Updating the app is recommended but not necessary. Updating the server is not required.
lint-staged development dependency from 16.4.0 to 17.0.5 (#29)vite from 8.0.12 to 7.3.2@vitejs/plugin-react from 6.0.1 to 5.2.0electron-vite from 6.0.0-beta.1 to 5.0.0@capacitor/android from 8.3.3 to 8.2.0@capacitor/core from 8.3.3 to 8.2.0@capacitor/cli from 8.3.3 to 8.2.0No significant changes.
]]>.exef in file names๐ Fixed an inconsistency where uploaded files must end in .exef but renaming files does not enforce this
.exef extension when renaming a file will return a 417 Expectation Failed error๐ Fixed backup command (excalibur backup) not including folders' contents
/api/files/count to count the number of items in the user's file systemThe Excalibur documentation website was also updated in this release.
Do note that there are several breaking changes to Excalibur in this version. Please follow the 0.6 upgrade guide to upgrade your Excalibur instance to version 0.6. Do also take note of all the breaking changes made to the server API if you are using it.
Read all about the changes to Excalibur below. Enjoy!
pnpm-workspace.yaml to address security vulnerabilities:
@xmldom/xmldom to 0.8.13โจ Implemented the OPAQUE-3DH protocol to replace the Secure Remote Password (SRP) protocol for increased security
โจ Implemented obfuscation of file and folder names
โจ Added more sorting options for the file explorer page:
โจ Added creation times to file and folder listings
๐ Added a new server settings submenu that contains the server vault key
๐ Changed default login protocol from Secure Remote Password (SRP) to OPAQUE-3DH
๐ Changed default registration protocol from Secure Remote Password (SRP) to OPAQUE-3DH
๐ธ Updated registration flow so that users are automatically logged in after registration
๐ธ Made the file change listener attempt to reconnect to the server upon initial disconnect
๐ Split up settings page's contents into multiple subpages for cleaner navigation
๐ Made the scrollbar for the file explorer breadcrumbs look nicer
๐ Updated file explorer interface to display the file listener status (i.e., connected or disconnected)
๐ Added current running Excalibur version to update dialog (to allow comparing with the latest release version)
โฐ๏ธ Removed vault key dialog
lib/security to lib/auth in the main package๐๏ธ Added minimum age that dependencies need to be released before accepting updates
โ Added mime dependency
โ Added seedrandom dependency (and @types/seedrandom as a development dependency)
โ Removed @vitejs/plugin-legacy dependency
โฌ๏ธ Updated Ionic dependencies:
@ionic/core from 8.8.2 to 8.8.6@ionic/react from 8.8.2 to 8.8.6@ionic/react-router from 8.8.2 to 8.8.6โฌ๏ธ Updated Vite dependencies:
vite from 7.3.1 to 8.0.12vite-plugin-node-polyfills from 0.25.0 to 0.26.0vitest from 4.1.2 to 4.1.5@vitejs/plugin-react from 5.1.4 to 6.0.1โฌ๏ธ Updated Capacitor dependencies:
@capacitor/android from 8.2.0 to 8.3.3@capacitor/app from 8.0.1 to 8.1.0@capacitor/core from 8.2.0 to 8.3.3@capacitor/cli from 8.2.0 to 8.3.3@capacitor/keyboard from 8.0.2 to 8.0.3โฌ๏ธ Updated Electron dependencies:
electron from 39.2.7 to 41.5.1electron-vite from 5.0.0 to 6.0.0-beta.1โฌ๏ธ Updated TailwindCSS dependencies:
tailwindcss from 4.2.1 to 4.3.0@tailwindcss/vite from 4.2.1 to 4.3.0โฌ๏ธ Updated React dependencies:
react from 19.2.4 to 19.2.5react-dom from 19.2.4 to 19.2.5โฌ๏ธ Updated immer from 11.1.4 to 11.1.8
โฌ๏ธ Updated baseline-browser-mapping from 2.10.7 to 2.10.29
๐ Pinned typescript development dependency version to 5.x.x (currently 5.9.3)
โฌ๏ธ Updated ESLint development dependencies:
eslint from 9.39.3 to 9.39.4@eslint/js from 9.39.2 to 9.39.4eslint-plugin-chai-friendly from 1.1.0 to 1.2.0eslint-plugin-cypress from 6.1.0 to 6.4.1eslint-plugin-react-hooks from 7.0.1 to 7.1.1typescript-eslint from 8.56.1 to 8.59.2โฌ๏ธ Updated Prettier development dependencies:
prettier from 3.8.1 to 3.8.3prettier-plugin-tailwindcss from 0.7.2 to 0.8.0โฌ๏ธ Updated globals development dependency from 17.4.0 to 17.6.0
โฌ๏ธ Updated lint-staged development dependency from 16.3.3 to 16.4.0
โฌ๏ธ Updated start-server-and-test development dependency from 2.1.5 to 3.0.4
โฌ๏ธ Updated cypress development dependency from 15.11.0 to 15.14.2
