Outline 1.7.1 → 1.12.0
9 releases · 1 breaking change · 37 security fixes · 39 advisories fixed
37security1breaking0deprecated175feature116fix
Vulnerabilities fixed by this upgrade
- 6.5 GHSA-h6ff-rw9x-5mq2 Authenticated members can publish documents into private collections through a retained parent link
- low GHSA-cprf-crfh-w3p4 Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)
- low GHSA-rvj7-2gww-6xfq Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member
- 7.5 GHSA-rq53-m97j-f2pg Unpublished documents remain publicly accessible and their shares cannot be revoked
- 3.1 GHSA-x4w3-9p9j-cprh users.update_role reveals whether a user id from another team exists and which role it has
- 8.3 GHSA-m9vh-j2wc-xj24 Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner)
- high GHSA-97vv-f6qq-6842 Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence
- critical GHSA-48rq-wx9j-g949 Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login)
- 4.9 GHSA-27h6-gg7j-wj5w Cross-tenant authorization gap in the GitLab integration inbound-webhook handler
- critical GHSA-f28f-75h4-499q Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback
- 8.1 GHSA-w8vg-8mjx-xq8x Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets
- medium GHSA-65xg-84g9-7hrm Existing collaboration connection remains writable after document archive or deletion
- medium GHSA-3jwc-gwg4-jqrq Attachment Import Preset Authorization Bypass
- medium GHSA-j99w-85jw-w4hx Account Identity Collision via Unverified Email Overwrite on SSO Re-Login (userProvisioner)
- 8.2 GHSA-rmv5-jh9q-899h Public share subscribers receive email copies of documents the share itself will not serve (incomplete fix of 12c71f267)
- 6.5 GHSA-m2h8-g6cf-42g7 Unauthorized disclosure of collection-less draft documents via relationships.list
- low GHSA-px83-2m6m-7frj Outline: Per-IP Share-Subscription Creation Limit Can Be Bypassed Indefinitely via the Stale-Unconfirmed Resend Path
- 5.3 GHSA-2jfj-rch9-whf4 documents.export writes the archive into the anonymously served public bucket when the document title contains path traversal (FILE_STORAGE=local)
- high GHSA-5h2f-gc77-r2j2 Race Condition / TOCTOU in Multiple Resource Limit Checks Allows Bypass of Quota Enforcement
- 8.7 GHSA-w826-vphp-43r6 Stored XSS via PDF attachment <embed> with unsanitized URL
- 4.3 GHSA-fjc7-xv59-m9jp relationships.list discloses inaccessible document UUIDs when no anchor ID is supplied
- 7.1 GHSA-6cv3-v7fh-v222 documents.import publishes into an arbitrary collection when parentDocumentId and collectionId are sent together (incomplete fix of fecca544f / GHSA-c43v-wwv4-9mcc)
- 5.3 GHSA-969g-q5r9-f9pr Incomplete fix for GHSA-fp2g-2283-rwvj: CSRF token is not session-bound and the verifier falls back to the non-prefixed cookie
- 6.5 GHSA-6mcq-gx87-gqrr Completed collection exports remain permanently downloadable by their creator after their access to the source collection is revoked
- 7.1 GHSA-593c-w8cr-c744 API key and OAuth token scopes are not enforced at the point of use (further instances of CVE-2026-54573)
- 4.3 GHSA-vfcq-7fxp-r7hf revisions.export authorizes listRevisions instead of download, so a Viewer can export revision markdown or HTML after admin disables ViewersCanExport, bypassing the Settings security export gate.
