BookStack Release v26.09

Dan Brown posted on the 24th of September 2026

Today we release BookStack v26.09, primarily aimed at introducing greater interface customization, along with API additions and other improvements.

• Update instructions
• Codeberg release page

Upgrade Notices

• Security Releases - There have been a number of security releases since v26.05. These can be found listed below, or on our updates page.
• Config - An APP_KEY value now must be set. It should be already set in the vast majority of cases, we just no longer fall back to a default value where unset, and instead error. If you get an error upon access after upgrading, ensure a key is set. You can find guidance here.

UI Layout Preferences

Within BookStack we commonly show sections of contextually relevant information. These are what you’d typically see in the sidebars, or on the home view. BookStack v26.09 introduces user control of these, allowing the sections of app layouts to be tweaked to suit specific user preferences.

Within the “My Account” area of BookStack, you’ll now find an “Interface Preferences” section which groups some existing preferences, like dark/light mode and UI language options, while also listing available layouts which can be customized:

Selecting a layout will then open the layout editor, providing a drag and drop interface for configuring where various sections are shown within each layout:

Beyond just moving and re-ordering, you can also remove sections from the layout, avoiding the display of unused & redundant UI blocks, allowing a minimal interface if desired.

While this adds a lot of extra user customizability, it also starts off a fundamental framework for managing and displaying these sections in a dynamic way, opening the door for more options in the future, along with great modification potential through our theme systems as referenced below.

Theme System: Layout Blocks

In combination with the new layout preferences, the logical theme system now provides a VIEW_BLOCKS_REGISTER event to register custom blocks. This makes it possible to define and use custom UI sections which can be configured in the same way as others via preferences. Here’s a simplified example of what registering a block looks like:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

<?php

use BookStack\Facades\Theme;
use BookStack\Theming\ThemeEvents;
use BookStack\View\BaseViewBlock;
use BookStack\View\ViewBlockManager;

class TotalStatsBlock extends BaseViewBlock
{
    // [...class code here]
}

Theme::listen(ThemeEvents::VIEW_BLOCKS_REGISTER, function (ViewBlockManager $manager) {
    $manager->register('home-default', 'unused', TotalStatsBlock::class);
});

The above would register a “TotalStatsBlock” to be made available in the default home view, although not used by default. A user could then choose to display this block within the homepage section of their layout preferences, resulting in a custom block like this:

You can find more detailed documentation on registering blocks in the logical theme system guide, and I’ll soon add an example to our hacks site.

Scroll Progress Indicator

When scrolling down longer pages in BookStack, you’ll now get a scroll page progress indicator, built into the “Back to top” button:

Originally this had been requested as a bar along the full width of the page, but I didn’t want to introduce anything which could be found highly distracting. Therefore I built this around the back to top button since that location makes contextual sense, while being subtle to avoid distractions.

API: Easier Docs Downloading

When viewing the API documentation, there are now a couple of actions to download the docs as either JSON or HTML:

The JSON format is compact and machine readable, while the HTML provides a formatted view which can be useful as an offline reference for humans or machines. There was already an API endpoint to fetch the API details as JSON, but the new download options also include the “Getting Started” guidance which provides a lot of important context.

These options are very useful for large language model use. Without a specific reference, an LLM would just guess at the API structure and requirements (which has often resulted in me, when supporting, telling folks their code is using hallucinated API endpoints). Now it’s easy to provide an exact reference context for your exact BookStack instance (which will include any endpoints added via customizations) to improve accuracy, making it way easier to use an LLM to build BookStack integrations, or to perform BookStack related tasks.

API: Book & Chapter Search

Extending out the search abilities in the API, this release adds endpoints for searching within specific books and chapters, mirroring the search inputs found on those items within the standard UI. As a request example, here’s searching a book:

1
2

GET https://example.bookstackapp.com/api/search/book/82?query=cat
Authorization: Token abc:123

The options and result format are the same as the existing search-all endpoint.

