SkySend

v2.11.0 Breaking

This release includes 4 breaking changes for platform teams planning a safe upgrade.

Published 1mo File Storage & Sync

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

aes-256-gcm docker encryption end-to-end-encryption file-sharing privacy

+5 more

react s3-storage self-hosted typescript zero-knowledge

Affected surfaces

auth

Summary

AI summary

Updates 🗑️ Removed, 🐳 Docker, and ✨ Features across a mixed release.

Full changelog

Password Protection Algorithm Removal, New Copy Button for Password Values, and Improvements

⚠️ Breaking: Password-protected uploads created with PBKDF2 (prior to v2.4.0) or the legacy Argon2id parameters (v2.4.0 - v2.5.0, 4-day window) can no longer be decrypted - both algorithms have been fully removed from the decryption pipeline. All such uploads have exceeded their maximum retention period and have expired, but any password-protected file from those eras cannot be opened after upgrading to this version.

✨ Features

web: Added a copy button to the password value fields in the "password" tab, matching the behaviour of the "password protection" input.

🎨 Improvements

web: Fixed the password generator not closing after clicking "generate" in the "password" tab.

🗑️ Removed

crypto: Removed PBKDF2-SHA256 decryption support - deriveKeyFromPasswordPbkdf2 and PBKDF2_ITERATIONS are deleted, deriveKeyFromPassword now requires an Argon2id function and no longer accepts undefined as a fallback. All pre-v2.5.0 PBKDF2-protected uploads have expired.
web: Removed "pbkdf2" from the passwordAlgo Zod enum in the download and note-info API schemas - responses containing this value are now treated as invalid.
client: Removed "pbkdf2" from the passwordAlgo Zod enum in the file-info and note-info API schemas, and removed the PBKDF2 decryption branch from prepareDownload.
server: Removed "pbkdf2" from the accepted passwordAlgo upload header values - any upload attempt with this algorithm now returns HTTP 400.
crypto: Removed ARGON2_PARAMS_LEGACY (19 MiB / 2 iterations) and the argon2Params optional parameter from deriveKeyFromPassword - the return type is now the literal "argon2id-v2". All uploads created during the 4-day "argon2id" window (v2.4.0 - v2.5.0) have expired.
web: Removed "argon2id" from the passwordAlgo Zod enum in the download and note-info API schemas - responses with the legacy algorithm are now treated as invalid.
client: Removed "argon2id" from the passwordAlgo Zod enum and the legacy decryption branch in prepareDownload - the function now always uses the current Argon2id parameters.
server: Removed "argon2id" from the accepted passwordAlgo upload header values - new uploads with this algorithm now return HTTP 400.

🐳 Docker

Image: skyfay/skysend:v2.11.0
Also tagged as: latest, v2
Platforms: linux/amd64, linux/arm64

Breaking Changes

Removed PBKDF2‑SHA256 decryption support; `deriveKeyFromPasswordPbkdf2` and `PBKDF2_ITERATIONS` deleted, `deriveKeyFromPassword` now requires Argon2id.
Removed `ARGON2_PARAMS_LEGACY` and the optional `argon2Params` parameter from `deriveKeyFromPassword`; return type is now literal "argon2id-v2".
"pbkdf2" removed from all `passwordAlgo` Zod enums in web, client, and server API schemas; responses with this value are invalid.
"argon2id" (legacy) removed from all `passwordAlgo` Zod enums and upload header acceptance; attempts now return HTTP 400.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track SkySend

Get notified when new releases ship.

About SkySend

Encrypted file and note sharing

All releases →