Excalibur 0.6.1 is a hotfix release fixing a bug with name obfuscation on the app.
/api/files/count to count the number of items in the user's file systemWelcome to Excalibur 0.6.0! This release brings significant security improvements, numerous bug fixes, and performance improvements. Here are some of the highlights:
The Excalibur documentation website was also updated in this release.
Do note that there are several breaking changes to Excalibur in this version. Please follow the 0.6 upgrade guide to upgrade your Excalibur instance to version 0.6. Do also take note of all the breaking changes made to the server API if you are using it.
Read all about the changes to Excalibur below. Enjoy!
pnpm-workspace.yaml to address security vulnerabilities:
@xmldom/xmldom to 0.8.13✨ Implemented the OPAQUE-3DH protocol to replace the Secure Remote Password (SRP) protocol for increased security
✨ Implemented obfuscation of file and folder names
✨ Added more sorting options for the file explorer page:
✨ Added creation times to file and folder listings
💄 Added a new server settings submenu that contains the server vault key
🔄 Changed default login protocol from Secure Remote Password (SRP) to OPAQUE-3DH
🔄 Changed default registration protocol from Secure Remote Password (SRP) to OPAQUE-3DH
🚸 Updated registration flow so that users are automatically logged in after registration
🚸 Made the file change listener attempt to reconnect to the server upon initial disconnect
💄 Split up settings page's contents into multiple subpages for cleaner navigation
💄 Made the scrollbar for the file explorer breadcrumbs look nicer
💄 Updated file explorer interface to display the file listener status (i.e., connected or disconnected)
💄 Added current running Excalibur version to update dialog (to allow comparing with the latest release version)
⚰️ Removed vault key dialog
lib/security to lib/auth in the main package🔒️ Added minimum age that dependencies need to be released before accepting updates
➕ Added mime dependency
➕ Added seedrandom dependency (and @types/seedrandom as a development dependency)
➖ Removed @vitejs/plugin-legacy dependency
⬆️ Updated Ionic dependencies:
@ionic/core from 8.8.2 to 8.8.6@ionic/react from 8.8.2 to 8.8.6@ionic/react-router from 8.8.2 to 8.8.6⬆️ Updated Vite dependencies:
vite from 7.3.1 to 8.0.12vite-plugin-node-polyfills from 0.25.0 to 0.26.0vitest from 4.1.2 to 4.1.5@vitejs/plugin-react from 5.1.4 to 6.0.1⬆️ Updated Capacitor dependencies:
@capacitor/android from 8.2.0 to 8.3.3@capacitor/app from 8.0.1 to 8.1.0@capacitor/core from 8.2.0 to 8.3.3@capacitor/cli from 8.2.0 to 8.3.3@capacitor/keyboard from 8.0.2 to 8.0.3⬆️ Updated Electron dependencies:
electron from 39.2.7 to 41.5.1electron-vite from 5.0.0 to 6.0.0-beta.1⬆️ Updated TailwindCSS dependencies:
tailwindcss from 4.2.1 to 4.3.0@tailwindcss/vite from 4.2.1 to 4.3.0⬆️ Updated React dependencies:
react from 19.2.4 to 19.2.5react-dom from 19.2.4 to 19.2.5⬆️ Updated immer from 11.1.4 to 11.1.8
⬆️ Updated baseline-browser-mapping from 2.10.7 to 2.10.29
📌 Pinned typescript development dependency version to 5.x.x (currently 5.9.3)
⬆️ Updated ESLint development dependencies:
eslint from 9.39.3 to 9.39.4@eslint/js from 9.39.2 to 9.39.4eslint-plugin-chai-friendly from 1.1.0 to 1.2.0eslint-plugin-cypress from 6.1.0 to 6.4.1eslint-plugin-react-hooks from 7.0.1 to 7.1.1typescript-eslint from 8.56.1 to 8.59.2⬆️ Updated Prettier development dependencies:
prettier from 3.8.1 to 3.8.3prettier-plugin-tailwindcss from 0.7.2 to 0.8.0⬆️ Updated globals development dependency from 17.4.0 to 17.6.0
⬆️ Updated lint-staged development dependency from 16.3.3 to 16.4.0
⬆️ Updated start-server-and-test development dependency from 2.1.5 to 3.0.4
⬆️ Updated cypress development dependency from 15.11.0 to 15.14.2
⬆️ Updated @types/node development dependency from 25.5.0 to 25.6.2
update_deps.py script to automate the generation of dependency updates' news fragmentscrud.cy.ts into multiple files for more modular testingFolderOpenerPlugin to Kotlin.browserslistrc to Ionic v8 versionsandroid-actions/setup-android to v4pnpm/action-setup to v5💥 Changed CLI options for the start command:
--enable-cors/--disable-cors to --enable-cors-validation/--no-cors-validation (since --disable-cors was misleading)💥 Added a new option --auth-protocol to the excalibur user add command
OPAQUE-3DH)--auth-protocol=SRP💥 The File type no longer returns a mimetype value; it is up to the client to derive the MIME type of the file. This affects the following endpoints:
