BookStack

April 2026 Community Updates

Sun, 19 Apr 2026 19:35:00 +0100

There have been a few recent developments in regard to BookStack’s community spaces so I thought I’d create a post to share what’s been going on.

BookStack Security Release v26.03.2

Mon, 23 Mar 2026 12:00:00 +0000

BookStack v26.03.2 has been released.

This is a security release to address a vulnerability where the registration form could be manipulated to gain access to additional roles.

BookStack Security Release v26.03.1

Tue, 17 Mar 2026 11:00:00 +0000

BookStack v26.03.1 has been released.

This is a security release to address a vulnerability where page content, which should be hidden by permissions, could be visible during certain markdown exports.

BookStack Release v26.03

Sun, 15 Mar 2026 13:30:00 +0000

The March 2026 BookStack release arrives today, with a focus on powering-up some of the core customization & extension options to allow new possibilities and easier usage.

BookStack Security Release v25.12.9

Thu, 12 Mar 2026 11:00:00 +0000

BookStack v25.12.9 has been released.

This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area in some revision views, opening up risk of potential phishing and/or tracking by bad page editors.

BookStack Security Release v25.12.4

Tue, 17 Feb 2026 11:30:00 +0000

BookStack v25.12.4 has been released.

This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area, opening up risk of potential phishing and/or tracking by bad page editors.

BookStack Security Release v25.12.3

Thu, 29 Jan 2026 15:30:00 +0000

BookStack v25.12.3 has been released.

This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.

BookStack in 2025

Fri, 02 Jan 2026 10:15:00 +0000

2025 has been a big year for BookStack, especially with us reaching a decade of BookStack back in July! As we jump into 2026 we’ll take this opportunity to look back at how the project has progressed over the last year:

BookStack Security Release v25.12.1

Tue, 30 Dec 2025 17:30:00 +0000

BookStack v25.12.1 has been released.

This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted. These changes help prevent potential abuse to host disk space usage and/or service availability.

BookStack Release v25.12

Wed, 24 Dec 2025 12:15:00 +0000

Merry Christmas and happy holidays! Today we release BookStack v25.12. With prior recent releases being focused on back-end changes, I focused on this next release being a Christmas present composed of a variety of improvements and additions that would more directly impact BookStack users, so I hope you find something merry in this new version of BookStack!

BookStack Security Release v25.11.6

Tue, 09 Dec 2025 21:00:00 +0000

BookStack v25.11.6 has been released.

This is a security release to address a vulnerability in our dependencies related to XML handling, which could allow users to replay SAML authentication requests with specially crafted & manipulated requests.

BookStack Release v25.11

Sun, 09 Nov 2025 13:00:00 +0000

Today arrives BookStack v25.11 which makes some significant changes to the database structure, while expanding on API capabilities along with other various improvements.

Azure/Entra OIDC User Avatar Images on Initial Login

Sat, 01 Nov 2025 15:00:00 +0000

This hack hooks into the OIDC login process to fetch and assign user avatar images from Azure/Entra on first user login/registration.

Tag Values in Page Content via Includes

Sat, 16 Aug 2025 00:00:00 +0000

This hack allows you to dynamically pull in the value of tags into page content, via customizing how page include tags are parsed. This hack will attempt to use tags on the page itself, then look to the parent chapter (if existing), then the parent book’s tags.

BookStack Release v25.07

Wed, 30 Jul 2025 08:47:00 +0000

Today we release the July 2025 version of BookStack which brings a varied bundle of improvements across the platform for better editing, extra customization capabilities and more!

A Decade of BookStack

Sat, 12 Jul 2025 21:48:00 +0000

BookStack is now over 10 years old! The initial commit for the project was made on the 12th of July 2015, and here we are a decade later. A massive thanks to all those who have contributed to the project. Whether that’s via providing code, reporting issues, providing translations, sponsoring, purchasing support, creating content, interacting with the community, or even just mentioning BookStack to others; This all helps drive the project forward and build motivation to keep the platform evolving.

Things I'm Proud of in the BookStack Project

Tue, 08 Jul 2025 09:22:00 +0000

With the BookStack project soon to be a decade old, I thought it’d be a great time to take a positive look back and assess the things I’m proud about regarding the project.

Mermaid Viewer

Fri, 27 Jun 2025 00:00:00 +0000

This hack enables interactive Mermaid diagrams to be rendered within a page on BookStack. The Mermaid diagram code itself can be written & edited using either BookStack’s WYSIWYG editor, by creating a code block and assigning it the language “mermaid”, or via the Markdown editor using standard mermaid code fences like so:

Interactive Embedded Page Drawings

Sun, 22 Jun 2025 00:00:00 +0000

This hack will, on page view, attempt to convert any drawing images into interactive embedded drawing viewers so that you’ll be able to pan & zoom around the drawings while also being able to interact with things like links within the drawings.

BookStack Release v25.05

Sat, 31 May 2025 13:30:00 +0000

Today we have the May 2025 release of BookStack. The headline features of this new version are focused on new comment abilities but we have some other goodies packaged in also!

Using BookStack as a Linux File System

Sun, 20 Apr 2025 10:46:00 +0000

For a while I’ve been playing with the idea of being able to mount a BookStack instance as a Linux file system. I attempted this a while ago, but recently dedicated a day to finishing up a proof on concept for this. The resulting project, with usage details, can be found here on Codeberg:

Testing Better Dependency Management

Mon, 17 Mar 2025 18:00:00 +0000

Yesterday I released BookStack v25.02.1 which included a range of updates to the system CLI, one of which being a new command:

BookStack Release v25.02

Wed, 26 Feb 2025 14:30:00 +0000

Today we release BookStack v25.02! This aimed to be a maintenance release with the primary goal of upgrading our core framework, but it grew a little to include some goodies like automatic sorting, theme system additions, and editor improvements.

BookStack in 2024

Mon, 06 Jan 2025 14:02:00 +0000

As we cross over yet another year boundary we look back at the progress, maintenance and funding of the project for 2024 with a view of potential plans in 2025:

BookStack Release v24.12

Mon, 23 Dec 2024 12:00:00 +0000

For this Christmas time period we have BookStack v24.12 which includes the gift of a new import & export format, while improving upon the new editor introduced in the last release.

