Excalibur 0.7.2 is a patch release fixing security issues and bugs on the app and server.

App​

🔒️ Security​

• 🔒️ Removed persistence of password in authInfo and the account unlock key (AUK) in vaultInfo

• 🔒️ Stopped persisting login session and vault key material in localStorage

  • A fresh login is now required on every app launch or page reload

🔄 Changes​

• 🔒️ Prompt user for current password when updating account details

🐛 Bug Fixes​

• 🐛 Fixed a previously necessary but janky reload of the page when a new user signs up
• 🐛 Fixed an issue where a failed update check could throw an error

Server​

🐛 Bug Fixes​

• 🐛 Fixed the database engine not being disposed after use
  • This leaked the DuckDB file lock and caused an IO error when a worker/reload subprocess tried to access the database

⬆️ Dependencies​

• ➖ Removed colorama dependency
• ⬆️ Updated alembic from 1.18.4 to 1.18.5 (#102)
• ⬆️ Updated typer from 0.26.7 to 0.26.8 (#99)
• ⬆️ Updated uvicorn from 0.49.0 to 0.51.0 (#100)
• ⬆️ Updated httpx2 test dependency from 2.4.0 to 2.5.0 (#97)

Welcome to Excalibur 0.7! This release brings significant performance improvements, security improvements, new features, and numerous bug fixes. Here are some of the highlights:

• Speedier Crypto: We've migrated from the old polyfilled NodeJS crypto API to @noble/ciphers, giving us a ~5x performance boost on encryption and decryption operations.
• New Jobs Modal: The old, slightly janky jobs popup has been replaced with a new jobs modal that shows up at the bottom of the screen when a new job is added, and continuously updates as jobs progress.
• Argon2d Support: Excalibur now supports the Argon2d key derivation algorithm for enhanced security. Existing users can change their key derivation algorithm from PBKDF2 to Argon2d in the new preferences menu.

The Excalibur documentation website was also updated in this release.

Do note that there are several breaking changes to Excalibur in this version. Please follow the 0.7 upgrade guide to upgrade your Excalibur instance to version 0.7. Do also take note of all the breaking changes made to the server API if you are using it.

Read all about the changes to Excalibur below. Enjoy!

App​

🔒️ Security​

• 🔒️ Overridden version minima of dependencies in pnpm-workspace.yaml to address security vulnerabilities:
  • GHSA-vxpw-j846-p89q, GHSA-p88m-4jfj-68fv, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m: undici to 6.27.0

✨ New Features​

• 💄 Added new preferences menu
  • Users can change their username and password within the new preferences menu's "Account Preferences" section
• ✨ Added support for Argon2d key derivation algorithm
  • Existing users can change their key derivation algorithm from PBKDF2 to Argon2d in the preferences menu

🔄 Changes​

• 💄 Replaced old jobs popup with new jobs modal
  • The modal will now show up at the bottom of the screen when a new job is added, and will continuously update as jobs progress
• 💄 Moved "server settings" to the new preferences menu
  • The old "server settings" page is now named "Data Preferences"
• 💄 Edited the "new user" page's password input field to require re-entering new password

🐛 Bug Fixes​

• 🐛 Fixed an issue that occurs when obfuscation is toggled whilst in a subfolder

⚡️ Performance Improvements​

• ⚡️ Use @noble/ciphers instead of the default polyfilled crypto for faster encryption

  • Benchmarking shows that the new @noble/ciphers encryption/decryption implementation is ~5x faster than the original polyfilled node:crypto

  ===================================== 256 KiB =====================================
  polyfilled `crypto` ╢███░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░  36.719 ms
  @noble/ciphers      ╢█░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░   7.425 ms
                      ╠══════════════════════════════════════════════════
                      0                                                  600
  
  ====================================== 1 MiB ======================================
  polyfilled `crypto` ╢████████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 145.738 ms
  @noble/ciphers      ╢██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░  29.581 ms
                      ╠══════════════════════════════════════════════════
                      0                                                  600
  
  ====================================== 4 MiB ======================================
  polyfilled `crypto` ╢█████████████████████████████████████████████████░ 584.844 ms
  @noble/ciphers      ╢██████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 117.138 ms
                      ╠══════════════════════════════════════════════════
                      0                                                  600
  

⬆️ Dependencies​

• ➕ Added @noble/ciphers dependency

• ➕ Added @noble/hashes dependency

• ➕ Added buffer dependency

• ➕ Added create-hash dependency (as well as @types/create-hash development dependency)

• ➕ Added create-hmac dependency (as well as @types/create-hmac development dependency)

• ➕ Added crypto-browserify dependency

• ➕ Added pbkdf2 dependency (as well as @types/pbkdf2 development dependency)

