Outline 1.6.0 → 1.11.0
11 releases · 1 breaking change · 7 security fixes · 9 advisories fixed
7security1breaking0deprecated179feature144fix
Vulnerabilities fixed by this upgrade
- 4.3 GHSA-x92r-w4r2-vwmf Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info
- high CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy
- 4.9 GHSA-33jq-x32c-3ccw Webhook subscription persists after creator's account deletion
- 5.8 CVE-2026-44695 Slack OAuth state can link a victim Outline account to an attacker Slack identity
- 8.7 CVE-2026-43888 Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import
- 6.5 CVE-2026-43889 Unauthorized Document Publication via Mixed collectionId+documentId Share
- 4.3 GHSA-hqmp-r5jw-265r Attachment Preset Size-Limit Bypass and Storage Accounting Corruption in Local-Storage Mode
- 4.3 GHSA-rg3q-3m93-rq7m Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service
- 7.7 CVE-2026-41649 IDOR in document share creation allows unauthorized access to private documents across workspaces
Breaking changes
- breaking Removed an N+1 query in documents.search – https://github.com/outline/outline/pull/12540 in 1.8.0
Security changes
- security Fixes GHSA-x92r-w4r2-vwmf: Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info in 1.9.0
- security Fixes CVE-2026-44695: Slack OAuth state can link a victim Outline account to an attacker Slack identity in 1.7.1
- security Fixes CVE-2026-43888: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import in 1.7.0
- security Fixes CVE-2026-41649: IDOR in document share creation allows unauthorized access to private documents across workspaces in 1.7.0
- security Fixes CVE-2026-43889: Unauthorized Document Publication via Mixed collectionId+documentId Share in 1.7.0
- security Fixes GHSA-hqmp-r5jw-265r: Attachment Preset Size-Limit Bypass and Storage Accounting Corruption in Local-Storage Mode in 1.7.0
- security Fixes GHSA-rg3q-3m93-rq7m: Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service in 1.7.0
Every release in between
featureA drag handle is now available on all root-level blocks
featureAlt+Up/Down now moves to the previous or next document in the sidebar
featureDocuments and collections can now record a reason for being archived or deleted
featureAdded Open Knowledge Format (OKF) import
featureGroups can now optionally have an icon and color
featureThe desktop app now shows a toast with actions when a file download completes
featureAvoided an N+1 query in share subscription notifications
featuredocumentCollaborativeUpdater now does its computation outside the transaction
featureThe loading bar now animates with transform
featurePlaceholder candidates are now filtered before conditions are evaluated
featureEditor decorations are now mapped through inline edits instead of rebuilt
featureDocument sidebar panels now stay mounted with React Activity
featureStore filter methods are now memoized
featureSimple read-only comments now render without an editor view
featureDocument row menus and tooltips are now deferred until interaction
featureRemoved redundant queries from document API routes
featuredocumentStructure is now excluded from the collections.list query
featureReduced query cost and reparsing in the comments API
featureProsemirror parsing is now memoized in DocumentHelper
featureTemplates are now loaded on demand
featureThe statement timeout is now sent in the same round trip as the transaction start
featureThe recently viewed documents query is faster
featureUpdating the collection structure no longer loads full subtrees
featureSidebar document trees are now virtualized
featureReduced editor mount cost
featureOpening a document from the sidebar now uses less main-thread time
featureSidebar section headers now have menus
featureThe child document list now supports multi-select
featureUsers are now notified when added to or removed from a group
featureBreadcrumbs are now shown in hovercards
featureLine-height is now adjusted for Chinese, Japanese and Korean documents
featureDate mentions are now formatted per locale
featureGmail and Outlook links are now shown after an email sign-in request
featureThe export menu now shows file extensions and the print shortcut
featureMaximum comment length has been increased to 10k characters
featureA code block that is most of the document is no longer auto-collapsed
featureThe find panel on mobile now has a close button and a two-line layout
featurecomments.update now accepts a text param
featureAdded a visible uncollapse sidebar button in the header
featureGroup descriptions are now synced, and groups are re-synced on SSO validation
+99 more items in the release notesfeatureAdded WebMCP support allowing agents in Chrome and ChatGPT to programmatically control Outline through the browser.
