this document](#manual-installation). 1. Check if you meet the [requirements at the top of this document](#manual-installation).
2. Download the [latest release](https://hedgedoc.org/latest-release/) and extract it. 2. Download the [latest release](https://hedgedoc.org/latest-release/) and extract it.
<small>Alternatively, you can use Git to clone the repository and checkout a release, e.g. with `git clone -b 1.10.8 https://github.com/hedgedoc/hedgedoc.git`.</small> <small>Alternatively, you can use Git to clone the repository and checkout a release, e.g. with `git clone -b 1.11.0 https://github.com/hedgedoc/hedgedoc.git`.</small>
3. Enter the directory and execute `bin/setup`, which will install the dependencies and create example configs. 3. Enter the directory and execute `bin/setup`, which will install the dependencies and create example configs.
4. Configure HedgeDoc: To get started, you can use this minimal `config.json`: 4. Configure HedgeDoc: To get started, you can use this minimal `config.json`:
```json ```json
@@ -61,7 +61,7 @@ If you want to upgrade HedgeDoc from an older version, follow these steps:
and the latest release. and the latest release.
2. Fully stop your old HedgeDoc server. 2. Fully stop your old HedgeDoc server.
3. [Download](https://hedgedoc.org/latest-release/) the new release and extract it over the old directory. 3. [Download](https://hedgedoc.org/latest-release/) the new release and extract it over the old directory.
<small>If you use Git, you can check out the new tag with e.g. `git fetch origin && git checkout 1.10.8`</small> <small>If you use Git, you can check out the new tag with e.g. `git fetch origin && git checkout 1.11.0`</small>
5. Run `bin/setup`. This will take care of installing dependencies. It is safe to run on an existing installation. 5. Run `bin/setup`. This will take care of installing dependencies. It is safe to run on an existing installation.
6. *:octicons-light-bulb-16: If you used the release tarball for 1.7.0 or newer, this step can be skipped.* 6. *:octicons-light-bulb-16: If you used the release tarball for 1.7.0 or newer, this step can be skipped.*
Build the frontend bundle by running `yarn install --immutable` and `yarn build`. The extra `yarn install --immutable` is necessary as `bin/setup` does not install the build dependencies. Build the frontend bundle by running `yarn install --immutable` and `yarn build`. The extra `yarn install --immutable` is necessary as `bin/setup` does not install the build dependencies.

2
package.json
View File

@@ -1,6 +1,6 @@
{ {
"name": "HedgeDoc", "name": "HedgeDoc",
"version": "1.10.8", "version": "1.11.0",
"description": "The best platform to write and share markdown.", "description": "The best platform to write and share markdown.",
"main": "app.js", "main": "app.js",
"license": "AGPL-3.0", "license": "AGPL-3.0",

20
public/docs/release-notes.md
View File

@@ -1,24 +1,28 @@
# Release Notes # Release Notes
## <i class="fa fa-tag"></i> 1.x <i class="fa fa-calendar-o"></i> UNRELEASED ## <i class="fa fa-tag"></i> 1.11.0 <i class="fa fa-calendar-o"></i> 2026-06-18
### Security fixes ### Security fixes
This release contains a ... security fix: This release contains four security fixes:
- [GHSA-6c2w-8w96-3pcv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv) reports a possible HTML injection via the localpart of an email address. - [GHSA-6c2w-8w96-3pcv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv) reports a possible HTML injection via the localpart of an email address.
- [GHSA-qj78-mjch-wwrv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-qj78-mjch-wwrv) reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
- [GHSA-8v9p-5j95-826j](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-8v9p-5j95-826j) reports a possible CSRF attack vector in the GitHub Gist export.
- [GHSA-2f9f-w8xq-276v](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-2f9f-w8xq-276v) reports a rate-limiting bypass by abusing the CF-Connecting-IP header.
Thanks to [Chandler Johnson](https://github.com/chndlrx) for reporting! Thanks to [Chandler Johnson](https://github.com/chndlrx), [taylorodell](https://github.com/taylorodell) and [alanturing881](https://github.com/alanturing881) for reporting!
### Important notices
- When using Cloudflare in front of HedgeDoc, you should set `rateLimitUsingCloudflare` in the config.json or `CMD_RATE_LIMIT_USING_CLOUDFLARE` as environment variable to `true`.
### Enhancements ### Enhancements
- Added a warning page when clicking external links - Added a warning page when clicking external links
- Improve the config.json.example file, which is used by `bin/setup` - Improve the config.json.example file, which is used by `bin/setup`
- Allow configuration of login / signup rate-limits - Allow configuration of login / signup rate-limits
- Allow configuration of Cloudflare usage in regards rate-limits - Allow configuration of Cloudflare usage in regards of rate-limits
- Several improvements in the documentation at <https://docs.hedgedoc.org>
### Bugfixes
- Made frontmatter parsing resilient to massive YAML alias expansion ("YAML bomb")
## <i class="fa fa-tag"></i> 1.10.8 <i class="fa fa-calendar-o"></i> 2026-04-15 ## <i class="fa fa-tag"></i> 1.10.8 <i class="fa fa-calendar-o"></i> 2026-04-15