---
title: openplanr 1.2.6
description: Published 2026-04-14. Replace gray-matter with yaml package to eliminate eval() vulnerability
url: https://openplanr.dev/docs/changelog/1.2.6
updated: 2026-04-14
related:
  - https://openplanr.dev/docs/changelog/1.2.8.md
  - https://openplanr.dev/docs/changelog/1.2.7.md
  - https://openplanr.dev/docs/changelog/1.2.5.md
---

# openplanr 1.2.6

Published 2026-04-14.

[Release on GitHub](https://github.com/openplanr/OpenPlanr/releases/tag/v1.2.6)

## Patch Changes

Replace gray-matter with yaml package to eliminate eval() vulnerability

- Remove gray-matter dependency (+ 6 transitive deps including js-yaml with eval)
- Add yaml package (zero deps, YAML 1.2 spec, no eval, maintained by YAML spec editors)
- Custom frontmatter parse/stringify in ~15 lines with robust regex handling