/api/files/search (which returns a list of file-score pairs)/api/files/list/{path} (which returns a list of files or directories)💥 Certain endpoints' response content have been removed as their response codes sufficiently indicate the success/failure of the operation. In particular, these endpoints now no longer return any content for the 200 OK status code:
/api/files/move (previously returned Item Moved)/api/files/mkdir/{path} (previously returned Directory created)/api/files/rename/{path} (previously returned Item renamed)/api/files/upload/{path} (previously returned File uploaded)💥 We will now use uv's 0.10.x series to build and install the server package, updating the minimum version from 0.9.30 in pyproject.toml and GitHub actions to 0.10.9
✨ Implemented the OPAQUE-3DH protocol to replace the Secure Remote Password (SRP) protocol
/api/auth/opaque/register) to handle OPAQUE registration flows
/api/auth/opaque) to handle OPAQUE login flows✨ Implemented a new database-backed file management system, moving away from relying on operating-system file management
✨ Added new endpoints to get and edit additional user info (/api/users/info/{username} and /api/users/edit-info/{username} respectively)
✨ Added a new endpoint (/api/files/all) to get all files and folders in the user's file system
✨ Added a new backup command to the CLI (excalibur backup)
✨ Made responses return X-Content-Type-Options and X-Frame-Options headers
X-Content-Type-Options: nosniff and X-Frame-Options: DENY🗃️ Modified the Excalibur database:
User table:
auth_protocol, additional_info, and registration_record fieldssrp_group, srp_salt, and srp_verifier fields optional (since they are not used for the OPAQUE-3DH protocol)FSItem table🗃️ Added authentication protocol information (auth_protocol) to be returned by the security details endpoint (/api/users/security/{username})
🗃️ The File and Directory types now return a creation_time field representing the creation timestamp of the item. This affects the following endpoints:
/api/files/search (which returns a list of file-score pairs)/api/files/list/{path} (which returns a list of files or directories)🗑️ The following endpoints no longer return the corresponding response codes:
/api/files/download/{path}: Removed 406 Not Acceptable, corresponding to an "Illegal or invalid path"/api/files/upload/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path"414 URI Too Long, corresponding to a file path that is too long/api/files/mkdir/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path"414 URI Too Long, corresponding to a directory path that is too long/api/files/list/{path}: Removed 406 Not Acceptable, corresponding to an "Illegal or invalid path"/api/files/check/path/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path"414 URI Too Long, corresponding to a directory path that is too long/api/files/check/dir/{path}: Removed 406 Not Acceptable, corresponding to an "Illegal or invalid path"/api/files/delete/{path}: Removed 406 Not Acceptable, corresponding to an "Illegal or invalid path"/api/files/move/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path"414 URI Too Long, corresponding to a path that is too long/api/files/rename/{path}: Removed
406 Not Acceptable, corresponding to an "Illegal or invalid path", replacing it with 400 Bad Request corresponding to an "Illegal or invalid name"414 URI Too Long, corresponding to a path that is too longThe documentation has been updated to reflect these changes.
🧹 Subdirectories returned by /api/files/list/{path} will no longer have items returned
items field would be set to null. Now the field is omitted entirely🐛 Fixed a bug where unbounded timestamps in the future were allowed as timestamps during the Proof-of-Possession (PoP) validation process
🐛 Fixed wrong exception being returned if the WebSocket credentials are incorrect
🐛 Fixed certain CLI commands (i.e., excalibur db ui and excalibur test) returning incorrect error codes
🐛 Fixed an issue where multiple file listener connections with the same communications UUID from the authentication token would override each other, causing all non-latest connections to not receive any updates from the server
🐛 Fixed a bug where returning nothing in some endpoints gives "Response content shorter than Content-Length" internal server errors
✏️ Fixed typo in the add user endpoint documentation.