featureAdded Open Knowledge Format (OKF) export
featureAdd indexes on user foreign key columns
featureUpgraded Zod and enable schema compilation
featureHistory revision content now prefetched on hover in history sidebar
featureOptimized document queries by excluding content when not needed
fixAllowed editing webhooks without signing secrets
fixEscaped MCP attachment PUT upload command arguments
fixPrevented overlapping nested list markers
fixpreserve toggle fold state across remote and local document edits
fixFixed manual sizing of embedded PDFs
fixAdded missing transaction in GitLabIssueProvider
fixFixed Mermaid diagram rendering size issue
fixAlign attachment upload permissions
fixLoad revision content in document history
fixRevisions now show accurate stats
fixEditor crash when upload placeholder targets a position with no node
fixGuard null $cursor in toggle block
fixChild documents list empty until sidebar renders the collection
fixTighten authentication on views.create endpoint
fixMarkdown list dropped when a plain item precedes a checkbox item
fixAllow document mentions to wrap
fixValidate API key and OAuth scopes at the model layer
fixPersist comment sidebar open/close state across reloads
fixAllow dropping a document after an expanded subtree in the sidebar
fixHistory "Current version" entry never finishes loading
fixAuthStore.availableTeams never becomes observable
fixExpand folded toggle blocks when printing
fixSigned file downloads rejected when an API key lacks scope for the route
fixAuthStore.fetchConfig updates config outside a MobX action
fixprevious() on UserMembership and Star returned the next item
fixCrash opening the template editor
fixrobots.txt blocked crawlers from indexable shares on self-hosted installs
fixHistory changes indicator missing on load and stuck on "N changes"
fixRevision view does not re-render when late-loaded content arrives
fixLinks in view mode ignore modifier clicks, drag, and keyboard activation
fixMembers receive authorization error when importing a document
fixStop repeated requests after final table page
fixTable of contents clicks ignored while a search term is active
fixByte range handling for media in Safari
+3 more items in the release notesfeatureOpen two views in side-by-side split view from any menu or cmd+click
featureUsers with read-only access can now leave inline comments
featureAdded [[ trigger for mentioning or creating a document
featureDocuments can now be shown with numbered headings, as a display preference
featureSidebar sections can now be reordered by dragging their headers
featureLive document stats can now be displayed in the corner of the editor
featureDanish and Indonesian have been added to the available language options
featureColor swatches now have a hover card in the editor
featureWeb pages, Email (.eml), TextPack, and PDF files can now be imported https://github.com/outline/outline/pull/13235 https://github.com/outline/outline/pull/13302
featureThe sidebar menu and navigation tree are faster
featureServer memory usage is reduced, with container memory best practices documented
featureBoot migration check now runs as a separate process to reduce memory usage
featureDrag and drop re-rendering has been optimized
featureLocal content search through the command menu is much faster and more accurate
featureNested policies are now briefly cached on the server
featureMarkdown import merge now uses an O(1) title lookup
featureThe revisions.list endpoint now loads less data
featurefindByPk now requires fewer database connections
featureRoute chunks are now preloaded on sidebar hover intent
featureSearch no longer needs to join on memberships
featureSearch queries are now faster
featureThe popularity score scan is now index-friendly and spread over an hour
featureRelationships are no longer fetched for newly created documents
featureCreating a new document is faster
featureCollection structure locks now use FOR NO KEY UPDATE
featureThe document row lock is now taken after text processing
featureDeleting a document subtree no longer triggers N+1 queries
featureMermaid is no longer part of the initial bundle
featureBrowser tracing now sends fewer spans to Sentry
featureRevision diffs are now skipped when they are too expensive to compute
featureFontAwesome icon packs are no longer eagerly loaded
featureLoading of y-prosemirror has been reworked
featureThe PWA precache is now limited and the service worker is skipped on share views
featureSmall images are now inlined as base64 into exported HTML
featureA cleanup job now trims search_queries to match event log retention
featureBacklinks and References now have a context menu
featureSocket management has moved from the client to the server
featureStreaming file outputs now pass through correctly
featureThe output stream is now attached before zip entries are added
featureExport emails now say how many days remain until the download expires
+250 more items in the release notesfeatureAdded "query" parameter to templates.list API endpoint
otherDeleting failed and expired exports now possible
