Full Changelog: v1.0.2...v2.0.0
Here are the release notes, ready to copy and paste:
What's New in v2.0.0
Breaking change: .pqf files encrypted with v1.x cannot be decrypted by v2.0.0. Re-encrypt any existing files after upgrading.
Security
The full .pqf file header is now authenticated using AEAD Additional Associated Data (AAD). Any tampering with the header — not just the ciphertext — is detected and rejected before decryption produces any output.
CLI
encrypt and decrypt commands now accept a custom output path, so you can specify exactly where the result is saved.
keygen now accepts a --force flag to overwrite existing key files without prompting.
keygen now prints a SHA3-256 fingerprint of the generated public key for easy verification.
Dependencies
Upgraded ml-kem to 0.3.
Upgraded thiserror to 2.
Upgraded eframe to 0.34.
Added js-sys, wasm-bindgen, and getrandom_02 for improved WebAssembly compatibility.
Project structure
Removed the standalone pqfile-gui binary; the GUI is now built exclusively as a WASM web app (pqfile-gui) or native desktop app (pqfile-desktop).
Added SECURITY.md with a vulnerability reporting policy and scope.
Added automated release workflow: pushing a version tag triggers testing, building, and artifact publishing via GitHub Actions.
New roundtrip.rs integration test covers the inspect command for .pqf files.
CI / Tooling
All GitHub Actions updated to latest versions (actions/checkout@v6, actions/cache@v5, actions/deploy-pages@v5, etc.).