BREAKING CHANGE(deps): Update BookStackApp/BookStack v25.11.1 → v26.03.4#2169
Open
truecharts-admin wants to merge 1 commit intomainfrom
Open
BREAKING CHANGE(deps): Update BookStackApp/BookStack v25.11.1 → v26.03.4#2169truecharts-admin wants to merge 1 commit intomainfrom
truecharts-admin wants to merge 1 commit intomainfrom
Conversation
Crow-Control
approved these changes
Apr 28, 2026
Member
Crow-Control
left a comment
Crow-Control
left a comment
There was a problem hiding this comment.
Auto approved automated PR
truecharts-admin
force-pushed
the
renovate/bookstackapp-bookstack-26.x
branch
from
c027d3b to
8fbd250
Compare
truecharts-admin
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
25.11.1→26.03.4Release Notes
BookStackApp/BookStack (BookStackApp/BookStack)
v26.03.4: BookStack v26.03.4Compare Source
Security Release
This is a security release to improve attachment related permission checks, and URL validation for webhooks.
Upgrade is advised if you allow untrusted users to delete attachments, or if untrusted users have permission to create webhooks on instances which make use of the
ALLOWED_SSR_HOSTSBookStack env file option.Thanks to 404_pkj (GitHub) and naruhodoowl (GitHub) for responsibly reporting these issues.
Full List of Changes
v26.03.3: BookStack v26.03.3Compare Source
Links
Full List of Changes
This release contains the following fixes and changes:
v26.03.2: BookStack v26.03.2Compare Source
Security Release
This is a security release to address a vulnerability where the registration form could be manipulated to gain access to additional roles.
Upgrade is very strongly advised if your instance has user registration enabled.
Thanks to Kwonyong Lee (LinkedIn) for responsibly reporting this issue.
Also thanks to Boustani OSAMA (LinkedIn) for also reporting this before public announcement.
Full List of Changes
v26.03.1: BookStack v26.03.1Compare Source
Security Release
This is a security release to address a vulnerability where page content, which should be hidden by permissions, could be visible during certain markdown exports.
We strongly advise that you update your instance if you use permissions to control page visibility.
Thanks to Ghufran Raza Khan (GitHub Profile, LinkedIn Profile) for responsibly reporting this issue.
Also thanks to Alex Dan (GitHub Profile) for also reporting this before public announcement.
Full List of Changes
v26.03: BookStack v26.03Compare Source
Links
Upgrade Notices
modules/folder is now dedicated to theme modules. If you happened to already have a folder of this name in your theme, it's advised to use a different folder name instead.Full List of Changes
Released in v26.03
v25.12.9: BookStack v25.12.9Compare Source
Security Release
BookStack v25.12.9 has been released.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area in some revision views, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Alex Dan (@windbreaker555 on GitHub) for their responsible discovery and reporting of this issue.
Full List of Changes
v25.12.8: BookStack v25.12.8Compare Source
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.7: BookStack v25.12.7Compare Source
This release specifically addresses a scenario, introduced in v25.12.4, where loading the editor of a page, last updated/created by a different user with blank content, would result in an error.
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.6: BookStack v25.12.6Compare Source
This release specifically addresses issues introduced in v25.12.4, where drawings could become non-editable in certain scenarios due to content filtering rules.
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.5: BookStack v25.12.5Compare Source
This release specifically addresses folder permission issues (often showing as an error when attempting to access content) which could occur from changes introduced in v25.12.4.
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.4: BookStack v25.12.4Compare Source
Security Release
BookStack v25.12.4 has been released.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to SeongYun Moon (@Moonster8282 on GitHub) for their responsible discovery and reporting of this issue.
Additional Update Notices
ALLOW_CONTENT_SCRIPTSenv option is now considered deprecated. It's advised to use theAPP_CONTENT_FILTERINGoption, as documented here, instead if needed.If you experience issues with your page content being over-filtered feel free to raise an issue on GitHub where we can check if the behaviour is intentional or something which needs to be patched.
You can use the new page content filtering option, with a value of
jhfwhich should match the prior version filtering, but this will remove a layer of content filtering security so is not recommend.Full List of Changes
v25.12.3: BookStack v25.12.3Compare Source
Security Release
BookStack v25.12.3 has been released.
This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
Full List of Changes
v25.12.2: BookStack v25.12.2Compare Source
Links
Full List of Changes
This release contains the following fixes and changes:
v25.12.1: BookStack v25.12.1Compare Source
Security Release
BookStack v25.12.1 has been released.
This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted.
These changes help prevent potential abuse to host disk space usage and/or service availability.
We recommended to update your instance if untrusted users have ZIP import permissions, or if untrusted users can perform searches.
Thanks to Jeong Woo Lee (@eclipse07077-ljw) and Gabriel Rodrigues (aka TEXUGO) for reporting these vulnerabilities.
Full List of Changes
v25.12: BookStack v25.12Compare Source
Links
Full List of Changes
v25.11.6: BookStack v25.11.6Compare Source
Security Release
BookStack v25.11.6 has been released.
This is a security release to address a vulnerability in our dependencies related to XML
handling, which could allow users to replay SAML authentication requests with specially crafted & manipulated requests.
It's strongly advised to update if you're using SAML authentication for BookStack.
Full List of Changes
v25.11.5: BookStack v25.11.5Compare Source
Links
Full List of Changes
This release contains the following fixes and changes:
v25.11.4: BookStack v25.11.4Compare Source
Note: This was originally accidentally published as v24.11.4, so this is essential a re-publish with the correct version.
The wrong version number commit/history has been retained though to prevent any breakages for git-managed environments.
Links
Full List of Changes
This release contains the following fixes and changes:
v25.11.3: BookStack v25.11.3Compare Source
Links
Full List of Changes
This release contains the following fixes and changes:
v25.11.2: BookStack v25.11.2Compare Source
Links
Full List of Changes
This release contains the following fixes and changes:
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.