โฌ๏ธ Updated @types/node development dependency from 25.5.0 to 25.6.2
update_deps.py script to automate the generation of dependency updates' news fragmentscrud.cy.ts into multiple files for more modular testingFolderOpenerPlugin to Kotlin.browserslistrc to Ionic v8 versionsandroid-actions/setup-android to v4pnpm/action-setup to v5๐ฅ Changed CLI options for the start command:
--enable-cors/--disable-cors to --enable-cors-validation/--no-cors-validation (since --disable-cors was misleading)๐ฅ Added a new option --auth-protocol to the excalibur user add command
OPAQUE-3DH)--auth-protocol=SRP๐ฅ The File type no longer returns a mimetype value; it is up to the client to derive the MIME type of the file. This affects the following endpoints:
/api/files/search (which returns a list of file-score pairs)/api/files/list/{path} (which returns a list of files or directories)๐ฅ Certain endpoints' response content have been removed as their response codes sufficiently indicate the success/failure of the operation. In particular, these endpoints now no longer return any content for the 200 OK status code:
/api/files/move (previously returned Item Moved)/api/files/mkdir/{path} (previously returned Directory created)/api/files/rename/{path} (previously returned Item renamed)/api/files/upload/{path} (previously returned File uploaded)๐ฅ We will now use uv's 0.10.x series to build and install the server package, updating the minimum version from 0.9.30 in pyproject.toml and GitHub actions to 0.10.9
โจ Implemented the OPAQUE-3DH protocol to replace the Secure Remote Password (SRP) protocol
/api/auth/opaque/register) to handle OPAQUE registration flows
/api/auth/opaque) to handle OPAQUE login flowsโจ Implemented a new database-backed file management system, moving away from relying on operating-system file management
โจ Added new endpoints to get and edit additional user info (/api/users/info/{username} and /api/users/edit-info/{username} respectively)
โจ Added a new endpoint (/api/files/all) to get all files and folders in the user's file system
โจ Added a new backup command to the CLI (excalibur backup)
โจ Made responses return X-Content-Type-Options and X-Frame-Options headers
X-Content-Type-Options: nosniff and X-Frame-Options: DENY๐๏ธ Modified the Excalibur database:
User table:
auth_protocol, additional_info, and registration_record fieldssrp_group, srp_salt, and srp_verifier fields optional (since they are not used for the OPAQUE-3DH protocol)FSItem table๐๏ธ Added authentication protocol information (auth_protocol) to be returned by the security details endpoint (/api/users/security/{username})
๐๏ธ The File and Directory types now return a creation_time field representing the creation timestamp of the item. This affects the following endpoints:
/api/files/search (which returns a list of file-score pairs)/api/files/list/{path} (which returns a list of files or directories)๐๏ธ The following endpoints no longer return the corresponding response codes:
/api/files/download/{path}: Removed 406 Not Acceptable, corresponding to an "Illegal or invalid path"/api/files/upload/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path"414 URI Too Long, corresponding to a file path that is too long/api/files/mkdir/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path"414 URI Too Long, corresponding to a directory path that is too long/api/files/list/{path}: Removed 406 Not Acceptable, corresponding to an "Illegal or invalid path"/api/files/check/path/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path"414 URI Too Long, corresponding to a directory path that is too long/api/files/check/dir/{path}: Removed 406 Not Acceptable, corresponding to an "Illegal or invalid path"/api/files/delete/{path}: Removed 406 Not Acceptable, corresponding to an "Illegal or invalid path"/api/files/move/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path"414 URI Too Long, corresponding to a path that is too long/api/files/rename/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path", replacing it with 400 Bad Request corresponding to an "Illegal or invalid name"414 URI Too Long, corresponding to a path that is too longThe documentation has been updated to reflect these changes.