Exporting & Importing Content

Fri, 20 Dec 2024 00:00:00 +0000

BookStack allows its content to be exported in a range of formats, while also providing a few options for importing content. Note that these options are not intended for backup or restore, for which you can find relevant documentation here.

Dynamic Glossary

Wed, 13 Nov 2024 16:20:00 +0000

This hack adds the ability to write global and book-level glossaries, which will then be utilised when viewing pages by marking those words in page content with a dashed underline. On hover, the set definitions will show in a popup below the word.

BookStack Security Release v24.10.2

Wed, 13 Nov 2024 12:00:00 +0000

BookStack v24.10.2 has been released.

This is a security release to address a vulnerability in our dependencies where specifically formatted requests could be used to manipulate application configuration in environments where a certain PHP option (register_argc_argv) is enabled. This is not an option that’s typically enabled in production web-serving environments, but it’s advised to update where uncertain.

BookStack Release v24.10

Wed, 09 Oct 2024 09:50:00 +0000

This laggard of a release finally lingers to deployment this day in October bringing the first alpha-state inclusion of the new WYSIWYG editor, which has been the main development focus, but that doesn’t stop a few other goodies being included for this release too!

BookStack Project Update for September 2024

Thu, 12 Sep 2024 10:00:00 +0000

Since we’ve gone a few months without an update I thought it’d be good to provide a post regarding project progress & other activities, so here’s what’s been going on over the last few months:

BookStack Security Release v24.05.4

Thu, 29 Aug 2024 15:00:00 +0000

BookStack v24.05.4 has been released.

This is a security release to address issues found in LDAP group syncing, where in certain scenarios a user could be matched to extra roles incorrectly, and an issue with content visibility in “book-show” API responses which would not have permissions applied properly.

Nine Years of BookStack

Fri, 12 Jul 2024 11:00:00 +0000

Today the BookStack project becomes 9 years old! Like last year’s post, and the years before it, we’ll take this as an opportunity to provide an update on the status of the project including the financials, current development status, and the growth figures.

Prune Revisions Command

Thu, 23 May 2024 13:00:00 +0000

This hack registers a custom command using the logical theme system, which will prune the revisions of a specific page to just those with a changelog provided (in addition to the current revision), before resetting the revision numbers across the remaining versions to be sequential without gaps. This will also reset the overall revision count on the page.

BookStack Security Release v24.05.1

Tue, 21 May 2024 10:00:00 +0000

BookStack v24.05.1 has been released. This is a security release that adds extra rate-limiting to some forms that are accessible without authentication, while also implementing changes to prevent methods that could be used to indicate if specific user emails exist in the system.

Content Tags

Tue, 14 May 2024 00:00:00 +0000

While BookStack has a hierarchy at the center of the platform to organise content, you can sometimes desire an extra dimension of categorisation for content. Tags in BookStack offer this in a flexible manner, where a tag can represent a category and value across all levels & parts of the hierarchy.

BookStack Release v24.05

Sat, 11 May 2024 13:36:00 +0000

Today we release a new BookStack feature update that’s mainly focused on updating the core underlying framework and some accompanying code, but that work comes with a sprinkling of extra additions and tweaks too.

Updating PHP & Composer

Wed, 08 May 2024 00:00:00 +0000

While we try to ensure a fairly steady & stable path for BookStack updates, requirements do change as software develops & moves on. In particular, the minimum required version of PHP will increase about once per year. Every so often we also may require a new minimum version of composer to be used for BookStack. This page details the common steps required to update these both.

Content Storage Format

Sun, 03 Mar 2024 00:00:00 +0000

When building up a documentation store, or assessing platform options, it can be useful to understand how data is stored so you know how portable & accessible your content is. This page aims to clearly lay-out how content is stored within BookStack and what our general project aims are when it comes to data storage, content formats, and how these may lead design & development decisions.

BookStack Release v24.02

Wed, 28 Feb 2024 13:36:00 +0000

For our first feature release of 2024 we have a variety enhancements to enjoy! Many of these build upon the work from the previous release, while many others address some common pain-points in BookStack.

BookStack Security Release v23.12.3

Mon, 26 Feb 2024 12:00:00 +0000

BookStack v23.12.3 has been released. This is a security release that addresses a vulnerability in PDF generation that could be exploited to perform blind server-side-request forgery.

Attachments

Wed, 17 Jan 2024 00:00:00 +0000

Within BookStack you can attach files & links to pages, so they can be referenced within content and shown available for download. Access to attachments is controlled via view permissions to the page they’re uploaded to, so users can only access attachments for pages they can view in the system.

BookStack in 2023

Thu, 04 Jan 2024 12:35:00 +0000

As we enter into 2024 I thought we’d once again look back over the past year to review the development of the platform throughout 2023 while also diving into topics about the wider project including funding and the impact of AI.

BookStack Release v23.12

Fri, 29 Dec 2023 12:10:00 +0000

As a little Christmas-time treat we have BookStack v23.12 slipping in as the last release of the year. This release focuses on providing a simple WYSIWYG editor for description inputs, along with adding default page templates within books, in addition to some other additional gifts.

BookStack Security Release v23.10.3

Mon, 20 Nov 2023 14:00:00 +0000

BookStack v23.10.3 has been released. This is a security release that addresses a vulnerability in image handling which could be exploited to perform server-side requests or read the contents of files on the server system. Additionally, this update addresses a lack of permission check in some image creation actions.

BookStack Release v23.10

Mon, 30 Oct 2023 11:43:00 +0000

This October maintenance release brings with it more than originally planned, with a significant revamp of user self-management in addition to an updated editor design, along with many other additions & improvements.

Format Webhooks for Pushover

Fri, 20 Oct 2023 16:00:00 +0000

This is a hack to adapt outgoing webhooks from BookStack so that they are directly compatible with the pushover message API. It specifically targets pushover webhook endpoints, so this won’t affect non-pushover webhooks.

BookStack Release v23.08

Wed, 30 Aug 2023 11:43:00 +0000

The August release of BookStack is now here! This is focused upon an initial implementation of a notification system for content, but as usual there are a few other improvements to enjoy.

A YouTube Alternative for our Video Content

Fri, 04 Aug 2023 21:30:00 +0000

Since setting it up in 2021, the BookStack YouTube channel has grown to be a fairly significant repository of guides and visual project updates. Our following on YouTube has also grown reaching 1.5k subscribers, which means I can even earn from our content on the platform as an extra minor revenue stream.

