From 85fffa37a230c42d1402527cbcc044f086b2717c Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Thu, 29 Oct 2026 12:08:21 +0100 Subject: [PATCH] Add Deno 2.9.8 security update to 1.11 highlights Quarto 1.11 bundles Deno 2.9.8 because Deno 2.7.14 still trusted the compromised eMudhra / emSign certificate authorities (quarto-dev/quarto-cli#15152). Follows the 1.8 'Dependency updates' list format and replaces the leftover placeholder text. --- docs/prerelease/1.11/_highlights.qmd | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/prerelease/1.11/_highlights.qmd b/docs/prerelease/1.11/_highlights.qmd index 74f9b859e5..44f818f430 100644 --- a/docs/prerelease/1.11/_highlights.qmd +++ b/docs/prerelease/1.11/_highlights.qmd @@ -1 +1,3 @@ -Quarto v1.11 was just released, nothing to see here -- yet! \ No newline at end of file +Dependency updates: + +- `deno` updated to 2.9.8 as a security fix. Deno 2.7.14, bundled with Quarto 1.10 and earlier 1.11 pre-releases, still trusted the compromised eMudhra / emSign intermediate certificate authorities, whose private keys can be recovered from their public certificates ([Mozilla bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449), [incident details](https://emudhra.we-have-a-problem.com/)). An attacker on the network could use them to impersonate any HTTPS site to `quarto publish`, `quarto add`, `quarto use template`, `quarto install`, and TypeScript scripts run by Quarto. Deno 2.9.8 [distrusts these certificate authorities](https://github.com/denoland/deno/pull/37046). See [quarto-dev/quarto-cli#15152](https://github.com/quarto-dev/quarto-cli/issues/15152) for details.