Skip to content

Changelog

The changelog leaves out chores and cleanup, for example:

  • spaces and indentation
  • unnecessary this. and parentheses removed
  • auto properties instead of private fields
  • modern argument checks (ArgumentNullException.ThrowIfNull())
  • .editorconfig formatting
  • ...

Details, reasons and decisions are in the roadmaps (see the home page).

Unreleased

Version 3.2.5 for every project, set once in Directory.Build.props (until v4.0, then per project again).

KeePassCoreLib

  • Argon2d is the default key derivation for new databases; Argon2 is managed only (native libargon2 path removed), always cancellable, its memory always wiped
  • Argon2 parameters below the RFC 9106 minimum memory are rejected on save (reading still works)
  • Argon2 working memory outside the managed heap (locked in RAM, excluded from core dumps where possible, wiped); no forced garbage collection any more
  • AES-KDF can be cancelled: a crafted file asking for 264 − 1 rounds no longer freezes the application
  • Passwords and protected attachments encrypted in memory with KeePassCore.Security.Memory (AES-256-GCM, key in OS-protected memory); ChaCha20 path, DPAPI stub and the ExtCrypt plugin hook removed
  • Protected texts never keep a plain copy (KeePass 2.x kept it after the first read)
  • New IO layer (IOConnectionEx) ready, not used yet: local files, HTTP / WebDAV and FTP, errors always reported (the draft swallowed them)
  • AES-KDF is always reported as weak (not memory-hard), whatever the rounds
  • AES-KDF errors keep their message (no more "Exception of type 'System.Exception' was thrown.")
  • AES-KDF rounds outside 1 to 231 − 2 are rejected on save (KeePassXC limit; reading still works)
  • Atomic save: the database is replaced in one step; a failed save never loses it (Windows transactional NTFS removed)
  • Mono code removed (MonoWorkarounds, MonoVersion, IsUnix()), with the libgcrypt AES-KDF path and Mono.Posix
  • No graphics library: custom icons are PNG bytes, colors are System.Drawing.Color; an invalid color in a file no longer prevents opening it
  • Windows-only calls replaced with .NET on every OS: relative paths, natural sort order
  • UWP (KeePassUAP) and Compact Framework (KeePassLibSD) code removed
  • [LibraryImport] instead of DllImport
  • Commented-out code and Mono comments removed
  • .NET 2.0 workarounds removed (Random seed, IntPtr arithmetic)
  • Own delegates (GAction, GFunc, GroupHandler, ...) replaced with Action / Func
  • IXmlSerializerEx removed (WinForms plumbing, no use in the library)
  • Native KeePassLibC DLL no longer used: AES-KDF is managed only on every OS
  • Saved files are always KDBX 4 (ChaCha20 inner stream): KDBX 3.1 write path removed (Salsa20, HashedBlockStream, 2-byte header fields, ForceVersion); KDBX 3.1 files still open
  • Tests: KDF known-answer tests (RFC 9106, libargon2, OpenSSL), save, KDBX 4 header, colors and icons, paths, sort order

KeePassCore (WinForms application)