- 5.3 GHSA-4x5j-6wvp-fc3m suggestions.mention returns the full workspace user and group directory to guests, bypassing the listUsers and listGroups policies (incomplete fix of fa2c49878)
- 5.3 GHSA-cxh6-3jv2-9xcp Missing `await` disables comment-mark redaction on public shares, leaking internal user IDs to unauthenticated viewers
- medium GHSA-5r93-89wq-vx52 Route-level rate limits are bypassed wholesale via path case variations (koa-router case-insensitive matching vs raw-path limiter keying)
- medium GHSA-2cr5-465m-rwj9 Revoked Collaborators Retain Read/Write Access Through Existing Collaboration WebSocket Sessions
- 5.3 GHSA-wp3v-3485-f3r6 shares.info discloses the share creator's internal profile, including team role, to unauthenticated visitors
- 8.6 GHSA-2396-xfgx-jrq7 Read-scoped API keys and OAuth grants obtain a collaboration token from auth.info and write to every document over the collaboration websocket, which performs no scope check
- 4.3 GHSA-g9wp-qv3q-2548 revisions.list discloses metadata of soft-deleted documents to former readers
- high GHSA-q9p3-66p5-76wp SSRF protection bypass: IPv4-mapped IPv6 addresses classified as public (reaches cloud metadata / internal hosts)
- 6.5 GHSA-mf33-ppqw-97v5 Authorization Bypass in shares.create Allows Viewers to Retrieve Existing Public Share URLs
- 6.1 GHSA-m28f-fh92-c93w Pinterest embed host validation uses endsWith suffix match, allowing attacker-controlled hosts whose name ends with the literal substring "pinterest.com" to be rendered as legitimate Pinterest embeds on the Outline origin.
- 4.3 GHSA-x92r-w4r2-vwmf Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info
- high CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy
- 4.9 GHSA-33jq-x32c-3ccw Webhook subscription persists after creator's account deletion
Breaking changes
- breaking Removed an N+1 query in documents.search – https://github.com/outline/outline/pull/12540 in 1.8.0
Security changes
- security Fixes GHSA-rq53-m97j-f2pg: Unpublished documents remain publicly accessible and their shares cannot be revoked in 1.12.0
- security Fixes GHSA-h6ff-rw9x-5mq2: Authenticated members can publish documents into private collections through a retained parent link in 1.12.0
- security Fixes GHSA-x4w3-9p9j-cprh: users.update_role reveals whether a user id from another team exists and which role it has in 1.12.0
- security Fixes GHSA-cprf-crfh-w3p4: Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed) in 1.12.0
- security Fixes GHSA-rvj7-2gww-6xfq: Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member in 1.12.0
- security Fixes GHSA-m9vh-j2wc-xj24: Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner) in 1.11.0
- security Fixes GHSA-w8vg-8mjx-xq8x: Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets in 1.11.0
- security Fixes GHSA-27h6-gg7j-wj5w: Cross-tenant authorization gap in the GitLab integration inbound-webhook handler in 1.11.0
- security Fixes GHSA-97vv-f6qq-6842: Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence in 1.11.0
- security Fixes GHSA-48rq-wx9j-g949: Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login) in 1.11.0
- security Fixes GHSA-f28f-75h4-499q: Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback in 1.11.0
- security Fixes GHSA-65xg-84g9-7hrm: Existing collaboration connection remains writable after document archive or deletion in 1.11.0
- security Fixes GHSA-3jwc-gwg4-jqrq: Attachment Import Preset Authorization Bypass in 1.10.1
- security Fixes GHSA-w826-vphp-43r6: Stored XSS via PDF attachment <embed> with unsanitized URL in 1.10.0
- security Fixes GHSA-2396-xfgx-jrq7: Read-scoped API keys and OAuth grants obtain a collaboration token from auth.info and write to every document over the collaboration websocket, which performs no scope check in 1.10.0
- security Fixes GHSA-rmv5-jh9q-899h: Public share subscribers receive email copies of documents the share itself will not serve (incomplete fix of 12c71f267) in 1.10.0
- security Fixes GHSA-6cv3-v7fh-v222: documents.import publishes into an arbitrary collection when parentDocumentId and collectionId are sent together (incomplete fix of fecca544f / GHSA-c43v-wwv4-9mcc) in 1.10.0
- security Fixes GHSA-593c-w8cr-c744: API key and OAuth token scopes are not enforced at the point of use (further instances of CVE-2026-54573) in 1.10.0
- security Fixes GHSA-m2h8-g6cf-42g7: Unauthorized disclosure of collection-less draft documents via relationships.list in 1.10.0
- security Fixes GHSA-6mcq-gx87-gqrr: Completed collection exports remain permanently downloadable by their creator after their access to the source collection is revoked in 1.10.0
