Ghostty 1.4
- ID
- 40133
- Status
- summarized
- Published
- 28 Oct 2026, 12:51 AM
- Fetched
- 28 Oct 2026, 2:26 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://ghostty.org/docs/install/release-notes/1-4-0
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.3
- Created
- 28 Oct 2026, 2:26 PM
- Tags
- Audience
- developersvibe_coders
What happened
Ghostty 1.4.0 was released on October 27, 2026 after 7 months of work, with 2,889 commits from 172 contributors. It includes large performance and memory improvements, SSH integration changes, and a 100% complete Kitty graphics implementation with animation and relative placements, which the notes say makes it the first non-Kitty terminal to do so. The release also fixes multiple security advisories covering paste handling, malicious Kitty graphics output, tmux control mode crashes, scrollback corruption, zsh shell integration escape sequences, and macOS OSC 8 hyperlink handling.
Why it matters
If you use Ghostty, upgrade—especially from 1.3.0 or 1.3.1, where crafted terminal output could crash every window via tmux control mode even without tmux installed, and malicious Kitty graphics could force huge allocations or read/delete files outside allowed temp directories. The notes also fix paste protection treating carriage returns as line endings and a zsh integration issue where cd-ing into a crafted directory name could send escape sequences such as silently replacing the clipboard via OSC 52. If you do not use Ghostty, the text gives no Malaysia or Southeast Asia angle and no action item.
Discussion angle
Several advisories require only displaying malicious output, not running a command—what boundary do you draw between viewing terminal output and trusting it in your dev environment?