mirror of
https://github.com/mountain-loop/yaak.git
synced 2026-11-08 02:14:53 -06:00
479a2af6c3
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It reaches Yaak through the bundled Node (`yaaknode`, used by plugins) and through the pure-Rust `brotli-decompressor` that yaak-http uses to decode `br` responses. - Bump the plugin runtime Node from 24.11.1 to 24.22.2 and update the vendoring script's SHA256 pins from the signed SHASUMS256.txt. - Move yaak-http from `brotli = "8"` to `brotli = "9"`, locking brotli 9.1.1 and brotli-decompressor 6.2.0. - Bump compression-codecs 0.4.43 -> 0.4.45 (as on main) so async-compression's streaming decoder also uses brotli 9.1.1. Tauri's pinned git rev still pulls brotli 8.0.1 and brotli-decompressor 5.0.0 for its embedded-asset compression; that needs a Tauri bump. (cherry picked from commit 39ff1351) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>