- security Fixes GHSA-2jfj-rch9-whf4: documents.export writes the archive into the anonymously served public bucket when the document title contains path traversal (FILE_STORAGE=local) in 1.10.0
- security Fixes GHSA-969g-q5r9-f9pr: Incomplete fix for GHSA-fp2g-2283-rwvj: CSRF token is not session-bound and the verifier falls back to the non-prefixed cookie in 1.10.0
- security Fixes GHSA-4x5j-6wvp-fc3m: suggestions.mention returns the full workspace user and group directory to guests, bypassing the listUsers and listGroups policies (incomplete fix of fa2c49878) in 1.10.0
- security Fixes GHSA-cxh6-3jv2-9xcp: Missing `await` disables comment-mark redaction on public shares, leaking internal user IDs to unauthenticated viewers in 1.10.0
- security Fixes GHSA-wp3v-3485-f3r6: shares.info discloses the share creator's internal profile, including team role, to unauthenticated visitors in 1.10.0
- security Fixes GHSA-fjc7-xv59-m9jp: relationships.list discloses inaccessible document UUIDs when no anchor ID is supplied in 1.10.0
- security Fixes GHSA-vfcq-7fxp-r7hf: revisions.export authorizes listRevisions instead of download, so a Viewer can export revision markdown or HTML after admin disables ViewersCanExport, bypassing the Settings security export gate. in 1.10.0
- security Fixes GHSA-g9wp-qv3q-2548: revisions.list discloses metadata of soft-deleted documents to former readers in 1.10.0
- security Fixes GHSA-j99w-85jw-w4hx: Account Identity Collision via Unverified Email Overwrite on SSO Re-Login (userProvisioner) in 1.10.0
- security Fixes GHSA-px83-2m6m-7frj: Outline: Per-IP Share-Subscription Creation Limit Can Be Bypassed Indefinitely via the Stale-Unconfirmed Resend Path in 1.10.0
- security Fixes GHSA-5h2f-gc77-r2j2: Race Condition / TOCTOU in Multiple Resource Limit Checks Allows Bypass of Quota Enforcement in 1.10.0
- security Fixes GHSA-5r93-89wq-vx52: Route-level rate limits are bypassed wholesale via path case variations (koa-router case-insensitive matching vs raw-path limiter keying) in 1.10.0
- security Fixes GHSA-2cr5-465m-rwj9: Revoked Collaborators Retain Read/Write Access Through Existing Collaboration WebSocket Sessions in 1.10.0
- security Fixes GHSA-mf33-ppqw-97v5: Authorization Bypass in shares.create Allows Viewers to Retrieve Existing Public Share URLs in 1.9.0
- security Fixes GHSA-m28f-fh92-c93w: Pinterest embed host validation uses endsWith suffix match, allowing attacker-controlled hosts whose name ends with the literal substring "pinterest.com" to be rendered as legitimate Pinterest embeds on the Outline origin. in 1.9.0
- security Fixes GHSA-x92r-w4r2-vwmf: Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info in 1.9.0
- security Fixes GHSA-q9p3-66p5-76wp: SSRF protection bypass: IPv4-mapped IPv6 addresses classified as public (reaches cloud metadata / internal hosts) in 1.9.0
Every release in between
securityFixes GHSA-rq53-m97j-f2pg: Unpublished documents remain publicly accessible and their shares cannot be revoked
securityFixes GHSA-h6ff-rw9x-5mq2: Authenticated members can publish documents into private collections through a retained parent link
securityFixes GHSA-x4w3-9p9j-cprh: users.update_role reveals whether a user id from another team exists and which role it has
securityFixes GHSA-cprf-crfh-w3p4: Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)
securityFixes GHSA-rvj7-2gww-6xfq: Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member
featureEvery user now has a personal section for private documents in the sidebar https://github.com/outline/outline/pull/14187 (Admins can disable in settings)
featureDrag and drop in the sidebar was rebuilt to be more responsive
featureMermaid diagrams are now faster, much prettier, and responsive as they are rendered with Pele -
featurePasskey login is now possible inside the desktop app (Make sure you're running the latest version) https://github.com/outline/outline/pull/14241 https://github.com/outline/outline/pull/14242
featureAdded a tool to show what changed in a document
featureThe MCP SDK has been upgraded to v2 with support for the 2026-07-28 protocol
featureEditor UI now renders from observable state instead of forceUpdate
featureShare popover and document meta chunks are now preloaded on predicted intent
featureThe document is no longer restyled on every frame of the sidebar animation
featureNotification counts no longer use default scope joins
featureEmpty unfurl results are now remembered on the client
featureThe text column is now skipped when loading document lists
featurePermanent Iframely errors are now cached for an hour
