Skip to content
TrustMyStack, home

etherpad

v3.3.17
ether/etherpad

Etherpad: A modern really-real-time collaborative document editor.

Version of ether/etherpad you run

CompareView on GitHub
Maintenance
Active303 commits in 3 months · bus factor 2
License
Apache-2.0Permissive · OSI-approved
Security
24 advisories4 critical, 4 high, 14 medium, 2 low
Supported versions
No scheduleendoflife.date does not track this project

18.6k stars · 3.1k forks · 16 open issues · last release 3 days ago · data checked 35 minutes ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • v3.0.0May 16, 2026

    Breaking changes

    • Minimum required Node.js version is now 24. Node.js 22 is no longer supported. Node 25 was briefly the floor mid-cycle but was rolled back to 24 LTS (Krypton, supported through ~May 2028) because Node 25 reached end-of-life on 2026-04-10 (see #7779 / #7781). The CI matrix targets Node 24 and 26. Node 24 still ships Corepack, so existing bin/installer.sh / bin/installer.ps1 flows continue to work unchanged; the global pnpm install fallback added for the Node 25 detour is kept for forward-compatibility.
    • pnpm floor raised to pnpm@11.1.2. packageManager is now pinned to pnpm@11.1.2 and engines.pnpm requires >=11.1.2. The Dockerfile, snap, .deb and all GitHub workflows are aligned.
    • swagger-ui-express removed. /api-docs now serves a vendored, telemetry-free copy of Scalar (see the privacy item below). The route, the OpenAPI document, and the rendered output are unchanged for downstream consumers, but anything that introspected swagger-ui-express internals will need updating.
    • Debian package depends on nodejs (>= 24). The signed apt repository at etherpad.org/apt is rebuilt against this floor; older Node packages are no longer acceptable as a dependency (#7754).
  • v2.7.3May 6, 2026

    Breaking changes

    • Minimum required Node.js version is now 22.13. Node.js 20 is reaching end-of-life (see https://nodejs.org/en/about/previous-releases) and pnpm 11 hard-rejects Node releases older than 22.13. The CI matrix targets Node 22, 24, and 25. Upgrading should be straightforward — install a current Node.js release before updating Etherpad.
    • The official Docker image no longer ships curl, npm, or npx. These were dropped to remove transitive CVEs (curl/libcurl SMB advisories, npm's bundled picomatch 4.0.3 and brace-expansion 2.0.2). The container's healthcheck now uses wget (busybox built-in, always present), and Etherpad provisions pnpm via corepack for all runtime package operations. If you exec into the container and rely on curl or npm for ad-hoc tasks, install them on demand with apk add curl or use the busybox wget / pnpm already present.
  • v2.7.0Apr 22, 2026

    Breaking changes

    • Abiword has been replaced with LibreOffice for document import/export. If you were using Abiword for DOCX/ODT/PDF conversion, update your settings.json to point soffice at your LibreOffice binary. DOCX export is now supported out of the box.

Release history

All releases on GitHub
Atom feed/feed/ether/etherpad
BadgeLatest version of ether/etherpad[![version](/badge/ether/etherpad)](/p/ether/etherpad)

3.3.17

3.3.17 is a security release. It caps the length of author display names, which any visitor could set to almost 1 MB, and fixes .etherpad imports into pads created through the HTTP API. Upgrade as soon as you can.

Security

  • Pads — author display names are now type-checked and capped at 128 characters (GHSA-w4w9-j4c3-hjf6, #8475). The name sent in CLIENT_READY and USERINFO_UPDATE was stored with no type or length check, so a visitor with no account could save a name of nearly 1 MB, bounded only by the socket's message size. That name was then sent to everyone who opened the pad. A name that wasn't a string also broke the admin author search. Names must now be strings and are trimmed and cut to 128 characters, with any Unicode accepted. Names already stored are capped when read back, so oversized records are no longer rebroadcast. The pad's name fields enforce the same limit. Reported by @MAYASEVEN.

Notable fixes

  • Import — .etherpad files import again into pads created through the HTTP API (#8470). Since 3.3.13 (#8420), importing a .etherpad file from the import dialog failed with a permission error when the target pad was created by createPad, createGroupPad, admin create-pad or ep_post_data, and the file came from a pad a browser created. When the importer isn't the target pad's creator, the file's first author is now rewritten to that creator. Text keeps its original authorship. An importer still can't make themselves the creator, and pad settings still come from the target pad.

Other changes

  • Localisation updates from translatewiki.net.
  • Dependency updates.

Full release notesCompare with previous