• ➕ Added randombytes dependency (as well as @types/randombytes development dependency)

• ➕ Added stream-browserify dependency

• ➕ Added util dependency

• ➕ Added vm-browserify dependency

• ➖ Removed @capacitor-community/safe-area dependency

  • The changes made in the dependency have been incorporated into version 8.3.0 of the SystemBars plugin in Capacitor

• ➖ Removed js-sha3 dependency

• ⬆️ Updated Capacitor dependencies:

  • @capacitor/android from 8.2.0 to 8.4.0
  • @capacitor/core from 8.2.0 to 8.4.0
  • @capacitor/cli from 8.2.0 to 8.4.0

• ⬆️ Updated Electron dependencies:

  • electron from 41.5.1 to 41.9.2
  • electron-builder from 26.8.1 to 26.15.3
  • dmg-builder from 26.8.1 to 26.15.3
  • electron-builder-squirrel-windows from 26.8.1 to 26.15.3

• ⬆️ Updated Ionic dependencies:

  • @ionic/core from 8.8.6 to 8.8.9
  • @ionic/react from 8.8.6 to 8.8.9
  • @ionic/react-router from 8.8.6 to 8.8.9

• ⬆️ Updated React dependencies (#75):

  • react from 19.2.5 to 19.2.7 (and @types/react development dependency from 19.2.14 to 19.2.17)
  • react-dom from 19.2.5 to 19.2.7

• ⬆️ Updated Vite dependencies:

  • vite from 7.3.2 to 8.0.16
  • vite-plugin-node-polyfills from 0.26.0 to 0.28.0
  • @vitejs/plugin-react from 5.2.0 to 6.0.1
  • electron-vite from 5.0.0 to 6.0.0-beta.1

• ⬆️ Updated @capawesome/capacitor-file-picker from 8.0.2 to 8.0.3 (#94)

• ⬆️ Updated @types/node development dependency from 25.6.2 to 25.9.1

• ⬆️ Updated baseline-browser-mapping development dependency from 2.10.29 to 2.10.33

• ⬆️ Updated cypress from 15.14.2 to 15.16.0

• ⬆️ Updated eslint-plugin-chai-friendly development dependency from 1.2.0 to 1.2.1 (#60)

• ⬆️ Updated eslint-plugin-cypress development dependency from 6.4.1 to 6.4.2 (#83)

• ⬆️ Updated eslint-plugin-react-refresh development dependency from 0.5.2 to 0.5.3 (#59)

• ⬆️ Updated globals development dependency from 17.6.0 to 17.7.0 (#71)

• ⬆️ Updated immer from 11.1.8 to 11.1.9 (#93)

• ⬆️ Updated lint-staged development dependency from 17.0.5 to 17.0.7

• ⬆️ Updated prettier development dependency from 3.8.4 to 3.9.4 (#85)

• ⬆️ Updated semver-parser from 4.1.8 to 4.2.1

• ⬆️ Updated start-server-and-test development dependency from 3.0.4 to 3.0.6

• ⬆️ Updated typescript-eslint development dependency from 8.61.0 to 8.62.1 (#64, #77, #92)

• ⬆️ Updated vitest development dependency from 4.1.5 to 4.1.9 (#81)

🧹 Miscellaneous​

• 💥 We will now use pnpm's 11.x.x series to build and install the main application package, updating the minimum version from 10 in the root package.json and GitHub actions to 11
• 🔒️ Changed point multiplication algorithm of Ristretto255 from double-and-add to Montgomery ladder
• ⚰️ Removed Secure Remote Password (SRP) related code

Server​

🔒️ Security​

• 🔒️ Addressed a security issue where the ExEF footer could have been left out when sending the request body and yet still accepted by the server, resulting in possibly tampered bodies being accepted by the server

• 🔒️ Changed the behaviour of encrypted routes so that they only accept encrypted payloads (i.e., X-Encrypted must be set to true)

  • This prevents an attacker from 'downgrading' the encryption level of a route by replacing a legitimate encrypted payload with an attacker-controlled malicious plaintext
  • This setting can only be bypassed on debug mode (via the --debug flag)

• 🔒️ Fixed a security issue where the nonce in the Proof-of-Possession header is consumed before the validity of the header is checked

  • This could allow an attacker to flood the server with a bunch of nonces, exhausting the nonce cache

• 🔒️ Removed encrypted query parameter from the directory changes listener endpoint (/api/files/listen)

  • All communications over this endpoint are now encrypted by default

💥 Breaking Changes​

• 💥🔒️ Include query parameters in the Proof-of-Possession (PoP) header calculation

  • This does not apply to WebSocket endpoints, as their PoP header is includes as one of the query parameters

• 💥 Uses of the account creation key (ACK) have been replaced with the server's account creation public key