๐งน Subdirectories returned by /api/files/list/{path} will no longer have items returned
items field would be set to null. Now the field is omitted entirely๐ Fixed a bug where unbounded timestamps in the future were allowed as timestamps during the Proof-of-Possession (PoP) validation process
๐ Fixed wrong exception being returned if the WebSocket credentials are incorrect
๐ Fixed certain CLI commands (i.e., excalibur db ui and excalibur test) returning incorrect error codes
๐ Fixed an issue where multiple file listener connections with the same communications UUID from the authentication token would override each other, causing all non-latest connections to not receive any updates from the server
๐ Fixed a bug where returning nothing in some endpoints gives "Response content shorter than Content-Length" internal server errors
โ๏ธ Fixed typo in the add user endpoint documentation.
๐ฅ Removed old operating-system file management code
excalibur db migrate-files command๐๏ธ Deprecated Secure Remote Password (SRP) related code
๐๏ธ Added minimum age that dependencies need to be released before accepting updates
โ Removed watchdog dependency
โฌ๏ธ Updated fastapi from 0.135.2 to 0.136.1
โฌ๏ธ Updated gitpython from 3.1.46 to 3.1.50
โฌ๏ธ Updated packaging from 26.0 to 26.2
โฌ๏ธ Updated pydantic from 2.12.5 to 2.13.4
โฌ๏ธ Updated pydantic-settings from 2.13.1 to 2.14.1
โฌ๏ธ Updated tomlkit from 0.14.0 to 0.15.0
โฌ๏ธ Updated typer from 0.24.1 to 0.25.1
โฌ๏ธ Updated uvicorn from 0.41.0 to 0.46.0
โฌ๏ธ Updated ipython development dependency from 9.10.0 to 9.10.1
โฌ๏ธ Updated pytest development dependency from 9.0.2 to 9.0.3
โฌ๏ธ Updated rapidfuzz dependency from 3.14.3 to 3.14.5
โฌ๏ธ Updated ruff development dependency from 0.15.6 to 0.15.12
โฌ๏ธ Updated sqlmodel dependency from 0.0.37 to 0.0.38
HTTPBearer instance from "SRP-Identity" to "Auth-Identity"./api/auth/ack endpoint (as_string=true)update_deps.py script to automate the generation of dependency updates' news fragments_add_new_field() function present in the excalibur config update commandโฌ๏ธ Updated Capacitor dependencies:
@capacitor/keyboard from 8.0.1 to 8.0.2โฌ๏ธ Updated Ionic dependencies:
@ionic/core from 8.8.1 to 8.8.2@ionic/react from 8.8.1 to 8.8.2@ionic/react-router from 8.8.1 to 8.8.2โฌ๏ธ Updated TailwindCSS dependencies:
tailwindcss from 4.2.1 to 4.2.2@tailwindcss/vite from 4.2.1 to 4.2.2โฌ๏ธ Updated baseline-browser-mapping dependency from 2.10.7 to 2.10.11
โฌ๏ธ Updated vitest development dependency from 4.1.0 to 4.1.2
sqlalchemy from 2.0.48 to 2.0.44fastapi from 0.135.1 to 0.135.2ruff development dependency from 0.15.6 to 0.15.8The Excalibur documentation website was also updated in this release.
Do note that there are some breaking changes to the Excalibur server in this release. Please follow the 0.5 upgrade guide to upgrade your Excalibur instance to version 0.5.
Read all about the changes to Excalibur below. Enjoy!
