What's Changed

This release opens the 3.2.2 line. It is built around LAPR (Linux Account Password Rotation), a new module that rotates the passwords of local Linux accounts directly from TeamPass over SSH, and it also brings item revisions for offline synchronization, three new notification types, and a broad pass over the interface. Upgrading is recommended for all installations.

This release changes the database schema. UPGRADE_MIN_DATE is raised, so every installation goes through the upgrade wizard once - including those already running 3.2.1.7. The upgrade creates the LAPR tables, the item revision journal and the notification deduplication key.

LAPR is disabled by default and fully opt-in. Upgrading changes nothing about how your vault behaves until an administrator explicitly enables the module.

🔐 LAPR - Linux Account Password Rotation

TeamPass has always been where a Linux account password is stored. It could never be where that password is changed: rotating root or a service account on fifty servers meant an administrator connecting to each machine, running passwd, and then remembering to come back and update the vault by hand. The two copies drifted apart the moment anyone forgot the second half, and the only way to make rotation routine was to accept that the vault would sometimes be wrong.

LAPR closes that loop. TeamPass generates a new password from a policy, pushes it to the server over SSH with chpasswd, and re-encrypts the corresponding item, in that order, so the vault only ever records a password the machine has actually accepted. It is agentless: nothing is installed on the target servers, only SSH access is required. It reuses the existing item encryption model (object key + per-user RSA sharekeys) rather than introducing a parallel secret store, and every SSH operation runs in a background task, never in a web request. LAPR never creates items - it takes over the password of an item you already store, so folder permissions, history and sharing keep working exactly as before.

• Managed endpoints - enroll a Linux server with its hostname, SSH port, username and the TeamPass item holding the SSH credential. That credential is read server-side through the TP_USER key chain: it is never typed into the enrollment form and never transmitted to the browser. A connection test records the host key fingerprint (trust on first use), collects the OS information and probes the real rotation capabilities (chpasswd, sudo). A later host key mismatch blocks rotation rather than merely logging it.
• Managed accounts - attach an existing TeamPass item to an endpoint and a policy. The item's login is the Linux account to rotate. Discovery lists the local accounts found on the endpoint so they can be matched against the vault.
• Rotation policies - frequency in days plus the generated-password rules (length, character sets) and an optional rotate on enrollment flag. Three read-only presets are seeded: Standard (30 days), High Security (7 days) and Weekly + rotate on enroll.
• Manual and scheduled rotation - rotate on demand from the LAPR pages or from the item itself, or let the scheduler enqueue rotations as they fall due. Failures are retried with a delay and, after lapr_max_retries, the account is suspended with an audit entry instead of hammering an unreachable host.
• Rotation history and audit - every action is recorded in a dedicated audit log, and rotations appear in the item's own history. No secret is ever written to a log: the audit details are whitelisted, and a password can never reach them.
• A separate permission - LAPR is operated by non-administrator users holding the new Can manage LAPR permission, granted from the administration. TeamPass administrators configure the module but cannot use the operational pages: those depend on item access, which administrators deliberately do not have.
• Safety rails on the item side - while an item is a managed target, its Linux login and password cannot be edited outside a rotation (web UI and REST API alike), it cannot be deleted while still referenced, and it cannot be moved into a personal folder, where LAPR could no longer read it. Disabling the module releases all of these immediately, so a managed item can never end up frozen.
• Hardening - an optional hostname allowlist, per-IP and per-host rate limiting, strict validation of the Linux username before any command is built, and generated passwords filtered for chpasswd safety. Rotating the account TeamPass itself runs under requires an explicit acknowledgement and a dedicated setting.
• Monitoring - a LAPR tab in the operational statistics, LAPR checks in the Health page, and optional email alerts.

Full documentation: Password Rotation (LAPR). Settings live under Operations → LAPR settings.

✨ New features

• Item revisions and an offline synchronization feed - every item now carries a monotonic revision, allocated from a global journal on every content change (item fields, custom fields, tags, attachments, OTP, move, delete, restore). Reads and pure re-encryptions deliberately do not bump it. The API exposes it on item/get, item/inFolders, item/findByUrl, item/create and item/update, adds the delta endpoint GET /api/v1/item/changes?since= so an offline client pulls only what changed, and accepts an optional revision precondition on PUT /api/v1/item/update that answers 409 on a conflict instead of silently overwriting a concurrent edit. Omitting it keeps the previous last-writer-wins behaviour, so existing clients are unaffected.
• Three new notification types (PR #5341, @guerricv) - the notification centre now also carries: local password expiry warnings at 14, 7, 3 and 1 day and on expiry (LDAP and OAuth2 accounts excluded, since TeamPass does not own their password); knowledge-base publication, fanned out to non-administrator users by a background task rather than inside the article save; and backup failures, delivered to administrators when a scheduled backup fails, an externalized backup exhausts its retries, or a successful backup cannot queue its externalization. A new optional deduplication key makes these retryable without producing duplicates in the inbox.
• Versioned Docker image tags - the tag list only derived versions through type=semver, which rejects TeamPass's four-digit versions: no release had ever published a versioned image, only latest, master, develop and sha-*. Release tags are now published verbatim, so teampass/teampass:3.2.2.0 can be pinned.