🔥 Removed old operating-system file management code
excalibur db migrate-files command🗑️ Deprecated Secure Remote Password (SRP) related code
🔒️ Added minimum age that dependencies need to be released before accepting updates
➖ Removed watchdog dependency
⬆️ Updated fastapi from 0.135.2 to 0.136.1
⬆️ Updated gitpython from 3.1.46 to 3.1.50
⬆️ Updated packaging from 26.0 to 26.2
⬆️ Updated pydantic from 2.12.5 to 2.13.4
⬆️ Updated pydantic-settings from 2.13.1 to 2.14.1
⬆️ Updated tomlkit from 0.14.0 to 0.15.0
⬆️ Updated typer from 0.24.1 to 0.25.1
⬆️ Updated uvicorn from 0.41.0 to 0.46.0
⬆️ Updated ipython development dependency from 9.10.0 to 9.10.1
⬆️ Updated pytest development dependency from 9.0.2 to 9.0.3
⬆️ Updated rapidfuzz dependency from 3.14.3 to 3.14.5
⬆️ Updated ruff development dependency from 0.15.6 to 0.15.12
⬆️ Updated sqlmodel dependency from 0.0.37 to 0.0.38
HTTPBearer instance from "SRP-Identity" to "Auth-Identity"./api/auth/ack endpoint (as_string=true)update_deps.py script to automate the generation of dependency updates' news fragments_add_new_field() function present in the excalibur config update commandExcalibur 0.5.1 includes minor changes to the app to improve the overall experience for users.
⬆️ Updated Capacitor dependencies:
@capacitor/keyboard from 8.0.1 to 8.0.2⬆️ Updated Ionic dependencies:
@ionic/core from 8.8.1 to 8.8.2@ionic/react from 8.8.1 to 8.8.2@ionic/react-router from 8.8.1 to 8.8.2⬆️ Updated TailwindCSS dependencies:
tailwindcss from 4.2.1 to 4.2.2@tailwindcss/vite from 4.2.1 to 4.2.2⬆️ Updated baseline-browser-mapping dependency from 2.10.7 to 2.10.11
⬆️ Updated vitest development dependency from 4.1.0 to 4.1.2
sqlalchemy from 2.0.48 to 2.0.44fastapi from 0.135.1 to 0.135.2ruff development dependency from 0.15.6 to 0.15.8Excalibur 0.5 includes many new features and improvements to the project. Here are some of the highlights:
The Excalibur documentation website was also updated in this release.
Do note that there are some breaking changes to the Excalibur server in this release. Please follow the 0.5 upgrade guide to upgrade your Excalibur instance to version 0.5.
Read all about the changes to Excalibur below. Enjoy!
POST requests to have their bodies encrypted
/api/files/mkdir, /api/files/move, and /api/files/rename endpoints used to send their POST bodies in the clear. Now they are encrypted using the shared end-to-end encryption keypnpm-workspace.yaml to address security vulnerabilities:
@isaacs/brace-expansion to 5.0.1ajv to 6.14.0axios to 1.13.5bn.js@<4.12.3 to 5.2.3 and bn.js@>=5.0.0 <5.2.3 to 5.2.3flatted to 3.4.0minimatch@<3.1.4 to 3.1.4, minimatch@>=5.0.0 <5.1.8 to 5.1.8, minimatch@>=9.0.0 <9.0.7 to 9.0.7, and minimatch@>=10.0.0 <10.2.3 to 10.2.3qs to 6.14.2rollup to 4.59.0tar to 7.5.11yauzl to 3.2.1Cypress.env() calls to Cypress.expose() in tests, following the advice of this migration guideprocess.env.NODE_ENV === "development" and the like with a reference to the new IS_DEV constant⬆️ Updated Capacitor dependencies:
@capacitor/android from 8.0.0 to 8.2.0@capacitor/app from 8.0.0 to 8.0.1@capacitor/cli from 8.0.0 to 8.2.0@capacitor/core from 8.0.0 to 8.2.0@capacitor/filesystem from 8.0.0 to 8.1.2@capacitor/keyboard from 8.0.0 to 8.0.1@capacitor/preferences from 8.0.0 to 8.0.1@capacitor/privacy-screen from 2.0.0 to 2.0.1@capawesome/capacitor-file-picker from 8.0.0 to 8.0.2capacitor-blob-writer from 1.1.19 to 1.1.20⬆️ Updated ESLint development dependencies:
