This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+3 more
Affected surfaces
Summary
AI summaryUpdates What's New in v0.6.6, https://github.com/kanlanc, and https://github.com/metaphorics across a mixed release.
Full changelog
Follow @plannotator on X for updates
Missed recent releases?
| Release | Highlights |
|---------|------------|
| v0.6.5 | Cmd+C shortcut, newline preservation, hook timeout fix |
| v0.6.4 | Cmd+Enter keyboard shortcut |
| v0.6.3 | OpenCode npm package fix, cache path fix |
| v0.6.2 | OpenCode title generation fix, WSL browser detection |
| v0.6.1 | Obsidian custom paths, disable sharing config |
| v0.6.0 | Permission mode support, inline annotation editing |
What's New in v0.6.6
OpenCode: Sub-Agent Fix
Sub-agents ("general", "explore") were incorrectly triggering plannotator during autonomous tasks. Fixed by:
- Targeted prompt injection - Planning instructions now only inject for the
planagent, not sub-agents - Runtime blocking - Sub-agents are blocked from calling
submit_planwith a helpful message
| Agent | Sees instruction? | Can use tool? |
|-------|------------------|---------------|
| plan | ✅ Yes | ✅ Yes |
| build | ❌ No | ✅ Yes |
| general | ❌ No | ❌ Blocked |
| explore | ❌ No | ❌ Blocked |
- Thanks to @kanlanc for the original report (#15)
- Thanks to @metaphorics for the detailed analysis (#86)
OpenCode: Security Update (CVE-2026-22812)
Bumped @opencode-ai/plugin dependency to >=1.1.10 to address a critical RCE vulnerability in OpenCode versions < 1.1.10.
Install / Update
macOS / Linux:
curl -fsSL https://plannotator.ai/install.sh | bash
Windows:
irm https://plannotator.ai/install.ps1 | iex
Claude Code Plugin: Run /plugin in Claude Code, find plannotator, and click "Update now".
OpenCode: Clear cache and restart:
rm -rf ~/.bun/install/cache/@plannotator
Then in opencode.json:
{
"plugin": ["@plannotator/opencode@latest"]
}
What's Changed
- fix: OpenCode plugin updates (CVE + sub-agent fix) by @backnotprop in https://github.com/backnotprop/plannotator/pull/90
Full Changelog: https://github.com/backnotprop/plannotator/compare/v0.6.5...v0.6.6
Security Fixes
- CVE-2026-22812 — Critical RCE in @opencode-ai/plugin < 1.1.10; dependency bumped to >=1.1.10
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Plannotator
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]