BookStack

This security release addresses multiple vulnerabilities including external authentication mismatches, login timing attacks, PDF rendering issues, and API information disclosure.

Security release addressing URL filtering, redirect handling, and permission vulnerabilities, alongside dependency updates and the addition of the Serbian language.

Security release addressing vulnerabilities related to attachment metadata leaks, file protocol abuse on Windows, and search system errors.

This release introduces a page contents view in the editor, Thai language support, new API endpoints for tags, and separate permission controls for revision viewing.

This security release addresses a brute-force vulnerability in multi-factor authentication and updates project libraries to prevent potential vulnerabilities.

Security release improving attachment permission checks, webhook URL validation, and fixing a search term negation issue.

This release updates translations via Crowdin and refreshes PHP dependency versions.

This security release fixes a vulnerability where restricted page content could be visible during markdown exports and updates PHP packages.

Introduces a new theme module system, adds several theme events for customization, and updates SMTP HELO domain handling and API endpoints.

This security release addresses a vulnerability allowing style code to manipulate page content in revision views and includes dependency updates.

This release fixes content filtering issues affecting link target attributes and user references in comments, and updates PHP package versions.

Fixed an error occurring when loading the editor for pages with blank content created by different users.

Fixes an issue where content filtering rules could make drawio diagrams non-editable.

Fixes server filesystem permission issues related to filter caching folder handling introduced in v25.12.4.

This security release addresses a style code vulnerability in page content and introduces more aggressive content filtering and a new filtering option.

This security release fixes a vulnerability allowing privileged users to be tricked into making API requests and removes most form content from page rendering.

This release updates translations via Crowdin and refreshes PHP dependency versions.

Security release adding search operation limits and ZIP import size checks to prevent resource abuse, alongside PHP dependency and translation updates.

This release introduces user mentions for comments, slug history tracking, an initial developer API for the new WYSIWYG editor, and various performance and UI improvements.

This security release updates PHP dependencies to fix a vulnerability in XML handling that could allow SAML authentication request replays.

This release includes fixes for OIDC state handling in Chromium browsers, session history redirects, and updates to PHP dependency versions.

This release corrects a versioning error, fixes a comment notification error, and updates PHP dependency versions.

This release fixes image access permission issues when using secure storage and updates PHP dependencies.

This release includes fixes for image permission checking in ZIP exports, updated translations, test environment improvements, and updated PHP dependencies.

Fixes database query errors affecting MySQL versions 5.7 and below.

This release updates the framework to Laravel 12, introduces new API endpoints for comments and image data, adds Groovy syntax highlighting, and implements several database and UI improvements.

This release updates translations and PHP packages while fixing PWA manifest access for users behind authenticated proxies.

This release improves the WYSIWYG editor, updates translations and PHP dependencies, and fixes issues with ZIP imports and shelf permissions.

This release includes translation updates, PHP package upgrades, and fixes for open redirects, ZIP import logout issues, and menu accessibility.

This release introduces a plaintext markdown editor, ZIP import/export API endpoints, an updated WYSIWYG editor for comments and descriptions, and various usability and performance improvements.

This release adds the Nepali language, updates translations and PHP packages, improves content diffs for non-ASCII characters, and fixes OpenSearch and test case errors.

This release improves the WYSIWYG editor with various media and table fixes, corrects comment notification text, fixes a search system bug, and updates translations.

This release introduces comment section referencing, comment archiving, AVIF image support, a new system info API endpoint, and OIDC avatar fetching.

This release fixes image directory permissions, updates translations and PHP packages, and improves system CLI credential and vendor command handling.

Updated PHP dependency package versions to resolve compatibility issues with recent libxml versions on some systems.

This release includes image permission error handling improvements, export style fixes, updated translations, and PHP dependency updates.

This release improves name sorting for accented characters, updates translations and dependencies, and fixes several bugs in the new WYSIWYG editor and comment timestamps.

This release adds IPv6 database host support, updates the system CLI with new commands and improvements, updates translations, and refreshes PHP dependencies.

Updates the app framework to Laravel 11, introduces automatic book sorting, improves search indexing, and upgrades the minimum PHP version to 8.2.

This release improves export logic and rate limiting, updates translations and PHP dependencies, and fixes a markdown editor focus issue.

Introduces a new portable ZIP import/export format, enhances LDAP attribute support, improves API search results, and updates the WYSIWYG editor.

This release includes PHP dependency updates, translation improvements, and bug fixes for Chrome video support, page includes, OIDC handling, and dark mode styling.

This security release addresses a vulnerability in PHP dependencies that could allow application configuration manipulation under specific server settings and updates translations.

This release includes updates to the System CLI, fixes for the update-url command and user input validation, and improvements to setting categories and translations.

Introduces a new Lexical-based editor, OpenSearch support, expanded search operators, and updated libraries and language support.

This security release fixes LDAP group syncing role assignments and resolves a permission vulnerability in the book-show API responses.

This release includes translation updates, dependency upgrades, and various fixes for diagrams.net loading, OIDC authentication, image replacement, and code block highlighting.

This release includes various bug fixes, updated translations, improved role validation, and optimizations for GIF thumbnail generation.

This security release introduces rate-limiting for unauthenticated forms, prevents email existence enumeration, and includes various bug fixes and dependency updates.

This release updates the app framework to Laravel 10, adds command-based PDF exports and OIDC userinfo support, and increases minimum requirements for PHP and Composer.