  • Weak key derivation (AES-KDF): the dialog now switches to Argon2d instead of resetting AES-KDF
  • Unix and Mono code removed (about 3,500 lines), the application is Windows only
  • [LibraryImport] instead of DllImport (105 declarations)
  • Image helpers taken over from the library; 4 bugs fixed on the way (unscaled images, wrong media type, image hash always 0, no fallback for an invalid custom icon)
  • MessageService and the clipboard code moved from the library
  • Tests project, also runs on Linux and macOS
  • "Native key transformations" option and native library entry of the About dialog removed
  • KeePass 1.x (KDB) import / export and KDBX 3.1 export removed: KDBX 4 only
  • .NET Framework AppContext switches removed; print preview optimization kept in the project file
  • 1Password import uses ZipArchive directly (no reflection); tests for the import
  • Old .NET Framework version checks and bug workarounds removed (input language, Random seed, high DPI config check)
  • Windows 9x / 2000 / XP / Vista / 7 code paths removed (.NET 10 needs Windows 10 or Server 2012)
  • Tray icon tooltip up to 127 characters (was 63)
  • Configuration in JSON only, in %APPDATA%\KeePassCore\KeePassCore.config.json (portable: KeePassCore.config.json next to the exe); KeePass 2.x files are never read nor written. A file that cannot be read is kept (not saved in that session). Settings are loaded and saved again (the half-done move ran on defaults)
  • Options, Duplication, URL overrides, triggers and password generator dialogs usable again (locked by the half-removed enforced configuration); Cancel no longer keeps changes
  • Translations read with the standard XmlSerializer: the generated XML reader and the -makexmlserializerex option removed (same files, about 0.1 s more at startup with a language file)
  • Enforced configuration back, in JSON (KeePassCore.config.enforced.json next to the exe): enforced options are read-only; triggers, URL overrides and password generator profiles are only used from it (CVE-2023-24055, as KeePass 2.54); written by the application when the folder is writable, otherwise by an administrator

KeePassCore.CLI (new)

  • Terminal application (Terminal.Gui): create or open a database (password and/or key file), browse groups and entries, create and edit them, save with confirmation of unsaved changes
  • Warning in the log when the opened database uses a weak key derivation (AES-KDF)

KeePassCore.Security.Memory (new)

  • Protection of secrets in process memory on Windows, Linux and macOS: AES-256-GCM with a per-process key kept in protected memory, optional process hardening

Repository

  • .editorconfig and formatting of the library
  • KDF benchmark (tests/benchmarks/KdfBenchmark)
  • Documentation site built with Zensical by Forgejo Actions, published on the pages branch

v3.2.0

  • KeePassCoreLib compiles platform-independent (no Windows-related code): very dirty (but temporary) migration of methods from the library to the application
  • MainForm in a dependency-injection format (first step to remove static classes and methods)

v3.1.2

  • Some code with the Obsolete attribute removed. Entropy from a random instance instead of the mouse position (platform-independent)
  • Application settings migrated to JSON: the XML enforced configuration is removed for now and will be reimplemented
  • On Wine, some methods are not implemented: try to execute them or ignore them
  • Migration from System.Drawing to SkiaSharp, first phase (make it work: regressions and memory leaks)
  • SystemIcons replaced with free icons (see Icons): some are not implemented in Wine

v3.1.1

  • NativeLib refactoring (use of RuntimeInformation)
  • Thread.Abort() replaced with CancellationToken (to be optimized)
  • IOConnection refactored to an instance class, one IORequest per scheme: HttpIORequest, FtpIORequest, FileIORequest. WebDAV missing. Not used yet
  • Start of the migration of the configuration file from XML to JSON

v3.1.0

  • Base URL of links and pages changed to the new site
  • Full name KeePass Core

v3.0.6

TrlUtil chores.

  • Auto properties (as few private fields as possible)
  • Debug.Assert placed just before a throw removed
  • new() declarations
  • Braces for every block
  • Collection initializers
  • C# 14 features

v3.0.5

KeePass Core (application) chores: same list as v3.0.6.

v3.0.4

KeePassLib Core chores: same list as v3.0.6.

v3.0.3

  • Type check removed in KeePass.Program.InitAppContext
  • KeePass.UI.CustomSplitContainerEx ratio computation improved

v3.0.2

  • TrlUtil project committed
  • net481 target framework removed, net10.0-windows only
  • Type check removed in KeePass.Program.InitAppContext (blocked the start on .NET 10)
  • KeePass.UI.CustomSplitContainerEx ratio computation improved (blocked the start on .NET 10)

v3.0.1

  • KeePass project committed
  • SDK-style project files
  • Builds for net10.0-windows and net481
  • KeePass and TrlUtil start on net481 with Wine on Linux

v3.0.0

  • KeePassLib project committed
  • SDK-style project file
  • Builds for net10.0-windows and net481
  • Obsolete cryptography replaced (new SHAxxxManaged() to SHAxxx.Create(), ...)