Skip to content

v1.2.8

Choose a tag to compare

View all tags
@CoderLuii CoderLuii released this 26 Oct 16:33
v1.2.8
dd6ba63

10/26/2026

Changed

  • Updated Node.js LTS to 24.22.1. Builds now require official Debian Chromium, common and sandbox packages 155.0.8059.79-1~deb13u1 or newer on AMD64 and ARM64.
  • Updated OpenCode to 1.19.3 and Claude Code to 2.1.307. OpenSpec is now 1.14.3. GitHub CLI is 2.103.0 and lazygit is 0.66.2.
  • Updated npm to 12.2.1, pnpm to 12.15.0, Vite to 8.3.5 and ESLint to 10.13.0.
  • Updated Wrangler to 4.151.3 with its published Miniflare 5.20261019.1-beta and workerd 1.20261019.1 graph. Updated Prisma to 7.10.1.
  • Refreshed the Python 3.13 hash locks with FastAPI 0.143.5, Markdown 3.11.2, setuptools 84.2.1, Pillow 13.0.0 and certifi 2026.10.19.
  • Kept Paperclip 2026.831.1 while following its normal Cursor SDK 1.0.40 and jsdom 30.1.3 resolution. jsdom now supplies Undici 8.12.3 without a HolyCode replacement.
  • Updated release scanning to Trivy 0.76.1 and Docker Scout 1.27.0. Upgrade and untouched-volume rollback checks now use the pinned v1.2.7 image.

Fixed

  • Removed the npm brace-expansion, tar and ip-address replacements. npm 12.2.1 supplies those dependencies through its published graph.
  • Removed Prisma's deepmerge-ts and mysql2 replacements and the added type peers. Prisma 7.10.1 supplies deepmerge-ts 8.0.2 and mysql2 3.24.4 through its published graph.
  • Updated npm's existing node-gyp Undici replacement to 8.12.3. pnpm 12.15.0 supplies fixed Undici 6.29.1 in its official bundle.
  • Updated pip to 26.2.2 for its fixed Certifi bundle. The existing msgpack 1.2.2, pkg_resources 78.1.1 and urllib3 2.8.0 repairs remain in the runtime and offline seed.
  • Followed Lighthouse 13.5.0's normal trace-engine resolution to legacy-javascript 0.0.4. third-party-web remains 0.30.0.
  • Corrected Scout result-to-package matching so a shared vulnerability rule no longer multiplies accepted finding counts. Actual repeated observations remain visible.

Security

Known upstream vulnerabilities remain in bundled third-party software. Accepting them doesn't fix them or prove they're safe.

Avoid untrusted browser content and automation while known findings remain. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port; those controls don't prove a finding is unreachable.

Chromium issue #14 requires fresh browser checks of both released native AMD64 and ARM64 images before closure. It also requires package inventories, full Scout and Trivy reports, verified registry digests and updated public warnings.

The compatibility holds remain, including Paperclip 2026.831.1 and Claude Auth 2.2.1. This release does not verify a fix for Claude Auth token refresh. See the dependency audit for the remaining holds and security policy.

Assets 24
Loading