fixFloating toolbar in template settings no longer overlaps sidebar
fix"Mermaid" no longer appears twice in language picker
fix"Reset theme" control correctly updates input value
fixErrored mermaid diagram no longer zoomable
fixDebounced search query persistence
fixMultiple fixes for comment gutter mark behavior and scroll-to-comment
fixSearch queries from MCP are now recorded
fixConsistent usage of configured proxy with auth providers
fixDocker image no longer includes test fixtures
fixMCP can now upload files with local storage method
fixImage dimensions editable in editor again
fixFocusing starred link no longer scrolls to original location
fixFixed indent of group-shared document children
fixFull keyspace is now used for email verification codes
fixOption to invite existing user not in doc
fixFixed 502 on sign-in from oversized id_token cookie using OIDC (#12986)
featureAdded importer support for Slab
featureAdded support for rgb, hsl swatches
featureNew sidebarHidden query option
featureEmpty list tool results in MCP now return improved responses
featureUnfurl previews for heading links are now aware of heading links
featureAdded comment marks in editor gutter
fixLong code words no longer cause comment bound overflow
fixDesktop sign-in supported for self-hosted deployments
fixFix image overflow in table cells
fixAnother fix for foreignObject sizing in Mermaid diagrams
fixPrevent collapsed sidebar opening during text selection
fixImproved fast-click behavior in sidebar
fixComments menu now works correctly when triggered from a document list
fixService worker loading
securityFixes GHSA-x92r-w4r2-vwmf: Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info
featureDate mentions are now supported
featureLogin with Passkey is now supported on desktop
featureMarkdown input such as --- now work after a soft-break
featureAdded document restore tool
featureAdd HTML input support to `create_document tool
featureAdd WWW-Authenticate header to /mcp 401 responses
featureTable menus in editor were improved and now include alignment options for rows
featureAdded support for Slack-style +:100: reaction shorthand
featureAdded PROXY_HEADERS_TRUSTED env option (defaults to true)
featureCloudFront support for signed attachment URLs
featureTable sorting is now IP-address aware
featureSmall images can now be displayed inline for iconography
featureAdded support for presigned PUT uploads for S3-compatible storage
featureImage corner drag resizing is now enabled
featureAdded spec-compliant OIDC logout
featureAdd support for OIDC provider returning JWT from userinfo endpoint
fixPDF display now correctly scales on mobile
fixplace cursor at start of inserted table row/column
fixImprove patch merging of links in table cells through MCP
fixCode blocks auto-collapse while editing
fixSpurious post-import edits
fixBefore/After creation options appear in menu when no permission on parent doc
fixUpdated validateUrlNotPrivate to match implementation in SSRF
fixWiden validated emails for Azure
fixPasted content sometimes appears in plaintext
fixDragging images in editor
fixperf: Improve performance of in-page search
fixPrevent selecting word-joiner characters around multiplayer cursor
fixReject collections.update requests that include both description and data in payload
fixImprove markdown serialization speed
fixEditor math block parsing and NaN media dimensions
fixToggling a nested list no longer converts parent lists
fixDuplicate paths in export ZIP
fixDate mentions
fixComment thread animations
fixNested list behavior
fixVarious checkbox fixes
fixperf: Server startup time
fixTracking of block toolbars
+64 more items in the release notesfeatureDrag-and-drop now supports dragging from document lists
featureAdd admin interface to change user avatars
featureAdd automatic metrics tagging of outgoing emails
featureVarious improvements to mobile styling and layout https://github.com/outline/outline/pull/12576
fixFixed search term highlights missing on navigation from search
fixFixed an intermitent issue where sidebar element is not correctly active on first load
fixScrollbar no longer causes horizontal movement in comments sidebar
fixAdded protection against timing attacks on notification unsubscribe endpoints
fixIcon picker is no longer auto-closed on choice
fixAccess requests can now be approved by collection managers
fixCollection title and icon inline are now editable like documents
fixIncreased valid user-supplied URL length to 1024
fixAdded handling of unhandled server error in MCP route
fixFixed sticky table header styling in Safari
fixPrivate IP lookup is now invalid request rather than internal error
fixImproved worker performance through caching
fixchore: Improve handling of "expected" network errors from webhooks
fixMermaid is no longer persisted as last used coding language
fixFixed collaboratorIds iterable error when handling very old documents
fixFixed correct support for hard break serialization for commonMark
fixAdded email verification check during sign-in flow
