v0.4.2

Signing certificate SHA-256: 52f61684029401fcb0137b334ad41907f83948fa1ec1377834f3b4291765fd7b. Play builds are signed by Google Play and carry a different certificate.

What's Changed

• add local password vault setup and live TOTP refresh by @Yoshiofthewire in #2
• feat: move KySignOn passkey into secure hardware and Settings by @Yoshiofthewire in #3
• feat: add Argon2id KyPasswords envelopes and KDBX interop coverage by @Yoshiofthewire in #4
• refactor: drop legacy KyPasswords compatibility paths by @Yoshiofthewire in #5
• feat: reveal the offline vault key behind confirmation and auth by @Yoshiofthewire in #6
• Add intact recycle-bin recovery to Passwords by @Yoshiofthewire in #8
• Report reused passwords and lock inactive native sessions by @Yoshiofthewire in #9
• Preserve KDBX vaults and add recovery, reuse reports and idle locking by @Yoshiofthewire in #7
• docs: record vault parity verification status by @Yoshiofthewire in #10
• Apply shared Busnes product icons by @Yoshiofthewire in #11
• feat: add passkey QR scanning and update KyIdentity branding by @Yoshiofthewire in #12
• fix(mfa): restore the push wire identifiers the server verifies by @Yoshiofthewire in #13
• feat: KyIdentity sign-on for suite apps via AccountManager by @Yoshiofthewire in #14
• feat(signon): bind the assertion to the relay origin by @Yoshiofthewire in #15
• Attest the device signing key at pairing by @Yoshiofthewire in #16
• docs: KyIdentity sign-on and attestation design, plans and hand-offs by @Yoshiofthewire in #17
• build: provision the daemon JDK 25 from any vendor by @Yoshiofthewire in #20
• fix(signon): only Settings and pinned consumers may add the KyIdentity account by @Yoshiofthewire in #18
• docs: Vaultwarden replaces KyPasswords; KyAuth becomes authenticator-only by @Yoshiofthewire in #19
• docs: authenticator-only plan; no TOTP backup by @Yoshiofthewire in #21
• feat(ui): Vault tab with the pending Push MFA request at its top by @Yoshiofthewire in #24
• Land the authenticator-only rewrite on main (#22-#24) by @Yoshiofthewire in #25
• feat(mfa): sign push v2 binding origin, user, device, purpose and expiry by @Yoshiofthewire in #26
• refactor: plain app-private prefs replace EncryptedSharedPreferences by @Yoshiofthewire in #27
• ci: add OpenSSF Scorecard workflow by @Yoshiofthewire in #28
• fix(mfa): answer a push request with one prompt by @Yoshiofthewire in #29
• feat(push): UnifiedPush Push MFA and play/github/fdroid flavors by @Yoshiofthewire in #30
• chore(security): clear Dependabot build-tooling alerts; harden CI for Scorecard by @Yoshiofthewire in #31
• docs: add a README by @Yoshiofthewire in #34
• refactor!: remove the KyIdentity passkey credential provider by @Yoshiofthewire in #33
• build(deps): bump the gradle group with 6 updates by @dependabot[bot] in #35
• ci: stop unlocking the emulator; UI tests show over the keyguard by @Yoshiofthewire in #36
• refactor(totp): replace the KDBX vault with one AES-256-GCM file by @Yoshiofthewire in #32
• feat: demo mode for Play Store review by @Yoshiofthewire in #37
• release: 0.4.0 — signed release workflow, privacy link, F-Droid prep by @Yoshiofthewire in #38
• feat: follow phone theme by default; monochrome launcher icon by @Yoshiofthewire in #40
• build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 in the actions group by @dependabot[bot] in #39
• Fix Play ship blockers and bump to 0.4.2 by @Yoshiofthewire in #41
• release: skip the Play upload when its secret is unset by @Yoshiofthewire in #42

New Contributors

• @dependabot[bot] made their first contribution in #35

Full Changelog: https://github.com/Busnes-app/KyAuth-android/commits/v0.4.2