LoginSign Up
← Back to all sparks
H

HedgeDoc

COLLAB
Velocity2.5

Open-source collaborative Markdown note editor for real-time team writing.

hedgedoc.org ↗

A collaborative markdown editor on a security-driven maintenance cadence.

markdowncollaborative-editingsecurity-fixesself-hostedmaintenance
◆Current state
HedgeDoc's 1.x line ships every one to two months and is dominated by security response. Recent releases carry seven advisories between them — HTML injection via an email localpart, YAML frontmatter denial of service, CSRF in the Gist export, a rate-limit bypass through CF-Connecting-IP, a permission-value validation gap, missing upload security headers, and script execution in uploaded SVGs. Around those sit configuration knobs for the external-link warning, webp uploads, and rate limits.
◆Where it's heading
Two threads run in parallel. The perimeter work reduces attack surface and maintenance burden at once: old API endpoints and unused config are deleted, Node 18 support is dropped now that its security window has closed, and features added in one release tend to gain an off switch in the next. The second thread is realtime correctness — concurrent-editing data loss, connections dropped mid-handshake, operations discarded during revision gap recovery — which is the only work aimed at the core editing experience rather than its edges.
◆Prediction
Expect the 1.x line to continue as security and correctness maintenance, with more legacy endpoints and configuration removed rather than new editing features added.

◆Recent moves

  1. 21d ago

    HedgeDoc 1.12.0

    1.12.0 raises the floor to Node 20.17 now that Node 18's security support has lapsed, and prunes some highlight.js languages. The substantive change continues the realtime thread — several connection-handling bugs could cost users on flaky links their edits — and login now skips the modal when exactly one external provider is configured.

    View source ↗
  2. 1mo ago

    HedgeDoc 1.11.1

    A permission-validation advisory is fixed, and the external-link warning added one release earlier gains both a whitelist and an off switch. Webp uploads arrive, and the old Temp database object and its endpoints are deleted — the same trim-the-surface habit visible across the line.

    View source ↗
  3. 2mo ago

    HedgeDoc 1.11.0

    Four advisories land at once — HTML injection, a YAML frontmatter denial of service, CSRF in the Gist export, and a rate-limit bypass via CF-Connecting-IP — with a config flag operators behind Cloudflare must set for rate limiting to work correctly. The heaviest security release in the run.

    View source ↗
  4. 4mo ago

    HedgeDoc 1.10.8

    Fixes data loss when five or more users edit concurrently, caused by the operational-transform client discarding operations during revision gap recovery. For a tool whose premise is simultaneous editing, this is the most consequential bug in the run.

    View source ↗
  5. 6mo ago

    HedgeDoc 1.10.7

    Small correctness fixes: cursor colours pinned to hex to avoid conversion errors, realtime connections closed properly when they drop mid-handshake, and the manage_users CLI no longer swallowing errors.

    View source ↗
  6. 7mo ago

    HedgeDoc 1.10.6

    Two medium-severity fixes covering security headers on uploaded files and limited script execution in uploaded SVGs. Uploads recur as a weak point across this line, and both advisories came from outside reporters.

    View source ↗