Pangolin v1.3.1

Upgrading

Replace the program and start it; vaults from every earlier release open unchanged.

Fixes

• Sharper, easier-to-read text. Fyne draws text without the hinting and ClearType Windows uses, so small grey text looked soft — most of all the warning on the create-vault screen. Text is now near-black instead of mid-grey, secondary text is darker, sizes are one point larger, and the warning is shown at normal size.
• A "Saved." message no longer touches a screen that was replaced by locking or switching language.

Testing

This release was checked with fuzzing, adversarial vault tests, UI flow tests, a real upgrade from v0.1.0, and a new smoke test that installs the published packages on Ubuntu 22.04, 24.04 (x86-64 and ARM64), macOS and Windows.

Full Changelog: v1.3.0...v1.3.1

Pangolin v1.3.0

Upgrading

Replace the program and start it. Vaults made by every earlier release (v0.1.0 to v1.2.0) open unchanged; a test now checks this for each one.

Fixes

• Crash when changing the master password with a vault open (all earlier versions, Windows). SQLCipher locked all of its memory and used up the small amount a process may lock, so the key protection library could not lock a key buffer and stopped the app.
• An empty or truncated vault.db opened as an empty vault (all earlier versions). After a sync conflict or an interrupted copy, new entries could overwrite the real data. It now fails instead.
• A ? in a custom vault path (PANGOLIN_HOME, macOS/Linux only) created the database without encryption. Passwords and notes stayed encrypted; titles, usernames and URLs did not. The default folders never contain ?.
• Vulnerable dependencies: golang.org/x/image (TIFF decoding), golang.org/x/net and goldmark updated.
• Release workflow hardened: build jobs get a read-only token and no stored credentials; actions are pinned to commit SHAs.
• A clipboard timer that fired late could clear a newly copied password early.
• Switching language while unlocking lost the result.
• Master passwords are Unicode-normalised (NFC), so the same password works whichever way the keyboard composes letters such as "ş".
• Header KDF limits lowered to 1 GiB / 16 passes.
• Ctrl+C and termination signals lock and clear the clipboard before quitting.

Changes

• The language switch moved to the top-right of the unlock screen.
• Entries in the list have an inset, so the avatar sits inside the selection.
• New: ROADMAP.md.

Full Changelog: v1.2.0...v1.3.0

Pangolin v1.2.0

Full Changelog: v1.1.1...v1.2.0

Pangolin v1.1.1

Full Changelog: v1.1.0...v1.1.1

Pangolin v1.1.0

Full Changelog: v1.0.0...v1.1.0

Pangolin v1.0.0

Full Changelog: v0.1.1...v1.0.0

Pangolin v0.1.1

Full Changelog: v0.1.0...v0.1.1

Pangolin v0.1.0

Full Changelog: https://github.com/KaanBahaSever/pangolin/commits/v0.1.0