Outline 1.11.0 → 1.12.0
1 release · 0 breaking changes · 5 security fixes · 5 advisories fixed
5security0breaking0deprecated40feature0fix
Vulnerabilities fixed by this upgrade
- 6.5 GHSA-h6ff-rw9x-5mq2 Authenticated members can publish documents into private collections through a retained parent link
- low GHSA-cprf-crfh-w3p4 Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)
- low GHSA-rvj7-2gww-6xfq Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member
- 7.5 GHSA-rq53-m97j-f2pg Unpublished documents remain publicly accessible and their shares cannot be revoked
- 3.1 GHSA-x4w3-9p9j-cprh users.update_role reveals whether a user id from another team exists and which role it has
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-rq53-m97j-f2pg: Unpublished documents remain publicly accessible and their shares cannot be revoked in 1.12.0
- security Fixes GHSA-h6ff-rw9x-5mq2: Authenticated members can publish documents into private collections through a retained parent link in 1.12.0
- security Fixes GHSA-x4w3-9p9j-cprh: users.update_role reveals whether a user id from another team exists and which role it has in 1.12.0
- security Fixes GHSA-cprf-crfh-w3p4: Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed) in 1.12.0
- security Fixes GHSA-rvj7-2gww-6xfq: Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member in 1.12.0
Every release in between
securityFixes GHSA-rq53-m97j-f2pg: Unpublished documents remain publicly accessible and their shares cannot be revoked
securityFixes GHSA-h6ff-rw9x-5mq2: Authenticated members can publish documents into private collections through a retained parent link
securityFixes GHSA-x4w3-9p9j-cprh: users.update_role reveals whether a user id from another team exists and which role it has
securityFixes GHSA-cprf-crfh-w3p4: Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)
securityFixes GHSA-rvj7-2gww-6xfq: Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member
featureEvery user now has a personal section for private documents in the sidebar https://github.com/outline/outline/pull/14187 (Admins can disable in settings)
featureDrag and drop in the sidebar was rebuilt to be more responsive
featureMermaid diagrams are now faster, much prettier, and responsive as they are rendered with Pele -
featurePasskey login is now possible inside the desktop app (Make sure you're running the latest version) https://github.com/outline/outline/pull/14241 https://github.com/outline/outline/pull/14242
featureAdded a tool to show what changed in a document
featureThe MCP SDK has been upgraded to v2 with support for the 2026-07-28 protocol
featureEditor UI now renders from observable state instead of forceUpdate
featureShare popover and document meta chunks are now preloaded on predicted intent
featureThe document is no longer restyled on every frame of the sidebar animation
featureNotification counts no longer use default scope joins
featureEmpty unfurl results are now remembered on the client
featureThe text column is now skipped when loading document lists
featurePermanent Iframely errors are now cached for an hour
featureTyping in large code blocks is faster
featureSearchIndexProcessor jobs are no longer queued for the Postgres provider
featureSlackProcessor now waits for a summary only after cheap checks pass
featureReduced traversals and skipped unneeded work in ProsemirrorHelper
featureAttachments are now loaded in one query when signing urls in text
featureComment view lookups are now batched and email diff clipping is memoized
featureOnly the patched path is now copied when recreating transforms
featureTables can now be placed inside notices
featureCode block line numbers can now be shown alongside line wrapping
featureThe mobile sidebar can now be closed with a drag, and header controls are touch-friendly
featureEmails now support one-click unsubscribe (RFC 8058)
featureA warning is now shown when theme colors have low contrast
featureHeadings are now weighted above body text in shared document search
featurePostgres search now retries as a quoted query when there are no results
featureSlab imports now resolve cross-links and import Slab-hosted attachments
featureAdded a "Manage templates" link to the Templates menu
featureVideo nodes now have a selection toolbar
featureUploads now render with the same component as the uploaded node
featureAlt+click now expands all in the document explorer
featureDocument update emails now list all contributors
featureComment webhook payloads now include collectionId in the payload
featureNotices now have softer colors with matching menu icons
+61 more items in the release notes