Eight Years of BookStack

Wed, 12 Jul 2023 11:30:00 +0000

As we veer towards the middle of July we hit the 8-year mark for the BookStack project. Following the pattern from previous years, we’ll compare the project’s various metrics year-on-year, and provide an update on finances.

BookStack Release v23.06

Fri, 30 Jun 2023 10:00:00 +0000

Today brings us BookStack v23.06 which aims to improve how comments are displayed & used, while also providing a revamp to the image manager among many other fixes and improvements.

BookStack System CLI

Fri, 23 Jun 2023 00:00:00 +0000

The BookStack System CLI allows easy running of BookStack infrastructure-level tasks such as backing up, restoring or updating. The CLI is distributed with the BookStack project source code, although the CLI is self-contained and can run independently of a BookStack instance.

WYSIWYG Docx Import

Wed, 07 Jun 2023 09:00:00 +0000

This hack adds the ability to import “.docx” files into the WYSIWYG editor, by dragging and dropping a “docx” file into the editor area. The file contents are converted to HTML then inserted into the editor at the current cursor position.

WYSIWYG Editor Autocomplete Suggestions

Thu, 04 May 2023 16:00:00 +0000

This hack adds custom autocomplete suggestions to the WYSIWYG page editor (TinyMCE). An autocomplete popup box will show after a “trigger character” (: as configured by default in this hack) is entered after a space, or at the start of a line. Pressing the Escape key will close the autocompleter.

WYSIWYG Editor Footnotes

Wed, 03 May 2023 23:00:00 +0000

This hack adds some level of “footnote” support to the WYSIWYG editor. A new “Footnote” button is added to the toolbar, next to the “Italic” button, that allows you to insert a new footnote reference. Footnotes will automatically be listed at the bottom of the page content. The reference numbering is automatic, chronologically from page top to bottom. New references will change existing numbering if inserted before.

BookStack Release v23.05

Wed, 03 May 2023 10:00:00 +0000

BookStack v23.05 releases today, sneaking into the start of May with a bunch of additions, updates and changes including a new command line tool to help with admin operations.

BookStack Project Update for March 2023

Fri, 31 Mar 2023 07:20:00 +0000

There’s no new feature release for BookStack this month, due to various distractions and the type of work done in this release cycle, so I thought it’d be good to instead provide a general project update to highlight what has happened in the last month or so.

Custom WYSIWYG Editor Buttons

Fri, 24 Mar 2023 00:00:00 +0000

This hack provides an example of adding custom actions to the WYSIWYG page editor (TinyMCE). By default, this adds an additional “…” overflow menu to the end of the WYSWIYG toolbar, which contains a single new “Insert Cat” button that has a custom icon. When clicked, this adds a placeholder kitten image into the page.

IFrame Specific Tweaks

Mon, 20 Mar 2023 00:00:00 +0000

This hack will add custom styles & scripts, hiding many parts of the interface while adding additional light/dark mode control, intended to provide a cleaner view that’s suitable for use within iframes embedded on external pages.

Page Export Contents List

Thu, 16 Mar 2023 00:00:00 +0000

This hack uses the visual theme system to customize the page export template file, used for both PDF and HTML exports, to add a simple linked “Contents” list to the top of the file, generated from the headers within the document.

Filesystem Permissions

Mon, 27 Feb 2023 00:00:00 +0000

BookStack requires the ability to write and read files for various uses such as writing logs, handling file uploads and running application code. Ideally, files permissions should be limited to just what’s required to reduce the chance of potential vulnerability exploit.

Render TeX/LaTeX Mathematics with MathJax

Mon, 27 Feb 2023 00:00:00 +0000

This hack will allow TeX/LaTeX mathematic markup to be rendered within a page on BookStack using MathJax.

Inline math can be surrounded with $ and math blocks can be surrounded with $$ or \[...\]. Additionally LaTeX environments and \ref{...} commands will be processed.

BookStack Release v23.02

Sun, 26 Feb 2023 11:00:00 +0000

BookStack v23.02 is here, acting primarily as a maintenance release to upgrade the underlying framework while optimizing things and making a few other additions.

Customization Hacks on the BookStack Site

Wed, 15 Feb 2023 17:30:00 +0000

Over the last few years BookStack has gained a few different methods that can be used to customize functionally and aesthetics. Quite often, for ideas that don’t quite fit for quick implementation within the core BookStack codebase, I’d provide a simplistic customization that can used to achieve that idea right now, using BookStack’s methods of hackery. These were scattered around GitHub issues, GitHub gists and discord messages, which required me to also provide implementation guidance each time. To organize and streamline the process of sharing these, there’s now a dedicated section on the BookStack site:

Simple Latest Pages RSS Feed

Sun, 12 Feb 2023 20:00:00 +0000

This is a hack to add a simple latest-page RSS feed to the BookStack using the logical theme system. A YouTube video covering the build and use of this customization can be found here.

BookStack Security Release v23.01.1

Thu, 02 Feb 2023 12:25:00 +0000

BookStack v23.01.1 has been released. This is a security release that addresses a potential vulnerability in PDF generation that could be used to make server-side requests or run potential other PHP code.

BookStack Release v23.01

Tue, 31 Jan 2023 11:45:00 +0000

To start off our releases for the year we have BookStack v23.01 which adds many user experience enhancements & options while also making subtle further back-end changes to permissions.

Custom Login Form Message

Fri, 27 Jan 2023 00:00:00 +0000

This logical theme system hack allows you to show a custom message on the login form, above the inputs and below the title.

Force Page Content Links to Open in New Tabs

Fri, 27 Jan 2023 00:00:00 +0000

This hack will force HTML links, within the main content body of a page, to open in a new tab.

Autosort Tagged Books

Mon, 23 Jan 2023 20:00:00 +0000

This is a hack to BookStack to enable auto-sorting of book chapters and pages upon page or chapter create/update. It sorts by name, ascending, with chapters first. By default it will run for any book with an Autosort tag assigned.

BookStack in 2022

Thu, 05 Jan 2023 23:00:00 +0000

Well 2022 is now in the past. During the year BookStack had a few milestones which included reaching the top of Hacker News, becoming 7 years old and hitting 10K stars on GitHub. In this post we’ll look back on how the project has progressed over the year, not just in terms of the codebase but also elements of the wider project as a whole.

