Yopass

v14.5.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 7d Secrets & Credentials

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

encryption-decryption file-upload onetimelink onetimesecret password-share secret-sharing

Affected surfaces

auth deps

Summary

AI summary

Updates ✨ New, 🧹 Maintenance, and 🐛 Fixes across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds optional Argon2id key derivation via `--argon2` flag. Adds optional Argon2id key derivation via `--argon2` flag. Source: llm_adapter@2026-07-19 Confidence: high	—
Feature	Medium	Gracefully degrades licensed features when the license expires at runtime without restarting. Gracefully degrades licensed features when the license expires at runtime without restarting. Source: llm_adapter@2026-07-19 Confidence: high	—
Feature	Medium	Adds ability to respond to secret requests with an encrypted file (max 512 KB). Adds ability to respond to secret requests with an encrypted file (max 512 KB). Source: llm_adapter@2026-07-19 Confidence: low	—
Feature	Medium	Enables import of request exports via drag‑and‑drop JSON file. Enables import of request exports via drag‑and‑drop JSON file. Source: llm_adapter@2026-07-19 Confidence: low	—
Feature	Low	Allows file responses to secret requests, encrypted client‑side up to 512 KB. Allows file responses to secret requests, encrypted client‑side up to 512 KB. Source: granite4.1:30b@2026-07-20-audit Confidence: low	—
Feature	Low	Supports import of request exports by dragging a JSON file onto the import panel. Supports import of request exports by dragging a JSON file onto the import panel. Source: granite4.1:30b@2026-07-20-audit Confidence: low	—
Dependency	Low	Updates routine dependencies via Dependabot. Updates routine dependencies via Dependabot. Source: llm_adapter@2026-07-19 Confidence: high	—
Bugfix	Medium	Prevents custom color overrides from resetting the base theme to light. Prevents custom color overrides from resetting the base theme to light. Source: llm_adapter@2026-07-19 Confidence: high	—
Bugfix	Medium	Distinguishes download failures from decryption failures with clearer error messages. Distinguishes download failures from decryption failures with clearer error messages. Source: llm_adapter@2026-07-19 Confidence: high	—

Full changelog

What's Changed

✨ New

File responses to secret requests — responders can now answer a secret request with a file instead of text. The file's content and filename are encrypted in the responder's browser (inside the OpenPGP literal data packet), so the server sees neither. File responses are capped at 512 KB (or --max-file-size if lower) so records fit the database backend, and are disabled together with --disable-upload. Viewing a provided secret now asks for confirmation since retrieval is one-time, and the label field warns that labels are stored unencrypted. https://github.com/jhaals/yopass/pull/3731
Opt-in Argon2 key derivation — new --argon2 flag switches client-side encryption to memory-hard Argon2id key derivation. https://github.com/jhaals/yopass/pull/3664
Runtime license expiry — licensed features now degrade gracefully when the license expires while the server is running, instead of requiring a restart to take effect. https://github.com/jhaals/yopass/pull/3721
Drag & drop import — request exports can be imported by dropping the JSON file onto the import panel. https://github.com/jhaals/yopass/pull/3694

🐛 Fixes

Custom color overrides no longer reset the base theme to light. https://github.com/jhaals/yopass/pull/3689
File retrieval now distinguishes download failures from decryption failures, with clearer error messages for each. https://github.com/jhaals/yopass/pull/3675

🧹 Maintenance

Code cleanups: API contract tests, deduplication, shared helpers. https://github.com/jhaals/yopass/pull/3665
Refactored yopass-server startup into testable functions; Prefetcher routed through api.ts. https://github.com/jhaals/yopass/pull/3666
Prefetcher data fetching extracted into hooks. https://github.com/jhaals/yopass/pull/3674
Shared icons module replaces duplicated inline SVGs. https://github.com/jhaals/yopass/pull/3673

Plus routine dependency updates via Dependabot.

Full Changelog: https://github.com/jhaals/yopass/compare/14.4.0...14.5.0

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Yopass

Get notified when new releases ship.

About Yopass

Secure sharing of secrets, passwords and files.

All releases →