Outline 1.10.1 → 1.12.0

2 releases · 0 breaking changes · 12 security fixes · 12 advisories fixed

12security0breaking0deprecated80feature0fix

Is 1.10.1 affected?

Vulnerabilities fixed by this upgrade

6.5 GHSA-h6ff-rw9x-5mq2 Authenticated members can publish documents into private collections through a retained parent link
low GHSA-cprf-crfh-w3p4 Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)
low GHSA-rvj7-2gww-6xfq Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member
7.5 GHSA-rq53-m97j-f2pg Unpublished documents remain publicly accessible and their shares cannot be revoked
3.1 GHSA-x4w3-9p9j-cprh users.update_role reveals whether a user id from another team exists and which role it has
8.3 GHSA-m9vh-j2wc-xj24 Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner)
high GHSA-97vv-f6qq-6842 Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence
critical GHSA-48rq-wx9j-g949 Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login)
4.9 GHSA-27h6-gg7j-wj5w Cross-tenant authorization gap in the GitLab integration inbound-webhook handler
critical GHSA-f28f-75h4-499q Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback
8.1 GHSA-w8vg-8mjx-xq8x Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets
medium GHSA-65xg-84g9-7hrm Existing collaboration connection remains writable after document archive or deletion

Breaking changes

None in the release notes.

Security changes

security Fixes GHSA-rq53-m97j-f2pg: Unpublished documents remain publicly accessible and their shares cannot be revoked in 1.12.0
security Fixes GHSA-h6ff-rw9x-5mq2: Authenticated members can publish documents into private collections through a retained parent link in 1.12.0
security Fixes GHSA-x4w3-9p9j-cprh: users.update_role reveals whether a user id from another team exists and which role it has in 1.12.0
security Fixes GHSA-cprf-crfh-w3p4: Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed) in 1.12.0
security Fixes GHSA-rvj7-2gww-6xfq: Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member in 1.12.0
security Fixes GHSA-m9vh-j2wc-xj24: Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner) in 1.11.0
security Fixes GHSA-w8vg-8mjx-xq8x: Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets in 1.11.0
security Fixes GHSA-27h6-gg7j-wj5w: Cross-tenant authorization gap in the GitLab integration inbound-webhook handler in 1.11.0
security Fixes GHSA-97vv-f6qq-6842: Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence in 1.11.0
security Fixes GHSA-48rq-wx9j-g949: Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login) in 1.11.0
security Fixes GHSA-f28f-75h4-499q: Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback in 1.11.0
security Fixes GHSA-65xg-84g9-7hrm: Existing collaboration connection remains writable after document archive or deletion in 1.11.0

Every release in between

1.12.0 Oct 23, 2026 Release notes ↗

securityFixes GHSA-rq53-m97j-f2pg: Unpublished documents remain publicly accessible and their shares cannot be revoked

securityFixes GHSA-h6ff-rw9x-5mq2: Authenticated members can publish documents into private collections through a retained parent link

securityFixes GHSA-x4w3-9p9j-cprh: users.update_role reveals whether a user id from another team exists and which role it has

securityFixes GHSA-cprf-crfh-w3p4: Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)

securityFixes GHSA-rvj7-2gww-6xfq: Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member

featureEvery user now has a personal section for private documents in the sidebar https://github.com/outline/outline/pull/14187 (Admins can disable in settings)

featureDrag and drop in the sidebar was rebuilt to be more responsive

featureMermaid diagrams are now faster, much prettier, and responsive as they are rendered with Pele -

featurePasskey login is now possible inside the desktop app (Make sure you're running the latest version) https://github.com/outline/outline/pull/14241 https://github.com/outline/outline/pull/14242

featureAdded a tool to show what changed in a document

featureThe MCP SDK has been upgraded to v2 with support for the 2026-07-28 protocol

featureEditor UI now renders from observable state instead of forceUpdate

featureShare popover and document meta chunks are now preloaded on predicted intent

