Release v0.87.0 · outline/outline

Warning

Skip this version, use v0.87.3 due to a breaking issue causing failing CSP in some browsers.

Note

This version includes multiple proactive security fixes for issues discovered during a routine security audit. Please see associated advisories:

What's Changed

Add notifications for reactions in #9893
It is now possible to split an existing code block by typing triple backticks in #9959
Implement right-click context menu in #9883 (Available on document lists now, elsewhere soon)
Added relationships API endpoints in #9402
Improved error boundary with option to clear cache on repeated errors… in #9891
Added support for encrypted environment variables with dotenvx in #9921

fix: Line-height too compact on editor headings in #9942
fix: Scroll-to-anchor reliability in #9945
fix: "Table of contents" shortcut on macOS in #10002
fix: Issue with draft comment being lost when navigating directly between documents in #9997
Use Sorting of mentions in a table now act correctly in #10011
fix: Image caption parsed as separate paragraph on copy/paste in #10020
fix: Image pasted twice in copy/paste #9938

fix: Tighten rate limits on email.callback endpoint in #9917
fix: Use safeEqual in VerificationCode verify method in #9915
fix: Allow user account lookup with mismatching email capitalization in #9929
fix: Remove attachments.redirect sw caching in #9927
fix: Remove mime-types usage from the browser in #9926
fix: Upgrade request-filtering-agent in #9937
fix: Increase timeout on remote file storage operations in #9936
fix: Properly truncate multiline labels in sidebar in #9940
fix: Drafts without a collection should be publishable by all members with update rights in #9941
fix: Standardize request filtering between cloud / self-hosted in #9914
chore: Removed usage of vite-static-copy plugin in #9916
fix: Document move/copy/publish dialog now behaves better in #9947
fix: Usage of ctx.attachment overrides explicit Content-Type in #9949
chore: More CSP hardening in #9951
fix: Frontend requests do not always send Content-Type header in request in #9954
Display correct child document structure & auto open shared document section in #9854
fix: Unable to use DATABASE_HOST env in #9977
Include collection attachments in json export in #10010
Skip Notion linked database views in #10018
Map export endpoint to read permissions in #10019
fix documents.import permission checks for shared parent in #9996
fix: Show API key creator name in settings page in #10041
fix: Update unique db constraint to account for revoked share links in #10022
Add CSRF middleware in #10051

Full Changelog: v0.86.1...v0.87.0