AI and security briefsTools

Should I upgrade to Ghostty 1.4, and what breaks when I do?

By Brandon Da Costa, founder of Digiton Dynamics

Published 28 October 2026Updated 28 October 2026Editorial policy

Yes, upgrade, and read the breaking changes first. Ghostty 1.4.0 shipped on 27 October 2026 with ten security advisories fixed, scrollback compression and new defaults. On macOS, selecting text no longer copies it. On Linux, the GTK build needs GTK 4.18 and libadwaita 1.7.

Who should act: Developers who run Ghostty on macOS or Linux, especially with zsh, cloned repositories or terminal coding agents, and anyone who packages it for a team.

What changed

Ghostty 1.4.0 was released on 27 October 2026 after seven months of work, with 172 contributors and 2,889 commits (Ghostty release notes, 27 October). The notes list ten security advisories fixed in this release. The maintainer says CVE numbers were requested weeks ago and GitHub has not assigned them yet.

• Paste protection did not treat carriage returns as line endings, so a paste could run a command without confirmation in programs that do not use bracketed paste.
• Malicious Kitty graphics commands could crash or hang Ghostty and, in limited cases, read or delete files outside the allowed temporary directories.
• Two tmux control mode flaws could close every window. They affect 1.3.0 and 1.3.1.
• The zsh shell integration could send escape sequences, including a silent clipboard replacement, when you cd into a directory with a crafted name (Ghostty advisory GHSA-2r63-vmw6-3m3c, 27 October). It affects 1.3.1 and earlier, is rated Moderate at 4.3 and also touches bash in a more limited way.
• Four macOS flaws involved cmd-clicked links, drag-and-drop text and file names with control characters.

The release adds scrollback compression, which the notes say cuts physical memory for typical text history by 70% to 90%. The default scrollback limit rises to 50 MB, up from 10 MB. Ghostty reports 25% to 55% higher I/O throughput on macOS (M4 Max) and full coverage of the Kitty graphics specification. These are the project's own benchmarks. It also adds the ghostty +ssh wrapper and support for macOS 27.

Who it affects

• macOS users on 1.3.x. The macOS default for copy-on-select becomes none, so selecting text stops copying it, and cmd+arrow_up and cmd+arrow_down jump between prompts again (Ghostty release notes, 27 October).
• Linux users on GTK. Ghostty 1.4 requires GTK 4.18 and libadwaita 1.7, up from 4.14 and 1.5. The notes say Ubuntu 24.04 LTS does not meet this, and suggest an older Ghostty or the Flatpak.
• zsh users who clone repositories. The directory-name flaw needs only a cd into a hostile folder, and a name like that survives git, zip and tar (Ghostty advisory, 27 October).
• Packagers. Builds need Zig 0.17, and the GTK build links the system EGL library.
• Scripts that call ghostty +ssh-cache, which now takes positional destinations.

What we checked

Run on 28 October 2026 on the Mac that builds this site. Each command and its output are copied as they ran.

$ command -v ghostty || echo "not installed"
not installed

$ curl -sI https://ghostty.org/docs/install/release-notes/1-4-0 | head -1
HTTP/2 200

Ghostty is not installed on the Mac that builds this site, so nothing in 1.4 was run here. Every behavior above is from the release notes and the advisory.

What to do now

1. Record what you run today.

   ghostty --version
   ghostty +show-config | grep -E "copy-on-select|scrollback-limit|clipboard-write"

2. Update through the channel you installed from, then confirm the version. Treat 1.3.1 and earlier as exposed to the zsh issue, and 1.3.0 and 1.3.1 to the tmux ones, until you do.
3. On macOS, put your old behavior back in the config file if you want it (Ghostty release notes, 27 October).

   copy-on-select = primary
   keybind = cmd+arrow_up=scroll_to_top
   keybind = cmd+arrow_down=scroll_to_bottom

4. On Linux, check the libraries before you upgrade.

   pkg-config --modversion gtk4 libadwaita-1

5. Rename scrollback-limit to scrollback-limit-bytes. The old name still works, and the notes recommend moving soon. Anyone with copy-on-select = clipboard who wants the old result should use both.
6. Until you have updated, set clipboard-write = ask. The advisory lists it as a workaround for the clipboard replacement, and it does not stop other escape sequences.

What to watch

• CVE numbers for the ten advisories. The notes say they are still unassigned and will be added.
• macOS 13 support. The notes first announced that 1.4 would require macOS 14, then kept 13 because nothing forced the change. They still plan to drop it in a later release.
• The performance figures. They come from Ghostty's benchmarks on an M4 Max and an x86_64 Linux machine, so time your own heavy output before you rely on them.
• Ghostty 1.5, which the notes plan for March 2027.

Questions people ask

Digiton's production review covers what developer machines and coding agents can reach, and the checks are on the Claude Code governance page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. Ghostty documentation, 1.4.0 release notes, 27 October 2026, read 28 October 2026. https://ghostty.org/docs/install/release-notes/1-4-0
2. Ghostty GitHub advisory for the zsh shell integration, 27 October 2026, read 28 October 2026. https://github.com/ghostty-org/ghostty/security/advisories/GHSA-2r63-vmw6-3m3c
3. Ghostty GitHub advisory for paste protection, read 28 October 2026. https://github.com/ghostty-org/ghostty/security/advisories/GHSA-4hwh-wx3w-3fqg
4. Ghostty GitHub release v1.4.0, 27 October 2026, read 28 October 2026. https://github.com/ghostty-org/ghostty/releases/tag/v1.4.0

More briefs

How these briefs are sourced and corrected. All AI and security briefs