v0.74.5
junegunn/fzfv0.74.5Oct 11, 2026by junegunn
Upgrading?
AI Summary
This release addresses critical bugs related to tmux popup behavior, grapheme cluster handling, and escape sequence processing, alongside important security fixes for shell injection and path exposure risks.
Key Highlights
- Fixed `--popup` unzooming the window over a zoomed pane on tmux 3.8+.
- Fixed `--gap-line` cutting a grapheme cluster when filling the last cells.
- Fixed focus event not triggering after `reload` when the item position is the same.
- Security fixes prevent command injection in fzf-tmux and path exposure in zsh completion.
Full Release Notes
- Fixed `--popup` unzooming the window when opened over a zoomed pane on tmux 3.8 or above (#4927, junegunn/fzf.vim#1625) (@jereviikari)
- On tmux 3.7, the window is still unzoomed, as tmux 3.7b crashes when a floating pane is created over a zoomed window
- Fixed `--gap-line` cutting a grapheme cluster when filling the last cells of the line (#4920)
- Fixed an escape sequence fzf does not recognize being partly consumed, which leaked the rest into the query (#4926)
- Fixed a key lost when it arrived in the same read as an escape sequence
- Fixed `focus` event not triggered after `reload` when the new item is at the same position as the previous one (#4930)
- With `--id-nth`, the event is not triggered if the focus moves directly from an item to another item with the same key
- A `focus` binding that runs `reload` now triggers itself again after each reload, unless `--id-nth` is set and the key does not change
- Security fixes
- fzf-tmux no longer evaluates an attached layout size (e.g. `-l50`) via bash arithmetic, which could run commands or inject tmux flags (GHSA-w6x2-f5m4-xw82)
- zsh completion now creates its FIFO in a private `mktemp -d` directory instead of a predictable `/tmp` path (GHSA-7rj6-7pqx-v7rm)
- Reported by Sai Sreewathsa Kovalluri, Shon Babu, and Kannan K (Researchers) of Innspark Solutions
Related Repositories
ollama/ollama★ 184,241
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
fatedier/frp★ 110,065
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
infiniflow/ragflow★ 92,634
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
gohugoio/hugo★ 90,197
The world’s fastest framework for building websites.
caddyserver/caddy★ 78,251
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS