v1.4.7

Fixed

• Changes are saved before the API answers. The database transaction was committed only after the response had been sent, so a request made immediately after a change could miss it, and a change whose commit failed was still reported as successful. The commit now happens first, and a failed commit returns an error.
• Some entry names made an action hit a different entry (GHSA-cv6q-x5p4-j9cx). The API routes on the entry name, so deleting an entry named x/purge permanently deleted a trashed entry named x, and ciphermoth password delete "x/attachments/1" deleted an attachment of x while reporting success. Names containing / now reach exactly that entry. The web UI and CLI also name the entry in a header, so if a reverse proxy rewrites the address on the way (nginx decodes %2F when proxy_pass includes a path), the request is refused instead of acting on another entry; see "Pass request paths through unchanged" in CONTRIBUTING.md. Browsers rewrite . and .. in a web address (purging a trashed . trashed an entry named purge), and trash collides with the trash list, so new entries can't use those three names; existing ones still open and can be renamed by editing them, and the web UI refuses to act on . or .. until you do. The CLI sends names with / only to servers that route them correctly.
• Imports can no longer break the vault. CSV and backup imports skipped the checks the rest of the app applies, so an over-long description, name or URL, an invalid 2FA secret, or a malformed backup entry was stored as is, after which the whole vault list failed to load. A vault already affected by this opens again, and the entry can be fixed by editing it. Every imported row is now checked before anything is written; if any row is invalid nothing is imported and the error names the row and column. CSV rows get the same checks as a new entry. A CipherMoth backup restores exactly what the vault held, including values older imports stored over the usual limits, and refuses only what the vault can't store at all.
• CSV cells larger than 128 KB (long notes or passwords) made the import fail with a server error. They now import, and a CSV that can't be parsed gets a clear error with the line number.
• Concurrent edits no longer lose passwords from the history. Two edits of the same entry at the same moment each started from the same old value, so one replaced password vanished from the history. Concurrent attachment uploads could also push an entry past the 25 MB and 20-file limits. Edits and uploads to one entry are now applied one at a time.
• Text the database can't store is refused with a clear message instead of a server error: a NUL character in an entry name, username or description, or a broken Unicode escape anywhere in a request, including the master password.
• Proton Pass CSV imports keep the login email when the username column is empty. Any CSV column now falls back to the next matching column when its cell is blank.
• CSV imports no longer drop records silently. Secure notes from Bitwarden and Proton Pass exports were skipped while the import reported success; they now import as secure notes. Rows sharing a name (Chrome exports two accounts for one site that way) collapsed into one entry and were reported as "already exist"; each now imports, the later ones as name (2), name (3). Anything that still can't be imported (cards, identities, aliases, rows without a name or password) is listed with its row and the reason, in the web UI and the CLI.
• Editing an entry whose name starts or ends with a space changed a different entry with the trimmed name (such names can come from older imports). Edits now match the entry's name exactly.
• Restoring or renaming onto a name that was just taken returns a clear error instead of a server error.

Security

• Validation errors no longer echo what you sent. A rejected master password (for example, too weak) or entry value was returned verbatim in the error response. Errors now name only the field and the problem.
• Dependencies: cryptography 50.0.0, anyio 4.14.2, Mako 1.4.2, axios 1.20.0 and react-router 7.18.4 clear every open advisory; none of the affected code paths were used by CipherMoth. The frontend image's file server is now pinned with a lockfile, which also updates compression to 1.8.2 (a denial-of-service fix that did apply to the UI port).

Changed

• Descriptions can be up to 10,000 characters (was 1,024), so notes from Bitwarden or KeePass exports import instead of failing.
• Backups and imports are checked against frozen test data from every release. Vaults and backups created by v1.0.0 to v1.4.6, and vault databases from Dinopass v0.3.0, are proven to open, upgrade, decrypt and restore. Backups from v0.3.0 (dinopass_backup.json) are not importable. See testdata/golden.
• The backend now declares Python >=3.13,<3.15.