October 18, 2026 · Robocorp

Robocorp 3.1.6: security updates for robocorp-log, robocorp-windows, robocorp-excel and robocorp-vault

Robocorp Log

robocorp-log 3.1.6 rebuilds the React application that renders log.html with dompurify 3.4.17 (#497). The previous bundle carried 3.4.1, which has since accumulated eleven advisories, among them CVE-2026-49458, CVE-2026-49978, CVE-2026-65898 and CVE-2026-65902. DOMPurify is what sanitises the HTML you pass to log.html() before it is shown in the viewer, so a log file produced by this version carries the fixed sanitiser.

The build tooling for the viewer was refreshed in the same change (vite 6.4.4, handlebars 4.7.10, js-yaml, postcss, browserslist and others). Those are build-time only and do not end up in the generated log.

Nothing changes in how you write logs:

from robocorp import log log.html("<b>Total:</b> 337.50 across 3 symbols")

Robocorp Windows and Robocorp Excel

robocorp-windows 1.1.3 and robocorp-excel 0.5.1 raise their pillow requirement to 12.3.0 or newer (#496). Pillow 12.3.0 fixes a run of image-decoding advisories, including CVE-2026-59205 (heap out-of-bounds write in ImageCmsTransform.apply()), CVE-2026-54058 (out-of-bounds read through a controlled row stride) and several missing decompression-bomb checks in the font and GD loaders (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380).

Both packages already required Python 3.10, which is also Pillow 12.3's minimum, so the new floor does not change which Python versions are supported. If something else in your environment pins an older Pillow, pip will tell you when you upgrade.

Robocorp Vault

robocorp-vault 1.4.2 raises its cryptography requirement to 50.0.0 or newer (#496). That version ships wheels with a patched OpenSSL (GHSA-537c-gmf6-5ccf) and fixes CVE-2026-69247, CVE-2026-69248 and CVE-2026-69249 in certificate verification and PKCS#7 handling.

Upgrading

robocorp 3.1.6 pins the new robocorp-log and robocorp-vault, so upgrading the meta package is enough for those two:

pip install --upgrade robocorp

robocorp-windows and robocorp-excel are not part of the meta package; upgrade them separately if you use them:

pip install --upgrade robocorp-windows robocorp-excel

Released packages

package robocorp 3.1.6 (meta package)
package robocorp-log 3.1.6
package robocorp-windows 1.1.3
package robocorp-excel 0.5.1
package robocorp-vault 1.4.2