v4.2.1
givanz/VvvebJsv4.2.1Sep 30, 2026by sid-bruno
Upgrading?
AI Summary
This release focuses on critical security updates to the QuickJS sandbox environment, ensuring local module paths are resolved securely and internal loaders are hidden from user scripts.
Key Highlights
- Resolved real path in QuickJS sandbox to prevent access to files outside intended location
- Stopped exposing `__brunoLoadLocalModule` to reduce the sandbox's attack surface
- Recommended upgrade for all users
Full Release Notes
### Security * **security: resolve real path in QuickJS sandbox** by @prateek-bruno in [#9226](https://github.com/usebruno/bruno/pull/9226) Local module paths are now resolved to their real path in the QuickJS runtime, preventing scripts from reaching files outside the intended location (e.g. via symlinks or path tricks). Credits to @wpframe for reporting this. * **security: stop exposing `__brunoLoadLocalModule` to scripts** by @prateek-bruno in [#9277](https://github.com/usebruno/bruno/pull/9277) Internal module loader is no longer accessible from user scripts, reducing the sandbox's attack surface. Credits to @wpframe for reporting this. **We recommend all users upgrade to this release.** **Full Changelog**: https://github.com/usebruno/bruno/compare/v4.2.0...v4.2.1
Related Repositories
affaan-m/ECC★ 285,702
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
react/react★ 251,622
The library for web and native user interfaces.
nodejs/node★ 122,511
Node.js JavaScript runtime ✨🐢🚀✨
Leonxlnx/taste-skill★ 100,554
Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages
louislam/uptime-kuma★ 92,731
A fancy self-hosted monitoring tool