v2.2.6

Bug Fixes

• Fix long filename wrapping in file upload #114 @umputun
• Add directory field to publish formula to Formula/

Improvements

• Add shell completions for bash, zsh, and fish #105 @paskal
• Update go dependencies (x/crypto, sqlite, slack-go, x/net, x/sys)
• Bump the github-actions-updates group with 6 updates #113
• Bump github.com/go-pkgz/lgr from 0.12.1 to 0.12.3 #112

v2.2.5

Fixed

• Enforce minimum 16-byte sign key length at startup to prevent weak encryption keys

Changed

• Extract inline JavaScript to external app.js for CSP compliance (#103)
• Switch Docker image to scratch-based for smaller footprint
• Use /data directory for SQLite storage in Docker by default
• Bump golang.org/x/crypto from 0.46.0 to 0.47.0 (#102)
• Bump github.com/go-pkgz/rest from 1.20.7 to 1.21.0 (#101)
• Bump github-actions-updates group (#100)

v2.2.4

• eac81ad fix(ui): prevent JS re-execution on HTMX boosted navigation

v2.2.3

Fixed

• Improve card header layout with proper alignment of title and mode toggle
• Replace iMessage with Signal in secure messenger examples

v2.2.2

• 80adb91 fix(web): show friendly 404 error page for non-existent messages

v2.2.1

• 7141d09 fix: add version-based cache busting for static assets

v2.2.0

• #99 chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2
• #98 feat: add optional PIN protection for secrets
• #97 Add ciphertext format validation for UI routes

v2.1.0

• Replace paranoid mode with hybrid encryption (#96)
• UI always uses client-side AES-128-GCM encryption, API uses server-side encryption
• Add RequireHTMX middleware to ensure JavaScript for UI encryption
• Add security headers middleware (CSP, X-Frame-Options, HSTS)

v2.0.0

Added

• SQLite storage engine replacing BoltDB for persistent storage
• Paranoid mode for zero-knowledge client-side AES-128-GCM encryption
  • Server stores only encrypted blobs, never sees plaintext
  • Encryption key derived from PIN, never transmitted to server
  • Visual indicator with shield icon when paranoid mode active
• Playwright E2E test suite for paranoid mode

Changed

• BREAKING: Replace BoltDB with SQLite for persistent storage
  • --engine=BOLT option removed
  • Existing BoltDB databases not migrated automatically
• Module path changed to github.com/umputun/secrets/v2

Related to #95

v1.9.3

• f14c5c3 Update go-pkgz/rest to v1.20.6 for CDN-compatible RealIP