Garry Tan 36c608eb6e security(browse): drop .svg from the load-html extension allowlist ... SVG is a script-capable format (inline <script>, event handlers, foreign objects), so allowing it through load-html's HTML allowlist let a local .svg execute script in the browse session context. The allowlist is now .html/.htm/.xhtml only; regression test asserts .svg is rejected. Contributed by @garagon (PR #1153). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-08-14 20:21:01 -07:00
..
bin	feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226)	2026-03-19 18:20:50 -07:00
scripts	fix(build): escape literal braces in the bun:sqlite stub regex	2026-08-14 20:20:59 -07:00
src	security(browse): drop .svg from the load-html extension allowlist	2026-08-14 20:21:01 -07:00
test	security(browse): drop .svg from the load-html extension allowlist	2026-08-14 20:21:01 -07:00
PLAN-snapshot-dropdown-interactive.md	fix: snapshot -i auto-detects dropdown/popover interactive elements (#845)	2026-04-05 22:57:45 -07:00
SKILL.md	fix(preamble): update_check:false gates the prose, not just the binary	2026-08-14 20:20:55 -07:00
SKILL.md.tmpl	v1.57.8.0 feat: browse js/eval --out render-to-file (canonical Chromium for offline rendering) (#1929)	2026-06-09 21:02:30 -07:00