featureTyping in large code blocks is faster
featureSearchIndexProcessor jobs are no longer queued for the Postgres provider
featureSlackProcessor now waits for a summary only after cheap checks pass
featureReduced traversals and skipped unneeded work in ProsemirrorHelper
featureAttachments are now loaded in one query when signing urls in text
featureComment view lookups are now batched and email diff clipping is memoized
featureOnly the patched path is now copied when recreating transforms
featureTables can now be placed inside notices
featureCode block line numbers can now be shown alongside line wrapping
featureThe mobile sidebar can now be closed with a drag, and header controls are touch-friendly
featureEmails now support one-click unsubscribe (RFC 8058)
featureA warning is now shown when theme colors have low contrast
featureHeadings are now weighted above body text in shared document search
featurePostgres search now retries as a quoted query when there are no results
featureSlab imports now resolve cross-links and import Slab-hosted attachments
featureAdded a "Manage templates" link to the Templates menu
featureVideo nodes now have a selection toolbar
featureUploads now render with the same component as the uploaded node
featureAlt+click now expands all in the document explorer
featureDocument update emails now list all contributors
featureComment webhook payloads now include collectionId in the payload
featureNotices now have softer colors with matching menu icons
+61 more items in the release notessecurityFixes GHSA-m9vh-j2wc-xj24: Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner)
securityFixes GHSA-w8vg-8mjx-xq8x: Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets
securityFixes GHSA-27h6-gg7j-wj5w: Cross-tenant authorization gap in the GitLab integration inbound-webhook handler
securityFixes GHSA-97vv-f6qq-6842: Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence
securityFixes GHSA-48rq-wx9j-g949: Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login)
securityFixes GHSA-f28f-75h4-499q: Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback
securityFixes GHSA-65xg-84g9-7hrm: Existing collaboration connection remains writable after document archive or deletion
featureA drag handle is now available on all root-level blocks
featureAlt+Up/Down now moves to the previous or next document in the sidebar
featureDocuments and collections can now record a reason for being archived or deleted
featureAdded Open Knowledge Format (OKF) import
featureGroups can now optionally have an icon and color
featureThe desktop app now shows a toast with actions when a file download completes
featureAvoided an N+1 query in share subscription notifications
featuredocumentCollaborativeUpdater now does its computation outside the transaction
featureThe loading bar now animates with transform
featurePlaceholder candidates are now filtered before conditions are evaluated
featureEditor decorations are now mapped through inline edits instead of rebuilt
featureDocument sidebar panels now stay mounted with React Activity
featureStore filter methods are now memoized
featureSimple read-only comments now render without an editor view
featureDocument row menus and tooltips are now deferred until interaction
featureRemoved redundant queries from document API routes
featuredocumentStructure is now excluded from the collections.list query
featureReduced query cost and reparsing in the comments API
featureProsemirror parsing is now memoized in DocumentHelper
featureTemplates are now loaded on demand
featureThe statement timeout is now sent in the same round trip as the transaction start
featureThe recently viewed documents query is faster
featureUpdating the collection structure no longer loads full subtrees
featureSidebar document trees are now virtualized
featureReduced editor mount cost
featureOpening a document from the sidebar now uses less main-thread time
featureSidebar section headers now have menus
featureThe child document list now supports multi-select
featureUsers are now notified when added to or removed from a group
featureBreadcrumbs are now shown in hovercards
featureLine-height is now adjusted for Chinese, Japanese and Korean documents
featureDate mentions are now formatted per locale
featureGmail and Outlook links are now shown after an email sign-in request
+106 more items in the release notessecurityFixes GHSA-3jwc-gwg4-jqrq: Attachment Import Preset Authorization Bypass
featureAdded WebMCP support allowing agents in Chrome and ChatGPT to programmatically control Outline through the browser.
