mirror of
https://github.com/mountain-loop/yaak.git
synced 2026-11-13 12:13:42 +01:00
Gregory SchierandClaude Opus 5.5
cd431186b6
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It reaches Yaak through the bundled Node (`yaaknode`, used by plugins) and through the pure-Rust `brotli-decompressor` that yaak-http uses to decode `br` responses. - Bump the plugin runtime Node from 24.11.1 to 24.22.2 and update the vendoring script's SHA256 pins from the signed SHASUMS256.txt. - Move yaak-http from `brotli = "8"` to `brotli = "9"`, locking brotli 9.1.1 and brotli-decompressor 6.2.0. Tauri's pinned git rev still pulls brotli 8.0.1 and brotli-decompressor 5.0.0 for its embedded-asset compression; that needs a Tauri bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 lines
8 B
Plaintext
2 lines
8 B
Plaintext
24.22.2
|