v5.0.0

5.0.0 (2026-09-29)

• feat!: prevent leaking passwords to untrusted hosts (3d2b8f0)
• feat!: refuse non-https requests unless explicitly allowed (2fe9eac)
• feat!: require ${host} in the target of a catch-all section (37098e4)

Bug Fixes

• pass -- before the pass target to prevent option injection (bcbee7c)
• stop logging decrypted entries and plaintext passwords (539e5b9)
• validate request values and confine targets to the password store (95ee427)

BREAKING CHANGES

• credentials are no longer served for non-https
  requests. Sections used with http, git or other plain-text
  protocols must set allow_insecure_protocol=true.
• a mapping section whose host pattern matches any host
  (for example [] or [.*]) is now rejected unless its target
  contains ${host}. Give such sections a host-specific target, or
  replace them with sections naming the hosts they should serve.
• wildcards in the host part of a mapping section no
  longer match across dots. [github.com*] continues to match
  github.com and github.com/user/repo but no longer matches
  github.com.evil.com, and [*.example.com] now matches exactly one
  label in place of *. Mappings that relied on a wildcard spanning
  several domain labels must spell out the additional labels.
• a mapping section without a path pattern now matches
  requests that carry a path, where it previously did not match once
  credential.useHttpPath was enabled. Sections which should apply to
  specific paths only must spell the path out, as in
  [github.com/user/project*].