{
 "schema": "bumplog.app.v1",
 "generatedAt": "2026-07-26T13:02:49.522Z",
 "slug": "bookstack",
 "name": "BookStack",
 "repo": "BookStackApp/BookStack",
 "latestVersion": "v26.05.2",
 "safeToUpdate": "caution",
 "rationale": "No breaking changes, schema migrations, or manual upgrade steps are mentioned, so the update itself is low-risk. However, the maintainers explicitly advise upgrading for any instance with public access or untrusted editors, and the behavioral changes to URL/srcset filtering and comment permission enforcement are security-relevant and worth verifying against any custom content policies before deploying.",
 "changelogSummary": "v26.05.2 is a security patch addressing edge-case vulnerabilities in URL filtering, redirect handling, and comment permission checks. Content allow-filtering was extended to cover protocols inside srcset attributes, and URL filtering was consolidated into a more robust centralized utility. A missing visibility-permission check on comment deletion was also corrected. The release additionally adds Serbian as a selectable language and refreshes PHP dependencies and translations.",
 "sourceUrl": "https://github.com/BookStackApp/BookStack/releases/tag/v26.05.2",
 "lastChecked": "2026-07-09",
 "successor": null,
 "url": "https://bumplog.org/apps/bookstack/",
 "badge": "https://bumplog.org/badge/bookstack.svg",
 "lifecycle": null
}