Thanks to @enableservices for contributing these new API capabilities.

API: Page Changelog Support

When creating or updating pages via the REST API, you can now provide a changelog parameter. The value of this will then be reflected in the revision history of the page, matching the ability to set a changelog message in the page editor.

As an example:

1
2
3
4
5
6
7
8

PUT https://example.bookstackapp.com/api/pages/101
Content-Type: application/json
Authorization: Token abc:123

{
    "name": "My super cute cat",
    "changelog": "Updated page title to emphasize cat cuteness"
}

Password Confirmation on Change

In the “My Account” area of BookStack, when standard email & password authentication is in use, we allow users to reset their own password. As of this release, users will now also need to provide their existing password to perform this action:

This is to prevent scenarios where passwords are changed by malicious actors when devices are shared, or accessed without permission. This does not impact any similar functionality in the setting/admin areas of BookStack just yet, but we do have plans for these areas too, once we’re able to do so in a non-irritating way (to avoid re-authentication being needed for every single little action performed).

New (Beta) WYSIWYG Improvements

The new beta WYSIWYG editor gained another big set of fixes and improvements in this release:

• Updated callout formatting shortcut handling, when in lists, to be more reliable.
• Updated code editor display so the editor area actually gains focus again.
• Updated collapsible blocks to be shadow root nodes, fixing issues with creating lists inside them.
• Updated copy/cut/paste/drag logic to specifically handle single selectable blocks like images/media.
• Updated enter/shift-enter handling for images when used directly in lists.
• Updated modal handling to delegate focus handling to the editor if focus was on the edit area before, to prevent cursor jumps to the start.
• Updated pop up form fields to be wider for easier use and to match old editor.
• Fixed ability to cut/copy/drag+drop details nodes.
• Fixed difference in line break in-editor & on export, preventing line breaks being removed on save.
• Fixed formatting on reverse selection ranges in lists.
• Fixed image node resizer not reacting to size changes.
• Fixed issue where link editor entity selection would overwrite existing link text/title.
• Fixed lack of text direction handling for code blocks.
• Fixed modals closing on out-of-window clicks, which are started from within the modal, on Chromium browsers.

I feel that things are getting relatively stable at this stage, so for the next feature release I’m planning to roll out the editor further for wider adoption and testing.

If you experience any issues, or experience function differences compared to the older WYSIWYG editor, please raise them within the feedback thread on Codeberg. Thanks again to all those who have continued to provide feedback! This isn’t something I can test alone so I’m very much grateful to those who are reporting the issues they come across.

Translations

A big thanks once again to our terrific translation taskforce who have helped ensure BookStack remains pleasant to use in a variety of languages. Here’s all those who have contributed translations since our last feature release:

• Bojan Maksimovic (PolarniMeda) - Serbian (Cyrillic) - 6088 words
• João Barbosa (hypeedd) - Portuguese - 1252 words
• dadda123 - Swedish - 1241 words
• Jeff Huang (s8321414) - Chinese Traditional - 603 words
• Qasem Talaee (qasem_talaee) - Persian - 389 words
• m0uch0 - Spanish - 344 words
• cbridi - Portuguese, Brazilian - 312 words
• toras9000 - Japanese - 309 words
• Tim (timakai) - Dutch; German - 249 words
• scureza - Italian - 233 words
• Indrek Haav (IndrekHaav) - Estonian - 198 words
• brtbr - German; German Informal - 195 words
• JanDziaslo - Polish - 195 words
• serinf-lauza - French - 164 words
• Luca (luca90043) - German - 157 words
• Vitaliy (gviabcua) - Ukrainian - 153 words
• zeronell - Chinese Simplified - 149 words
• AlwaleedAlwabel (Nick390) - Arabic - 148 words
• Honza Nagy (honza.nagy) - Czech - 145 words
• Julien Muggli (JulienMuggli) - French - 115 words
• ddeicide - Bulgarian - 78 words
• nomoreshow - Turkish - 55 words
• Calle Calmar (HrCalmar) - Danish - 28 words
• Ricardo Covelo (covelo12) - Portuguese - 11 words
• Dian Prawira (wiradian84) - Indonesian - 9 words
• kpfurtak - Polish - 3 words
• MrClock (MrClock8163) - Hungarian - 1 word

Word counts are those tracked by Crowdin, indicating original EN words translated.

