outline

v1.9.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 17d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

docker javascript mobx nodejs react slack

+1 more

wiki

Affected surfaces

auth rbac rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 11d

The MCP API now errors on `document_update` and `collection_update` when no changes are supplied; new collections default to private visibility.

Why it matters: MCP's breaking change triggers errors for unchanged updates (severity 70) and defaults collection privacy to private, requiring developers to handle these conditions explicitly.

Summary

AI summary

Updates Other improvements, MCP, and Highlights across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Breaking
Breaking	High	`document_update` and `collection_update` tools now error when no changes occur. `document_update` and `collection_update` tools now error when no changes occur. Source: llm_adapter@2026-07-16 Confidence: high	—
Breaking	High	Newly created collections via MCP default to private visibility. Newly created collections via MCP default to private visibility. Source: llm_adapter@2026-07-16 Confidence: high	—
Breaking	Medium	Reject `collections.update` requests containing both `description` and `data`. Reject `collections.update` requests containing both `description` and `data`. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature
Feature	Medium	Desktop app now supports on-premise installations. Desktop app now supports on-premise installations. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	Login with Passkey is supported on desktop clients. Login with Passkey is supported on desktop clients. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	MCP now reads and uses templates for document creation. MCP now reads and uses templates for document creation. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	Document restore tool added to MCP workflow. Document restore tool added to MCP workflow. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	HTML input support added to `create_document` tool. HTML input support added to `create_document` tool. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	`client_name` field made optional on `/oauth/register` endpoint. `client_name` field made optional on `/oauth/register` endpoint. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	`WWW-Authenticate` header added to `/mcp` 401 responses for better client handling. `WWW-Authenticate` header added to `/mcp` 401 responses for better client handling. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Markdown input such as `---` works after a soft-break. Markdown input such as `---` works after a soft-break. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Table menus in editor include alignment options for rows. Table menus in editor include alignment options for rows. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Slack-style `+:100:` reaction shorthand is supported. Slack-style `+:100:` reaction shorthand is supported. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	`PROXY_HEADERS_TRUSTED` env option added (defaults to true). `PROXY_HEADERS_TRUSTED` env option added (defaults to true). Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	CloudFront support for signed attachment URLs. CloudFront support for signed attachment URLs. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Table sorting becomes IP-address aware. Table sorting becomes IP-address aware. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Small images can be displayed inline for iconography. Small images can be displayed inline for iconography. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Presigned PUT uploads supported for S3-compatible storage. Presigned PUT uploads supported for S3-compatible storage. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Image corner drag resizing is enabled. Image corner drag resizing is enabled. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Spec-compliant OIDC logout added. Spec-compliant OIDC logout added. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Support for OIDC provider returning JWT from userinfo endpoint. Support for OIDC provider returning JWT from userinfo endpoint. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	In-page search performance improved. In-page search performance improved. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Markdown serialization speed improved. Markdown serialization speed improved. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix
Bugfix	Medium	PDF display now correctly scales on mobile devices. PDF display now correctly scales on mobile devices. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Low	Place cursor at start of inserted table row/column. Place cursor at start of inserted table row/column. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Improve patch merging of links in table cells through MCP. Improve patch merging of links in table cells through MCP. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Code blocks auto-collapse while editing. Code blocks auto-collapse while editing. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Prevent selecting word-joiner characters around multiplayer cursor. Prevent selecting word-joiner characters around multiplayer cursor. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Fix editor math block parsing and NaN media dimensions. Fix editor math block parsing and NaN media dimensions. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Toggling a nested list no longer converts parent lists. Toggling a nested list no longer converts parent lists. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—

Full changelog

What's Changed

Highlights

It is now possible to use the desktop app with on-premise installations from this version onwards in https://github.com/outline/outline/pull/12742
Login with Passkey is now supported on desktop in https://github.com/outline/outline/pull/12749
Markdown input such as --- now work after a soft-break in https://github.com/outline/outline/pull/12925

MCP

Now supports reading and using templates in https://github.com/outline/outline/pull/12639
Added document restore tool in https://github.com/outline/outline/pull/12575
document_update,collection_update tools now return error when no changes occur in https://github.com/outline/outline/pull/12890
Add HTML input support to `create_document tool by @Ali-ovo in https://github.com/outline/outline/pull/12943
Newly created collections via MCP now default to private in https://github.com/outline/outline/pull/12644
Make client_name optional on /oauth/register by @cassvail in https://github.com/outline/outline/pull/12836
Add WWW-Authenticate header to /mcp 401 responses by @cassvail in https://github.com/outline/outline/pull/12834