featureAdded Open Knowledge Format (OKF) export
featureAdd indexes on user foreign key columns
featureUpgraded Zod and enable schema compilation
featureHistory revision content now prefetched on hover in history sidebar
featureOptimized document queries by excluding content when not needed
fixAllowed editing webhooks without signing secrets
fixEscaped MCP attachment PUT upload command arguments
fixPrevented overlapping nested list markers
fixpreserve toggle fold state across remote and local document edits
fixFixed manual sizing of embedded PDFs
fixAdded missing transaction in GitLabIssueProvider
fixFixed Mermaid diagram rendering size issue
fixAlign attachment upload permissions
fixLoad revision content in document history
fixRevisions now show accurate stats
fixEditor crash when upload placeholder targets a position with no node
fixGuard null $cursor in toggle block
fixChild documents list empty until sidebar renders the collection
fixTighten authentication on views.create endpoint
fixMarkdown list dropped when a plain item precedes a checkbox item
fixAllow document mentions to wrap
fixValidate API key and OAuth scopes at the model layer
fixPersist comment sidebar open/close state across reloads
fixAllow dropping a document after an expanded subtree in the sidebar
fixHistory "Current version" entry never finishes loading
fixAuthStore.availableTeams never becomes observable
fixExpand folded toggle blocks when printing
fixSigned file downloads rejected when an API key lacks scope for the route
fixAuthStore.fetchConfig updates config outside a MobX action
fixprevious() on UserMembership and Star returned the next item
fixCrash opening the template editor
fixrobots.txt blocked crawlers from indexable shares on self-hosted installs
fixHistory changes indicator missing on load and stuck on "N changes"
fixRevision view does not re-render when late-loaded content arrives
fixLinks in view mode ignore modifier clicks, drag, and keyboard activation
fixMembers receive authorization error when importing a document
fixStop repeated requests after final table page
fixTable of contents clicks ignored while a search term is active
+4 more items in the release notessecurityFixes GHSA-w826-vphp-43r6: Stored XSS via PDF attachment <embed> with unsanitized URL
securityFixes GHSA-2396-xfgx-jrq7: Read-scoped API keys and OAuth grants obtain a collaboration token from auth.info and write to every document over the collaboration websocket, which performs no scope check
securityFixes GHSA-rmv5-jh9q-899h: Public share subscribers receive email copies of documents the share itself will not serve (incomplete fix of 12c71f267)
securityFixes GHSA-6cv3-v7fh-v222: documents.import publishes into an arbitrary collection when parentDocumentId and collectionId are sent together (incomplete fix of fecca544f / GHSA-c43v-wwv4-9mcc)
securityFixes GHSA-593c-w8cr-c744: API key and OAuth token scopes are not enforced at the point of use (further instances of CVE-2026-54573)
securityFixes GHSA-m2h8-g6cf-42g7: Unauthorized disclosure of collection-less draft documents via relationships.list
securityFixes GHSA-6mcq-gx87-gqrr: Completed collection exports remain permanently downloadable by their creator after their access to the source collection is revoked
securityFixes GHSA-2jfj-rch9-whf4: documents.export writes the archive into the anonymously served public bucket when the document title contains path traversal (FILE_STORAGE=local)
securityFixes GHSA-969g-q5r9-f9pr: Incomplete fix for GHSA-fp2g-2283-rwvj: CSRF token is not session-bound and the verifier falls back to the non-prefixed cookie
securityFixes GHSA-4x5j-6wvp-fc3m: suggestions.mention returns the full workspace user and group directory to guests, bypassing the listUsers and listGroups policies (incomplete fix of fa2c49878)
securityFixes GHSA-cxh6-3jv2-9xcp: Missing `await` disables comment-mark redaction on public shares, leaking internal user IDs to unauthenticated viewers
securityFixes GHSA-wp3v-3485-f3r6: shares.info discloses the share creator's internal profile, including team role, to unauthenticated visitors
securityFixes GHSA-fjc7-xv59-m9jp: relationships.list discloses inaccessible document UUIDs when no anchor ID is supplied
securityFixes GHSA-vfcq-7fxp-r7hf: revisions.export authorizes listRevisions instead of download, so a Viewer can export revision markdown or HTML after admin disables ViewersCanExport, bypassing the Settings security export gate.