POST requests to have their bodies encrypted
/api/files/mkdir, /api/files/move, and /api/files/rename endpoints used to send their POST bodies in the clear. Now they are encrypted using the shared end-to-end encryption keypnpm-workspace.yaml to address security vulnerabilities:
@isaacs/brace-expansion to 5.0.1ajv to 6.14.0axios to 1.13.5bn.js@<4.12.3 to 5.2.3 and bn.js@>=5.0.0 <5.2.3 to 5.2.3flatted to 3.4.0minimatch@<3.1.4 to 3.1.4, minimatch@>=5.0.0 <5.1.8 to 5.1.8, minimatch@>=9.0.0 <9.0.7 to 9.0.7, and minimatch@>=10.0.0 <10.2.3 to 10.2.3qs to 6.14.2rollup to 4.59.0tar to 7.5.11yauzl to 3.2.1Cypress.env() calls to Cypress.expose() in tests, following the advice of this migration guideprocess.env.NODE_ENV === "development" and the like with a reference to the new IS_DEV constantโฌ๏ธ Updated Capacitor dependencies:
@capacitor/android from 8.0.0 to 8.2.0@capacitor/app from 8.0.0 to 8.0.1@capacitor/cli from 8.0.0 to 8.2.0@capacitor/core from 8.0.0 to 8.2.0@capacitor/filesystem from 8.0.0 to 8.1.2@capacitor/keyboard from 8.0.0 to 8.0.1@capacitor/preferences from 8.0.0 to 8.0.1@capacitor/privacy-screen from 2.0.0 to 2.0.1@capawesome/capacitor-file-picker from 8.0.0 to 8.0.2capacitor-blob-writer from 1.1.19 to 1.1.20โฌ๏ธ Updated ESLint development dependencies:
eslint from 9.39.2 to 9.39.3eslint-plugin-cypress from 5.2.1 to 6.1.0eslint-plugin-react-refresh from 0.4.26 to 0.5.2typescript-eslint from 8.52.0 to 8.56.1โฌ๏ธ Updated Electron dependencies:
dmg-builder from 26.4.0 to 26.8.1electron-builder from 26.4.0 to 26.8.1electron-builder-squirrel-windows from 26.4.0 to 26.8.1electron-updater from 6.7.3 to 6.8.3โฌ๏ธ Updated Ionic dependencies:
@ionic/core from 8.7.16 to 8.8.1@ionic/react from 8.7.16 to 8.8.1@ionic/react-router from 8.7.16 to 8.8.1โฌ๏ธ Updated React dependencies:
react from 19.2.3 to 19.2.4react-dom from 19.2.3 to 19.2.4โฌ๏ธ Updated TailwindCSS dependencies:
tailwindcss from 4.1.18 to 4.2.1@tailwindcss/vite from 4.1.18 to 4.2.1โฌ๏ธ Updated Vite dependencies:
vite-plugin-node-polyfills from 0.24.0 to 0.25.0vitest from 4.0.16 to 4.1.0@vitejs/plugin-react from 5.1.2 to 5.1.4โฌ๏ธ Updated immer from 11.1.3 to 11.1.4
โฌ๏ธ Updated cypress development dependency from 15.8.2 to 15.11.0
โฌ๏ธ Updated globals development dependency from 17.0.0 to 17.4.0
โฌ๏ธ Updated lint-staged development dependency from 16.2.7 to 16.3.3
โฌ๏ธ Updated prettier development dependency from 3.7.4 to 3.8.1
โฌ๏ธ Updated type dependencies:
@types/node from 25.0.6 to 25.5.0@types/react from 19.2.8 to 19.2.14TestPage (/dev/test): Basic test page for developmentExEFPage (/dev/exef): Test page for ExEF encryption/decryptionX-Encrypted: true header
pyjwt in pyproject.toml to 2.12.0 to address CVE-2026-32597 (#15)start command:
--host can now be specified with -h--port can now be specified with -p--encrypt-responses/--no-encrypt-responses no longer has the short forms of -e/-E--delay no longer has the short form of -d--enable-cors/--disable-cors no longer has the short forms of -c/-C--clean-up-logs/--no-clean-up-logs can now be specified with -c/-C/api/well-known/heartbeat)
logging.no_log_endpoints configuration option was updated to remove this endpointpath in upload file endpoint (/api/files/upload/{path:path}) to be the file path instead of the file's containing directory; also removed the name query parameter/api/files/list/{path}'s with_exef_header query parameter to include_exef_size/api/files/searchstart command to enable or disable Proof of Possession (PoP) checking
/api/docs endpoint as a default endpoint that is ignored in the logging.no_log_endpoints fieldos.getenv and os.environ with calls to functions in env.py for easier management and less repeated codeEXCALIBUR_SERVER_POP_ENABLED to EXCALIBUR_SERVER_ENABLE_POPlistings.py in excalibur_server/src/files to utils.pyuv version from 0.9.3 in pyproject.toml and 0.9.18 in GitHub actions to 0.9.30
uv version to the 0.10.x series in the futurealembic from 1.18.0 to 1.18.4duckdb from 1.3.2 to 1.4.4fastapi from 0.128.0 to 0.135.1pydantic-settings from 2.12.0 to 2.13.1pyjwt from 2.10.1 to 2.12.1sqlalchemy from 2.0.45 to 2.0.48sqlmodel from 0.0.31 to 0.0.37tomlkit from 0.13.3 to 0.14.0typer from 0.21.1 to 0.24.1uvicorn from 0.40.0 to 0.41.0ipython development dependency from 9.9.0 to 9.10.0ruff development dependency from 0.14.11 to 0.15.6Version 0.4.3 was skipped due to a misconfigured dependency version preventing the release action from completing successfully. Its changes were combined with 0.4.4's changes below.
