Outline 1.6.1 → 1.9.2
7 releases · 1 breaking change · 7 security fixes · 9 advisories fixed
7security1breaking0deprecated93feature99fix
Vulnerabilities fixed by this upgrade
- 4.3 GHSA-x92r-w4r2-vwmf Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info
- high CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy
- 4.9 GHSA-33jq-x32c-3ccw Webhook subscription persists after creator's account deletion
- 5.8 CVE-2026-44695 Slack OAuth state can link a victim Outline account to an attacker Slack identity
- 8.7 CVE-2026-43888 Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import
- 6.5 CVE-2026-43889 Unauthorized Document Publication via Mixed collectionId+documentId Share
- 4.3 GHSA-hqmp-r5jw-265r Attachment Preset Size-Limit Bypass and Storage Accounting Corruption in Local-Storage Mode
- 4.3 GHSA-rg3q-3m93-rq7m Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service
- 7.7 CVE-2026-41649 IDOR in document share creation allows unauthorized access to private documents across workspaces
Breaking changes
- breaking Removed an N+1 query in documents.search – https://github.com/outline/outline/pull/12540 in 1.8.0
Security changes
- security Fixes GHSA-x92r-w4r2-vwmf: Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info in 1.9.0
- security Fixes CVE-2026-44695: Slack OAuth state can link a victim Outline account to an attacker Slack identity in 1.7.1
- security Fixes CVE-2026-43888: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import in 1.7.0
- security Fixes CVE-2026-41649: IDOR in document share creation allows unauthorized access to private documents across workspaces in 1.7.0
- security Fixes CVE-2026-43889: Unauthorized Document Publication via Mixed collectionId+documentId Share in 1.7.0
- security Fixes GHSA-hqmp-r5jw-265r: Attachment Preset Size-Limit Bypass and Storage Accounting Corruption in Local-Storage Mode in 1.7.0
- security Fixes GHSA-rg3q-3m93-rq7m: Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service in 1.7.0
Every release in between
featureAdded "query" parameter to templates.list API endpoint
otherDeleting failed and expired exports now possible
fixFloating toolbar in template settings no longer overlaps sidebar
fix"Mermaid" no longer appears twice in language picker
fix"Reset theme" control correctly updates input value
fixErrored mermaid diagram no longer zoomable
fixDebounced search query persistence
fixMultiple fixes for comment gutter mark behavior and scroll-to-comment
fixSearch queries from MCP are now recorded
fixConsistent usage of configured proxy with auth providers
fixDocker image no longer includes test fixtures
fixMCP can now upload files with local storage method
fixImage dimensions editable in editor again
fixFocusing starred link no longer scrolls to original location
fixFixed indent of group-shared document children
fixFull keyspace is now used for email verification codes
fixOption to invite existing user not in doc
fixFixed 502 on sign-in from oversized id_token cookie using OIDC (#12986)
featureAdded importer support for Slab
featureAdded support for rgb, hsl swatches
featureNew sidebarHidden query option
featureEmpty list tool results in MCP now return improved responses
featureUnfurl previews for heading links are now aware of heading links
featureAdded comment marks in editor gutter
fixLong code words no longer cause comment bound overflow
fixDesktop sign-in supported for self-hosted deployments
fixFix image overflow in table cells
fixAnother fix for foreignObject sizing in Mermaid diagrams
fixPrevent collapsed sidebar opening during text selection
fixImproved fast-click behavior in sidebar
fixComments menu now works correctly when triggered from a document list
fixService worker loading
securityFixes GHSA-x92r-w4r2-vwmf: Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info
featureDate mentions are now supported
featureLogin with Passkey is now supported on desktop
featureMarkdown input such as --- now work after a soft-break
featureAdded document restore tool
featureAdd HTML input support to `create_document tool
featureAdd WWW-Authenticate header to /mcp 401 responses
featureTable menus in editor were improved and now include alignment options for rows
featureAdded support for Slack-style +:100: reaction shorthand
featureAdded PROXY_HEADERS_TRUSTED env option (defaults to true)
featureCloudFront support for signed attachment URLs
featureTable sorting is now IP-address aware
featureSmall images can now be displayed inline for iconography
featureAdded support for presigned PUT uploads for S3-compatible storage
featureImage corner drag resizing is now enabled
featureAdded spec-compliant OIDC logout
featureAdd support for OIDC provider returning JWT from userinfo endpoint
fixPDF display now correctly scales on mobile
fixplace cursor at start of inserted table row/column
fixImprove patch merging of links in table cells through MCP
fixCode blocks auto-collapse while editing
fixSpurious post-import edits
fixBefore/After creation options appear in menu when no permission on parent doc
fixUpdated validateUrlNotPrivate to match implementation in SSRF
fixWiden validated emails for Azure
fixPasted content sometimes appears in plaintext
fixDragging images in editor
fixperf: Improve performance of in-page search
fixPrevent selecting word-joiner characters around multiplayer cursor
fixReject collections.update requests that include both description and data in payload
fixImprove markdown serialization speed
fixEditor math block parsing and NaN media dimensions
fixToggling a nested list no longer converts parent lists