featureMembers can now request access to documents they don't have permission to view – https://github.com/outline/outline/pull/10825
featureComments are now available in the image lightbox, making it easier to discuss visuals in context – https://github.com/outline/outline/pull/12335
featureAdded a fullWidth parameter to create_document and update_document, by @toralux – https://github.com/outline/outline/pull/12338
fixFixed an issue where updating a collection description via MCP wouldn't persist – https://github.com/outline/outline/pull/12410
featureCode blocks are now supported inside comments – https://github.com/outline/outline/pull/12480
featureAdded a system preference to open the desktop app automatically on startup – https://github.com/outline/outline/pull/12279
featureViewers can now create and use API keys – https://github.com/outline/outline/pull/12278
featureMentioned users are now automatically subscribed to the document – https://github.com/outline/outline/pull/12235
featureThe command menu now shows breadcrumbs alongside documents to make results easier to disambiguate – https://github.com/outline/outline/pull/12403
featureYou can now format the word at the cursor with the associated shortcut without needing to select it first – https://github.com/outline/outline/pull/12492
featureSelf-hosted instances can now use HTTP webhook URLs – https://github.com/outline/outline/pull/12499
featureDelete confirmation dialogs now use a segmented-style input – https://github.com/outline/outline/pull/12495
featureImages pasted as data URIs are now supported – https://github.com/outline/outline/pull/12294
featureThe icon picker is now responsive and easier to use on mobile – https://github.com/outline/outline/pull/12275
featureNotifications now open in a mobile drawer on small screens – https://github.com/outline/outline/pull/12276
featureReduced minimum table column width to 25px for tighter layouts – https://github.com/outline/outline/pull/12269
featureHyphenated words are now treated as a single unit when diffing changes – https://github.com/outline/outline/pull/11272
featureHover previews now trigger while the editor is focused – https://github.com/outline/outline/pull/12545
featureThe settings sidebar is no longer collapsible – https://github.com/outline/outline/pull/12460
featureHardened OAuth scope validation – https://github.com/outline/outline/pull/12490
featureAdded Catalan as a language option – https://github.com/outline/outline/pull/12454
featureThousands of new community translations
featureAdded missing indexes on foreign keys referencing documents – https://github.com/outline/outline/pull/12473
breakingRemoved an N+1 query in documents.search – https://github.com/outline/outline/pull/12540
fixDocument text can now be selected in version history – https://github.com/outline/outline/pull/12268
fixFixed search highlights not rendering in Firefox – https://github.com/outline/outline/pull/12273
fixResolved console warnings for the rtl DOM attribute and an untracked MobX read – https://github.com/outline/outline/pull/12284
fixOutline now only preconnects to S3 when it's actually in use, by @marksteward – https://github.com/outline/outline/pull/12298
fixImproved handling of additional client-aborted error types – https://github.com/outline/outline/pull/12303
fixShort-circuited common scanner and crawler routes – https://github.com/outline/outline/pull/12306
fixFixed a crash when file storage environment variables are misconfigured – https://github.com/outline/outline/pull/12325
fixPrinting no longer includes an extra blank page – https://github.com/outline/outline/pull/12326
fixDocument deletes are now batched when emptying trash – https://github.com/outline/outline/pull/12328
fixUpgraded Mermaid to 11.15.0 – https://github.com/outline/outline/pull/12331
fixTable cell selection no longer appears in print output – https://github.com/outline/outline/pull/12334
fixFixed Mermaid diagrams not rendering correctly inside toggle blocks – https://github.com/outline/outline/pull/12343
fixCode blocks now automatically expand when a find result is inside – https://github.com/outline/outline/pull/12346
fixMermaid diagrams now appear correctly in light theme when printing from dark theme – https://github.com/outline/outline/pull/12342
fixFixed authorization providers not being correctly disabled via environment variables – https://github.com/outline/outline/pull/12349
fixImproved the resilience of the Markdown importer – https://github.com/outline/outline/pull/12357
+71 more items in the release notessecurityFixes CVE-2026-44695: Slack OAuth state can link a victim Outline account to an attacker Slack identity
featureMCP responses now include breadcrumbs (), summaries (), and title guidance ()
featureMCP now has delete_document and delete_collection tools ()
featurePer-share branding lets you override the title and logo on individual public shares ()
featureWhen navigating to document from search results there is now a UI element to clear search highlights ()
featureOAuth account linking flows refactored ()