Getting Around and Finding Content

Mon, 12 Dec 2022 00:00:00 +0000

There are many ways to get around and find content within your BookStack instance outside of following the core hierarchy. Below is an overview of some common options.

Notify Page Updates for Tagged Books

Thu, 01 Dec 2022 20:00:00 +0000

This allows you to configure notifications to be sent to users within roles defined via tags applied to parent books. For example, if a tag with name Notify and value Admins, Viewers is applied to a book, updates to pages within will be notified via email to all users within the “Admins” and “Viewers” roles.

Notify Updates for Favourited pages

Thu, 01 Dec 2022 20:00:00 +0000

This hack sends out page update notification emails to all users that have marked that page as a favourite.

Considerations

The sending of emails may slow down page update actions, and these could be noisy if a user edits a page many times quickly.
You may run into email system rate-limits with the amount of emails being sent.

Options

You can customize the email message, if desired, by editing the lines of text within the toMail part at around lines 23-25 of the functions.php code.

Code

functions.php

Download | Logical Theme System

<?php

use BookStack\Activity\ActivityType;
use BookStack\Activity\Notifications\Messages\BaseActivityNotification;
use BookStack\Entities\Models\Page;
use BookStack\Facades\Theme;
use BookStack\Theming\ThemeEvents;
use BookStack\Users\Models\User;
use Illuminate\Notifications\Messages\MailMessage;

// This customization notifies page-updates via email to all users that have marked
// that updated page as a favourite, excluding the user performing the update

// This notification class represents the notification that'll be sent to users.
// The text of the notification can be customized within the 'toMail' function.
class PageUpdatedNotification extends BaseActivityNotification {
    public function toMail($notifiable): MailMessage
    {
        /** @var Page $page */
        $page = $this->detail;
        $updater = $this->user;
        return (new MailMessage())
            ->subject('BookStack page update notification')
            ->line("The page \"{$page->name}\" has been updated by \"{$updater->name}\"")
            ->action('View Page', $page->getUrl());
    }
}

// This function does the work of sending notifications to the relevant users that have
// marked the given page as a favourite.
function notifyThoseThatHaveFavouritedPage(Page $page): void {
    // Find those we need to notify, and find the current updater of the page
    $userIds = $page->favourites()->pluck('user_id');
    $usersToNotify = User::query()->whereIn('id', $userIds)
        ->where('id', '!=', $page->updated_by)
        ->get();
    $updater = User::query()->findOrFail($page->updated_by);

    // Send a notification to each of the users we want to notify
    foreach ($usersToNotify as $user) {
        $user->notify(new PageUpdatedNotification($page, $updater));
    }
}

// Listen to page update events and kick-start our notification logic
Theme::listen(ThemeEvents::ACTIVITY_LOGGED, function (string $type, $detail) {
    if ($type === ActivityType::PAGE_UPDATE && $detail instanceof Page) {
        notifyThoseThatHaveFavouritedPage($detail);
    }
});

BookStack Release v22.11

Wed, 30 Nov 2022 12:30:00 +0000

Just sneaking into November is BookStack v22.11 which comes with a splendid spread of surprises intended to enhance many existing interfaces and features of BookStack. There’s no upgrade notices for this one, so let’s jump right in.

Username-based Login

Fri, 25 Nov 2022 20:00:00 +0000

This is a hack to BookStack, using the theme system, so that login presents itself as a username. Upon login attempt, this will match to a user of <username>@<configured-domain> within the database.

Page Templates

Thu, 24 Nov 2022 00:00:00 +0000

Within BookStack you can mark a page as a template so that its content can easily be reused when editing and creating pages. This can be super useful when you need to create many pages following a similar format.

Drawings & Diagrams

Fri, 28 Oct 2022 00:00:00 +0000

BookStack has built-in support for creating and editing drawings via integrating with diagrams.net. This integration provides very powerful drawing/diagram editing capabilities for a range of use-cases. By default BookStack will use the online version of diagrams.net but this is configurable by an admin.

BookStack Release v22.10

Fri, 21 Oct 2022 10:15:00 +0000

This spooky season supplies us with BookStack v22.10, which continues our work to improve permission control while bringing along some extra treats, without any tricks.

Reaching 10k GitHub Stars & A look at first sharing BookStack

Thu, 15 Sep 2022 12:15:00 +0000

Today, after over 7 years of continuous active development, we’ve now reached 10,000 stars on GitHub! 🥳 🥳 🥳

Previously when hitting star milestones I’ve written about the the project growth relative to this metric but, since I’ve already published such as post this year, I thought we’d do something different via video.

BookStack Release v22.09

Thu, 08 Sep 2022 11:30:00 +0000

The BookStack September release is here with a variety of desired features that build upon, and enhance, existing BookStack systems. As usual, it also includes language updates and a bunch of tweaks & fixes.

A Look at Some Interesting Documentation Methods

Thu, 25 Aug 2022 12:00:00 +0000

As the maintainer of a documentation platform, I find myself taking note of methods of how people go about creating documentation. I strongly believe that there’s no “single best method” when it comes to documentation, and that any option that’d actually be used is a value gain.

BookStack Security Release v22.07.3

Thu, 11 Aug 2022 12:00:00 +0000

BookStack v22.07.3 has been released. This is a security release that adds additional filtering to page content to prevent certain cross-site-scripting techniques. These cross-site-scripting techniques would be already by blocked by BookStack’s usage of Content-Security-Policy, but this change will help scenarios where BookStack content is used externally.

BookStack Release v22.07

Thu, 28 Jul 2022 13:30:00 +0000

For July we have what could be considered a “stepping-stone” release since it marks the start of some underlying permission system changes but it does bundle in a rich set of system enhancements & minor features. Let’s jump right in.

Seven Years of BookStack

Tue, 12 Jul 2022 14:25:00 +0000

Another year goes by with BookStack now being 7 years in development from its original commit on the 12th of July 2015. In this post we’ll continue the yearly tradition of reviewing the figures while exploring how this year has proved different to the years before it.

BookStack Release v22.06

Fri, 24 Jun 2022 11:00:00 +0000

BookStack v22.06 is now here! This release was primarily refinement focused but it does include some great new features that may streamline your usage of the platform.

BookStack Release v22.04

Fri, 29 Apr 2022 12:00:00 +0000

Today brings the release of BookStack v22.04! This includes the much-awaited feature of easier page editor switching, in addition to a bunch of other additions and improvements.

