LoginSign Up
← Back to all sparks
H

HedgeDoc

COLLAB
Velocity2.5

Open-source collaborative Markdown note editor for real-time team writing.

hedgedoc.org ↗

HedgeDoc 1.x releases are now mostly advisories — security in, features rarely.

collaborative-editingmarkdownself-hostedsecurity-hardeningmaintenance-mode
◆Current state
The 1.x line ships on a roughly six-to-eight-week rhythm, and almost every release leads with security fixes: HTML injection through an email localpart, YAML frontmatter denial-of-service, CSRF in the Gist export, a rate-limit bypass via the CF-Connecting-IP header, SVG upload script execution. Around that, the recent additions are operator controls — an external-link warning page with a whitelist, configurable login and signup rate limits, an option to restrict uploads to registered users or disable them entirely.
◆Where it's heading
This reads as a mature collaborative editor in hardening mode. New settings appear where an administrator needed a lever, not where a user asked for a feature, and the one substantial correctness fix in the window — data loss when five or more people edited a document at once — was a repair to the existing operational-transform client rather than new ground. Node 24 support and the removal of dead config options point the same direction: keeping a working product current.
◆Prediction
Expect the next 1.x release to follow the same shape — one or more advisories plus a small configuration option — since every release in this window has done so.

◆Recent moves

  1. 4d ago

    HedgeDoc 1.11.1

    Adds a whitelist so trusted domains skip the external-link warning introduced one release earlier, plus a switch to turn the warning off entirely and support for webp uploads. The advisory here concerns unvalidated permission values, which only bite when an owner set an invalid permission deliberately.

    View source ↗
  2. 1mo ago

    HedgeDoc 1.11.0

    Four advisories at once — HTML injection via an email localpart, denial-of-service through YAML frontmatter parsing, CSRF in the Gist export, and a rate-limit bypass using the CF-Connecting-IP header. The accompanying features are defensive: an external-link warning page and configurable login and signup rate limits.

    View source ↗
  3. 3mo ago

    HedgeDoc 1.10.8

    Fixes data loss when five or more people edit a document concurrently, caused by the operational-transform client discarding operations during revision gap recovery. For a real-time editor this is the most consequential repair in the window, even though the release carries nothing else.

    View source ↗
  4. 5mo ago

    HedgeDoc 1.10.7

    Three small corrections: cursor colors always emitted as hex to avoid conversion errors, realtime connections closed properly when they drop mid-setup, and the manage_users CLI no longer swallowing errors.

    View source ↗
  5. 5mo ago

    HedgeDoc 1.10.6

    Two medium-severity fixes — security headers not being set correctly on uploaded files, and limited script execution in uploaded SVGs. Upload handling has been a repeat source of advisories across this line.

    View source ↗
  6. 7mo ago

    HedgeDoc 1.10.4

    The most substantial release in the window: an enableUploads option to limit uploads to registered users or switch them off, sandboxed iframes, OAuth2 state and PKCE, a move from shortid to nanoid, and verified Node 24 support. Still framed around two advisories.

    View source ↗