diff version minima to ^5.2.2 in pnpm-workspace.yaml to address CVE-2026-24001lodash and lodash-es version minima to ^4.17.23 in pnpm-workspace.yaml to address CVE-2025-13465tar version minima to ^7.5.7 in pnpm-workspace.yaml to address CVE-2026-24842 and CVE-2026-23950@capacitor/cli from 8.0.0 to 8.0.2No significant changes.
]]>Note that the server still has the heartbeat endpoint, but is now unused. The removal of this endpoint will come in Excalibur 0.5.
No significant changes.
]]>/api/auth/token also disconnect the user from the update managerThere are no breaking changes made in Excalibur 0.4, but please still follow the 0.4 upgrade guide to upgrade your Excalibur instance to version 0.4.
Read all about the changes to Excalibur below. Enjoy!
refreshContents() call listdir() three times before giving upnatural-compare-lite)listdir() failing badly when timeout occurs( and ), by following Python's urllib.quote() and urllib.quotePlus() implementationseslint-plugin-cypress from 5.2.0 to 5.2.1typescript-eslint from 8.51.0 to 8.52.0electron-builder from 26.3.1 to 26.4.0electron-builder-squirrel-windows from 26.3.1 to 26.4.0dmg-builder from 26.3.1 to 26.4.0electron-updater from 6.6.2 to 6.7.3@trivago/prettier-plugin-sort-imports from 6.0.1 to 6.0.2cypress from 15.8.1 to 15.8.2vite from 7.3.0 to 7.3.1@types/node from 25.0.3 to 25.0.6@types/react from 19.2.7 to 19.2.8validateURL() tests to url.test.tsconsole.log()/console.debug() callsfiles.cy.ts into multiple files for better organization and maintainability/api/well-known/info which returns the following information:
version: SemVer of the servermax_upload_size: Maximum allowed file size in bytestime: ISO 8601 string of the server's current time/api/files/check/size endpoint in favour of the new server info endpoint/api/well-known/clock endpoint in favour of the new server info endpoint/api/files/listen/debug was removed)cachetools dependencyalembic from 1.17.2 to 1.18.0typer from 0.21.0 to 0.21.1websockets from 15.0.1 to 16.0ruff development dependency from 0.14.10 to 0.14.11pytest-timeout development dependency as a last-resort method to catch any tests that are hangingTTLCache to replace cachetools dependency_add_new_field() to config updater CLI to promote code reusestatic folderOne pressing issue is with the rate limiting of file uploads. This is caused by the default token capacity and refill limit being too small for mass file uploads. As a temporary fix, modify your server's config.toml file as follows:
[server.rate_limit]
# The capacity of the rate limiter (e.g., number of allowed bursts)
-capacity = 20
+capacity = 250
# The refill rate of the rate limiter, in tokens per second
-refill_rate = 1
+refill_rate = 25
This will increase the rate limit for requests made to the server.
qs transitive dependency from 6.14.0 to 6.14.1 to address CVE-2025-15284Updated Ionic dependencies:
@ionic/core from 8.7.15 to 8.17.6@ionic/react from 8.7.15 to 8.17.6@ionic/react-router from 8.7.15 to 8.17.6Updated @trivago/prettier-plugin-sort-imports development dependency from 6.0.0 to 6.0.1
Updated immer from 11.1.0 to 11.1.3
Updated typescript-eslint development dependency from 8.50.1 to 8.51.0
useDirectory() to use useExplorerContext()useUploadFile() to use useExplorerContext().vscode folder to app's main directory (app/packages/main)Jobs-related things into components/explorer/jobsexcalibur config update will also update the rate limit in the config file during the config update processfastapi from 0.127.0 to 0.128.0gitpython from 3.1.45 to 3.1.46sqlmodel from 0.0.29 to 0.0.31typer from 0.20.1 to 0.21.0ipython development dependency from 9.8.0 to 9.9.0HTTP_429_TOO_MANY_REQUESTS constant instead of using the status code directlyThe Excalibur documentation website was also updated in this release.
