v18.1.0

Keeper Commander release version v18.1.0

Security Fixes

• Password rotation plugins — SQL query injection (mysql, oracle, postgresql): Rotation plugin queries now use parameterized statements, closing an injection path that existed when record field values were interpolated directly into SQL.
• AD password rotation plugin — TLS certificate validation: The Active Directory rotation plugin no longer silently ignores TLS certificate errors. Certificates are now verified by default; set ignore_certificate_errors explicitly to opt out.
• connect command — SSH proxy command injection: Arguments passed to the SSH proxy command are now properly quoted and escaped, preventing shell injection via crafted record field values.
• rsync SFTP — path traversal via absolute remote filenames: The rsync SFTP client now rejects absolute remote filenames, blocking arbitrary file writes outside the intended destination directory.

New Features

• Google Chat integration setup (gchat-app-setup): New interactive command to collect and store Google Chat / Pub/Sub credentials in the vault and generate a ready-to-use docker-compose configuration, following the same flow as the existing Slack and Teams setup commands.
• HTTP 429 throttling and retry support: The REST client now recognizes HTTP 429 (Too Many Requests) responses and retries the request after the server-indicated back-off, improving resilience against rate limits.

Improvements & Bug Fixes

• Service Mode Config ownership check: The Commander Service Mode Config record lookup now only considers records owned by the authenticated account. Shared or non-owned records with a matching title are ignored, preventing configuration hijacking via shared vault records.
• switch-to-mc respects MC forbid_rsa setting
• SailPoint Service Mode offboarding (KC-1382/1383/1384): Improved policy gates for offboarding and share/role operations in SailPoint Service Mode; the integration now uses transfer-user instead of eu --delete and correctly enforces share and role policies during offboard flows.
• Audit report compliance detail fetch: Fixed an issue where compliance (SOX) data was fetched with a stale cache instead of refreshing when required, resulting in incomplete audit report output.
• KeePass export — remove template file dependency: The KeePass exporter now creates a new database directly via pykeepass.create_database, eliminating the dependency on a bundled template .kdbx file.
• enterprise-info --users -v — separate node name and ID fields: Verbose user listings now return node_id and node_name as distinct fields instead of a single combined string, making downstream parsing more reliable.