Ubuntu 22.04 BookStack Install Script Now Available

Thu, 21 Apr 2022 15:30:00 +0000

To support today’s release of the next LTS version of Ubuntu, 22.04 (Jammy Jellyfish), we have added a new BookStack install script for users of this OS:

Reaching 9000 Stars & The Effects of Hacker News

Tue, 05 Apr 2022 10:00:00 +0000

It’s been a while since I last put out a blogpost regarding a GitHub star milestone, with the last being a December 2017 blogpost where we hit 1000 stars. Well today I’m happy to say we’ve now hit 9,000 stars on GitHub! 🥳 🥳 🥳

BookStack Release v22.03

Wed, 30 Mar 2022 12:00:00 +0000

Today we release BookStack v22.03 which features some further additions to the WYSIWYG editor, aiming to align its feature-set with our markdown editor. We also see some changes to the settings view while LDAP users get a useful new debugging option.

Introducing BookStack Support Services

Mon, 21 Mar 2022 10:30:00 +0000

Today I’m happy to announce availability of official BookStack support services! These services are broken down into a couple of different plans, the detail of which can be found on our new support page.

BookStack Security Release v22.02.3

Mon, 07 Mar 2022 15:00:00 +0000

BookStack v22.02.3 has been released. This is a security release that adds better protections against embedded content that could be used in malicious ways. This effectively restricts embedded iframe content in an allow-list approach.

BookStack Release v22.02

Sat, 26 Feb 2022 12:00:00 +0000

Today we announce the first BookStack feature release of 2022. This brings updates & features to the WYSIWYG editor, user management API endpoints and much more. In this post we cover features added in this release in addition to some notable changes in the v21.12 patch releases.

Contributing to BookStack (And Open Source)

Sat, 12 Feb 2022 20:00:00 +0000

A few times recently people have asked how they can get involved and help BookStack so I thought I’d formalize my response into this blog post. While the below is my view in regards to BookStack contributions, it will likely apply to many open source projects

BookStack Security Release v21.12.1

Thu, 06 Jan 2022 11:00:00 +0000

BookStack v21.12.1 has been released. This is a security release that better enforces permissions on book-sort & chapter-move operations to address scenarios where content could be moved to non-permissible locations.

BookStack in 2021

Fri, 31 Dec 2021 19:30:00 +0000

Thought it would be nice to take some time out to look back over the last year and review how things have progressed. This’ll be a relatively high level summary but more detailed figures can be found in our six years of BookStack post from back in July.

BookStack Release v21.12

Wed, 22 Dec 2021 16:45:00 +0000

As our last feature release of the year BookStack v21.12 is now available. Upon a bunch of fixes & improvements, this release features outgoing webhooks in addition to the ability of copying entire chapters and books.

Email & Webhooks

Tue, 21 Dec 2021 00:00:00 +0000

Within BookStack email is used in various ways relating to user management & authentication. Outgoing webhooks are available as a mechanism to extend BookStack or notify in an event-driven manner.

BookStack Security Release v21.11.3

Wed, 15 Dec 2021 13:00:00 +0000

BookStack v21.11.3 has been released. This is a security release that helps prevent potential discovery and harvesting of user details including name and email address.

BookStack Security Release v21.11.2

Tue, 30 Nov 2021 14:15:00 +0000

BookStack v21.11.2 has been released. This is a security release that address a couple of vulnerabilities relating to API access and page draft related content visibility:

BookStack Release v21.11

Tue, 16 Nov 2021 10:04:45 +0000

Today we release BookStack v21.11 which focuses on a couple of areas that have gone untouched for a while; Those areas being tags and the site-wide search system. These changes sit upon more substantial framework upgrade work that has occurred this release cycle.

BookStack Security Release v21.10.3

Mon, 01 Nov 2021 12:00:00 +0000

BookStack v21.10.3 has been released. This is a security release that address a couple of vulnerabilities within the attachment and image serving mechanisms. The attachment vulnerability could result in users uploading content to be served in a way that can be utilized for phishing. The image serving vulnerability could result in unintended file access within your BookStack storage folder.

BookStack Security Release v21.10.2

Thu, 28 Oct 2021 15:00:08 +0000

BookStack v21.10.2 has been released. This is a security release that builds upon changes in v21.10.1 which covers a vulnerability which would allow malicious users, who have permission to update or create pages, to upload content that could then be utilized for phishing or other general malicious intent.

BookStack Security Release v21.10.1

Wed, 27 Oct 2021 11:30:08 +0000

BookStack v21.10.1 has been released. This is a security release that covers a vulnerability which would allow malicious users, who have permission to update or create pages, to upload content that could then be utilized for phishing or other general malicious intent.

BookStack Release v21.10

Mon, 25 Oct 2021 14:20:00 +0000

October brings us BookStack v21.10. This release is primarily intended to wrap up a few loose ends before we make more substantial framework changes, but it does bring with it a new authentication option in addition to some new API endpoints. In the below we’ll dive into many of the new features and improvements added since v21.08.

OpenID Connect Authentication

Thu, 21 Oct 2021 00:00:00 +0000

OpenID Connect (OIDC) can be used within BookStack as a primary method of authentication. This replaces the default email & password authentication mechanism. BookStack supports a simple level of auto-discovery to ease endpoint and key management.

The Services We Use

Fri, 15 Oct 2021 16:39:32 +0000

Now that I’ve got a bit more time to work on BookStack, I thought it’d be good to do something a little different on the blog and pay tribute to the services we use to help manage the project. Keep in mind that this is not a complete listing of projects that we use within BookStack itself, but instead a listing of the services and projects that we use from a project & code management point of view.

BookStack Security Release v21.08.5

Fri, 08 Oct 2021 20:53:08 +0000

BookStack v21.08.5 has been released. This is a security release that covers a vulnerability which would allow malicious users, who have permission to update or create pages, to load content from files stored within the storage/ or public/ directories (Such as application logs) via the page HTML export system.

BookStack Security Release v21.08.2

Sat, 04 Sep 2021 14:12:36 +0000

BookStack v21.08.2 has been released. This security release is intended to cover a couple of XSS vulnerabilities, where a malicious user with page edit access could enter script that would execute upon page view. You should update as soon as possible if you allow untrusted users to edit content in your instance.

