[1.17.4] - 2026-10-10

Added

• age: Add hello capability negotiation to the age agent protocol (#3624)
• age: Report the time left until auto-lock in gopass age agent status
• age: add hello capability negotiation to the age agent (#3634)
• age: log received identities via out.Secret (#3630) (#3625)
• age: report auto-lock countdown in age agent status (#3656)
• age: support hardware-backed keyring unlocking (#3648) (#3644)
• secret-service: add Linux Secret Service daemon (#3434) (#3607)
• show: Add show.password config option to display only the password by default (#3621)
• show: add show.password config option (#3621) (#3623)

Fixed

• Mitigate path-traversal gap in Store.Link (#3649)
• Remove capslock (#3647)
• age-agent: redact sensitive protocol lines from debug logs (#3625) (#3508)
• age: cache unlocked SSH identities in agent (#3646)
• age: honor preferred identity order during decryption (#3643) (#3632)
• age: prevent agent panic when decrypting plugin identities (#3633)
• ls: Hide template-only folders from flat listing (#3650)
• msi: add install dir to user PATH (#3588) (#3622)

Security

• fs: reject symlinked store entries escaping the store root (#3654)

[1.17.3] - 2026-09-22

Changed

• deps: move HIBP client into pkg/hibp to break the module cycle (#3603)

Fixed

• age: send waiting on plugin message to stderr (#3613)
• config: Avoid overwriting the config when there is no need (#3602) (#3593)
• tempfile: avoid hdiutil deprecation warning on macOS 27 (#3610)

[1.17.2] - 2026-09-10

Fixed

• Remove GPG_FINGERPRINT from goreleaser config
• Revert to goreleaser 2.11.2 so we can keep on Go 1.25
• ci: Fix broken script snippet in release workflow

[1.17.2-rc.0] - 2026-09-10

Fixed

• Remove GPG_FINGERPRINT from goreleaser config
• ci: Fix broken script snippet in release workflow

[1.17.1] - 2026-09-09

Added

• api: Add new AuditList method (#3594)
• create: support passwordless / SSO login profiles (#3493)

Fixed

• ctxutil: restore password callback hook for embedded age prompts (#3590)
• store: Fix reencrypt when adding recipients (#3595) (#3473)

[1.17.0] - 2026-08-30

Added

• Add --safe flag to set safecontent on demand (#3318)
• Add --stdin, --file, and --exec modes to gopass env
• Add JSON output to audit, list, find, and recipients commands (I-3)
• Add gopass doctor diagnostic command (I-4)
• Add show.fuzzysearch config and --nofuzzysearch flag to control automatic fuzzy lookup in show
• Add show.hidden-keys config option for customizable safecontent redaction (I-5)
• Add stable structured exit codes; --exit-codes flag lists all codes (I-2)
• add configurable show.hidden-keys for safecontent redaction
• changelog: migrate to Keep a Changelog 1.1.0 (#3506) (#3414)
• env: add --stdin, --file, and --exec modes to gopass env
• gpg: support v5/v6 PGP keys with 64-character fingerprints (#3496)
• machine-readable JSON output (I-3)
• pwgen: add memorable generator support (#3494)
• show: add configurable fuzzy-search fallback toggle (#3449)
• structured exit codes (I-2)
• support -c=N to copy specific line to clipboard (#3386)

Changed

• Define pkg/gopass API stability contract: best-effort stable policy with [PKG-BREAK] changelog tag and minimum deprecation window (A-12)
• Fix documentation vs. implementation mismatches in config.md, show.md, find.md, generate.md, secrets.md, and ARCHITECTURE.md
• Fully document wizard template format, attribute types, and file naming convention (I-7)
• Protect autosyncLastRun with a mutex (S-6)
• Replace context-key config system with typed structs (A-2)
• Replace sort.Strings with slices.Sort throughout (S-3)
• Split Action handler into focused handler types (A-1)
• Standardize XKCD password generator flag names to --xkcd-sep, --xkcd-lang etc. (U-4)
• Unified secret name validation rejects path traversal and consecutive slashes (I-1)
• action: split Action god object into focused handler types (A-1)
• age: share identity file parsing (#3559)
• ctxutil: replace context-key config system with typed structs (A-2)

Deprecated

• Surface GOPASS_AUTOSYNC_INTERVAL deprecation as a visible warning (U-7)

Removed

• Remove cryptic -t alias from --force-regen in generate (U-6)
• Remove misleading --force / -f aliases from --unsafe in show and find (U-1)