🛠️ Improvements

• Search results open in a modal - the detail panel used row.child(), the same DataTables API the Responsive extension drives, which pushed every row below it out of place. It now opens in its own modal. The two bare icons became quick actions floating over the row: copy the login, copy the password, open the item, copying a password no longer requires opening anything. Administrators also get the correct refusal message instead of the expiry one.
• A real page transition indicator - every navigation is a full page reload, so nothing moved on screen between the click and the first paint of the next page. A top progress bar now spans the whole transition, the clicked control shows a spinner, and a second click on the same entry is swallowed. The departing page hands its position to the arriving one so the bar resumes rather than rewinding. It also covers AJAX calls above 400 ms, which allowed the external Pace plugin to be removed entirely.
• Native browser dialogs replaced by the TeamPass modal (PR #5337, @guerricv) - the profile, knowledge base, administration and tools pages used confirm(). They now use the application's own confirmation dialog, and a regression test guards against native dialogs coming back.
• Personal folders no longer appear in management lists - the role rights matrix, the folders table and parent selector, and the allowed/denied folder lists of the user edit form all listed other users' personal folders. The existing filter was ineffective (the session array it read is never populated), and filtering on the personal_folder column alone is not enough either, because a sub-folder of a personal root keeps that flag at 0 when it was never written. Personal-ness is now resolved by tree containment, the same way a single folder is already resolved elsewhere.
• Independent manual overrides for each web-server log (PR #5339, @guerricv) - an administrator can now override one log path while leaving automatic detection on for the others.
• The browser extension key can no longer be regenerated by accident - the generate button is no longer rendered once a key exists, and disappears right after a successful generation. Regenerating it invalidates every already configured extension.
• Unused language strings removed - a large cleanup pass over the language files, and the translations were refreshed from POEditor.
• Modernized GitHub landing page and community files.

🐛 Bug fixes

• Legacy HTML entities shown literally in the Utilities logs (PR #5316, @guerricv) - labels, folder names, logins and names appeared as Clémence instead of Clémence in the Connections and Items tabs. Some records legitimately contain HTML entities; escaping an already-encoded value turned é into é, and the client-side renderer only ever removed one layer. Values are now normalized once before serialization.
• Web-server access log not found on Debian and Ubuntu (PR #5339, @guerricv) - Apache virtual hosts commonly declare logs through ${APACHE_LOG_DIR}, and /etc/apache2/envvars sets it to /var/log/apache2$SUFFIX. The Health System read that value literally without expanding the unbraced $SUFFIX, building an invalid path. The error log still appeared to work because a hard-coded fallback existed; the equivalent access-log fallback did not, so discovery either failed or fell back to the server-wide access.log.

⬆️ Upgrade notes

• Schema. This release changes the database schema, so UPGRADE_MIN_DATE is raised and every installation runs the upgrade wizard once. It creates the five LAPR tables, the item revision journal and the users.can_manage_lapr column, adds an index on background_tasks, and adds a deduplication key to the notification table. Every statement is guarded, so re-running the upgrade is safe.
• LAPR is opt-in and does nothing until enabled. All its settings are seeded disabled. Before enabling it, review Operations → LAPR settings → Security: the hostname allowlist is off by default, and enabling it is recommended.
• LAPR needs its own permission. It is operated by non-administrator users holding Can manage LAPR. Granting the permission is a deliberate administrative step, no existing user receives it on upgrade. Administrators can configure the module but cannot use the operational pages.
• Item revisions start at zero and are not backfilled. revision = 0 means "unchanged since tracking was installed", which is consistent for every client since a client only ever compares an item against its own cached copy. A first API sync answers full_sync_required.
• The offline synchronization window is a capability bound, not a retention. offline_sync_window_days (default 90, 0 = never trim) controls how far back the revision journal is kept so a client can catch up incrementally. Trimming it destroys no item and no history: a client outside the window simply performs a full resync. Item history remains untouched.
• The Pace plugin was removed. If you serve TeamPass behind a cache or CDN, a hard refresh may be needed for the new page transition indicator to load.
• Back up your database before upgrading, as always.

Full Changelog: 3.2.1.7...3.2.2.0

Important

• Requires at least PHP 8.2

Languages

Please join Teampass v3 translation project on Poeditor and translate it for your language.

Installation

Follow instructions from Documentation.

Upgrade

Follow instructions from Documentation.

Ideas and comments

Are welcome ... please use Discussions.