LoginSign Up
← Back to all sparks
W

Wiki.js

COLLAB
Velocity0.0

Modern open-source wiki engine with markdown editing and access control.

js.wiki ↗

Wiki.js 2.x is in security-maintenance mode, and the feed has been quiet since May

wikiself-hostedsecurity-patchesmaintenance-modecommunity-contributions
◆Current state
Six patch releases on the 2.5 line, most of them fixes. The substantive ones are security: a permissions flaw allowing user assignment to elevated groups, open redirect validation on the login redirect cookie, authentication for GraphQL subscription WebSocket connections, prototype pollution in Rocket.Chat auth, and secure cookie flags on HTTPS sites. Two small features appear — OIDC and OAuth2 avatar claim mapping, and MySQL socket path connections.
◆Where it's heading
This is a mature 2.x line receiving externally reported vulnerability fixes and community contributions rather than product direction. Several fixes credit outside researchers and contributors, which is what maintenance looks like when the maintainer's attention is elsewhere. Release intervals stretched from days in January to nothing since early May.
◆Prediction
More 2.5.x patches driven by reported vulnerabilities are the likely continuation. Nothing in this window indicates when feature work resumes.

◆Recent moves

  1. 3mo ago

    ARM Docker base and Windows build fixes

    Updates the ARM Docker base to Node 24 and fixes a missing migration file in Windows tarball creation. Packaging housekeeping published within two hours of the previous release.

    View source ↗
  2. 3mo ago

    Fixes privilege escalation via group assignment

    Prevents users being assigned to elevated groups, closing a reported advisory credited to several external researchers. The most consequential fix in this window and typical of what drives 2.5.x releases now.

    View source ↗
  3. 5mo ago

    OIDC avatar claims, open redirect and WebSocket auth fixes

    Maps OIDC and OAuth2 avatar claims to user profiles while closing an open redirect in the login cookie and requiring authentication on GraphQL subscription sockets. One of the few releases here carrying a feature alongside the security work.

    View source ↗
  4. 6mo ago

    Prototype pollution and secure cookie fixes

    Fixes prototype pollution in Rocket.Chat authentication, adds secure cookie flags for HTTPS sites, and repairs draw.io diagrams broken by sanitisation. Hardening plus editor repair in one patch.

    View source ↗
  5. 6mo ago

    Breadcrumb and stream pipeline fixes

    Two internal corrections covering breadcrumb path generation and use of the promisified stream pipeline. Nothing users would notice.

    View source ↗
  6. 6mo ago

    MySQL socket path connections and search reliability

    Adds database connection via socketPath on the mysql2 driver and ensures the pg_trgm extension is available for PostgreSQL search, alongside several community-contributed fixes. A broad community-driven patch.

    View source ↗