• 💥 Changed the Proof of Possession (PoP) header name from X-SRP-PoP to X-Auth-PoP

• 💥 Changed vault file organization to be sorted by UUID instead of by usernames

• 💥 Replaced the security details endpoint (/api/users/security/{username}) with an authentication info endpoint (/api/auth/info/{username})

  • The authentication info endpoint only returns the authentication protocol

• 💥 Combined the vault key endpoint (/api/users/vault) and 'additional info' endpoints (/api/users/info/{username} and /api/users/edit-info/{username}) into a single vault info endpoint (/api/users/vault)

  • This endpoint returns the account unlock key (AUK) key generation function, the AUK salt, the encrypted vault key, and the 'additional info'
  • Editing the AUK key generation function and the 'additional info' is done by sending a PUT request to that endpoint

• 💥 The OPAQUE login endpoint (/api/auth/opaque)'s behaviour has changed:

  • It will no longer respond with ERR: User does not exist if the user does not exist. Instead, a fake user vector will be returned. Clients are expected to detect this and respond accordingly
  • The final authentication token is now sent as an ExEF message instead of a 3-part JSON object

  Please read the updated documentation for more information.

• 💥 The OPAQUE registration endpoint (/api/auth/opaque/register) now requires clients to negotiate a shared session key with the server using the Noise-NK protocol before continuing with OPAQUE registration

  • Please check the updated documentation for more information

• 💥 The check user endpoint (/api/user/check/{username}) is now only accessible in debug mode

✨ New Features​

• 🗃️ A fake user will be created upon server start
• ✨ Added a new WebSocket endpoint (/api/auth/opaque/edit-record) for changing the OPAQUE record of a user
  • This encompasses both changing the username and password of a user
  • This also allows changing of the saved key generation function on the server
    • This is just a record of what key generation function was used to generate the user's keys

🔄 Changes​

• 🔒️ Changed the JWT signing key from a per-run randomly generated key to a static value in config.toml
• 🔒️ Tightened the timestamp Proof-of-Possession (PoP) validity window to be half of the previous window
• ⚰️ Removed redundant username path parameter and 404 Not Found response code from /api/users/vault/{username} (now is /api/users/vault)
• ⚰️ Removed the security.srp table from the Excalibur configuration
• 🔨 Added --validate-config and --silent flags to the excalibur config generate-keys command
• 🗃️ Modified the User table:
  • Added new id and keygen_algorithm fields
  • Changed the primary key of the table from username to id
  • Renamed the additional_info field to vault_info
• 🗃️ Removed SRP-related fields from the User table
• 🗃️ Updated DuckDB from 1.4 Andium to 1.5 Variegata
• 🛂 Changed subject (sub) of the authentication token to be the user's ID instead of the username
• 💄 Enhanced the look and feel of the excalibur backup command
• 🗑️ Removed comms_uuid query parameter from the OPAQUE registration endpoint (/auth/opaque/register)
• 🗑️ Removed srp_salt from the security details returned by the security details endpoint (/api/auth/info)
• 🗑️ Removed SRP login endpoint (/api/auth) in favour of OPAQUE-3DH login
• 🗑️ Removed add user endpoint using SRP (/api/user/add/{username}) in favour of OPAQUE-3DH user creation
• 🗑️ Removed the SRP group size endpoint (/api/auth/group-size) as SRP is no longer supported

🐛 Bug Fixes​

• 🐛 Fixed a bug where the server was not actually obeying the X-Content-Type header
• 🐛 Fixed a bug where invalid JWT tokens that are missing required fields would cause the server to throw 500 Internal Server Error
• 🐛 Fixed a bug where PersistentTTLCache's pop() method does not update the local disk copy of the cache

⬆️ Dependencies​

• ➕ Added httpx2 test dependency
• ➖ Removed httpx test dependency
• ⬆️ Updated duckdb from 1.4.4 to 1.5.3
• ⬆️ Updated fastapi from 0.136.3 to 0.139.0 (#63, #68, #72, #88)
• ⬆️ Updated ipython development dependency from 9.14.1 to 9.15.0 (#86)
• ⬆️ Updated pydantic-settings from 2.14.1 to 2.14.2 (#78)
• ⬆️ Updated pytest test dependency from 9.0.3 to 9.1.1 (#66, #74)
• ⬆️ Updated ruff development dependency from 0.15.16 to 0.15.20 (#61, #76, #91)
• ⬆️ Updated sqlmodel from 0.0.38 to 0.0.39 (#82)

🧹 Miscellaneous​

• 💥 We will now use uv's 0.11.x series to build and install the server package, updating the minimum version from 0.10.9 in pyproject.toml and GitHub actions to 0.11.26
• 🧑‍💻 Added additional safeguards and warnings when using debug mode (--debug)
• 🔒️ Changed point multiplication algorithm of Ristretto255 from double-and-add to Montgomery ladder
• 🔨 Updated the configuration migration strategy used by excalibur config update

Excalibur 0.6.6 is a patch release fixing bugs on the app and server.

