Skip to content

Plannotator

v0.8.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agents claude-code code-review codex obsidian opencode
+3 more
pi-mono plan-mode skills

Summary

AI summary

Updates https://github.com/rerorero, https://github.com/siomporas, and browser across a mixed release.

Full changelog

Follow @plannotator on X for updates


Missed recent releases?

| Release | Highlights |
|---------|------------|
| v0.8.1 | Devcontainer BROWSER fallback, mermaid clipping fix, annotation toolbar focus guard |
| v0.8.0 | Open source (MIT/Apache-2.0), annotate command, self-hosted share portal, resizable panels, mermaid controls, auto-close on approval, documentation site |
| v0.7.0 | TOC sidebar, sticky actions, save to notes without approving, import teammate reviews, viewed file tracking |
| v0.6.8 | Mermaid diagram rendering, repo/branch info display |
| v0.6.7 | Quick Comment mode, type-to-comment shortcut, smart agent detection |
| v0.6.6 | OpenCode sub-agent fix, CVE-2026-22812 security update |
| v0.6.5 | Cmd+C shortcut, newline preservation, hook timeout fix |
| v0.6.4 | Cmd+Enter keyboard shortcut |
| v0.6.3 | OpenCode npm package fix, cache path fix |
| v0.6.2 | OpenCode title generation fix, WSL browser detection |


What's New in v0.8.2

A targeted fix for the BROWSER environment variable handling introduced in v0.8.1. The devcontainer browser-opening feature now works correctly on macOS and WSL.

BROWSER Environment Variable Fix

v0.8.1 added support for the standard BROWSER environment variable so devcontainer users get automatic browser opening without any Plannotator-specific configuration. However, the implementation treated BROWSER the same as PLANNOTATOR_BROWSER across all platforms — which broke on macOS (where open -a expects an application name, not a script path) and WSL (where cmd.exe /c start can't execute Linux paths).

PLANNOTATOR_BROWSER and BROWSER now have distinct semantics. PLANNOTATOR_BROWSER is a platform-native application reference: an app name for open -a on macOS, a Windows executable for cmd.exe /c start on WSL. BROWSER is always executed directly as $BROWSER <url>, matching the Unix convention that VS Code and other tools expect.


Install / Update

macOS / Linux:

curl -fsSL https://plannotator.ai/install.sh | bash

Windows:

irm https://plannotator.ai/install.ps1 | iex

Claude Code Plugin: Run /plugin in Claude Code, find plannotator, and click "Update now".

OpenCode: Clear cache and restart:

rm -rf ~/.bun/install/cache/@plannotator

Then in opencode.json:

{
  "plugin": ["@plannotator/opencode@latest"]
}

What's Changed

  • fix(browser): use open -a only for PLANNOTATOR_BROWSER on macOS by @rerorero in https://github.com/backnotprop/plannotator/pull/163

New Contributors

  • @rerorero made their first contribution in https://github.com/backnotprop/plannotator/pull/163

Full Changelog: https://github.com/backnotprop/plannotator/compare/v0.8.1...v0.8.2

Security Fixes

  • CVE-2026-22812

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Plannotator

Get notified when new releases ship.

Sign up free

About Plannotator

All releases →

Related context

Beta — feedback welcome: [email protected]