securityFixes GHSA-g9wp-qv3q-2548: revisions.list discloses metadata of soft-deleted documents to former readers
securityFixes GHSA-j99w-85jw-w4hx: Account Identity Collision via Unverified Email Overwrite on SSO Re-Login (userProvisioner)
securityFixes GHSA-px83-2m6m-7frj: Outline: Per-IP Share-Subscription Creation Limit Can Be Bypassed Indefinitely via the Stale-Unconfirmed Resend Path
securityFixes GHSA-5h2f-gc77-r2j2: Race Condition / TOCTOU in Multiple Resource Limit Checks Allows Bypass of Quota Enforcement
securityFixes GHSA-5r93-89wq-vx52: Route-level rate limits are bypassed wholesale via path case variations (koa-router case-insensitive matching vs raw-path limiter keying)
securityFixes GHSA-2cr5-465m-rwj9: Revoked Collaborators Retain Read/Write Access Through Existing Collaboration WebSocket Sessions
featureOpen two views in side-by-side split view from any menu or cmd+click
featureUsers with read-only access can now leave inline comments
featureAdded [[ trigger for mentioning or creating a document
featureDocuments can now be shown with numbered headings, as a display preference
featureSidebar sections can now be reordered by dragging their headers
featureLive document stats can now be displayed in the corner of the editor
featureDanish and Indonesian have been added to the available language options
featureColor swatches now have a hover card in the editor
featureWeb pages, Email (.eml), TextPack, and PDF files can now be imported https://github.com/outline/outline/pull/13235 https://github.com/outline/outline/pull/13302
featureThe sidebar menu and navigation tree are faster
featureServer memory usage is reduced, with container memory best practices documented
featureBoot migration check now runs as a separate process to reduce memory usage
featureDrag and drop re-rendering has been optimized
featureLocal content search through the command menu is much faster and more accurate
featureNested policies are now briefly cached on the server
featureMarkdown import merge now uses an O(1) title lookup
featureThe revisions.list endpoint now loads less data
featurefindByPk now requires fewer database connections
featureRoute chunks are now preloaded on sidebar hover intent
featureSearch no longer needs to join on memberships
+270 more items in the release notesfeatureAdded "query" parameter to templates.list API endpoint
otherDeleting failed and expired exports now possible
fixFloating toolbar in template settings no longer overlaps sidebar
fix"Mermaid" no longer appears twice in language picker
fix"Reset theme" control correctly updates input value
fixErrored mermaid diagram no longer zoomable
fixDebounced search query persistence
fixMultiple fixes for comment gutter mark behavior and scroll-to-comment
fixSearch queries from MCP are now recorded
fixConsistent usage of configured proxy with auth providers
fixDocker image no longer includes test fixtures
fixMCP can now upload files with local storage method
fixImage dimensions editable in editor again
fixFocusing starred link no longer scrolls to original location
fixFixed indent of group-shared document children
fixFull keyspace is now used for email verification codes
fixOption to invite existing user not in doc
fixFixed 502 on sign-in from oversized id_token cookie using OIDC (#12986)
featureAdded importer support for Slab
featureAdded support for rgb, hsl swatches
featureNew sidebarHidden query option
featureEmpty list tool results in MCP now return improved responses
featureUnfurl previews for heading links are now aware of heading links
featureAdded comment marks in editor gutter
fixLong code words no longer cause comment bound overflow
fixDesktop sign-in supported for self-hosted deployments
fixFix image overflow in table cells
fixAnother fix for foreignObject sizing in Mermaid diagrams
fixPrevent collapsed sidebar opening during text selection
fixImproved fast-click behavior in sidebar
fixComments menu now works correctly when triggered from a document list
fixService worker loading
securityFixes GHSA-mf33-ppqw-97v5: Authorization Bypass in shares.create Allows Viewers to Retrieve Existing Public Share URLs
securityFixes GHSA-m28f-fh92-c93w: Pinterest embed host validation uses endsWith suffix match, allowing attacker-controlled hosts whose name ends with the literal substring "pinterest.com" to be rendered as legitimate Pinterest embeds on the Outline origin.