Unfortunately, this release does bring about some breaking changes. Please follow the 0.3 upgrade guide to upgrade your Excalibur instance to version 0.3.
Read all about the changes to Excalibur below. Enjoy!
Version field from 2 bytes to 1 byteKey Size field with Cipher ID field for greater flexibility of choice of encryption algorithm, and reduced its size from 2 bytes to 1 byteHeader MAC field for quick verification of the decryption key (solving the issue of 'decrypting' the entire file before seeing that the AES-GCM tag does not match)pnpm for dependency managementjs-yaml transitive dependency version from 4.1.0 to 4.1.1 to address CVE-2025-64718glob transitive dependency version from 11.0.3 to 11.1.0 to address CVE-2025-64756@capacitor/android from 7.4.3 to 8.0.0@capacitor/app from 7.1.0 to 8.0.0@capacitor/core from 7.4.3 to 8.0.0@capacitor/cli from 7.4.3 to 8.0.0@capacitor/filesystem from 7.1.4 to 8.0.0@capacitor/keyboard from 7.0.3 to 8.0.0@capacitor/preferences from 7.0.2 to 8.0.0@capacitor/privacy-screen from 1.1.1 to 2.0.0@capacitor/screen-orientation from 7.0.2 to 8.0.0@capawesome/capacitor-file-picker from 7.2.0 to 8.0.08.13.0 to 8.13.21.9.2 to 1.11.01.15.0 to 1.17.03.6.1 to 3.7.01.8.4 to 1.8.91.2.1 to 1.3.01.12.1 to 1.14.01.0.1 to 1.2.010.1.1 to 14.0.115.3.0 to 15.8.1eslint from 9.37.0 to 9.39.2@eslint/js from 9.37.0 to 9.39.2eslint-plugin-react-hooks from 7.0.0 to 7.0.1eslint-plugin-react-refresh from 0.4.23 to 0.4.26typescript-eslint from 8.46.1 to 8.50.1@ionic/core from 8.7.5 to 8.7.15@ionic/react from 8.7.5 to 8.7.15@ionic/react-router from 8.7.5 to 8.7.15prettier from 3.6.2 to 3.7.4prettier-plugin-tailwindcss from 0.6.14 to 0.7.2@trivago/prettier-plugin-sort-imports from 5.2.2 to 6.0.0react from 19.2.0 to 19.2.3react-dom from 19.2.0 to 19.2.3tailwindcss from 4.1.14 to 4.1.18@tailwindcss/vite from 4.1.14 to 4.1.18vite from 7.1.11 to 7.3.0@vitejs/plugin-react from 5.0.4 to 5.1.2globals from 16.4.0 to 16.5.0jsonwebtoken from 9.0.3 to 9.0.4lint-staged from 16.2.3 to 16.2.4lint-staged from 16.2.4 to 16.2.6vitest from 3.2.4 to 4.0.16@types/node from 24.10.1 to 25.0.3@types/react from 19.2.0 to 19.2.7@types/react-dom from 19.2.0 to 19.2.3actions/checkout from v5 to v6actions/setup-node from v5 to v6actions/setup-python from v5 to v6actions/upload-artifact from v5 to v6astral-sh/setup-uv from v6.5.0 to v7 (with corresponding uv version bumped from 0.8.17 to 0.9.18)release-builds.yml workflowFileExplorer page to be less complex and more maintainableVersion field from 2 bytes to 1 byteKey Size field with Cipher ID field for greater flexibility of choice of encryption algorithm, and reduced its size from 2 bytes to 1 byteHeader MAC field for quick verification of the decryption key (solving the issue of 'decrypting' the entire file before seeing that the AES-GCM tag does not match)config subcommands to the CLI:
