v1.15.3 🔥 Ignition

🎯 Headline: Multisig Feels Normal, and the App Keeps Its Place

A 2-of-3 multisig wallet descriptor is one of the most important things an heir can inherit, and seQRets used to greet it with a warning that its QR code "may be difficult to scan". It isn't. That warning is gone, and the camera now reads dense Qards more reliably. Alongside that, the page now scrolls to where you need it every time you move to the next step. No change to the Qard format: everything you have already made restores exactly as before.

✨ What's New

Multisig descriptors are welcome

• No more scary warning for a descriptor. A 2-of-3 descriptor produces a larger QR code than a seed phrase, but printed at the normal size it scans without trouble. We tested exactly that with a real descriptor and a real camera. The yellow "difficult to scan" warning is replaced by a short grey note: larger QR, normal for multisig, just don't shrink it when printing.
• The size estimate is now exact. The "Estimated QR Data per Share" figure used to be an approximation; it now matches the real Qard to the byte.

Sharper camera scanning

The restore scanner now asks your camera for full HD instead of letting the browser pick, which was often a low 640×480. Dense Qards such as multisig descriptors get several times more detail to work with, so they scan more readily on laptop webcams, at a distance, or in poorer light. Cameras that can't do full HD simply use their best mode.

The page keeps its place

• Next Step now always scrolls all the way down, so the new step sits fully in view with nothing cut off at the bottom. Before, it often stopped short.
• Generate Seed Phrase and Generate New Phrase do the same, so the generator never pushes the Next Step button off the screen.
• The three main tabs (Secure Secret, Inheritance Plan, Restore Secret) now bring the work area into view, with Ask Bob still visible at the top.

A more dependable web app

app.seqrets.app now runs on Cloudflare Pages. The old setup needed a manual fix every few months to stop the site going offline; this one renews its own security certificate. All security headers are unchanged. As a side effect, links with a trailing slash such as /terms/ now work instead of showing "page not found".

🧹 Under the Hood

• Next.js 16.3.3 → 16.3.8 and DOMPurify 3.4.16. These close a Critical advisory in Next.js's image-generation feature and a Low one in DOMPurify. Neither was reachable in seQRets: the app never uses that Next.js feature and the web app has no server, and DOMPurify only arrives through the desktop PDF library, in a function the app doesn't call. Updated anyway on principle.
• Desktop: Tauri 2.12 and refreshed Rust dependencies. The desktop app's window layer and its supporting libraries are updated, with the JavaScript side kept in step. The encryption libraries (Argon2id, XChaCha20-Poly1305) did not change. Tested by hand: saving Qards, camera scanning, plan PDF export and the keychain.
• A quieter release process. The version-bump script used to pull untested Rust dependency updates into every release without anyone noticing. It now changes only the version number; dependency updates get their own reviewed change, like the one above.
• v1.15.2 was a web-only build and was never released on its own; this release includes everything since v1.15.1.

🤝 Compatibility

• ✅ All existing Qards: share format, integrity hash, and every cryptographic primitive are unchanged. Restores are unaffected.
• ✅ recover.html: Qards made by this version were checked against the current seQRets Recover, and all 21 checks pass.
• ✅ All existing inheritance plans, vault files and smart cards: unchanged.

🛡️ Security Note

No cryptographic primitive changed in this release. Argon2id, XChaCha20-Poly1305, Shamir's Secret Sharing and SHA-256 are untouched, in both the web code and the desktop's Rust code.

Both dependency advisories closed here were checked for whether they could actually be reached from seQRets, and neither could. They were updated as hygiene, not because earlier versions were unsafe.

The independent code review in docs/SECURITY_ANALYSIS.md was re-verified through v1.15.1; the changes in v1.15.3 have not been independently reviewed.

🤖 Generated with Claude Code