CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It
reaches Yaak through the bundled Node (`yaaknode`, used by plugins) and
through the pure-Rust `brotli-decompressor` that yaak-http uses to decode
`br` responses.
- Bump the plugin runtime Node from 24.11.1 to 24.22.2 and update the
vendoring script's SHA256 pins from the signed SHASUMS256.txt.
- Move yaak-http from `brotli = "8"` to `brotli = "9"`, locking brotli
9.1.1 and brotli-decompressor 6.2.0.
- Bump compression-codecs 0.4.43 -> 0.4.45 (as on main) so
async-compression's streaming decoder also uses brotli 9.1.1.
Tauri's pinned git rev still pulls brotli 8.0.1 and brotli-decompressor
5.0.0 for its embedded-asset compression; that needs a Tauri bump.
(cherry picked from commit 39ff1351)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add .oxfmtignore to skip generated bindings and wasm-pack output.
Add npm format script, update DEVELOPMENT.md for Vite+ toolchain,
and format all non-generated files with oxfmt.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The call_http_authentication_request handler was mutating auth.args with the result of applyDynamicFormInput(), which strips the dynamic callback functions. This permanently corrupted the plugin module's args, making all dynamic form controls (checkboxes, selects, etc.) unresponsive for that auth type after sending the first request.
- Add body, bodyType, authentication, and authenticationType fields to create/update HTTP request MCP tools
- Include comprehensive documentation for body structures and auth types in Zod descriptions
- Fix MCP update_http_request to merge partial updates with existing data to prevent FK constraint violations
- Fix Zod imports from 'zod/v4' to 'zod' to match installed version
- Add uncaughtException handler to plugin runtime to prevent individual plugin crashes from crashing entire runtime
- Removed workspaceId parameter from ctx.folder.list() and ctx.httpRequest.list()
- Updated event handlers to get workspace from plugin context
- Use proper generated TypeScript types in Context interface
Gregory SchierandClaude Opus 5.5
dependabot[bot]
Ricardo Lopes Temoteo
Chris Turchin
Gregor MajcenandGregory Schier
Song