Skip to content

3.3.1.md

Latest commit

 

History

History
59 lines (46 loc) · 2.7 KB

3.3.1.md

File metadata and controls

59 lines (46 loc) · 2.7 KB
Raw

Keysoft 3.3.1

Source release: 2026-08-09.

Android production target: versionCode 130. Google Play status at release creation: Keysoft 3.3.0 / versionCode 129 remains published; 3.3.1 submission is a separate manual step.

Keysoft 3.3.1 is a security, reliability, dependency, and repository-quality release. It does not change the visible application design, canonical assets, Android permissions, offline-first behavior, storage keys, or KS1/KS1-PW1 payload layouts.

Security And Reliability

  • Makes first-time PIN setup, PIN rotation, and transparent KDF upgrades transactional.
  • Closes authentication and clears the active key when verifier/ciphertext rollback cannot restore a known-good storage state.
  • Persists encrypted mutations before updating decrypted caches.
  • Validates backup size, KDF costs, field/collection limits, and KS1 CBC framing before persistence.
  • Merges imported records by ID and commits password/note changes through one encrypted batch, preventing partial imports and repeated quadratic writes.
  • Requires an active vault key for secure collection clears and blocks SYSTEM_ALERT_WINDOW in generated Android manifests.
  • Keeps debug logging message-only and avoids structured vault or preference data.

Fixed

  • Applies excluded-similar-character filtering to every password-generator character set, including the character guaranteed from each enabled class.
  • Keeps generated passwords at the requested length even for direct API calls shorter than the number of enabled classes.
  • Uses canonical-alphabet membership in the development web crypto mock's special-character regression coverage.

Tooling And Repository

  • Aligns Expo SDK 57 and compatible JavaScript patch releases while preserving the supported React Native 0.86 toolchain.
  • Adds weekly Bun Dependabot updates and frozen lockfile installation to every CI path.
  • Publishes a product-first README, official production screenshots, a Google Play homepage, structured issue intake, a first-party social preview, and a dated full audit.

Verification

  • bun install --frozen-lockfile
  • bun run verify: formatting, strict TypeScript, ESLint, 30 suites / 212 tests, and Expo Doctor 20/20
  • bun audit --audit-level=critical: zero critical advisories
  • Android Expo bundle export
  • Generated Android inspection for permissions, optimized R8/resource shrinking, and Argon2 keep rules
  • GitHub Validate and CodeQL checks

Deployment Boundary

The v3.3.1 tag identifies the exact source used to start the EAS Android production build. The EAS profile produces an Android App Bundle and auto-increments the remote version from 129 to 130. It does not submit to Google Play; store review and publication remain manual.