App​

🔒️ Security​

• 🔒️ Overridden version minima of dependencies in pnpm-workspace.yaml to address security vulnerabilities:
  • GHSA-4x5r-pxfx-6jf8: @babel/core to 7.29.1
  • GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr: esbuild to 0.28.1
  • GHSA-hmw2-7cc7-3qxx: form-data to 4.0.6
  • GHSA-h67p-54hq-rp68: js-yaml to 4.1.2
  • GHSA-q8mj-m7cp-5q26: qs to 6.15.2
  • GHSA-vmf3-w455-68vh: tar to 7.5.16
  • GHSA-ph9p-34f9-6g65: tmp to 0.2.6
  • GHSA-w5hq-g745-h8pq: uuid to 11.1.1
  • GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3: vite to 7.3.5

🐛 Bug Fixes​

• 🐛 Fixed a bug where nested directories with paths like folder/subfolder would be created as a single directory with the name folder/subfolder (with the slash)

⬆️ Dependencies​

• ⬆️ Updated prettier development dependency from 3.8.3 to 3.8.4 (#54)
• ⬆️ Updated typescript-eslint development dependency from 8.60.1 to 8.61.0 (#55)

Server​

🔒️ Security​

• 🔒️ Overridden version minima of dependencies in uv.lock to address security vulnerabilities:
  • GHSA-65pc-fj4g-8rjx: idna to 3.15
  • GHSA-86qp-5c8j-p5mr, GHSA-x746-7m8f-x49c, GHSA-wqp7-x3pw-xc5r, GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3: starlette to 1.3.1

🐛 Bug Fixes​

• 🐛 Fixed bug where the server did not properly resolve dot-slashes (./) in paths, especially for encrypted paths

⬆️ Dependencies​

• ➕ Added httpx2 test dependency
• ➖ Removed httpx test dependency
• ⬆️ Updated ipython development dependency from 9.14.0 to 9.14.1 (#57)
• ⬆️ Updated ruff development dependency from 0.15.13 to 0.15.16 (#53)

Excalibur 0.6.5 is a patch release fixing a security issue on the server.

It is recommended to upgrade both the server and app to this version.

App​

⬆️ Dependencies​

• ⬆️ Updated typescript-eslint development dependency from 8.59.2 to 8.60.1 (#36, #50)

Server​

🔒️ Security​

• 🔒️ Fixed a security issue where other authenticated users are permitted to view, access, or edit other users' stuff.

  In particular, the following endpoints were affected:

  • /api/users/vault/{username}: any authenticated user could get another user's encrypted vault key
  • /api/users/info/{username}: any authenticated user could get another user's additional info
  • /api/users/edit-info/{username}: any authenticated user could edit another user's additional info

  These endpoints now always refer to the currently authenticated user, regardless of the username parameter. For now, the username parameter is kept for backwards compatibility, but is silently ignored. It, however, still needs to be provided. This requirement will be removed in the next minor release.

⬆️ Dependencies​

• ⬆️ Updated fastapi from 0.136.1 to 0.136.3 (#48)
• ⬆️ Updated httptools from 0.7.1 to 0.8.0 (#38)
• ⬆️ Updated pyjwt from 2.12.1 to 2.13.0 (#52)
• ⬆️ Updated typer from 0.25.1 to 0.26.7 (#49)
• ⬆️ Updated uvicorn from 0.47.0 to 0.49.0 (#40, #46)
• ⬆️ Updated ipython development dependency from 9.13.0 to 9.14.0 (#39)
• ⬆️ Updated watchfiles development dependency from 1.1.1 to 1.2.0 (#34)

Excalibur 0.6.4 is a patch release fixing a bug on the app and updating some dependencies.

Updating the app is recommended but not necessary. Updating the server is not required.

App​

🐛 Bug Fixes​

• 🐛 Fixed a bug where the name sorting was not ignoring the case (e.g., uppercase names were sorted before lowercase names of the same letter)

⬆️ Dependencies​

• ⬆️ Updated lint-staged development dependency from 16.4.0 to 17.0.5 (#29)

Server​

⬆️ Dependencies​

• ⬆️ Updated uvicorn from 0.46.0 to 0.47.0 (#24)
• ⬆️ Updated ipython development dependency from 9.10.1 to 9.13.0 (#25)
• ⬆️ Updated ruff development dependency from 0.15.12 to 0.15.13 (#28)