featureThe document is no longer restyled on every frame of the sidebar animation

featureNotification counts no longer use default scope joins

featureEmpty unfurl results are now remembered on the client

featureThe text column is now skipped when loading document lists

featurePermanent Iframely errors are now cached for an hour

featureTyping in large code blocks is faster

featureSearchIndexProcessor jobs are no longer queued for the Postgres provider

featureSlackProcessor now waits for a summary only after cheap checks pass

featureReduced traversals and skipped unneeded work in ProsemirrorHelper

featureAttachments are now loaded in one query when signing urls in text

featureComment view lookups are now batched and email diff clipping is memoized

featureOnly the patched path is now copied when recreating transforms

featureTables can now be placed inside notices

featureCode block line numbers can now be shown alongside line wrapping

featureThe mobile sidebar can now be closed with a drag, and header controls are touch-friendly

featureEmails now support one-click unsubscribe (RFC 8058)

featureA warning is now shown when theme colors have low contrast

featureHeadings are now weighted above body text in shared document search

featurePostgres search now retries as a quoted query when there are no results

featureSlab imports now resolve cross-links and import Slab-hosted attachments

featureAdded a "Manage templates" link to the Templates menu

featureVideo nodes now have a selection toolbar

featureUploads now render with the same component as the uploaded node

featureAlt+click now expands all in the document explorer

featureDocument update emails now list all contributors

featureComment webhook payloads now include collectionId in the payload

featureNotices now have softer colors with matching menu icons

+61 more items in the release notes

1.11.0 Oct 12, 2026 Release notes ↗

securityFixes GHSA-m9vh-j2wc-xj24: Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner)

securityFixes GHSA-w8vg-8mjx-xq8x: Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets

securityFixes GHSA-27h6-gg7j-wj5w: Cross-tenant authorization gap in the GitLab integration inbound-webhook handler

securityFixes GHSA-97vv-f6qq-6842: Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence

securityFixes GHSA-48rq-wx9j-g949: Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login)

securityFixes GHSA-f28f-75h4-499q: Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback

securityFixes GHSA-65xg-84g9-7hrm: Existing collaboration connection remains writable after document archive or deletion

featureA drag handle is now available on all root-level blocks

featureAlt+Up/Down now moves to the previous or next document in the sidebar

featureDocuments and collections can now record a reason for being archived or deleted

featureAdded Open Knowledge Format (OKF) import

featureGroups can now optionally have an icon and color

featureThe desktop app now shows a toast with actions when a file download completes

featureAvoided an N+1 query in share subscription notifications

featuredocumentCollaborativeUpdater now does its computation outside the transaction

featureThe loading bar now animates with transform

featurePlaceholder candidates are now filtered before conditions are evaluated

featureEditor decorations are now mapped through inline edits instead of rebuilt

featureDocument sidebar panels now stay mounted with React Activity

featureStore filter methods are now memoized

featureSimple read-only comments now render without an editor view

featureDocument row menus and tooltips are now deferred until interaction

featureRemoved redundant queries from document API routes

featuredocumentStructure is now excluded from the collections.list query

featureReduced query cost and reparsing in the comments API

featureProsemirror parsing is now memoized in DocumentHelper

featureTemplates are now loaded on demand

featureThe statement timeout is now sent in the same round trip as the transaction start

featureThe recently viewed documents query is faster

featureUpdating the collection structure no longer loads full subtrees

featureSidebar document trees are now virtualized

featureReduced editor mount cost

featureOpening a document from the sidebar now uses less main-thread time

featureSidebar section headers now have menus

featureThe child document list now supports multi-select

featureUsers are now notified when added to or removed from a group

featureBreadcrumbs are now shown in hovercards

featureLine-height is now adjusted for Chinese, Japanese and Korean documents

featureDate mentions are now formatted per locale

featureGmail and Outlook links are now shown after an email sign-in request

+106 more items in the release notes