Is it safe to update BookStack?
Tracking BookStackApp/BookStack
Update with care.
No breaking changes, schema migrations, or manual upgrade steps are mentioned, so the update itself is low-risk. However, the maintainers explicitly advise upgrading for any instance with public access or untrusted editors, and the behavioral changes to URL/srcset filtering and comment permission enforcement are security-relevant and worth verifying against any custom content policies before deploying.
What changed
v26.05.2 is a security patch addressing edge-case vulnerabilities in URL filtering, redirect handling, and comment permission checks. Content allow-filtering was extended to cover protocols inside srcset attributes, and URL filtering was consolidated into a more robust centralized utility. A missing visibility-permission check on comment deletion was also corrected. The release additionally adds Serbian as a selectable language and refreshes PHP dependencies and translations.
Source
Every verdict on Bumplog traces back to a GitHub release. No invented details.
