Release v3.3.0-20261012.2

This release adds S3 storage support for KDBX vaults, and system authentication unlock on Linux.

New

• Linux: Added system authentication unlock via polkit (#1550).
• Windows: Added auto-lock when the system becomes inactive (#1602).
• Windows: Added an ARM64 .msi installer (#727).
• Bitwarden: Added DNS server auto-discovery.
• KDBX: Added support for S3 storage.
• GPG: Added generating and editing of V6 certificates.

Improvements

• macOS, Windows: Experimental auto-type is now available from the Quick search window.
• Desktop: Application startup is now faster.
• Android: Window content is now marked as accessibility data sensitive.
• Android: Ecosia and Via browsers are now included in the list of privileged browsers (#1571).
• Android: Non-privileged apps are now prompted for authorization when requesting passkeys (#1607).
• Android: Installed app icons now render at the requested size.
• Bitwarden: FIDO2 two-factor authentication is now supported directly in the app (#1264).
• WebDAV: A preference is now available to prefer WebDAV transactions (#1585).
• Generator: A recipient ID can now be specified for the addy.io email forwarder (#1628).
• Backups: A setup wizard now guides backup configuration.
• UI: Switches now display Material Design 3 on and off icons (#1621, thanks @Shimmerfly).
• UI: Pressing Esc now exits the item screen (#1588).
• Data: Updated translations and the list of browsers allowed to request passkeys.

Security

• Desktop: Exports are now saved atomically with owner-only file permissions.
• Vault: Secrets in memory are now cleared more thoroughly.
• GPG: OpenPGP private operations now avoid RSA factor recovery.

Fixes

• Desktop: Fixed changing URI match detection causes crashing (#1617).
• Desktop: Fixed data and downloads folders so missing folders are created on a fresh profile.
• Desktop: Fixed pressing Esc so it closes popups before popping navigation entries.
• Windows: Fixed remember key approval not working on Windows (#1618).
• Windows: Fixed the Downloads folder resolution so it resolves when missing or redirected.
• Android: Fixed app password reprompt does not work in autofill, duplicates, and vault quick actions (#2).
• Android: Fixed a crash when launching autofill authentication.
• Android: Fixed Internet connectivity detection so wired connections are detected.
• Android: Fixed the SSH socket listener so it is retained until cleanup.
• Wear OS: Fixed unable to switch language on the watch version (#1609).
• Wear OS: Fixed incorrect formatting of the "Save vault key on disk" pop-up prompt on the watch (#1608).
• Autofill: Fixed unable to block loopback autofills (#1620).
• Watchtower: Fixed Watchtower configuration not preserved after editing (#1626).
• Watchtower: Fixed Watchtower overview shows reused passwords count, but detail page is empty (#1606).
• Watchtower: Fixed the website leak screen so it shows a warning on request error instead of an empty state.
• Watchtower: Fixed website leak matching so domains are matched correctly.
• Watchtower: Fixed folder handling when opening directly into a hidden account.
• Send: Fixed max access count so values with leading spaces are not converted to no limit.
• Attachments: Fixed "Select all" so it selects only filtered items instead of all items.
• Attachments: Fixed downloaded attachments so items with reprompt enabled require authentication.
• Attachments: Fixed attachment previews so files exceeding the size limit are not downloaded completely.
• Bitwarden: Fixed two-factor authentication email delivery so retrying is immediately allowed upon failure.
• Vault: Fixed the folders screen so it respects the hidden accounts setting.
• Vault: Fixed the Luhn check so it fails for strings containing non-digit characters.
• Unlock: Fixed vault creation so a race condition navigating to the unlock screen is prevented.
• Unlock: Fixed hardware key operations so poisoned locks do not block them.
• KDBX: Fixed placeholder formatting and XML parsing so maximum depth limits are enforced.
• WebDAV: Fixed WebDAV surrogate decoding so characters are decoded correctly.
• GPG: Fixed secp256k1 signature verification so signatures are normalized.
• GPG: Fixed inline OpenPGP signature compatibility so it is enforced.
• Generator: Fixed default email selection so verified emails are prioritized.
• UI: Fixed copy username shortcut not working in main screen in landscape mode (#1586).
• UI: Fixed the QR code so it fits into the dialog.
• UI: Fixed the sort menu so its state remains consistent.
• UI: Fixed dismissed notifications so they are removed from the screen.