BookStack Release v21.08

Tue, 31 Aug 2021 21:01:23 +0000

Today we release BookStack v21.08, which brings along multi-factor authentication support in addition to a number of other nice features. Within this post we’ll dive into some of the biggest new changes since the v21.05 release.

Six Years of BookStack

Tue, 13 Jul 2021 19:00:00 +0000

Well there goes another year, A year of worldwide lock-downs and uncertainty but BookStack development has pushed on and now we’re at 6 years since the original commit on the 12th of July 2015. To mark the milestone we’ll look at the figures, go into some upcoming plans and distribute some thanks.

BookStack Release v21.05

Sun, 30 May 2021 14:32:33 +0000

BookStack v21.05 has now been released which brings along new user interface features & enhancements including a favourites system and easier in-book navigation.

Roles and Permissions

Thu, 15 Apr 2021 00:00:00 +0000

Within BookStack the abilities of a user are controlled by the roles assigned to them and the permissions provided to those roles. A user can be assigned multiple roles, in which case the permissions will stack and the user will receive any ability if any of the roles is provided that specific ability.

BookStack Release v21.04

Fri, 09 Apr 2021 20:20:00 +0000

Today is the launch of BookStack v21.04 which is our next feature release after Beta v0.31. For this release we’re dropping the beta and changing our version scheme as detailed below. This release has no single major feature but is instead focused on a range of fixes, improvements and community contributions.

Beta Security Release v0.31.5

Tue, 02 Feb 2021 21:30:00 +0000

BookStack v0.31.5 has been released. As with the previous release (v0.31.4) this updates the Laravel framework version used to help avoid a potential vulnerability when requests were crafted in a certain manner. While it is not known if such a case exists in BookStack, this release updates the framework as a pre-emptive measure.

Beta Security Release v0.31.4

Sat, 16 Jan 2021 18:00:00 +0000

BookStack v0.31.4 has been released. This security release updates the Laravel framework version, due to a vulnerability that could occur if request data was crafted and then used in a certain way. While it is not known if such a case exists in BookStack, this release updates the framework as a pre-emptive measure.

Replacing Google Analytics & Mailchimp

Tue, 05 Jan 2021 18:44:52 +0000

On this BookStack site I have been using Google Analytics to track visitor metrics. While not crucial to know, it’s generally useful to have an idea of the target audience, current popularity and be aware of any visitor spikes. For the email updates and email security alerts I’ve been using Mailchimp. This post explains the move to more privacy aware alternatives.

Beta Release v0.31.0

Sun, 03 Jan 2021 21:30:00 +0000

We kick of this optimistic year with BookStack v0.31 which includes some great additions & updates to existing functionality including a new recycle bin system, controllable item ownership, audit log changes, page API endpoints and much more.

Beta Security Release v0.30.7

Fri, 18 Dec 2020 14:00:00 +0000

In continuation of the patches in v0.30.6, BookStack v0.30.7 has been released to address an issue that could lead to restricted page content being made visible in exports. As with the last release, You should upgrade to this released as soon as possible if you make use of page-level permissions at all. Apologies for the frequency of security releases.

Beta Security Release v0.30.6

Thu, 17 Dec 2020 21:30:00 +0000

BookStack v0.30.6 has been released to address an issue that could lead to restricted page content being visible in certain circumstances. You should upgrade to this released as soon as possible if you make use of page-level permissions at all.

Beta Security Release v0.30.5

Sun, 06 Dec 2020 20:30:00 +0000

Phishing and and server-side request forgery vulnerabilities have been found within BookStack. Release v0.30.5 will remove this server-side request forgery issue while bringing updated wording and advisories to prevent the potential phishing vulnerability.

Beta Security Release v0.30.4

Sat, 31 Oct 2020 16:30:00 +0000

XSS and user-injected auto-redirect vulnerabilities have been found within the page content & attachment components of BookStack which BookStack v0.30.4 looks to address. These are primarily a concern if untrusted users can edit content on your BookStack instance.

Beta Release v0.30.0

Sun, 20 Sep 2020 09:30:00 +0000

Although intended to be a quick release cycle, v0.30 is now here 5 months after the last major release. Sketchy personal health, a poorly pet & a busy day-job workload, combined with constant working-from-home, have reduced the amount of time I could afford to spare working on the project but with normality somewhat returning I present BookStack v0.30 which includes an assortment of enhancements.

Five Years of BookStack

Tue, 28 Jul 2020 23:00:00 +0000

With a first commit dated Sunday the 12th of July 2015, BookStack is now over 5 years old. Looking back, those 5 years have appeared to fly by but within that time there’s been a lot of growth, both for me as a maintainer and in regards to the project itself.

Beta Security Release v0.29.3

Tue, 12 May 2020 22:30:00 +0000

BookStack v0.29.3 has been released to address an issue that could expose the names of private/restricted books.

Impact

The name of a restricted book could be viewed by non-authorised users when the book was on a shelf, and the shelves were viewed in “List View”. This could expose book names to those that did not have permission to see them, when part of a shelf.

Beta Security Release v0.29.2

Sat, 02 May 2020 11:00:00 +0000

Over the last few days some vulnerabilities in the comment system have been identified, which BookStack v0.29.2 looks to address.

Beta Release v0.29.1

Tue, 28 Apr 2020 11:00:00 +0000

After the recent release of v0.29 comes this patch update to fix some bugs while introducing some nice user experience enhancements. On this post we’ll go through a couple of them.

Beta Release v0.29.0

Mon, 13 Apr 2020 15:30:00 +0000

This Easter BookStack release welcomes a range of user-experience improvements, with features such as dark mode and improved right-to-left text support, in addition to a bunch of fixes and enhancements.

Beta Releases v0.28.1, v0.28.2 & v0.28.3

Sat, 14 Mar 2020 21:00:00 +0000

Following on from the release of v0.28, we’ve had a series of patch releases to apply a range of fixes & enhancements in addition to some translation updates. There’s nothing urgent or security related in these but they collectively include quite a few fixes so it’s still worth updating.

Beta Release v0.28.0

Mon, 03 Feb 2020 21:00:00 +0000

Our first 2020 release arrives with some great new features such as an initial API implementation and SAML2 authentication alongside further new customisation options.

