⬆️ Update BookStackApp/BookStack to v26#436
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
added
dependencies
renovate
Bot
force-pushed
the
renovate/bookstackapp-bookstack-26.x
branch
from
246141e to
f8d1c76
Compare
renovate
Bot
force-pushed
the
renovate/bookstackapp-bookstack-26.x
branch
2 times, most recently
from
f9e616f to
57d2708
Compare
renovate
Bot
force-pushed
the
renovate/bookstackapp-bookstack-26.x
branch
from
57d2708 to
bea3b5b
Compare
renovate
Bot
force-pushed
the
renovate/bookstackapp-bookstack-26.x
branch
from
bea3b5b to
d4ba94a
Compare
renovate
Bot
force-pushed
the
renovate/bookstackapp-bookstack-26.x
branch
from
d4ba94a to
1447ee9
Compare
renovate
Bot
force-pushed
the
renovate/bookstackapp-bookstack-26.x
branch
from
1447ee9 to
cc9a1a2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v25.12.2→v26.05.1Release Notes
BookStackApp/BookStack (BookStackApp/BookStack)
v26.05.1: BookStack v26.05.1Compare Source
Security Release
This is a security release to address the following vulnerabilities:
file://protocol could be abused in some Windows-specific scenarios to auto-run requests with credential information when viewing exports.Upgrade is advised for instances with public viewing enabled, or where untrusted users have authenticated access.
Thanks to Stephen O. / Sakusen (Codeberg, Website), Gurmandeep Deol (LinkedIn), Rafael Castilho (X account) and Gabriel Duarte Guerra (GitHub) for responsibly reporting these issues.
Full List of Changes
file://protocol on anchor hrefs, instead of in all dynamic content.v26.05: BookStack v26.05Compare Source
Links
Upgrade Notices
storage/fontsfolder (and all folders within that) are accessible & writable by the web-server. If you start seeing errors on PDF export after updating, it's likely this issue. See this page for guidance on setting permissions.Full List of Changes
v26.03.5: BookStack v26.03.5Compare Source
Security Release
This is a security release to address a brute-force based vulnerability related to multi-factor authentication, and to update project libraries to help avoid potential vulnerabilities that have been reported in those.
Upgrade is generally advised, but strongly so where multi-factor authentication is used & considered as a critical layer of defense.
Thanks to Stephen O. / Sakusen (Codeberg, Website) for responsibly reporting these issues.
Full List of Changes
v26.03.4: BookStack v26.03.4Compare Source
Security Release
This is a security release to improve attachment related permission checks, and URL validation for webhooks.
Upgrade is advised if you allow untrusted users to delete attachments, or if untrusted users have permission to create webhooks on instances which make use of the
ALLOWED_SSR_HOSTSBookStack env file option.Thanks to 404_pkj (GitHub) and naruhodoowl (GitHub) for responsibly reporting these issues.
Full List of Changes
v26.03.3: BookStack v26.03.3Compare Source
Links
Full List of Changes
This release contains the following fixes and changes:
v26.03.2: BookStack v26.03.2Compare Source
Security Release
This is a security release to address a vulnerability where the registration form could be manipulated to gain access to additional roles.
Upgrade is very strongly advised if your instance has user registration enabled.
Thanks to Kwonyong Lee (LinkedIn) for responsibly reporting this issue.
Also thanks to Boustani OSAMA (LinkedIn) for also reporting this before public announcement.
Full List of Changes
v26.03.1: BookStack v26.03.1Compare Source
Security Release
This is a security release to address a vulnerability where page content, which should be hidden by permissions, could be visible during certain markdown exports.
We strongly advise that you update your instance if you use permissions to control page visibility.
Thanks to Ghufran Raza Khan (GitHub Profile, LinkedIn Profile) for responsibly reporting this issue.
Also thanks to Alex Dan (GitHub Profile) for also reporting this before public announcement.
Full List of Changes
v26.03: BookStack v26.03Compare Source
Links
Upgrade Notices
modules/folder is now dedicated to theme modules. If you happened to already have a folder of this name in your theme, it's advised to use a different folder name instead.Full List of Changes
Released in v26.03
v25.12.9: BookStack v25.12.9Compare Source
Security Release
BookStack v25.12.9 has been released.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area in some revision views, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Alex Dan (@windbreaker555 on GitHub) for their responsible discovery and reporting of this issue.
Full List of Changes
v25.12.8: BookStack v25.12.8Compare Source
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.7: BookStack v25.12.7Compare Source
This release specifically addresses a scenario, introduced in v25.12.4, where loading the editor of a page, last updated/created by a different user with blank content, would result in an error.
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.6: BookStack v25.12.6Compare Source
This release specifically addresses issues introduced in v25.12.4, where drawings could become non-editable in certain scenarios due to content filtering rules.
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.5: BookStack v25.12.5Compare Source
This release specifically addresses folder permission issues (often showing as an error when attempting to access content) which could occur from changes introduced in v25.12.4.
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.4: BookStack v25.12.4Compare Source
Security Release
BookStack v25.12.4 has been released.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to SeongYun Moon (@Moonster8282 on GitHub) for their responsible discovery and reporting of this issue.
Additional Update Notices
ALLOW_CONTENT_SCRIPTSenv option is now considered deprecated. It's advised to use theAPP_CONTENT_FILTERINGoption, as documented here, instead if needed.If you experience issues with your page content being over-filtered feel free to raise an issue on GitHub where we can check if the behaviour is intentional or something which needs to be patched.
You can use the new page content filtering option, with a value of
jhfwhich should match the prior version filtering, but this will remove a layer of content filtering security so is not recommend.Full List of Changes
v25.12.3: BookStack v25.12.3Compare Source
Security Release
BookStack v25.12.3 has been released.
This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
Full List of Changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.