v1.2.7

10/15/2026

Changed

• Update Node to 24.22.0, OpenCode to 1.19.0, Claude Code to 2.1.300 and OpenSpec to 1.14.2.
• Update fzf, lazygit, pnpm, Prettier, Wrangler and the Python toolchain dependencies. Keep Wrangler with its official Miniflare/workerd graph.
• Follow Paperclip's normal jsdom resolution to official Undici 8.12.1, with clearer dependency version errors.
• Update pinned build actions and Trivy to 0.76.0. Keep full scanner reports and accepted upstream vulnerability records.
• Use v1.2.6 for upgrade and rollback checks. Preserve Paperclip 2026.831.1, user data, providers and plugin settings.

Fixed

• Raise the Chromium, Chromium Common and Chromium Sandbox floor to Debian 155.0.8059.39-1~deb13u1 on AMD64 and ARM64. Fresh scans no longer report the five CVEs reported in #13 plus CVE-2026-106195 and CVE-2026-106237.
• Cover hidden-iframe visibility in the Playwright 1.64.0 browser check.
• Correct the runtime table to npm 12.2.0.

Security

• Fresh scans still report 37 other Chromium CVEs, CVE-2026-110136 through CVE-2026-110172. These are accepted upstream findings, including seven rated CRITICAL by Scout. Neither scanner lists a fixed version. Track the remaining findings in #14.
• Avoid untrusted browser content and automation. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port. These controls do not prove the vulnerabilities are unreachable.
• Full per-architecture scanner reports, package inventories, software bills of materials and accepted-finding records are attached to this release.

Compatibility

• Claude Auth 2.2.1 does not establish a fix for the idle credential-refresh failure in #11. That issue remains open.
• Keep the documented Paperclip, TypeScript, Prisma, Apprise and json-server compatibility holds. Managed oh-my-openagent and Hermes remain suspended.
• Accepted upstream vulnerabilities are not fixed vulnerabilities. Secrets, HolyCode-owned findings, unknown provenance, malformed reports and scanner failures still block delivery.