config validate: Validates the config fileconfig update: Updates the config file to the latest version/api/files/listen) that allows clients to listen for directory changes--log/--no-log or -l/-L) that enables/disables logging to consoleexcalibur user ack will now print the mnemonic for the key instead of the key itself--logging/--no-logging (-l/-L) to --log-to-file/--no-log-to-file (-f/-F)aiofiles from 24.1.0 to 25.1.0alembic from 1.16.5 to 1.17.2cachetools from 6.2.0 to 6.2.4fastapi from 0.118.0 to 0.127.0pydantic from 2.11.9 to 2.12.5pydantic-core from 2.33.2 to 2.41.5pydantic-settings from 2.11.0 to 2.12.0sqlalchemy from 2.0.43 to 2.0.45sqlmodel from 0.0.25 to 0.0.29typer from 0.19.2 to 0.20.1uvicorn from 0.37.0 to 0.40.0ipython development dependency from 9.6.0 to 9.8.0pytest development dependency from 8.4.2 to 9.0.2ruff development dependency from 0.13.3 to 0.14.10uv package manager version from 0.8.17 to 0.9.3EXCALIBUR_SERVER_HMAC_ENABLED to EXCALIBUR_SERVER_POP_ENABLEDHTTP_413_REQUEST_ENTITY_TOO_LARGE to HTTP_413_CONTENT_TOO_LARGEHTTP_414_REQUEST_URI_TOO_LONG to HTTP_414_URI_TOO_LONGHTTP_416_REQUESTED_RANGE_NOT_SATISFIABLE to HTTP_416_RANGE_NOT_SATISFIABLEHTTP_422_UNPROCESSABLE_ENTITY to HTTP_422_UNPROCESSABLE_CONTENTexcalibur test command to allow running specific testsfiles subdirectory of the APIlicense-files in pyproject.tomlvite from 7.1.9 to 7.1.11 to address CVE-2025-62522 (#13)No significant changes.
]]>react-hooks/set-state-in-effect lint errors. The app should now run slightly fastertypescript-eslint from 8.45.0 to 8.46.1 and eslint-plugin-react-hooks from 6.1.1 to 7.0.0excalibur user ack)HTTP_413_REQUEST_ENTITY_TOO_LARGE to HTTP_413_CONTENT_TOO_LARGEHTTP_414_REQUEST_URI_TOO_LONG to HTTP_414_URI_TOO_LONGHTTP_416_REQUESTED_RANGE_NOT_SATISFIABLE to HTTP_416_RANGE_NOT_SATISFIABLEHTTP_422_UNPROCESSABLE_ENTITY to HTTP_422_UNPROCESSABLE_CONTENTvite from 7.1.3 to 7.1.5 to address CVE-2025-58751 and CVE-2025-58752 (#8)tar-fs versions to address CVE-2025-59343 (#12)52419 and, if it finds one, use it as the API server URL52419 if no port is specified.exef suffix are displayed
.exef suffixreact and react-dom from 19.1.1 to 19.2.0vite from 7.1.5 to 7.1.9, and upgraded @vitejs/plugin-react from 5.0.1 to 5.0.4@capacitor/app from 7.0.2 to 7.1.0@capacitor/keyboard from 7.0.2 to 7.0.314.5.4 to 15.3.0@ionic/react and @ionic/react-router from 8.7.3 to 8.7.5eslint from 9.33.0 to 9.37.0, and upgraded typescript-eslint from 8.40.0 to 8.45.0globals from 16.3.0 to 16.4.0tailwindcss and @tailwindcss/vite from 4.1.12 to 4.1.14typescript from 5.9.2 to 5.9.38.12.1 to 8.13.01.2.1 to 1.3.03.6.1 to 3.7.0@types/react from 19.1.10 to 19.2.0@types/react-dom from 19.1.7 to 19.2.0CHANGELOG.md file contents into per-version changes406 Not Acceptable instead of 400 Bad Request if the directory name is invalidlocalhost (was 0.0.0.0)8888 to 52419/api prefixwell-known endpoint namescachetools from 6.1.0 to 6.2.0fastapi from 0.116.1 to 0.118.0ipython in dev dependencies from 9.4.0 to 9.6.0pydantic from 2.11.7 to 2.11.9, and upgraded pydantic-settings from 2.10.1 to 2.11.0ruff in dev dependencies from 0.12.9 to 0.13.3sqlmodel from 0.0.24 to 0.0.25typer from 0.16.1 to 0.19.2uvicorn from 0.35.0 to 0.37.0excalibur build command for generating buildstest_token_bucket.py tests by mocking the time instead of using time.sleepCHANGELOG.md file contents into per-version changesmultipart/form-data requestsha.js dependency from 2.4.11 to 2.4.12 to address CVE-2025-9288uv.lock's dependencies' versions--disable-cors option for debuggingtyper minimum version to 0.16.1No significant changes.
]]>