fixDuplicate paths in export ZIP
fixDate mentions
fixComment thread animations
fixNested list behavior
fixVarious checkbox fixes
fixperf: Server startup time
fixTracking of block toolbars
+64 more items in the release notesfeatureDrag-and-drop now supports dragging from document lists
featureAdd admin interface to change user avatars
featureAdd automatic metrics tagging of outgoing emails
featureVarious improvements to mobile styling and layout https://github.com/outline/outline/pull/12576
fixFixed search term highlights missing on navigation from search
fixFixed an intermitent issue where sidebar element is not correctly active on first load
fixScrollbar no longer causes horizontal movement in comments sidebar
fixAdded protection against timing attacks on notification unsubscribe endpoints
fixIcon picker is no longer auto-closed on choice
fixAccess requests can now be approved by collection managers
fixCollection title and icon inline are now editable like documents
fixIncreased valid user-supplied URL length to 1024
fixAdded handling of unhandled server error in MCP route
fixFixed sticky table header styling in Safari
fixPrivate IP lookup is now invalid request rather than internal error
fixImproved worker performance through caching
fixchore: Improve handling of "expected" network errors from webhooks
fixMermaid is no longer persisted as last used coding language
fixFixed collaboratorIds iterable error when handling very old documents
fixFixed correct support for hard break serialization for commonMark
fixAdded email verification check during sign-in flow
featureMembers can now request access to documents they don't have permission to view – https://github.com/outline/outline/pull/10825
featureComments are now available in the image lightbox, making it easier to discuss visuals in context – https://github.com/outline/outline/pull/12335
featureAdded a fullWidth parameter to create_document and update_document, by @toralux – https://github.com/outline/outline/pull/12338
fixFixed an issue where updating a collection description via MCP wouldn't persist – https://github.com/outline/outline/pull/12410
featureCode blocks are now supported inside comments – https://github.com/outline/outline/pull/12480
featureAdded a system preference to open the desktop app automatically on startup – https://github.com/outline/outline/pull/12279
featureViewers can now create and use API keys – https://github.com/outline/outline/pull/12278
featureMentioned users are now automatically subscribed to the document – https://github.com/outline/outline/pull/12235
featureThe command menu now shows breadcrumbs alongside documents to make results easier to disambiguate – https://github.com/outline/outline/pull/12403
featureYou can now format the word at the cursor with the associated shortcut without needing to select it first – https://github.com/outline/outline/pull/12492
featureSelf-hosted instances can now use HTTP webhook URLs – https://github.com/outline/outline/pull/12499
featureDelete confirmation dialogs now use a segmented-style input – https://github.com/outline/outline/pull/12495
featureImages pasted as data URIs are now supported – https://github.com/outline/outline/pull/12294
featureThe icon picker is now responsive and easier to use on mobile – https://github.com/outline/outline/pull/12275
featureNotifications now open in a mobile drawer on small screens – https://github.com/outline/outline/pull/12276
featureReduced minimum table column width to 25px for tighter layouts – https://github.com/outline/outline/pull/12269
featureHyphenated words are now treated as a single unit when diffing changes – https://github.com/outline/outline/pull/11272
featureHover previews now trigger while the editor is focused – https://github.com/outline/outline/pull/12545
featureThe settings sidebar is no longer collapsible – https://github.com/outline/outline/pull/12460
featureHardened OAuth scope validation – https://github.com/outline/outline/pull/12490
featureAdded Catalan as a language option – https://github.com/outline/outline/pull/12454
featureThousands of new community translations
featureAdded missing indexes on foreign keys referencing documents – https://github.com/outline/outline/pull/12473
breakingRemoved an N+1 query in documents.search – https://github.com/outline/outline/pull/12540
fixDocument text can now be selected in version history – https://github.com/outline/outline/pull/12268
fixFixed search highlights not rendering in Firefox – https://github.com/outline/outline/pull/12273
fixResolved console warnings for the rtl DOM attribute and an untracked MobX read – https://github.com/outline/outline/pull/12284
fixOutline now only preconnects to S3 when it's actually in use, by @marksteward – https://github.com/outline/outline/pull/12298
fixImproved handling of additional client-aborted error types – https://github.com/outline/outline/pull/12303
fixShort-circuited common scanner and crawler routes – https://github.com/outline/outline/pull/12306
fixFixed a crash when file storage environment variables are misconfigured – https://github.com/outline/outline/pull/12325
fixPrinting no longer includes an extra blank page – https://github.com/outline/outline/pull/12326
fixDocument deletes are now batched when emptying trash – https://github.com/outline/outline/pull/12328
fixUpgraded Mermaid to 11.15.0 – https://github.com/outline/outline/pull/12331
fixTable cell selection no longer appears in print output – https://github.com/outline/outline/pull/12334
