Security update for broot

The broot 1.59.0 update (CVE-2026-72847) introduces a new shell_command verb attribute enabling commands to run through a shell, allowing shell operators like &&, ;, and pipes to function without exiting broot. It fixes an invalid Mac binary issue, adds Sixel graphics support for image previews in compatible terminals, and improves high-resolution image support in Rio terminal. Several bugs are fixed, including off-by-one errors in line number matching, duplicate server name detection, preview transformer extension matching, and escape sequence stripping to prevent OSC injection. Additional fixes address Windows path handling, panic on certain regex matches, and issues with Windows PowerShell temp paths containing spaces. The update also removes JPEG XL image preview due to decoder bugs and updates the minimal Rust compiler version requirement.

The update mitigates a security risk related to escape sequence injection (OSC injection) by stripping escape sequences from displayed names, which could otherwise be exploited to execute unintended terminal commands. Other fixes improve stability and usability but do not directly relate to security impact. No known exploits in the wild have been reported for this vulnerability.

A fixed version of broot is available in version 1.59.0. Users should upgrade to broot 1.59.0 to apply the security fix and other improvements. No additional mitigation actions are indicated by the vendor advisory.