Ghostty 1.4.0 is a major release featuring significant performance and memory improvements, a complete Kitty graphics implementation with animation and relative placements, and SSH integration enhancements. This update includes over 2,889 commits from 172 contributors across 7 months. The release addresses multiple security vulnerabilities, including issues with paste protection, malicious graphics commands, and tmux control mode attacks. Several macOS-specific fixes improve compatibility with macOS 27 (Golden Gate), including corrected tab bar rendering and enhanced security against crafted hyperlinks and file names. The update maintains backward compatibility with macOS 13 (Ventura) and later.
The release notes, handcrafted by maintainers over 16+ hours, detail critical security patches such as GHSA-4hwh-wx3w-3fqg (paste protection bypass), GHSA-mhff-mv4q-fp63 (Kitty graphics vulnerabilities), and GHSA-hcr9-7hcr-7hcr-mjm8 (tmux control mode crashes). Additional fixes address memory corruption, zsh integration escape sequences, and unsafe local file access via crafted hyperlinks. Users are encouraged to update to mitigate potential risks from malicious terminal output.
Source: Hacker News · Summarized by HeadlinesBriefing