featureSelf-hosted instances can now tune rate limiting with the new RATE_LIMITER_MULTIPLIER configuration option ()
featureDefault model creation rate limits raised from 10/min to 25/min ()
featureImproved table-of-contents positioning on shared documents ()
featureImproved sidebar performance ()
featureAdded a Redis healthcheck for better monitoring and resilience ()
fixShift-Tab on a list item inside a toggle block no longer outdents the entire block ()
fixCode blocks now expand correctly when printing ()
fixAPI keys created with global read/write scope are now saved correctly ()
fixRepublishing a document now updates lastModifiedById as expected ()
fixSuspended users are no longer counted toward the cached group member count ()
fixPost-login redirects with invalid paths are now handled correctly in Firefox ()
fixFixed incorrect Mod-ArrowLeft behavior inside heading nodes in Firefox ()
fixAutofocus now works inside lazy-loaded modals and popovers ()
fixStricter validation on table attributes () and the subscription creation endpoint ()
fixResolved a parseXML error originating from the AWS SDK ()
fixMany dependency updates
securityFixes CVE-2026-43888: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import
securityFixes CVE-2026-41649: IDOR in document share creation allows unauthorized access to private documents across workspaces
securityFixes CVE-2026-43889: Unauthorized Document Publication via Mixed collectionId+documentId Share
securityFixes GHSA-hqmp-r5jw-265r: Attachment Preset Size-Limit Bypass and Storage Accounting Corruption in Local-Storage Mode
securityFixes GHSA-rg3q-3m93-rq7m: Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service
featureExpanded MCP capabilities with patch support, improved tree hierarchy reading, configurable workspace guidance, a create_attachment tool, simplified mention syntax, and richer comment tool responses ()
featureAdded email subscriptions to public documents so readers can follow along with updates, including diffs in notifications ()
featureIntroduced a redesigned document history with the ability to compare any two revisions side-by-side ()
featureAdded full right-to-left (RTL) layout support for languages such as Hebrew and Arabic ()
featureAdded a command bar search to public shares with quick access to recently viewed documents ()
featureAdded a recent documents menu in the desktop app for faster navigation ()
featureLong code blocks now auto-collapse to keep documents easier to scan ()
featureLinks now show previews on hover in shared documents ()
featureAdded keyboard access to Mermaid diagram editing and various other mermaid improvements ()
featureAdded a role preference for collection template management ()
featureAdded a group members popover in share search suggestions ()
featureHighlighted commented images in documents to make comments easier to find ()
featureAdded support for Docker Swarm style secrets ()
featureShare popover data is now preloaded on hover for a snappier experience ()
featureAdded context menus to document breadcrumb items ()
featureSearch highlights now use native CSS highlights where available for better performance ()
featureWelcome email is now sent via a background processor ()
featureRemoved auto creation of share links; shares must now be created explicitly ()
featureKeyboard shortcuts are now displayed in menus where available ()
featureCopying a document now preserves the fullWidth property ()
featureAllowed replacing custom emoji images ()
featureAdded max character count indicators to inputs ()
featureAdded a cmd+k shortcut hint to the search input ()
featureAdded a suppressEmail argument when inviting users through the API ()
featureAdded missing controls to starred documents ()
featureMapped document creators to existing users during JSON import ()
featureAdded hex color swatch previews ()
featureAllowed geo:, maps:, and magnet: link protocols ()
featureMoved API Keys and Webhook settings into filterable tables ()
featureVarious mobile breakpoint improvements ()
featureReduced Sentry noise from expected errors, crawler traffic, and upload network issues ()
featureStaggered scheduled cleanup tasks to reduce load spikes ()
featureImproved search indexing via a performance optimization that removes an unnecessary location subscription ()
featureNew translations ()
fixFixed suggestion menus being blocked by placeholder marks ()
+54 more items in the release notesfixA bug affecting file and image upload in the editor was fixed
fixMCP: Now has tools to move documents within a collection
fixMCP: Now supports API key header authentication
fixAdded Tahoe-compatible icon variants for PWA
fixFixed a race condition when editing title while doc is saving would reset the title
fixPrint layout now respects full-width option
fixFixed a page hang with corrupted PNG upload
fixImproved validation of SMTP_FROM_EMAIL and SMTP_REPLY_EMAIL
fixCustom port is now preserved in OAuth metadata URLs when self-hosted behind a reverse proxy
fixIt is now possible to "Create a nested doc" when using @mention
fixAdded a guard against concurrent restore while deleting