14.5.0

What's Changed

✨ New

• File responses to secret requests — responders can now answer a secret request with a file instead of text. The file's content and filename are encrypted in the responder's browser (inside the OpenPGP literal data packet), so the server sees neither. File responses are capped at 512 KB (or --max-file-size if lower) so records fit the database backend, and are disabled together with --disable-upload. Viewing a provided secret now asks for confirmation since retrieval is one-time, and the label field warns that labels are stored unencrypted. #3731
• Opt-in Argon2 key derivation — new --argon2 flag switches client-side encryption to memory-hard Argon2id key derivation. #3664
• Runtime license expiry — licensed features now degrade gracefully when the license expires while the server is running, instead of requiring a restart to take effect. #3721
• Drag & drop import — request exports can be imported by dropping the JSON file onto the import panel. #3694

🐛 Fixes

• Custom color overrides no longer reset the base theme to light. #3689
• File retrieval now distinguishes download failures from decryption failures, with clearer error messages for each. #3675

🧹 Maintenance

• Code cleanups: API contract tests, deduplication, shared helpers. #3665
• Refactored yopass-server startup into testable functions; Prefetcher routed through api.ts. #3666
• Prefetcher data fetching extracted into hooks. #3674
• Shared icons module replaces duplicated inline SVGs. #3673

Plus routine dependency updates via Dependabot.

Full Changelog: 14.4.0...14.5.0