Fixed

• Add thread safety to SSH identity cache (M-3)
• Avoid NPE when attempting to edit a non-existing secret (#3489)
• CI: moving to go 1.25 (#3322)
• Configure .gitattributes based on the backend (#3427) (#3409)
• Correctly honor show.safecontent overrides in substores (#3337)
• Default audit output to summary when no format flag is given (B-7)
• Disable grype, the builder seems to be broken (#3463)
• Fix autoSync debounce timestamp to update on success instead of failure (B-2)
• Fix convert backend name in error messages (B-5, B-6)
• Fix create wizard maximum-length check (B-3)
• Fix grep match and error counters in audit summary (B-1)
• Fix queue goroutine leak and Add() post-Close() panic (B-8)
• REPL tab-completion for entries with spaces (#3360)
• Support HW Age identities (#3389) (#3387)
• Support strict character class enforcement in create templates (#3352) (#3350)
• Update fish completion to remove warning (#3339)
• add case-insensitive secret name normalization (#3390) (#2837)
• add hidden pull and push commands (#3532)
• address A-5, S-1, S-2, S-3, S-4, S-6 and I-1 from code quality audit
• address CLI/UX issues from code quality audit
• address all confirmed bugs from code quality report
• age-agent: handle AGE-PLUGIN-* identities to fix 'malformed secret key: mixed case' error (#3397)
• age: deterministically order identities for decryption (#3566) (#3393)
• age: expand ~/ in age.ssh-key-path (#3474)
• age: only encrypt for recipients in .age-recipients (#3564) (#3392)
• age: raise agent scanner buffer limit to handle large decrypt payloads (#3529) (#3508)
• age: recover agent on missing identities, not only when locked (#3488)
• age: send agent identities space-separated on a single line (#3509)
• backend: add storage.backend config key to lock backend selection (#3332) (#3398)
• clip flag (-c) for cli/v3 GenericFlag compatibility (#3448)
• config: restore sub-store fallback for core.exportkeys (#3379)
• copy: preserve directory structure when copying with trailing slash (#3396)
• docs: removing reference to invalid 'gopass binary' command, and adding docs for 'fsmove' and 'fscopy' (#3321)
• drain background queue before exiting on failure (#3528)
• eliminate audit, queue, and test initialization races (#3540)
• fix lint issues and update tests for removed show -f/--force alias
• gpg: make identity selection deterministic (#3577)
• highlight linked secrets in ls output (#3536)
• honor core.autopush during root-store move operations (#3535)
• pwgen: remove math/rand fallback (#3531)
• queue: fix Idle() TOCTOU race and Add() post-Close() panic
• recover from panic during shell completion with unknown flags (#3388)
• require --age-sshkeys (or age.sshkeys config) to access ~/.ssh (#3525) (#3522)
• restore clip flag through fuzzy search in show command (#3466)
• secparse: replace panic in MustParse with testing.TB.Fatalf (#3420)
• setup: rename --alias/--create to --team/--create-team (#3568) (#3497)
• setup: suppress auto-commit in gitfs when setup remote is specified (#2901) (#3391)
• store mount paths relative to home dir for cross-platform portability (#3439) (#2897)
• tempfile: mount macOS ramdisk read-write (#3527)
• todos: resolve all stale TODOs from S-5
• update bash completion flag for urfave/cli/v3 compatibility (#3441) (#3440)
• updater: cap archive/icon extraction writes and surface oversize errors (#3530)
• use imperative mood in generated commit messages (#3492) (#1222)
• warn when recipient key is expired or unusable during encryption (#3443) (#2885)

Security

• Bound symlink traversal to store root (H-2)
• Fix path traversal vulnerability in fs storage layer (C-1)
• Restrict template engine secret access and fix error information leakage (H-1)
• Validate editor binary path before invocation (H-3)
• Warn on env command secret exposure via environment variables (C-2)
• bound symlink walk to store root (H-2)
• document and warn on env command secret exposure (C-2)
• fix path traversal in fs storage layer (C-1)
• restrict template engine secret access and fix error leakage (H-1)
• validate editor binary exists before invocation (H-3)

[1.17.0-rc.3] - 2026-08-20

Added

• Add --stdin, --file, and --exec modes to gopass env
• Add JSON output to audit, list, find, and recipients commands (I-3)
• Add gopass doctor diagnostic command (I-4)
• Add show.fuzzysearch config and --nofuzzysearch flag to control automatic fuzzy lookup in show
• Add show.hidden-keys config option for customizable safecontent redaction (I-5)
• Add stable structured exit codes; --exit-codes flag lists all codes (I-2)
• changelog: migrate to Keep a Changelog 1.1.0 (#3506) (#3414)
• gpg: support v5/v6 PGP keys with 64-character fingerprints (#3496)
• pwgen: add memorable generator support (#3494)

