Skip to content

v2.26.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 00:17
· 20 commits to main since this release
v2.26.3
02b2956
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Forge v2.26.3

CLI/TUI and desktop release v2.26.3; mobile remains on its compatible native version.

  • CLI / TUI — binaries below (*.tar.gz / *.zip) or brew upgrade forge
  • Desktop (macOS · Windows · Linux) — app bundles below + in-app auto-update
  • Mobile (iOS) — production OTA by default; native/TestFlight builds are manual when required

Security

  • Cleared RUSTSEC-2026-0433 and RUSTSEC-2026-0429 where a fix exists. pulldown-cmark moves to 0.13.6 (quadratic wikilink parsing), self_update to 1.3.3 (so the CLI's zip is 9.x) and the desktop app's own zip dependency to 9.x, removing the zip 8 advisory ignores from deny.toml and the security workflow. The desktop lockfile keeps zip 4 only as tauri-plugin-updater 2.10.1's dependency, with a documented audit ignore, because that crate must match the pinned JS plugin.

What's Changed

  • fix(mesh): stop catalog refresh flapping and quiet the session note by @florisvoskamp in #1832
  • fix(deps): clear RUSTSEC-2026-0433 and RUSTSEC-2026-0429 by @florisvoskamp in #1833
  • chore(dist): update package manifests to v2.26.2 by @github-actions[bot] in #1830

Full Changelog: v2.26.2...v2.26.3

Contributors

florisvoskamp
Assets 25
Loading