Other improvements

Table menus in editor were improved and now include alignment options for rows in https://github.com/outline/outline/pull/12611
Added support for Slack-style +:100: reaction shorthand in https://github.com/outline/outline/pull/12650
Added PROXY_HEADERS_TRUSTED env option (defaults to true) in https://github.com/outline/outline/pull/12676
CloudFront support for signed attachment URLs by @oliinykdm in https://github.com/outline/outline/pull/12656
Table sorting is now IP-address aware in https://github.com/outline/outline/pull/12734
Small images can now be displayed inline for iconography in https://github.com/outline/outline/pull/12776
Added support for presigned PUT uploads for S3-compatible storage by @nmnmcc in https://github.com/outline/outline/pull/12748
Image corner drag resizing is now enabled by @UmbraCi in https://github.com/outline/outline/pull/12690
Added spec-compliant OIDC logout in https://github.com/outline/outline/pull/12804
Add support for OIDC provider returning JWT from userinfo endpoint in https://github.com/outline/outline/pull/12879

Fixes

PDF display now correctly scales on mobile in https://github.com/outline/outline/pull/12608
place cursor at start of inserted table row/column in https://github.com/outline/outline/pull/12610
Improve patch merging of links in table cells through MCP in https://github.com/outline/outline/pull/12614
Code blocks auto-collapse while editing in https://github.com/outline/outline/pull/12616
Spurious post-import edits in https://github.com/outline/outline/pull/12620
Before/After creation options appear in menu when no permission on parent doc in https://github.com/outline/outline/pull/12629
Updated validateUrlNotPrivate to match implementation in SSRF in https://github.com/outline/outline/pull/12636
Widen validated emails for Azure in https://github.com/outline/outline/pull/12637
Pasted content sometimes appears in plaintext in https://github.com/outline/outline/pull/12638
Dragging images in editor in https://github.com/outline/outline/pull/12647
perf: Improve performance of in-page search in https://github.com/outline/outline/pull/12649
Prevent selecting word-joiner characters around multiplayer cursor in https://github.com/outline/outline/pull/12660
Reject collections.update requests that include both description and data in payload in https://github.com/outline/outline/pull/12648
Improve markdown serialization speed in https://github.com/outline/outline/pull/12667
Editor math block parsing and NaN media dimensions in https://github.com/outline/outline/pull/12668
Toggling a nested list no longer converts parent lists in https://github.com/outline/outline/pull/12670
Duplicate paths in export ZIP in https://github.com/outline/outline/pull/12674
Date mentions in https://github.com/outline/outline/pull/12621
Comment thread animations in https://github.com/outline/outline/pull/12677
Nested list behavior in https://github.com/outline/outline/pull/12678
Various checkbox fixes in https://github.com/outline/outline/pull/12679
perf: Server startup time in https://github.com/outline/outline/pull/12680
Tracking of block toolbars in https://github.com/outline/outline/pull/12681
Reset focusedCommentId on document nav in https://github.com/outline/outline/pull/12687
Setting attributes from col/row span in https://github.com/outline/outline/pull/12686
Encode code & math fences in table cells with
to avoid breaking rows in https://github.com/outline/outline/pull/12569
Image drop into editor in https://github.com/outline/outline/pull/12691
only users with "manage" permissions can edit page permissions by @orikad in https://github.com/outline/outline/pull/12597
Enable PDF toggle for pre -contentType files in https://github.com/outline/outline/pull/12709
Import avatar image from Azure/Entra/Microsoft in https://github.com/outline/outline/pull/12710
Allow template management to be extended to viewers in https://github.com/outline/outline/pull/12719
Pinterest host matching too broad in https://github.com/outline/outline/pull/12718
Allow webhook urls without a top-level domain when self-hosted in https://github.com/outline/outline/pull/12728
Documents shared directly with user not accessible through MCP list tool in https://github.com/outline/outline/pull/12717
Importer fails after stripping emoji within mark on first line in https://github.com/outline/outline/pull/12730
Inline code marks longer than the width of editor escape bounds in https://github.com/outline/outline/pull/12735
Newlines in block fences in table cells in https://github.com/outline/outline/pull/12740
Cmd+A in image/video captions now works correctly in https://github.com/outline/outline/pull/12751
Suggestion menus are now correctly announced to screenreaders in https://github.com/outline/outline/pull/12750
Prevent concurrent OAuth refresh attempts from revoking grant in https://github.com/outline/outline/pull/12752
Smoothed out image lightbox transition in https://github.com/outline/outline/pull/12756
