Mitchell Hashimoto Releases Ghostty 1.4 with Full Kitty Graphics and Security Overhaul

The Three-Question Framework

What Happened?

Mitchell Hashimoto and the Ghostty core team released Ghostty 1.4.0 on October 27, 2026, marking seven months of work across 2,889 commits from 172 contributors, bringing full Kitty graphics protocol support and substantial memory reductions.

Why It Matters

Ghostty becomes the first non-Kitty terminal to achieve 100% Kitty graphics compliance (including animation frames and relative placement), while remediating eight security vulnerabilities that could allow arbitrary execution or terminal crashes.

What Could Happen Next

Ghostty 1.4.0 is available immediately via Homebrew, native macOS DMG, Linux package managers, and Windows preview builds, with documentation for its Kitty animation APIs published in the reference manual.

Executive Key Takeaways

Incorporates changes from 172 contributors spanning 2,889 commits over a seven-month release cycle.

Achieves 100% complete Kitty graphics protocol implementation, adding relative image placement and animated GIF/PNG playback.

Patches eight security advisories, resolving carriage-return paste bypasses (GHSA-4hwh-wx3w-3fqg), graphics memory corruption, and OSC 8 hyperlink exploits.

Source: Ghostty 1.4.0 release notes published by Mitchell Hashimoto and maintainers on October 27, 2026.

Terminal emulators have historically struggled with fragmented implementations of graphics protocols, resulting in broken image rendering and erratic layout clipping. Ghostty 1.4.0 resolves this by delivering a 100% complete implementation of the Kitty graphics protocol, becoming the first non-Kitty terminal emulator to support relative image positioning and multi-frame animation playback.

Written in Zig, Ghostty 1.4.0 brings significant memory and rendering optimizations. A newly refactored glyph cache and scrollback manager cuts memory usage by up to 35% during heavy log streaming, while frame pacing on macOS Metal and Linux OpenGL backends delivers consistent sub-millisecond input responsiveness.

The release features a major security overhaul addressing eight separate GitHub Security Advisories. Foremost among them is GHSA-4hwh-wx3w-3fqg, where paste protection mechanisms failed to treat carriage returns as line breaks in utilities lacking bracketed paste, enabling command injection via unverified clipboards. Other remediated vulnerabilities include graphics parser crashes (GHSA-mhff-mv4q-fp63) and unsafe OSC 8 hyperlink URL schemes (GHSA-cw69-wm67-5pv8).

Shell integration received comprehensive hardening across Bash, Zsh, and Fish environments. Ghostty 1.4.0 sanitizes OSC 52 clipboard escape sequences, preventing maliciously crafted directory names from executing arbitrary clipboard operations when navigating untrusted repositories.

With packages released across macOS, Arch Linux, Debian, Fedora, and Windows preview, Ghostty 1.4.0 solidifies its position as a high-performance, modern terminal emulator tailored for developers demanding hardware-accelerated rendering and robust security guarantees.

The Three-Question Framework

What Happened?

Why It Matters

What Could Happen Next

Executive Key Takeaways

Primary Sources & Citations