eslint from 9.39.2 to 9.39.3eslint-plugin-cypress from 5.2.1 to 6.1.0eslint-plugin-react-refresh from 0.4.26 to 0.5.2typescript-eslint from 8.52.0 to 8.56.1⬆️ Updated Electron dependencies:
dmg-builder from 26.4.0 to 26.8.1electron-builder from 26.4.0 to 26.8.1electron-builder-squirrel-windows from 26.4.0 to 26.8.1electron-updater from 6.7.3 to 6.8.3⬆️ Updated Ionic dependencies:
@ionic/core from 8.7.16 to 8.8.1@ionic/react from 8.7.16 to 8.8.1@ionic/react-router from 8.7.16 to 8.8.1⬆️ Updated React dependencies:
react from 19.2.3 to 19.2.4react-dom from 19.2.3 to 19.2.4⬆️ Updated TailwindCSS dependencies:
tailwindcss from 4.1.18 to 4.2.1@tailwindcss/vite from 4.1.18 to 4.2.1⬆️ Updated Vite dependencies:
vite-plugin-node-polyfills from 0.24.0 to 0.25.0vitest from 4.0.16 to 4.1.0@vitejs/plugin-react from 5.1.2 to 5.1.4⬆️ Updated immer from 11.1.3 to 11.1.4
⬆️ Updated cypress development dependency from 15.8.2 to 15.11.0
⬆️ Updated globals development dependency from 17.0.0 to 17.4.0
⬆️ Updated lint-staged development dependency from 16.2.7 to 16.3.3
⬆️ Updated prettier development dependency from 3.7.4 to 3.8.1
⬆️ Updated type dependencies:
@types/node from 25.0.6 to 25.5.0@types/react from 19.2.8 to 19.2.14TestPage (/dev/test): Basic test page for developmentExEFPage (/dev/exef): Test page for ExEF encryption/decryptionX-Encrypted: true header
pyjwt in pyproject.toml to 2.12.0 to address CVE-2026-32597 (#15)start command:
--host can now be specified with -h--port can now be specified with -p--encrypt-responses/--no-encrypt-responses no longer has the short forms of -e/-E--delay no longer has the short form of -d--enable-cors/--disable-cors no longer has the short forms of -c/-C--clean-up-logs/--no-clean-up-logs can now be specified with -c/-C/api/well-known/heartbeat)
logging.no_log_endpoints configuration option was updated to remove this endpointpath in upload file endpoint (/api/files/upload/{path:path}) to be the file path instead of the file's containing directory; also removed the name query parameter/api/files/list/{path}'s with_exef_header query parameter to include_exef_size/api/files/searchstart command to enable or disable Proof of Possession (PoP) checking
/api/docs endpoint as a default endpoint that is ignored in the logging.no_log_endpoints fieldos.getenv and os.environ with calls to functions in env.py for easier management and less repeated codeEXCALIBUR_SERVER_POP_ENABLED to EXCALIBUR_SERVER_ENABLE_POPlistings.py in excalibur_server/src/files to utils.pyuv version from 0.9.3 in pyproject.toml and 0.9.18 in GitHub actions to 0.9.30
uv version to the 0.10.x series in the futurealembic from 1.18.0 to 1.18.4duckdb from 1.3.2 to 1.4.4fastapi from 0.128.0 to 0.135.1pydantic-settings from 2.12.0 to 2.13.1pyjwt from 2.10.1 to 2.12.1sqlalchemy from 2.0.45 to 2.0.48sqlmodel from 0.0.31 to 0.0.37tomlkit from 0.13.3 to 0.14.0typer from 0.21.1 to 0.24.1uvicorn from 0.40.0 to 0.41.0ipython development dependency from 9.9.0 to 9.10.0ruff development dependency from 0.14.11 to 0.15.6This is a security release overriding some dependencies' versions' minima.
Version 0.4.3 was skipped due to a misconfigured dependency version preventing the release action from completing successfully. Its changes were combined with 0.4.4's changes below.
diff version minima to ^5.2.2 in pnpm-workspace.yaml to address CVE-2026-24001lodash and lodash-es version minima to ^4.17.23 in pnpm-workspace.yaml to address CVE-2025-13465tar version minima to ^7.5.7 in pnpm-workspace.yaml to address CVE-2026-24842 and CVE-2026-23950@capacitor/cli from 8.0.0 to 8.0.2No significant changes.