Next Steps

The next feature release will be primarily a maintenance release, aiming to upgrade the framework which results in a change of requirements, which then requires extra support work. Therefore it will be light on features, but I’ll be aiming to turn it around quicker than usual.

As referenced above, I want to roll out the new WYSIWYG editor further in the next feature release. My plan is to make the new editor the default for new instances, leaving existing instances alone for now. Along with this will be an option to migrate existing pages between the WYSIWYG options so existing instances can upgrade (and roll back) early where desired.

Full List of Changes

Released in v26.09

• Added interface layout system for UI customization, with theme system support. (#6179)
• Added API endpoints for searching within a specific book or chapter. Thanks to @enableservices. (#6182)
• Added a page scroll progress indicator. (#6176, #5932)
• Added ability to easily download API docs as JSON or HTML. (#6198)
• Updated translations with the latest Crowdin changes. (#6225)
• Updated app logo with better accessibility text. (#6171)
• Updated codebase static analysis to PHPStan Level 5. (#6143, #6089)
• Updated config to remove default APP_KEY value. (#6210)
• Updated new WYSIWYG editor with a range of fixes and improvements. (#6207)
• Updated page create/update endpoints to allow a changelog message. (#6162)
• Updated user password changes to require their existing password. (#6181)
• Fixed incorrect LDAP group result handling scenario. (#6088)
• Fixed lack of label text connected to checkboxes for screen readers. Thanks to @MHameed. (#6173)
• Fixed markdown table alignment being removed by page content filtering. (#6167)
• Fixed page content popup being caught in text selection range. (#6214)
• Fixed unexpected error when using an invalid page ID with the API. (#6136)

Released in v26.05.5 - Security Release

• Updated social logins to scope social account queries to social system.
• Updated PHP package versions.

Released in v26.05.4 - Security Release

• Updated image serving with additional MIME-based content type check.
• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Fixed issue where anchor links would be removed or be made invalid. (#6178)
• Fixed issue where sftp links would be removed from content. (#6186)
• Fixed lack of content validation when storing base64 drawing content.
• Fixed lack of permission check on draft endpoints.
• Fixed lacking content validation checks on book covers during ZIP imports.
• Fixed missing update permission check on attachment API.
• Fixed scenario where joint permission table would not be updated for chapter pages which are in the recycle bin.
• Fixed search queries not filtering out drafts from other users.

Released in v26.05.3 - Security Release

• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Updated login with fake hash and random delay on failed login.
• Updated allow list content filter to force the use of schemes.
• Updated allow list content filter with smarter srcset attribute parsing.
• Updated user external authentication ID queries, and database column collation, to ensure an exact match.
• Updated API exception handler to follow a more controlled error message approach.
• Fixed image delete API endpoint to avoid an error scenario.

Released in v26.05.2 - Security Release

• Added Serbian language to language_select array. Thanks to @PolarniMeda. (#6153)
• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Updated content allow-filtering to consider protocols used in srcset attributes.
• Updated URL filtering with a more thorough centralized utility class.
• Updated comment delete action to also check comment visibility permissions.
• Updated referring URL use with stronger source validation.
• Updated translations with latest Crowdin changes. (#6166)

Released in v26.05.1 - Security Release

• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Updated content allow-filtering to only allow the file:// protocol on anchor hrefs, instead of in all dynamic content.
• Updated attachment update handling to validate permissions before request content.
• Fixed numeric handling issue in tag search when using non-standard numbers.

Header Image Credits: Photo by Julian Herzog (cc-by-4) - Image Modified