Changed

• Define pkg/gopass API stability contract: best-effort stable policy with [PKG-BREAK] changelog tag and minimum deprecation window (A-12)
• Fix documentation vs. implementation mismatches in config.md, show.md, find.md, generate.md, secrets.md, and ARCHITECTURE.md
• Fully document wizard template format, attribute types, and file naming convention (I-7)
• Protect autosyncLastRun with a mutex (S-6)
• Replace context-key config system with typed structs (A-2)
• Replace sort.Strings with slices.Sort throughout (S-3)
• Split Action handler into focused handler types (A-1)
• Standardize XKCD password generator flag names to --xkcd-sep, --xkcd-lang etc. (U-4)
• Unified secret name validation rejects path traversal and consecutive slashes (I-1)

Deprecated

• Surface GOPASS_AUTOSYNC_INTERVAL deprecation as a visible warning (U-7)

Removed

• Remove cryptic -t alias from --force-regen in generate (U-6)
• Remove misleading --force / -f aliases from --unsafe in show and find (U-1)

Fixed

• Add thread safety to SSH identity cache (M-3)
• Avoid NPE when attempting to edit a non-existing secret (#3489)
• Default audit output to summary when no format flag is given (B-7)
• Fix autoSync debounce timestamp to update on success instead of failure (B-2)
• Fix convert backend name in error messages (B-5, B-6)
• Fix create wizard maximum-length check (B-3)
• Fix grep match and error counters in audit summary (B-1)
• Fix queue goroutine leak and Add() post-Close() panic (B-8)
• add hidden pull and push commands (#3532)
• age: expand ~/ in age.ssh-key-path (#3474)
• age: raise agent scanner buffer limit to handle large decrypt payloads (#3529) (#3508)
• age: recover agent on missing identities, not only when locked (#3488)
• age: send agent identities space-separated on a single line (#3509)
• drain background queue before exiting on failure (#3528)
• highlight linked secrets in ls output (#3536)
• honor core.autopush during root-store move operations (#3535)
• pwgen: remove math/rand fallback (#3531)
• restore clip flag through fuzzy search in show command (#3466)
• tempfile: mount macOS ramdisk read-write (#3527)
• updater: cap archive/icon extraction writes and surface oversize errors (#3530)
• use imperative mood in generated commit messages (#3492) (#1222)

Security

• Bound symlink traversal to store root (H-2)
• Fix path traversal vulnerability in fs storage layer (C-1)
• Restrict template engine secret access and fix error information leakage (H-1)
• Validate editor binary path before invocation (H-3)
• Warn on env command secret exposure via environment variables (C-2)

1.17.0-rc.2 / 2026-06-07

• [chore] Document stability for pkg/gopass (#3438)
• [chore] Update gopasspw/clipboard (#3436)
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#3458)
• chore(deps): bump docker/build-push-action from 7.1.0 to 7.2.0 (#3455)
• chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 (#3459)
• chore(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 (#3452)
• chore(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#3456)
• chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#3453)
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#3454)
• chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#3457)
• chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.4 (#3451)
• chore: More output before and after long running release ops (#3433)
• feat(show): add configurable fuzzy-search fallback toggle (#3449)
• fix: Disable grype, the builder seems to be broken (#3463)
• fix: clip flag (-c) for cli/v3 GenericFlag compatibility (#3448)
• fix: store mount paths relative to home dir for cross-platform portability (#3439)
• fix: update bash completion flag for urfave/cli/v3 compatibility (#3441)
• fix: warn when recipient key is expired or unusable during encryption (#3443)
• otp: add noscreenshot build tag and document screen-capture scope (#3442)
• otp: hide --snip flag when built with noscreenshot tag (#3445)

1.17.0-rc.1 / 2026-05-17

This release contains a larger than usual amount of changes and few which might be considered breaking, thus bumping to 1.17 already. Please help us test this release before we publish 1.17.0 proper.