securityFixes GHSA-x92r-w4r2-vwmf: Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info
securityFixes GHSA-q9p3-66p5-76wp: SSRF protection bypass: IPv4-mapped IPv6 addresses classified as public (reaches cloud metadata / internal hosts)
featureDate mentions are now supported
featureLogin with Passkey is now supported on desktop
featureMarkdown input such as --- now work after a soft-break
featureAdded document restore tool
featureAdd HTML input support to `create_document tool
featureAdd WWW-Authenticate header to /mcp 401 responses
featureTable menus in editor were improved and now include alignment options for rows
featureAdded support for Slack-style +:100: reaction shorthand
featureAdded PROXY_HEADERS_TRUSTED env option (defaults to true)
featureCloudFront support for signed attachment URLs
featureTable sorting is now IP-address aware
featureSmall images can now be displayed inline for iconography
featureAdded support for presigned PUT uploads for S3-compatible storage
featureImage corner drag resizing is now enabled
featureAdded spec-compliant OIDC logout
featureAdd support for OIDC provider returning JWT from userinfo endpoint
fixPDF display now correctly scales on mobile
fixplace cursor at start of inserted table row/column
fixImprove patch merging of links in table cells through MCP
fixCode blocks auto-collapse while editing
fixSpurious post-import edits
fixBefore/After creation options appear in menu when no permission on parent doc
fixUpdated validateUrlNotPrivate to match implementation in SSRF
fixWiden validated emails for Azure
fixPasted content sometimes appears in plaintext
fixDragging images in editor
fixperf: Improve performance of in-page search
fixPrevent selecting word-joiner characters around multiplayer cursor
fixReject collections.update requests that include both description and data in payload
fixImprove markdown serialization speed
fixEditor math block parsing and NaN media dimensions
fixToggling a nested list no longer converts parent lists
fixDuplicate paths in export ZIP
fixDate mentions
fixComment thread animations
fixNested list behavior
+67 more items in the release notesfeatureDrag-and-drop now supports dragging from document lists
featureAdd admin interface to change user avatars
featureAdd automatic metrics tagging of outgoing emails
featureVarious improvements to mobile styling and layout https://github.com/outline/outline/pull/12576
fixFixed search term highlights missing on navigation from search
fixFixed an intermitent issue where sidebar element is not correctly active on first load
fixScrollbar no longer causes horizontal movement in comments sidebar
fixAdded protection against timing attacks on notification unsubscribe endpoints
fixIcon picker is no longer auto-closed on choice
fixAccess requests can now be approved by collection managers
fixCollection title and icon inline are now editable like documents
fixIncreased valid user-supplied URL length to 1024
fixAdded handling of unhandled server error in MCP route
fixFixed sticky table header styling in Safari
fixPrivate IP lookup is now invalid request rather than internal error
fixImproved worker performance through caching
fixchore: Improve handling of "expected" network errors from webhooks
fixMermaid is no longer persisted as last used coding language
fixFixed collaboratorIds iterable error when handling very old documents
fixFixed correct support for hard break serialization for commonMark
fixAdded email verification check during sign-in flow
featureMembers can now request access to documents they don't have permission to view – https://github.com/outline/outline/pull/10825
featureComments are now available in the image lightbox, making it easier to discuss visuals in context – https://github.com/outline/outline/pull/12335
featureAdded a fullWidth parameter to create_document and update_document, by @toralux – https://github.com/outline/outline/pull/12338
fixFixed an issue where updating a collection description via MCP wouldn't persist – https://github.com/outline/outline/pull/12410
