This release applies the findings of the September 2026 security & quality audit, introduces streaming output for large files, and adds regression + E2E test infrastructure.
Security & hardening
- Tiny-chunk DoS fix (HIGH): decrypt no longer accepts attacker-crafted metadata with
chunk: 1. Chunk size is now floored at 4 KiB. No released version ever wrote chunks below 1 MiB, so no legitimate file is affected. - Metadata validation:
kdfandhashheader fields are verified when present (PBKDF2/SHA-512); header length capped at 4 KiB. - Decrypt error logging: failures are now logged to the console instead of silently discarded (user-facing message stays generic).
- Supply chain: Dependabot auto-merge no longer approves/merges major version bumps.
- CSP: added
worker-src 'self'andframe-src 'self';frame-ancestors/X-Frame-Optionstightened toself/SAMEORIGIN. - Server hardening: nginx version disclosure removed, gzip enabled for CSS/JS/SVG/JSON.
Streaming output (memory & performance)
Encrypt/decrypt previously buffered 2–4× the file size in memory. Output now streams through a three-tier sink model:
| Sink | When it's used | Behavior |
|---|---|---|
fs
| Chromium over HTTPS/localhost | Streams straight to disk via File System Access API |
sw
| HTTPS/localhost, any modern browser | Bytes stage into OPFS, then stream through a Service Worker-intercepted download response |
blob
| Plain HTTP / old browsers | In-memory fallback (previous behavior) |
Measured peak memory (256 MB input): encrypt 4.2× → 1.29×, decrypt 3.2× → 0.31× file size. Also added Cancel buttons for both operations.
Fixes
formatFileSizereturned"1 undefined"for ≥ 1 TiB; now supports TB/PB.- Large-file warning lowered from 1 GiB to 500 MB.
- Removed the unused 80 KB
bootstrap.bundle.min.js. - Deduplicated crypto plumbing into
src/js/crypto-common.js.
Tests & CI
- Node regression suite (
npm test, zero dependencies): 48 tests — round-trip matrix with chunk boundaries, wrong-password/garbage rejection, v1 legacy compatibility, v2 tamper suite, malicious metadata validation, per-sink round-trips, flat-memory regression assertions. - E2E suite (Playwright): real Chromium against the real container, SHA-256-verified round trips per sink mode.
- CI: both suites run as GitHub checks on every PR.
Deployment
- Docker image: added
HEALTHCHECK; no port or volume changes.
Compatibility notes
.vaultfiles with chunk size < 4 KiB are rejected on decrypt — no released version produced them.- v1 legacy files (version byte
1) remain fully supported. - No changes to the on-disk v2 format; outputs remain byte-identical across sink modes.
Full Changelog: v.1.5.0...v.1.6.0