fixFixed Mermaid diagrams not rendering correctly inside toggle blocks – https://github.com/outline/outline/pull/12343
fixCode blocks now automatically expand when a find result is inside – https://github.com/outline/outline/pull/12346
fixMermaid diagrams now appear correctly in light theme when printing from dark theme – https://github.com/outline/outline/pull/12342
fixFixed authorization providers not being correctly disabled via environment variables – https://github.com/outline/outline/pull/12349
fixImproved the resilience of the Markdown importer – https://github.com/outline/outline/pull/12357
+71 more items in the release notessecurityFixes CVE-2026-44695: Slack OAuth state can link a victim Outline account to an attacker Slack identity
featureMCP responses now include breadcrumbs (), summaries (), and title guidance ()
featureMCP now has delete_document and delete_collection tools ()
featurePer-share branding lets you override the title and logo on individual public shares ()
featureWhen navigating to document from search results there is now a UI element to clear search highlights ()
featureOAuth account linking flows refactored ()
featureSelf-hosted instances can now tune rate limiting with the new RATE_LIMITER_MULTIPLIER configuration option ()
featureDefault model creation rate limits raised from 10/min to 25/min ()
featureImproved table-of-contents positioning on shared documents ()
featureImproved sidebar performance ()
featureAdded a Redis healthcheck for better monitoring and resilience ()
fixShift-Tab on a list item inside a toggle block no longer outdents the entire block ()
fixCode blocks now expand correctly when printing ()
fixAPI keys created with global read/write scope are now saved correctly ()
fixRepublishing a document now updates lastModifiedById as expected ()
fixSuspended users are no longer counted toward the cached group member count ()
fixPost-login redirects with invalid paths are now handled correctly in Firefox ()
fixFixed incorrect Mod-ArrowLeft behavior inside heading nodes in Firefox ()
fixAutofocus now works inside lazy-loaded modals and popovers ()
fixStricter validation on table attributes () and the subscription creation endpoint ()
fixResolved a parseXML error originating from the AWS SDK ()
fixMany dependency updates
securityFixes CVE-2026-43888: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import
securityFixes CVE-2026-41649: IDOR in document share creation allows unauthorized access to private documents across workspaces
securityFixes CVE-2026-43889: Unauthorized Document Publication via Mixed collectionId+documentId Share
securityFixes GHSA-hqmp-r5jw-265r: Attachment Preset Size-Limit Bypass and Storage Accounting Corruption in Local-Storage Mode
securityFixes GHSA-rg3q-3m93-rq7m: Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service
featureExpanded MCP capabilities with patch support, improved tree hierarchy reading, configurable workspace guidance, a create_attachment tool, simplified mention syntax, and richer comment tool responses ()
featureAdded email subscriptions to public documents so readers can follow along with updates, including diffs in notifications ()
featureIntroduced a redesigned document history with the ability to compare any two revisions side-by-side ()
featureAdded full right-to-left (RTL) layout support for languages such as Hebrew and Arabic ()
featureAdded a command bar search to public shares with quick access to recently viewed documents ()
featureAdded a recent documents menu in the desktop app for faster navigation ()
featureLong code blocks now auto-collapse to keep documents easier to scan ()
featureLinks now show previews on hover in shared documents ()
featureAdded keyboard access to Mermaid diagram editing and various other mermaid improvements ()
featureAdded a role preference for collection template management ()
featureAdded a group members popover in share search suggestions ()
featureHighlighted commented images in documents to make comments easier to find ()
featureAdded support for Docker Swarm style secrets ()
featureShare popover data is now preloaded on hover for a snappier experience ()
featureAdded context menus to document breadcrumb items ()
featureSearch highlights now use native CSS highlights where available for better performance ()
featureWelcome email is now sent via a background processor ()
featureRemoved auto creation of share links; shares must now be created explicitly ()
featureKeyboard shortcuts are now displayed in menus where available ()
featureCopying a document now preserves the fullWidth property ()
featureAllowed replacing custom emoji images ()
featureAdded max character count indicators to inputs ()
featureAdded a cmd+k shortcut hint to the search input ()
featureAdded a suppressEmail argument when inviting users through the API ()
featureAdded missing controls to starred documents ()
featureMapped document creators to existing users during JSON import ()
featureAdded hex color swatch previews ()
featureAllowed geo:, maps:, and magnet: link protocols ()
featureMoved API Keys and Webhook settings into filterable tables ()
featureVarious mobile breakpoint improvements ()
featureReduced Sentry noise from expected errors, crawler traffic, and upload network issues ()
featureStaggered scheduled cleanup tasks to reduce load spikes ()
featureImproved search indexing via a performance optimization that removes an unnecessary location subscription ()
featureNew translations ()
fixFixed suggestion menus being blocked by placeholder marks ()
+54 more items in the release notes