Release Notes
Added
- Otty terminal support: Ghost Complete now recognizes Otty
(TERM_PROGRAM=otty, bundle id io.appmakes.otty), a Ghostty fork, as a
first-class supported terminal. It
inherits Ghostty's exact capability profile — DECSET 2026 synchronized output
and native OSC 133 prompt markers — so popups render at the correct cursor
position with no configuration and without [experimental] multi_terminal.
Unlike Ghostty proper, Otty does not set GHOSTTY_RESOURCES_DIR, so it is
detected purely via TERM_PROGRAM; the zsh init whitelist and the shell
integration's native-OSC-133 gate were updated to match. Brings the supported
terminal count to 10 (#153).
Changed
- Dependency maintenance clearing the Dependabot backlog. Each bump was verified
against the full test / clippy -D warnings / fmt gate, and every
breaking-semver bump additionally passed an adversarial changelog-vs-usage
audit before merge:
shlex 1.3.0 → 2.0.1 (#133) — the one API we use (split) is behaviorally
unchanged; 2.0 only removed convenience/unsafe APIs we never call.sha2 0.10.9 → 0.11.0 (#134) — RustCrypto digest 0.11 generation; SHA-256
output is byte-identical, now pinned by a FIPS-180-4 known-answer test.rquickjs 0.10.0 → 0.12.0 (#136) — bundled quickjs-ng advances to Unicode
17.0.0 with regex/TypedArray security fixes; a new tripwire test pins the
engine's Unicode behavior so a future bump that silently shifts requires_js
generator output for non-ASCII input is caught.toml_edit 0.22.27 → 0.25.12 (#90) — config round-trip output is
byte-identical; also gains TOML 1.1 input acceptance, aligning it with the
already-1.1 toml crate.- CI actions:
actions/setup-node 5 → 6 (#87), dorny/paths-filter 3 → 4
(#88).
Security
- Bumped
anyhow from 1.0.102 to 1.0.103 to clear RUSTSEC-2026-0190: an
unsoundness in Error::downcast_mut() that could trigger undefined behavior
when a mutable downcast follows an Error::context call. Lockfile-only change;
the workspace already required anyhow = "1" (#154).
- Bumped the AWS SDK crates to clear Dependabot advisory GHSA-g59m-gf8j-gjf5
(AWS SDK for Rust v1 region-parameter defense-in-depth, low severity):
aws-sdk-iam 1.80.0 → 1.95.0 (direct pin) plus the transitive aws-sdk-sts
→ 1.103.0, aws-sdk-ssooidc → 1.100.0, and aws-sdk-sso → 1.98.0, all past
their patched versions. Supersedes the partial Dependabot bump #135, which
stopped at 1.90.0 — short of the 1.95.0 patch line (#157).
Install ghost-complete 0.19.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/StanMarek/ghost-complete/releases/download/v0.19.0/ghost-complete-installer.sh | sh
Install prebuilt binaries via Homebrew
brew install StanMarek/tap/ghost-complete
Download ghost-complete 0.19.0
