v4.2.1
usebruno/brunov4.2.1Sep 30, 2026by sid-bruno
Upgrading?
AI Summary
This release focuses on critical security improvements for the QuickJS sandbox runtime. It resolves path resolution vulnerabilities and restricts access to internal module loaders to prevent unauthorized file access. All users are strongly recommended to upgrade to address these potential security risks.
Key Highlights
- Resolved real path resolution in QuickJS sandbox to prevent scripts from reaching unintended files.
- Stopped exposing the internal `__brunoLoadLocalModule` function to reduce the sandbox attack surface.
- Security improvements credited to researcher @wpframe.
- Explicit recommendation to upgrade for all users.
Full Release Notes
### Security * **security: resolve real path in QuickJS sandbox** by @prateek-bruno in [#9226](https://github.com/usebruno/bruno/pull/9226) Local module paths are now resolved to their real path in the QuickJS runtime, preventing scripts from reaching files outside the intended location (e.g. via symlinks or path tricks). Credits to @wpframe for reporting this. * **security: stop exposing `__brunoLoadLocalModule` to scripts** by @prateek-bruno in [#9277](https://github.com/usebruno/bruno/pull/9277) Internal module loader is no longer accessible from user scripts, reducing the sandbox's attack surface. Credits to @wpframe for reporting this. **We recommend all users upgrade to this release.** **Full Changelog**: https://github.com/usebruno/bruno/compare/v4.2.0...v4.2.1
Related Repositories
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
The library for web and native user interfaces.
Node.js JavaScript runtime ✨🐢🚀✨
Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages
A fancy self-hosted monitoring tool