Incorrect sidebar hover state with menu open in https://github.com/outline/outline/pull/12758
Collapse code blocks taller than half the viewport in https://github.com/outline/outline/pull/12743
Vertically center empty state in notifications popover in https://github.com/outline/outline/pull/12764
Viewer can disclose existing shared document in https://github.com/outline/outline/pull/12769
Remove settings from integration presenter in https://github.com/outline/outline/pull/12770
Remove quote flattening on markdown serialization in https://github.com/outline/outline/pull/12774
Notion import crash on empty table ("Index 0 out of range") in https://github.com/outline/outline/pull/12775
Ensure mention in doc emails always include context in https://github.com/outline/outline/pull/12787
Flicker of sticky table header in https://github.com/outline/outline/pull/12803
Retain location state when clicking on hash links in doc and TOC in https://github.com/outline/outline/pull/12805
Guard missing key in manifest in https://github.com/outline/outline/pull/12806
"User verification was required" during passkey signin in https://github.com/outline/outline/pull/12817
CleanupDemotedUserTask throws on deleted user in https://github.com/outline/outline/pull/12818
Guard against orphaned jobs in queue in https://github.com/outline/outline/pull/12819
Refactor find logic for non-ascii characters in https://github.com/outline/outline/pull/12813
Avoid pointless +1 on Facepile (show avatar instead) in https://github.com/outline/outline/pull/12823
Settings appear behind sidebar in https://github.com/outline/outline/pull/12824
Handle deleted user or team in UserCreatedProcessor in https://github.com/outline/outline/pull/12839
Avoid SequelizeEmptyResultError in AvatarProcessor in https://github.com/outline/outline/pull/12838
Avoid SequelizeEmptyResultError when team is missing in CollectionsProcessor in https://github.com/outline/outline/pull/12837
Remove separate editing guard on Rename action in https://github.com/outline/outline/pull/12846
revisions.list response too large in https://github.com/outline/outline/pull/12822
Cannot connect existing workspace when signed into multiple in https://github.com/outline/outline/pull/12870
mermaid Ctrl+Enter edit shortcut not working on Windows in https://github.com/outline/outline/pull/12867
Ensure accessible name to search and text inputs in https://github.com/outline/outline/pull/12869
Incorrect typing of passport request handlers in https://github.com/outline/outline/pull/12883
useMediaQuery value incorrect on first render in https://github.com/outline/outline/pull/12914
Handle transient errors in HealthMonitor in https://github.com/outline/outline/pull/12913
useIdle never triggered without user activity in https://github.com/outline/outline/pull/12908
all _FILE suffix secrets in env are cemented at startup in https://github.com/outline/outline/pull/12889
Show more useful breadcrumbs on search results in https://github.com/outline/outline/pull/12915
Various unlabeled and undescribed interactive elements in https://github.com/outline/outline/pull/12912
Sensitive fields can leak into logging when non-primitive in https://github.com/outline/outline/pull/12910
Decode percent-encoded filenames from URLs in https://github.com/outline/outline/pull/12906
Stale CSRF token sent on request retries and form submissions in https://github.com/outline/outline/pull/12888
passThrough prop not correctly applied in https://github.com/outline/outline/pull/12930
Skip attachment work in exports when includeAttachments is false in https://github.com/outline/outline/pull/12933
Math formulas not rendering correctly in HTML/PDF output in https://github.com/outline/outline/pull/12939
Comments sidebar opens on document load when draft comment exists in https://github.com/outline/outline/pull/12897
validateUrlNotPrivate hardening in https://github.com/outline/outline/pull/12938
perf: Do not load webhook content during failure check in https://github.com/outline/outline/pull/12944
correctly paste doc links with hash by @salihudickson in https://github.com/outline/outline/pull/12900

New Contributors

@eliottreich made their first contribution in https://github.com/outline/outline/pull/12662
@oliinykdm made their first contribution in https://github.com/outline/outline/pull/12656
@orikad made their first contribution in https://github.com/outline/outline/pull/12597
@nmnmcc made their first contribution in https://github.com/outline/outline/pull/12748
@UmbraCi made their first contribution in https://github.com/outline/outline/pull/12690
@cassvail made their first contribution in https://github.com/outline/outline/pull/12836

Full Changelog: https://github.com/outline/outline/compare/v1.8.1...v1.9.0

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track outline

Get notified when new releases ship.

About outline

The fastest knowledge base for growing teams. Beautiful, realtime collaborative, feature packed, and markdown compatible.