cherrytree (1.7.3-2) focal; urgency=low

  * fixed command injection with custom link actions (@r3vpwnx, @Afnaan-Ahmed #2945 CVE-2026-118692)
  * fixed arbitrary local file read via crafted embedded-file name (@Afnaan-Ahmed, #2944 CVE-2026-118693)
  * reject symlinked multifile node directories + prevent cleanup from following symlinks (@acts-1631, #2922, #2920)
  * reject empty tables during XML parsing so malformed XML cannot reach table construction or clipboard indexing (@acts-1631, #2923)
  * on node name header, show node icon and aux icons on the left rather than on the right, just after last visited nodes buttons
  * improved image download on HTML paste from browser (#2925)
  * fixed crash when destroying anchored widgets (#2947)
  * support for new language Tamil (@TamilNeram)
  * build with libxml++5 on windows/msys2, ubuntu 26.04+, flatpak (#2918, @bgermann)


 -- Giuseppe Penone <giuspen@gmail.com>  Sat, 07 Nov 2026 09:47:25 +0000