featureCode blocks are now supported inside comments – https://github.com/outline/outline/pull/12480
featureAdded a system preference to open the desktop app automatically on startup – https://github.com/outline/outline/pull/12279
featureViewers can now create and use API keys – https://github.com/outline/outline/pull/12278
featureMentioned users are now automatically subscribed to the document – https://github.com/outline/outline/pull/12235
featureThe command menu now shows breadcrumbs alongside documents to make results easier to disambiguate – https://github.com/outline/outline/pull/12403
featureYou can now format the word at the cursor with the associated shortcut without needing to select it first – https://github.com/outline/outline/pull/12492
featureSelf-hosted instances can now use HTTP webhook URLs – https://github.com/outline/outline/pull/12499
featureDelete confirmation dialogs now use a segmented-style input – https://github.com/outline/outline/pull/12495
featureImages pasted as data URIs are now supported – https://github.com/outline/outline/pull/12294
featureThe icon picker is now responsive and easier to use on mobile – https://github.com/outline/outline/pull/12275
featureNotifications now open in a mobile drawer on small screens – https://github.com/outline/outline/pull/12276
featureReduced minimum table column width to 25px for tighter layouts – https://github.com/outline/outline/pull/12269
featureHyphenated words are now treated as a single unit when diffing changes – https://github.com/outline/outline/pull/11272
featureHover previews now trigger while the editor is focused – https://github.com/outline/outline/pull/12545
featureThe settings sidebar is no longer collapsible – https://github.com/outline/outline/pull/12460
featureHardened OAuth scope validation – https://github.com/outline/outline/pull/12490
featureAdded Catalan as a language option – https://github.com/outline/outline/pull/12454
featureThousands of new community translations
featureAdded missing indexes on foreign keys referencing documents – https://github.com/outline/outline/pull/12473
breakingRemoved an N+1 query in documents.search – https://github.com/outline/outline/pull/12540
fixDocument text can now be selected in version history – https://github.com/outline/outline/pull/12268
fixFixed search highlights not rendering in Firefox – https://github.com/outline/outline/pull/12273
fixResolved console warnings for the rtl DOM attribute and an untracked MobX read – https://github.com/outline/outline/pull/12284
fixOutline now only preconnects to S3 when it's actually in use, by @marksteward – https://github.com/outline/outline/pull/12298
fixImproved handling of additional client-aborted error types – https://github.com/outline/outline/pull/12303
fixShort-circuited common scanner and crawler routes – https://github.com/outline/outline/pull/12306
fixFixed a crash when file storage environment variables are misconfigured – https://github.com/outline/outline/pull/12325
fixPrinting no longer includes an extra blank page – https://github.com/outline/outline/pull/12326
fixDocument deletes are now batched when emptying trash – https://github.com/outline/outline/pull/12328
fixUpgraded Mermaid to 11.15.0 – https://github.com/outline/outline/pull/12331
fixTable cell selection no longer appears in print output – https://github.com/outline/outline/pull/12334
fixFixed Mermaid diagrams not rendering correctly inside toggle blocks – https://github.com/outline/outline/pull/12343
fixCode blocks now automatically expand when a find result is inside – https://github.com/outline/outline/pull/12346
fixMermaid diagrams now appear correctly in light theme when printing from dark theme – https://github.com/outline/outline/pull/12342
fixFixed authorization providers not being correctly disabled via environment variables – https://github.com/outline/outline/pull/12349
fixImproved the resilience of the Markdown importer – https://github.com/outline/outline/pull/12357
+71 more items in the release notes