479a2af6c3
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It reaches Yaak through the bundled Node (`yaaknode`, used by plugins) and through the pure-Rust `brotli-decompressor` that yaak-http uses to decode `br` responses. - Bump the plugin runtime Node from 24.11.1 to 24.22.2 and update the vendoring script's SHA256 pins from the signed SHASUMS256.txt. - Move yaak-http from `brotli = "8"` to `brotli = "9"`, locking brotli 9.1.1 and brotli-decompressor 6.2.0. - Bump compression-codecs 0.4.43 -> 0.4.45 (as on main) so async-compression's streaming decoder also uses brotli 9.1.1. Tauri's pinned git rev still pulls brotli 8.0.1 and brotli-decompressor 5.0.0 for its embedded-asset compression; that needs a Tauri bump. (cherry picked from commit 39ff1351) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
💫 Yaak ➟ Desktop API Client 💫
A fast, privacy-first API client for REST, GraphQL, SSE, WebSocket, and gRPC – built with Tauri, Rust, and React.
Development is funded by community-purchased licenses. You can also become a sponsor to have your logo appear below. 💖
Install
Download Yaak for macOS, Windows, or Linux from yaak.app/download. Package managers and other install methods are in the installation docs.
Features
Yaak is an offline-first API client designed to stay out of your way while giving you everything you need when you need it. Built with Tauri, Rust, and React, it’s fast, lightweight, and private. No telemetry, no VC funding, and no cloud lock-in.
🌐 Work with any API
- Import collections from Postman, Insomnia, OpenAPI, Swagger, or Curl.
- Send requests via REST, GraphQL, gRPC, WebSocket, or Server-Sent Events.
- Filter and inspect responses with JSONPath or XPath.
🔐 Stay secure
- Use OAuth 2.0, JWT, Basic Auth, or custom plugins for authentication.
- Secure sensitive values with encrypted secrets.
- Store secrets in your OS keychain.
☁️ Organize & collaborate
- Group requests into workspaces and nested folders.
- Use environment variables to switch between dev, staging, and prod.
- Mirror workspaces to your filesystem for versioning in Git or syncing with Dropbox.
🧩 Extend & customize
- Insert dynamic values like UUIDs or timestamps with template tags.
- Pick from built-in themes or build your own.
- Create plugins to extend authentication, template tags, or the UI.
Contribution Policy
Important
Community PRs are currently limited to bug fixes. If your PR is not a bug fix, link the feedback item where @gschier explicitly gave you permission to work on it. See
CONTRIBUTING.mdfor policy details andDEVELOPMENT.mdfor local setup.
Useful Resources
License
The source is MIT licensed and can be built and run for free, for both personal and commercial use.
The prebuilt binaries follow Yaak's pricing terms: free for personal use, license required for commercial use.