This release fixes issues with the 'Open Link In' option, reference loading from the recycle bin, code block rendering, and page editor content widths.

This release addresses missed version and asset changes from v24.02.1.

This release includes translation updates, improved breadcrumb ordering, MFA input refinements, and fixes for page navigation and non-breaking spaces.

Introduces a WYSIWYG comment editor, PKCE support for OIDC authentication, and various improvements to the WYSIWYG editor and page templates.

This security release addresses a blind server-side-request forgery vulnerability in PDF generation and updates PHP dependencies.

This release fixes issues with attachment inline opening and entity selector search pre-filling, and updates translations via Crowdin.

This release fixes a missing book_slug field in the chapter API and updates translations via Crowdin.

This release introduces a simple WYSIWYG for description fields, book template options, OIDC RP-initiated logout, and improvements to page include handling and the WYSIWYG editor.

This release fixes the application version number as a follow-up to v23.10.3.

This security release fixes a vulnerability in image handling that could allow server-side requests or unauthorized file access and corrects missing permission checks during image creation.

This release fixes audit log dropdown behavior and manifest endpoint redirects, and updates translations.

This release introduces PHP 8.3 support, adds Norwegian Nynorsk language options, and includes several UI fixes and a new JavaScript event for codemirror customization.

This release introduces a new My Account area, a redesigned page editor, basic PWA support, and various UI improvements and bug fixes.

This release fixes issues with comment reply notifications, JavaScript permission errors, and updates various translations.

This release fixes a WYSIWYG filtering issue that hindered page editing and drawing, and updates translations via Crowdin.

This release includes UI improvements to preferences, WYSIWYG editor filtering updates, translation updates, and several bug fixes regarding notifications and documentation.

Introduces a content notification system, browser-based drawing backup storage, and a host allow list for server-side requests alongside various API and UI fixes.

This release re-introduces shelf create permissions, fixes delete-based action webhooks, and updates translations.

This release updates email TLS configuration, refreshes translations, and fixes bugs related to image timestamps, role page loading, and audit log formatting.

This release introduces visual comment threading, an updated image manager, and accessibility improvements, alongside changes to email encryption and font customization methods.

This release includes improvements to the System CLI, multi-file upload support for images and attachments, and updates to code block highlighting and translations.

This release includes system CLI improvements, translation updates, and various fixes for the WYSIWYG editor and code block formatting.

This release introduces a system CLI for admin operations, updates the markdown editor to CodeMirror 6, adds nested include tags, and expands API endpoints for image galleries and content permissions.

This release includes fixes for user deletion and Safari tag selection, alongside updated translations via Crowdin.

This release fixes role deletion errors, resolves user ownership migration issues, and updates translations via Crowdin.

This release fixes a language loading issue and updates translations via Crowdin.

This release updates the framework to Laravel 9, introduces user roles API endpoints, and improves the shelf book management interface and editor performance.

This security release updates the PDF library to fix a vulnerability allowing server-side requests or PHP code execution, and includes translation updates and a minor icon fix.

This release introduces customizable app icons and dark mode colors, expanded code highlighting, OIDC ID claim configuration, and updates to the permission system.

This release adds Smarty and Twig template code language support, updates translations, and fixes issues with global search focus, editor sidebar scrolling, and user role removal.

This release introduces UI shortcuts, global search live previews, expanded language support for code blocks, and updated tabular list views.

Updated translations with the latest changes from Crowdin.

Fixed an issue with generation permissions when a chapter is in the recycle bin.

This release introduces a redesigned content permissions interface, adds Greek language support and MATLAB syntax highlighting, and includes various UI improvements and bug fixes.

This release includes PHPCS for formatting, improved SAML error handling, updated translations, and locale setting fixes for Windows.

Introduces cross-item link reference tracking, OIDC group sync, a new secure image storage option, and updates to revision visibility and limits.

This security release implements additional HTML filtering to prevent XSS techniques and updates API and security documentation regarding external content use.

This release introduces export template partials, activity recording for revisions, translation updates, and bug fixes for user validation and audit logs.

This release fixes a WYSIWYG editor caching issue and updates translations via Crowdin.

This update introduces chapter sorting, WYSIWYG editor enhancements including TinyMCE 6, improved shelf management, and performance optimizations to the permission system.

This release includes updated translations and bug fixes for LDAP/SAML2 group mapping and the link selector popup.

This release includes bug fixes for tag saving, layout issues in Custom Head settings, and updates to translations and the entity selector popup.

Introduces content conversion tools, auto-initiation for SAML/OIDC login, expanded code editor language support, and various UI and performance improvements.

This release adds Persian language support, updates API documentation and translations, fixes attachment downloads and LDAP errors, and updates PHP dependencies.

This release fixes a URL double-slash issue causing 404 errors and updates translations via Crowdin.

This release introduces per-page editor switching, new recycle bin API endpoints, improved file streaming for efficiency, and updated URL handling for better stability in sub-path scenarios.

This release includes fixes for settings redirects and custom HTML head content, updated translations, and updated PHP dependencies.

Introduces WYSIWYG checkbox tasklists, Basque language support, and a reorganized settings layout, along with various bug fixes and webhook enhancements.

This security release introduces an allow-list for embedded iframe sources to prevent malicious content, adding a new ALLOWED_IFRAME_SOURCES configuration option.