ExcaliDash
Dashboards & Home PagesA self-hosted dashboard and organizer for Excalidraw with multi-user collaboration and scoped sharing.
Features
- Persistent storage for all drawings
- Real‑time collaboration on diagrams
- Version history with restore capability
Recent releases
View all 7 releases →- ID token signing algorithm resolution with discovery fallback and explicit override
- Admin JIT provisioning toggle and OIDC-only user invitation controls
- Frontend resilience improvements with error retry and multi-image drag-and-drop import
Full changelog
Release date: 2026-04-17
| Area | Key Changes |
|------|-------------|
| OIDC hardening | ID token signing alg resolution with discovery fallback + explicit override (OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG), token endpoint auth method override (OIDC_TOKEN_ENDPOINT_AUTH_METHOD), HS-alg mismatch auto-retry in callback, Keycloak/Authentik preflight warnings, oidc-doctor.cjs diagnostic tool, provider-specific .env example files |
| Admin OIDC controls | Runtime JIT provisioning toggle via admin panel + DB (oidcJitProvisioningEnabled column + migration), OIDC-only invited user creation (oidcOnly flag), block self-registration toggle in oidc_enforced mode |
| HTTPS redirect policy | Refactored into pure httpsRedirectPolicy.ts module, new ENFORCE_HTTPS_REDIRECT env var, mixed http/https FRONTEND_URL support, IPv4 loopback healthchecks |
| Frontend resilience | AuthStatusErrorPanel with retry for backend connectivity failures, registrationEnabled propagation to hide register link/route, multi-image drag-and-drop import in Editor, Excalidraw asset copy script for dev + build |
Upgrading
Show upgrade stepsData safety checklist
- Back up backend volume (
dev.db, secrets) before upgrading. - Let migrations run on startup (
RUN_MIGRATIONS=true) for normal deploys. - Run
docker compose -f docker-compose.prod.yml logs backend --tail=200after rollout and verify startup/migration status.
Recommended upgrade (Docker Hub compose)
docker compose -f docker-compose.prod.yml pull
docker compose -f docker-compose.prod.yml up -d
Pin images to this release (recommended for reproducible deploys)
Edit docker-compose.prod.yml and pin the release tags:
services:
backend:
image: zimengxiong/excalidash-backend:v0.5.0
frontend:
image: zimengxiong/excalidash-frontend:v0.5.0
Example:
docker compose -f docker-compose.prod.yml up -d
Removed broken Save to menu entry, fixed shared-drawing undo to only roll back user's own changes, and resolved editor state issue affecting hand-tool and middle-mouse panning.
- CSRF hardening
- Session token controls
- Local registration and login
- OIDC support
- User management
- CSRF_SECRET environment variable now required for backend startup
- CSRF (Cross-Site Request Forgery) protection implementation
- Comprehensive CSRF protection on all state-changing requests
- Upload progress indicator with visual progress bar
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.