[!WARNING] Skip this version, use v0.87.3 due to a breaking issue causing failing CSP in some browsers.

[!NOTE] This version includes multiple proactive security fixes for issues discovered during a routine security audit. Please see associated advisories:

• https://github.com/outline/outline/security/advisories/GHSA-fp2g-2283-rwvj
• https://github.com/outline/outline/security/advisories/GHSA-jfhx-7phw-9gq3
• https://github.com/outline/outline/security/advisories/GHSA-gcj7-c9jv-fhgf

What's Changed

Improvements

• Add notifications for reactions in https://github.com/outline/outline/pull/9893
• It is now possible to split an existing code block by typing triple backticks in https://github.com/outline/outline/pull/9959
• Implement right-click context menu in https://github.com/outline/outline/pull/9883 (Available on document lists now, elsewhere soon)
• Added relationships API endpoints in https://github.com/outline/outline/pull/9402
• Improved error boundary with option to clear cache on repeated errors… in https://github.com/outline/outline/pull/9891
• Added support for encrypted environment variables with dotenvx in https://github.com/outline/outline/pull/9921

Fixes

Editor

• fix: Line-height too compact on editor headings in https://github.com/outline/outline/pull/9942
• fix: Scroll-to-anchor reliability in https://github.com/outline/outline/pull/9945
• fix: "Table of contents" shortcut on macOS in https://github.com/outline/outline/pull/10002
• fix: Issue with draft comment being lost when navigating directly between documents in https://github.com/outline/outline/pull/9997
• Use Sorting of mentions in a table now act correctly in https://github.com/outline/outline/pull/10011
• fix: Image caption parsed as separate paragraph on copy/paste in https://github.com/outline/outline/pull/10020
• fix: Image pasted twice in copy/paste https://github.com/outline/outline/pull/9938

Other

• fix: Tighten rate limits on email.callback endpoint in https://github.com/outline/outline/pull/9917
• fix: Use safeEqual in VerificationCode verify method in https://github.com/outline/outline/pull/9915
• fix: Allow user account lookup with mismatching email capitalization in https://github.com/outline/outline/pull/9929
• fix: Remove attachments.redirect sw caching in https://github.com/outline/outline/pull/9927
• fix: Remove mime-types usage from the browser in https://github.com/outline/outline/pull/9926
• fix: Upgrade request-filtering-agent in https://github.com/outline/outline/pull/9937
• fix: Increase timeout on remote file storage operations in https://github.com/outline/outline/pull/9936
• fix: Properly truncate multiline labels in sidebar in https://github.com/outline/outline/pull/9940
• fix: Drafts without a collection should be publishable by all members with update rights in https://github.com/outline/outline/pull/9941
• fix: Standardize request filtering between cloud / self-hosted in https://github.com/outline/outline/pull/9914
• chore: Removed usage of vite-static-copy plugin in https://github.com/outline/outline/pull/9916
• fix: Document move/copy/publish dialog now behaves better in https://github.com/outline/outline/pull/9947
• fix: Usage of ctx.attachment overrides explicit Content-Type in https://github.com/outline/outline/pull/9949
• chore: More CSP hardening in https://github.com/outline/outline/pull/9951
• fix: Frontend requests do not always send Content-Type header in request in https://github.com/outline/outline/pull/9954
• Display correct child document structure & auto open shared document section in https://github.com/outline/outline/pull/9854
• fix: Unable to use DATABASE_HOST env in https://github.com/outline/outline/pull/9977
• Include collection attachments in json export in https://github.com/outline/outline/pull/10010
• Skip Notion linked database views in https://github.com/outline/outline/pull/10018
• Map export endpoint to read permissions in https://github.com/outline/outline/pull/10019
• fix documents.import permission checks for shared parent in https://github.com/outline/outline/pull/9996
• fix: Show API key creator name in settings page in https://github.com/outline/outline/pull/10041
• fix: Update unique db constraint to account for revoked share links in https://github.com/outline/outline/pull/10022
• Add CSRF middleware in https://github.com/outline/outline/pull/10051

New Contributors

• @volodymyrkoval made their first contribution in https://github.com/outline/outline/pull/9935
• @esafev made their first contribution in https://github.com/outline/outline/pull/10031

Full Changelog: https://github.com/outline/outline/compare/v0.86.1...v0.87.0