• [BUGFIX] Update fish completion to remove warning (#3339)
• [chore] Follow up to PR 3383 (#3410)
• [feat] Add --safe flag to set safecontent on demand (#3318)
• [fix] Support HW Age identities (#3389)
• age: fix YubiKey identity persistence via raw-append (ADR-0002) (#3399)
• bug: reload identities on unlock command (#3430)
• chore(deps): bump actions/cache from 4.3.0 to 5.0.3 (#3324)
• chore(deps): bump actions/cache from 5.0.3 to 5.0.4 (#3374)
• chore(deps): bump actions/cache from 5.0.4 to 5.0.5 (#3404)
• chore(deps): bump actions/checkout from 6.0.0 to 6.0.2 (#3326)
• chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#3329)
• chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#3349)
• chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#3367)
• chore(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 (#3347)
• chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3403)
• chore(deps): bump anchore/sbom-action from 0.20.10 to 0.23.0 (#3348)
• chore(deps): bump anchore/sbom-action from 0.23.0 to 0.24.0 (#3376)
• chore(deps): bump anchore/scan-action from 7.2.1 to 7.3.2 (#3346)
• chore(deps): bump anchore/scan-action from 7.3.2 to 7.4.0 (#3372)
• chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 (#3368)
• chore(deps): bump dependabot/fetch-metadata from 2 to 3 (#3406)
• chore(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#3342)
• chore(deps): bump docker/build-push-action from 6.19.2 to 7.0.0 (#3377)
• chore(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 (#3407)
• chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#3330)
• chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 (#3378)
• chore(deps): bump docker/login-action from 4.0.0 to 4.1.0 (#3400)
• chore(deps): bump docker/metadata-action from 5.10.0 to 6.0.0 (#3375)
• chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#3341)
• chore(deps): bump github/codeql-action from 4.31.6 to 4.32.4 (#3345)
• chore(deps): bump github/codeql-action from 4.32.4 to 4.35.1 (#3369)
• chore(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#3401)
• chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#3343)
• chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 (#3402)
• chore(deps): bump msys2/setup-msys2 from 2.29.0 to 2.31.0 (#3370)
• chore(deps): bump msys2/setup-msys2 from 2.31.0 to 2.31.1 (#3408)
• chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.1 (#3373)
• chore(deps): bump step-security/harden-runner from 2.13.2 to 2.15.0 (#3344)
• chore(deps): bump step-security/harden-runner from 2.15.0 to 2.16.1 (#3371)
• chore(deps): bump step-security/harden-runner from 2.16.1 to 2.19.0 (#3405)
• chore(deps): migrate from urfave/cli v2 to v3 (#3428)
• chore(deps): switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#3362)
• docs(appdir): explain GOPASS_HOMEDIR override in UserHome comment (#3421)
• docs(architecture): add API Stability section clarifying module semver policy (#3422)
• docs(otp): document the various supported ways of adding OTP (#3323)
• docs: add gopass-secret-service to integrations list (#3356)
• docs: fix all documentation vs. implementation mismatches from code quality report
• docs: fully document wizard template format (I-7)
• feat(env): add --stdin, --file, and --exec modes to gopass env
• feat: add configurable show.hidden-keys for safecontent redaction
• feat: add gopass doctor diagnostic command (I-4)
• feat: machine-readable JSON output (I-3)
• feat: structured exit codes (I-2)
• feat: support -c=N to copy specific line to clipboard (#3386)
• fix(CI): moving to go 1.25 (#3322)
• fix(age-agent): handle AGE-PLUGIN-* identities to fix 'malformed secret key: mixed case' error (#3397)
• fix(backend): add storage.backend config key to lock backend selection (#3332) (#3398)
• fix(config): restore sub-store fallback for core.exportkeys (#3379)
• fix(copy): preserve directory structure when copying with trailing slash (#3396)
• fix(docs): removing reference to invalid 'gopass binary' command, and adding docs for 'fsmove' and 'fscopy' (#3321)
• fix(queue): fix Idle() TOCTOU race and Add() post-Close() panic
• fix(secparse): replace panic in MustParse with testing.TB.Fatalf (#3420)
• fix(setup): suppress auto-commit in gitfs when setup remote is specified (#2901) (#3391)
• fix(todos): resolve all stale TODOs from S-5
• fix: Configure .gitattributes based on the backend (#3427)
• fix: Correctly honor show.safecontent overrides in substores (#3337)
• fix: REPL tab-completion for entries with spaces (#3360)
• fix: Support strict character class enforcement in create templates (#3352)
• fix: add case-insensitive secret name normalization (#3390)
• fix: add thread safety to SSH identity cache (M-3)
• fix: address A-5, S-1, S-2, S-3, S-4, S-6 and I-1 from code quality audit
• fix: address CLI/UX issues from code quality audit
• fix: address all confirmed bugs from code quality report
• fix: fix lint issues and update tests for removed show -f/--force alias
• fix: recover from panic during shell completion with unknown flags (#3388)
• openbsd: allow unix sockets in pledge (#3381)
• refactor(action): split Action god object into focused handler types (A-1)
• refactor(ctxutil): replace context-key config system with typed structs (A-2)
• security: bound symlink walk to store root (H-2)
• security: document and warn on env command secret exposure (C-2)
• security: fix path traversal in fs storage layer (C-1)
• security: restrict template engine secret access and fix error leakage (H-1)
• security: validate editor binary exists before invocation (H-3)

1.16.1 / 2025-12-13

• chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#3299)
• chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#3300)
• chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 (#3296)
• chore(deps): bump anchore/scan-action from 7.1.0 to 7.2.1 (#3298)
• chore(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#3297)
• chore(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (#3295)
• chore(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 (#3302)
• chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 (#3301)
• fix(config): use the config propery generate.strict as default value for Strict rules (#3303)
• fix: Fix version check against latest release (#3292)