Full Changelog: v4.3.1...v4.3.2
A quality and hardening release: no new wire formats, but real functional additions (seekable random-access decryption, an algorithm-distrust mechanism, check --parallel, hardened CLI private-key writes) alongside a large internal cleanup and CI cost-reduction pass.
Seekable / random-access decryption
New pqfile::seek_decrypt::SeekableDecryptor implements Read/Seek over a decrypted v3/v5 (chunked, single-recipient) .pqf file, so a caller can jump straight to a byte range instead of decrypting everything before it (e.g. previewing part of a large file, or seeking within decrypted media). Intentionally authenticates only the chunk(s) actually requested, not the whole file - documented clearly as a narrower guarantee than every other decrypt API in the crate. Rejects multi-recipient, compressed, passphrase, stealth, and time-locked formats up front.
Algorithm-distrust mechanism
New pqfile::distrust module gives pqfile a TLS-style way to flag an algorithm (an ML-KEM variant, the X25519 hybrid, ML-DSA-65, SLH-DSA-SHAKE-192f) as no longer trustworthy without breaking the ability to read files or keys that already used it. Nothing is distrusted today - the list is empty. inspect and doctor (CLI and GUI) now print a non-fatal WARNING: whenever a checked key or file matches an entry.
pqfile check --parallel
check now takes the same parallel decrypt path decrypt --parallel already had, so verifying a large backup no longer has to be single-threaded.
Hardened CLI private-key writes
Every CLI subcommand that writes key material directly (now including exhume) writes atomically and restricts the file to its owner before any secret bytes land in it, closing a brief world-readable window on write and adding a Windows ACL restriction that didn't exist before at all.
GUI accessibility
Settings-tab toggles and four icon-only buttons (copy, remove-recipient, remove-file, remove-key) now expose real AccessKit labels and state instead of being invisible to screen readers. The algorithm-distrust warnings above are now also wired into the GUI's Health Check tab, not just the CLI. New automated a11y test harness covers both fixes going forward.
Known-answer crypto tests
ML-KEM, ML-DSA-65, and SLH-DSA-SHAKE-192f are now checked against official third-party vectors (Wycheproof and NIST's ACVP-Server samples), not just the crate's own self-consistent tests - closes a gap where a bug wrong the same way on both sides of a roundtrip could go undetected.
Under the hood
pqfile-cli/src/main.rs split from one 5,370-line file into per-subcommand modules, one per CLI command family
Windows release binaries had silently shipped without an embedded .exe icon since the very first release; fixed
CI cost cleanup: several feature-check jobs consolidated and moved to a weekly schedule, along with the SonarQube and Valgrind benchmark jobs
Routine dependency and GitHub Actions bumps; cargo vet, cargo deny, zizmor, and semver-checks all re-verified clean
A round of documentation-drift fixes (GUI in-app copy, READMEs, FORMAT.md, STABILITY.md) and internal dead-code/duplication cleanup
No breaking changes to the .pqf file format or key formats in this release.