Hacking BookStack

Sun, 02 Feb 2020 00:00:00 +0000

Sometimes you may want to perform deeper customisation to BookStack or extend the system to suit your use-case. The core of BookStack is fairly rigid as it’s intended to be a configured, ready-to-use system out of the box but there are a few advanced options for performing more advanced modifications without needing to alter the system code-base.

SAML 2.0 Authentication

Sat, 25 Jan 2020 00:00:00 +0000

BookStack can be configured to utilise a SAML 2.0 based authentication provider as a solution for users to log-in, log-out and self-register within BookStack. This replaces the default email & password authentication mechanism within BookStack. When enabled, BookStack will attempt to match the SAML user to an existing BookStack user based on a stored external id attribute otherwise, if not found, BookStack will effectively auto-register that user to provide a seamless access experience.

Page Permalinks

Fri, 24 Jan 2020 00:00:00 +0000

The URL for a page within BookStack includes a “Slug” generated based upon the name in addition to a “Slug” generated from the parent book’s name. Upon name changes of the book or page, BookStack will use the revision system to attempt resolving when old links are used but it is possible for some actions to cause old page links to no longer lead to the updated content.

Beta Release v0.27.0

Sat, 31 Aug 2019 13:00:00 +0000

BookStack v0.27 is now available which adds page templates, a new user invitation flow, a more accessible interface and a bunch of under-the-hood changes to provide a better user & developer experience.

Beta Release v0.26.0

Mon, 06 May 2019 17:00:00 +0000

After a long development cycle BookStack v0.26 is finally here, bringing a refreshed design that includes new functionality while providing a much better mobile experience.

Beta Security Releases v0.25.[3,4,5] & Our Security Process

Sun, 24 Mar 2019 20:15:00 +0000

Over the last week some security issues have been raised regarding file uploads. BookStack v0.25.3, v0.25.4 & v0.25.5 have been released to cover these issues, in addition to bringing some translation updates.

Project Roadmap & Beta Release v0.25.2

Sun, 10 Mar 2019 13:45:00 +0000

We have another patch release for BookStack v0.25 to fix bugs, update translations & to add some new configuration options. We now also have a project roadmap to provide some visibility of where the BookStack is going.

Beta Release v0.25.1

Sun, 20 Jan 2019 16:30:00 +0000

Soon after the v0.25 release last weekend we have the v0.25.1 patch release to fix some bugs, add support for s3 compatible services and to prepare for the upcoming removal of the Google Plus API.

Beta Release v0.25.0

Sat, 12 Jan 2019 22:45:00 +0000

2019 is here and to kick it off we have BookStack v0.25. This release does not contain any major new features but instead is focused on making improvements to existing systems within BookStack.

Subdirectory Setup

Thu, 04 Oct 2018 00:00:00 +0000

You may want to host BookStack on a “Subdirectory” of your website, For example https://example.com/bookstack. To achieve this you will need to make some alterations to your webserver config. The details for setting this up on Apache or Nginx can be found below. You’ll need to follow the BookStack setup section after configuring any webserver.

Beta Release v0.24.0

Mon, 24 Sep 2018 11:00:00 +0000

Need a way to categorise your Books? Well BookStack v0.24 is the release for you bringing Bookshelves along with a host of other notable features such as revision removals, social authentication auto-registration and Arabic support.

Content Overview

Sun, 23 Sep 2018 00:00:00 +0000

The principles of storing information within BookStack is based of the ideas of a normal stack of books. Just like normal books, BookStack books can contain chapters and pages. You start off by creating a book which acts as the highest level of categorisation. Ideally you’d have separate books for separate topics.

Language & Locale Configuration

Sat, 11 Aug 2018 00:00:00 +0000

By default the BookStack interface is shown in English. Additional languages are supported by the wider BookStack community. English translations may show as a fallback if a chosen alternative language does not have fully up-to-date translations.

Beta Release v0.23.0

Sun, 29 Jul 2018 15:00:00 +0000

Quicker editing, better LDAP integration and Discord login are now here with BookStack v0.23 along with a good set of fixes and improvements. I must admit this release comes a little later than expected due to an unusually warm English summer making working conditions in my home office exhausting but luckily we’ve had a good number of code contributions to keep things moving.

Beta Release v0.22.0

Mon, 28 May 2018 10:00:00 +0000

BookStack v0.22 is here with a much requested homepage option in addition to changes to the drawing system and improvements. Let’s get into it:

Beta Release v0.21.0

Sun, 22 Apr 2018 17:00:00 +0000

A new version of BookStack is here. Version 0.21 improves upon a number of existing features in addition to bringing its own new capabilities to BookStack. If you are updating to this release from v0.20.0 or before it’s also worth reviewing the hefty update v0.20.1 which included a good number of fixes and improvements itself.

Beta Release v0.20.1

Sun, 25 Mar 2018 16:00:00 +0000

Today we release BookStack v0.20.1. Although this update does not include any major new features it bundles up some big behind-the-scenes changes along with a great deal of fixes and updates.

Beta Release v0.20.0

Sun, 11 Feb 2018 18:00:00 +0000

Here we have the first release of 2018 and it’s a chunky one! Not only do we have draw.io integration but thanks to a range of contributors we have extra languages and authentication options. Additionally, In this release we are testing options for theming as well as authenticated image access.

Configuring File Uploads

Fri, 12 Jan 2018 00:00:00 +0000

BookStack allows users to upload both images for content and files as attachments.

For information relating to security for file uploads please refer to the Security Page.

Other Configuration

Fri, 12 Jan 2018 00:00:00 +0000

.env Options

As part of the installation of BookStack you will have a .env file containing system options. By default this only contains a few options. Within your BookStack install directory you should also have a .env.example.complete file which contains every supported option available alongside the default value for each. You can copy options in this file to your own .env file as required. Many of the options in the .env.example.complete file are detailed in-depth in this documentation.

1000 Stars and Beta Release v0.19

Sun, 10 Dec 2017 17:00:00 +0000

Before 2017 is up we have managed to hit 1000 stars on GitHub! This reflects the continued growing momentum that the project has experienced over time considering the 500 star milestone was only passed in March of this year.

Beta Security Release v0.18.5 + Other Bugfix Releases

Sat, 11 Nov 2017 19:01:00 +0000

Security Release v0.18.5

This release fixes the following security issue:

Fixed issue where email confirmation was not forced when domain restriction was enabled. (#573)

This issue meant that if you have domain restriction enabled on sign-up, and you did not enable email confirmation, a user could sign up via email (Using an approved email domain) but then login right away without confirming they own the email.

