libmutton/docs/release-notes-archive/2025.md

libmutton v0.4.4 November 23, 2025

This release fixes a minor bug and dependency-derived security issues.

Fixes

• (711515f3a1) Fix subprocesses being killed prematurely when the main process is force quit
  • Fixes issues with master password caching and clipboard clearing

Dependencies

• Bumped (direct/replaced)
  • golang.org/x/crypto: v0.43.0 => v0.45.0
    • Addresses CVE-2025-58181 and CVE-2025-47914
  • github.com/rwinkhart/rcw: v0.2.3 => v0.2.4

---

libmutton v0.4.2 November 09, 2025

This is purely a dependency bump release.

Dependencies

• Bumped (direct/replaced)
  • Go: v1.25.3 => v1.25.4
  • github.com/rwinkhart/rcw: v0.2.2 => v0.2.3
  • github.com/rwinkhart/peercred-mini: v0.1.1 => v0.1.2
  • github.com/rwinkhart/sys: v0.37.0 => v0.38.0
  • github.com/rwinkhart/go-winio-easy-pipe-handles: switched to tagged v0.1.0 of github.com/rwinkhart/go-winio

---

libmutton v0.4.1 October 26, 2025

This is a dependency bump release with only minor changes for developers.

Breaking (for developers)

• (b9175d7ff3) Standardized on "password" rather than a mix of "passphrase"/"password"
  • Some function names changed as a result
• (aa10016f77) Developers using LibmuttonInit can now force clients into offline mode programmatically
  • This means LibmuttonInit now requires an extra parameter

Dependencies

• Bumped (direct/replaced)
  • Go: v1.24.6 => v1.25.3
  • github.com/pkg/sftp: v1.13.9 => v1.13.10
  • golang.org/x/crypto: v0.41.0 => v0.43.0
  • github.com/rwinkhart/sys: v0.35.0 => v0.37.0

---

libmutton v0.4.0 August 17, 2025

This is the largest update to libmutton yet, and as such, these patch notes are non-exhaustive. Many minor changes and fixes to features mentioned in these patch notes have been made. Please see the commit history for a more complete list of changes.

Breaking (for users)

• GPG has been entirely replaced with RCW
  • All entries created in previous versions must be converted using this conversion program
• Steam TOTP keys now must be in base32 format
• (3c5db78da9) Release binaries of libmuttonserver now target x86_64_v2 and arm64v8.7
• (3dd07e7165) Offline mode is now manually specified in libmutton.ini

Breaking (for developers)

• libmutton has been further modularized
  • The core package has been split into core, global, crypt, and cfg
  • The sync package has been split into syncclient, syncserver, synccommon, and synccycles
  • This decreases the size of the server binary and allows for more modular clients
• (40f0f35f45) Errors are now returned, rather than printed

Features

• (111324cc25) Deletions (server-side) now follow the client through device ID changes
• (ca277ba773) Added the EntryRefresh() function for re-encrypting entries with a new passphrase/optimizing bloated entries
• (74b8261bc8) Added the LibmuttonInit() function to ensure clients initialize libmutton as intended
• (bed23e987d) (41a12c6e4a) Added iOS clipboard support
• (3fdcc9e96d) (1a66a30bc1) (d023058630) Support one-time TOTP copy
• (fb2120c94e) Support custom device ID prefixes

Fixes

• (50ab27c674) libmutton.ini is now always created with 0600 permissions on *nix platforms
• (4a0e0f8e9e) Old devices IDs are no longer removed from clients when registration of a new device ID fails

Dependencies

• Dropped
  • github.com/fortis/go-steam-totp (functionality now covered by github.com/pquerna/otp)
• Bumped (direct)
  • Go: v1.24.2 => v1.24.6
  • github.com/pquerna/otp: v1.4.1-0.20231130234153-3357de7c0481 => v1.5.0
  • golang.design/x/clipboard: v0.7.0 => v0.7.1
  • golang.org/x/crypto: v0.37.0 => v0.41.0
• Added (direct)
  • github.com/rwinkhart/go-boilerplate v0.1.0
  • github.com/rwinkhart/rcw v0.2.2

---

libmutton v0.3.1 April 21, 2025

Features

• (da95ede807) Added EntryAddPrecheck() utility function for ensuring the target locations for new entries are valid
• (17223758b1) (44924737ab) (0f90e82514) Added initial native Android support
• (51bb67f315) Split device ID retrieval into dedicated exported function, GetCurrentDeviceID
• (4ed816cb11) Allow more control over string generation to improve generated password compatibility

Fixes

• (51bb67f315) Fixed clients having multiple device IDs after failed registrations
• (451d695649) Fixed inability to add a folder on the server if the folder was already created on a client that failed to sync

Dependencies

• Bumps (direct and indirect)
  • Go: v1.24.0 => v1.24.2
  • github.com/pkg/sftp: v1.13.7 => v1.13.9
  • golang.org/x/crypto: v0.34.0 => v0.37.0
  • golang.org/x/sys: v0.30.0 => v0.32.0
• New
  • Android builds only
    • golang.design/x/clipboard v0.7.0
      • golang.org/x/exp/shiny v0.0.0-20250408133849-7e4ce0ab07d0
      • golang.org/x/image v0.26.0
      • golang.org/x/mobile v0.0.0-20250408133729-978277e7eaf7

---

libmutton v0.3.0 February 22, 2025

Features

• (f9aa2fc374) (d2034b458b) (81b78068a7) (e9d0c37043) core.LaunchClipClearProcess, core.WriteToStdin, core.ExpandPathWithHome, and core.PrintError are now exported utility functions for direct use by clients
• (c28d45c9da) One-off sync functions can now be forced to run in offline mode
• (5028fb21b0) SSH connection attempts now have a 3-second timeout
• (89b74cec1e) Individual keys can now be removed from the config file
• Many features for building interactive (GUI/TUI) clients
  • (619e4220a6) Clipboard clearing can now be handled much more sensibly by interactive clients
  • (3b57d59ddc) (55be8a3075) The clipboard can now be cleared instantly (no timer); useful for clearing on client exit
  • (2feeeb74d7) core.ParseConfig now returns errors for proper handling in interactive clients
  • (68e3108741) sync.RunJob can now return lists of synchronized entries for display in interactive clients

Fixes

• (eb2b349697) Deletions are now synchronized before folders to avoid sync failures under unlikely conditions
• (fc1cd349b8) Double-space line breaks with Markdown formatting are now preserved when saving an entry
• (4689cae3f4) Sheared folder names now always end in a trailing slash for clarity and reduced duplicate entries in the deletions directory
• Many fixes for building interactive (GUI/TUI) clients
  • (1cebb39546) The soft exit function now specifies a return value
  • (a4a39a3a99) Passphrase-protected SSH identity files are no longer broken for interactive clients
  • (1c650d4751) (0162b737c8) Interactive clients will no longer crash on SSH dialing failures
  • (173574eb85) Error messages not making sense for interactive clients have been addressed

Optimizations

• (f2f9c523f4) An unnecessary variable declaration was removed in core.DecryptGPG
• (fb5449cf1f) A redundant (and late) check for the pre-existence of a new entry has been removed
• (e9d0c37043) core.PrintError can be used to decrease the overall size of client binaries through code re-use

Dependencies

• Bumps (direct and indirect)
  • Go: v1.23.4 => v1.24.0
  • golang.org/x/crypto: v0.31.0 => v0.34.0
  • golang.org/x/sys: v0.28.0 => v0.30.0