CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It
reaches Yaak through the bundled Node (`yaaknode`, used by plugins) and
through the pure-Rust `brotli-decompressor` that yaak-http uses to decode
`br` responses.
- Bump the plugin runtime Node from 24.11.1 to 24.22.2 and update the
vendoring script's SHA256 pins from the signed SHASUMS256.txt.
- Move yaak-http from `brotli = "8"` to `brotli = "9"`, locking brotli
9.1.1 and brotli-decompressor 6.2.0.
Tauri's pinned git rev still pulls brotli 8.0.1 and brotli-decompressor
5.0.0 for its embedded-asset compression; that needs a Tauri bump.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The shared tree treats every node with a children list as a folder and
collapses an empty one before the left arrow moves to its parent. Left
out of the collapsed map, a leaf path never read as collapsed, so the
left arrow kept trying to collapse it and never moved up.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every domain and path node starts collapsed, so paths stay hidden until
a host is expanded. The nodes the user expands are kept by id in local
storage, so they stay open across launches; hosts seen later start
collapsed. The Domains folder, selection and counts are as before. The
shared tree is unchanged: the proxy hands it its own collapsed atom.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Send a flow's write event inside its transaction, so a clear's event,
sent after its own commit, always comes after it.
- Record a saved request only on a flow that still exists, so a save
that finishes after a clear does not bring the flow back.
- Count the total again from the database a second after new flows,
so a flow both in a page and in the events around it settles to the
right count.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Replay live changes over a page of older flows, so a slow flow that
ends while the page loads is not lost from the window.
- Read list_flows' page and total from one snapshot, so a flow written
between them is not counted twice.
- Commit a clear's flow deletion only after its bodies' deletion, so a
failure leaves the flows to clear again rather than orphaned bodies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The app held every flow in memory and redid all of its work for each new
one: the sidebar mounted every domain and path node (its tree scrolled
inside a container that never bounded it), every tree row looked up its
atoms by scanning every atom the family had made, and the layout, detail
pane and list rows re-rendered per flow. At 3,000 flows each new one cost
about 90 ms of main thread, more than the traffic left time for.
The app now holds a window of the newest 2,000 flows, applies new ones in
batches, and loads older ones in pages from the database on scrolling to
the top, through a new list_flows RPC that pages in SQL. The database
keeps every flow.
Also adds clear_flows: an RPC, POST /flows/clear on the control API, and
a Clear button in the header that Cmd+K opens, confirming first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Rebuild a bare-path plain-HTTP request's URL from Host, answer 400
"no host in request" when there is none, and refuse with 508 a rebuilt
request that is routed back into the proxy, which would otherwise loop
without end.
- Drop Host when forwarding to an HTTP/2 upstream. Google's servers reset
every stream that carries Host alongside :authority.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use an object with a null prototype so inherited property names are not
mistaken for existing fields and __proto__ remains a literal JSON key.
Cover __proto__, constructor, and toString with regression cases.
dependabot[bot]
David Leung
Gregory SchierandClaude Opus 5.5
Zhizhen He