Beta Release v0.18.0

Sun, 10 Sep 2017 18:00:00 +0000

We’re now over two years into the life of BookStack and to celebrate we have a new release, v0.18. This release unexpectedly grew in scope during development but it brings a good bunch of highly-requested features along with the biggest design change since October 2015.

Customising Visuals

Tue, 22 Aug 2017 00:00:00 +0000

You may want to customise BookStack to use custom branding, or you may just not like the default blue theme. Customising the branding of BookStack is super simple and can be done within the “Settings > Customization” area of the interface. Here you can change the application name, logo and the core colours used. Additional ways to customise are listed below:

Beta Bugfix Releases v0.17.1 to v0.17.4

Fri, 28 Jul 2017 14:00:00 +0000

Since the v0.17 feature release at the start of the month a good bunch of fixes and feature tweaks have made their way into BookStack. After 4 bugfix release we’re now at version v0.17.4. Here are some details on the changes made over the last month:

Default Page Editor

Fri, 28 Jul 2017 00:00:00 +0000

The default editor in BookStack is a ‘What You See Is What You Get’ (WYSIWYG) editor. The usage of this editor is similar to typical word-processing applications such as Word or Google Docs. For those that would prefer it, there is an alternative Markdown Editor which can be set as default or switched to where permissions allow.

Markdown Editor

Fri, 28 Jul 2017 00:00:00 +0000

If you prefer to write in a simpler format, a Markdown editor is available in BookStack. Markdown compatibility generally follows that of CommonMark, along with a few extensions including tables and task-lists. This is an alternative to the default WYSIWYG Editor.

Beta Release v0.17.0

Sun, 02 Jul 2017 21:00:00 +0000

After a few quiet months I’m happy to announce BookStack v0.17 is now ready for release. This release focuses mainly on the code editing experience throughout BookStack. Here are the handy quick-links:

Beta Bugfix Releases v0.16.2 and v0.16.3

Sun, 04 Jun 2017 16:00:00 +0000

Just a quick update on some bugfix point releases. Last month v0.16.2 was released. This fixes issues in the permission system when using the non-native php-mysql driver. More information can be found in the issue thread here.

Beta Bugfix Release v0.16.1

Sun, 30 Apr 2017 20:00:00 +0000

One week after v0.16.0 we have our first v0.16 Bugfix release. This contains the following changes and fixes:

Fixed permission updates on large books failing due to MySQL placeholder count (#374)
Added functionality to check ‘Accept-Language’ header to provide translations when not logged in. (#375)
Added HTML support back into the Markdown editor. (#378)
Refactored permission system for general speedups.

Header Image Credits: Timo Vijn

Beta Release v0.16.0

Sun, 23 Apr 2017 21:00:00 +0000

Another BookStack release is upon us. Since the last release work has been put into spring-cleaning the search system which is detailed below. Community contributions have gained some momentum bringing in some fantastic new features and fixes.

Ditching Disqus Comments

Mon, 17 Apr 2017 13:05:00 +0000

Just a small update about a change on the blog here. I have decided to drop the use of Disqus as a commenting system and instead replaced the comments area with a few simple links to my twitter and to the BookStack issues page.

Searching Content

Sun, 16 Apr 2017 00:00:00 +0000

The ability to search your documentation is vital in day-to-day use. There are a few locations within BookStack where you can search for your content. Below is a list of search functions within BookStack:

500 Stars & Release v0.15.2

Sun, 05 Mar 2017 18:05:00 +0000

Over 500 Stars

BookStack now has over 500 stars on GitHub! Yeah yeah yeah, I know, GitHub stars aren’t a great way to track the success of a project but it is nice as a periodical milestone and to give a relative idea of user growth.

Beta Release v0.15.0

Mon, 27 Feb 2017 12:45:00 +0000

Sneaking in before February closes we have another BookStack release. As well as your usual handful of bugfixes this release also comes with new sign-in options and better export functionality.

Commands

Sun, 26 Feb 2017 00:00:00 +0000

BookStack has some command line actions that can help with maintenance and common operations. There are also many commands available from the underlying Laravel framework. To list all available commands you can simply run php artisan from your BookStack install folder. Custom BookStack commands are all under the ‘bookstack’ namespace.

Beta Security Release v0.14.3

Sun, 05 Feb 2017 21:30:00 +0000

Security Bugfix release. Fixes for the following major issue:

On 404 (Not found) views page/chapter/book names were visible. No content of those items were visible, just the names. This includes instances that had ‘public viewing’ turned off.

Sincere apologies for this issue.

Beta Bugfix Release v0.14.2

Sun, 05 Feb 2017 13:30:00 +0000

Bugfix release. Fixes for the following issues:

Missing subscript styling (#284)
Fixed book contents not showing in some instances (#287, #294)

Beta Bugfix Release v0.14.1

Mon, 23 Jan 2017 22:34:00 +0000

This is a quick bugfix release for following single major bug:

Possibility that all permissions could be deleted on book sort. (#282)

If this issue occurs in your BookStack instance permission can be regenerated via the command line using php artisan permissions:regen from your BookStack install folder.

Beta Release v0.14.0

Sun, 22 Jan 2017 12:45:00 +0000

The first release of 2017 is upon us with v0.14. Since the last release, back in November, focus has been put on adding support mulitple languages as was planned but a range of additional features & bugfixes have also been added. As usual, Here are the update links:

PDF Rendering

Sun, 22 Jan 2017 00:00:00 +0000

By default BookStack uses dompdf to export pages as PDF documents. The benefit of using dompdf is that it doesn’t require any additional installation or setup but the rendering capabilities are somewhat limited.

Reusing Page Content

Sun, 22 Jan 2017 00:00:00 +0000

Within BookStack you may find that you want to include the same block of content in multiple places. You could copy and paste that content into multiple pages but then, if that content needs to be changed, you’d have to update it multiple times across different pages. By using include tags you can include entire other pages and also include single blocks of content from other pages.

LDAP Authentication

Sat, 21 Jan 2017 00:00:00 +0000

BookStack can be configured to allow LDAP based user login. While LDAP login is enabled you cannot log in with the standard user/password login and new user registration is disabled. BookStack will only use the LDAP server for getting user details and for authentication. Data on the LDAP server is not editable through BookStack.

Backup and Restore