[renovate]

This PR contains the following updates:

Package	Update	Change
hedgedoc/hedgedoc	patch	1.12.0 → 1.12.2

---

Release Notes

hedgedoc/hedgedoc

v1.12.2: [WITHDRAWN] HedgeDoc 1.12.2

Compare Source

[!CAUTION]
DO NOT UPDATE TO THIS RELEASE, IT MIGHT BREAK YOUR INSTANCE

Bugfixes

• Fixed the profile provider migration failing on PostgreSQL

v1.12.1: [WITHDRAWN] HedgeDoc 1.12.1

Compare Source

[!CAUTION]
Due to some bugs with usage on PostgreSQL, we had to pull back this release.

Security fixes

• GHSA-2c27-4x43-jrm6 reports a possible impersonation attack when two auth providers provide the same profile id
• GHSA-g5g7-gfr5-f89m reports a possible crash of the realtime code via an invalid selection.
• GHSA-7p6g-mhrh-286p reports the ability to include unescaped iframes in slides view.
• GHSA-cqg6-86p6-77jm reports a possible timing attack which allows to check whether an email address is registered at the instance.
• GHSA-q9v8-vwgh-x2mc reports missing permissions enforcement for invalid permissions. See GHSA-93w7-49m2-cqwg.
• GHSA-jxrf-wfc5-w77h reports a HTML injection possibility using specially crafted user display names
• GHSA-3fwm-h59w-j268 reports a denial-of-service attack where authenticated users can crash a HedgeDoc instance using a specific note alias
• Several other HTML injection possibilities were fixed

Enhancements

• Added CMD_OAUTH2_USER_PROFILE_PHOTO_ATTR to let OAuth2/OIDC providers supply a profile photo URL, instead of always falling back to a generated avatar
• Updated mermaid to 11.17 which includes many new diagram types

Bugfixes

• Fixed opening links in new tabs did not work for published and slideshow views. This was forgotten with the last fix in 1.12.0.
• Tell the user about an impending data loss immediately after the reconnect.
• Fixed hashtag links opening in new tabs when external link warning is disabled
• Fixed links with the same origin not opening in new tabs when external link warning is enabled
• Fixed crash when importing history entries that already exist
• Fixed text not rendering when placed following a <br> HTML tag
• In "free URL" mode, there is no "409 conflict" anymore when trying to create a note with an alias that parses also as a valid note ID
• Fixed a missing uniqueness constraint in the database for email addresses of local accounts
• Fixed invalid HTML for task lists with checkboxes, clicking the label should now trigger the checkbox as well
• Fixed line numbers in wrapped code blocks being attached to the wrong lines
• Fixed an issue with syntax highlighting in the editor when using $$ math blocks
• Fixed a rendering issue, resulting in wrong checkboxes being toggled sometimes

Node compatability

• Node 26 support was tested and is now supported officially.

Contributors

• Anant Kumar
• Chris Ellrich
• Stephan
• Vaibhav Srivastav

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.