V16.4.4

🔒 Security Fixes

• Upgraded Next.js
  • Updated Next.js from 15.5.7 to 15.5.9 to address CVE-2025-55183 and CVE-2025-55184, security vulnerabilities in React Server Components.
  • Ensured compatibility by updating related dependencies and lock files.
  • No functional changes, only security patches applied.

V16.4.3

🔒 Security Fixes

• Upgraded Next.js and React
  • Updated Next.js to 15.5.7 and React to 19.2.1 to address CVE-2025-55182, a critical RCE vulnerability in React Server Components.
  • Ensured compatibility by updating related dependencies and packages.
  • No functional changes, only security patches applied.

V16.4.2

🛠️ Bug Fixes

• Preserve Subkey Properties When Adding/Reordering User IDs
  • Fixed issue where subkey expiration times and revocation status were being reset when adding new user IDs or changing the primary user ID. Subkey binding signatures are now preserved to maintain all subkey properties including expiration dates, key flags, and revocation status.

V16.4.1

🛠️ Bug Fixes

• Adjusted Table Column Widths
  • Fixed inconsistent column widths across manage-keyrings, cloud-backup, and cloud-manage tables to improve layout consistency.

V16.4.0

✨ Enhancements

• Streamlined Table Column Widths

  • Removed fixed width properties from column definitions to improve adaptability across various screen sizes.
  • Added dynamic width calculation using relative weightings, enabling more flexible and content aware table layouts.

• Dynamic Column Visibility Management

  • Implemented loading and saving of visible table columns to localStorage, ensuring user display preferences persist across sessions.
  • Added customizable column visibility support for manage-keyrings, cloud-backup, and cloud-manage.

---

📐 Layout & Responsiveness

• Improved Table Responsiveness
  • Tables now resize more intelligently based on content, enhancing readability and reducing layout constraints.
  • Overall UI responsiveness improved through more fluid and adaptable table rendering.

V16.3.0

✨ Enhancements

• Ultrawide Monitor Support
  • Added full responsiveness for ultrawide displays to improve layout scaling and ensure seamless UI rendering across all resolutions.

---

🛠️ Bug Fixes

• App Password Protection Prompt
  • Fixed an issue where random password prompts was appearing unexpectedly while using the app by removing the unnecessary useEffect dependency, ensuring stable decryption flow.

V16.2.0

✨ Enhancements

• Cipher Format Improvements

  • Introduced standardized constants for cipher format validation, including:
    • Magic bytes
    • Encryption version
    • Salt, IV, and HMAC lengths
  • Enhanced the validateCipherFormat function for improved readability, consistency, and maintainability.
  • Strengthened validation checks to ensure proper cipher structure and integrity, including reserved byte and iteration count validation.

• Transaction & Request Handling Fixes

  • Changed rate limiting isolation level from Serializable to ReadCommitted to prevent transaction deadlocks during concurrent requests.
  • Fixed "Body has already been read" error in the DELETE handler by refactoring request body parsing order.

V16.1.0

✨ Enhancements

• Rate Limiting Improvements

  • Added a new addRateLimitHeaders function to standardize rate limit response headers across all endpoints.
  • Introduced a failClosed option for critical endpoints, ensuring that rate limiting errors default to secure denial instead of allowing requests through.
  • Improved consistency in rate limit handling and response formatting for multiple API routes.

• Security Enhancements

  • Strengthened CSRF token validation by implementing a timing-safe comparison mechanism to mitigate timing attacks.
  • Enhanced API response security with additional protective headers applied across key endpoints.

• Schema Optimization

  • Refactored the rate limit schema in Prisma to simplify tracking of users and endpoints, improving maintainability and query performance.

V16.0.0

✨ Enhancements

🔐 Security & API Improvements

• Enhanced CSRF Protection System

  • Added centralized CSRF token generation and validation for consistent security across all routes.
  • Implemented stricter token validation with automatic expiration and session based protection.
  • Enforced CSRF middleware on all critical API endpoints including vault, key, and authentication routes.

• Request Size Limiting & Input Hardening

  • Introduced strict request size limits across multiple APIs to prevent abuse and potential DoS attacks.
  • Added validation logic for incoming payloads to ensure data integrity and secure request handling.

• Vault & Key Management Security

  • Enforced rate limiting across all vault and key management APIs.
  • Implemented cipher format validation to prevent malformed or tampered ciphertext injection.
  • Strengthened security headers across all endpoints for improved browser level protection.

• OAuth Integration

  • Added support for Discord OAuth authentication, enabling secure and seamless login via Discord accounts.
  • Integrated token validation and secure callback handling within the existing authentication flow.

---

☁️ Cloud & Key Handling

• Improved Key Processing Logic
  • Refined key management flow for more reliable key fetching, validation, and import/export.
  • Added robust error handling for corrupted or mismatched keys during synchronization and backups.
  • Enhanced worker based key operations to ensure non blocking cryptographic processing.

---

🧩 UI & UX Improvements

• Vault Deletion OTP Modal

  • Improved responsiveness and layout scaling for OTP verification modal across devices.
  • Added loading spinner during OTP verification to improve feedback for users.

• Login Page Theme Alignment

  • Updated OAuth provider icons (Google, Github, Discord) to match the app’s global theme for better visual consistency.

---

🗄️ Database & Infrastructure

• Migration to Prisma + PostgreSQL

  • Fully migrated authentication and vault management from Mongoose + MongoDB to Prisma + PostgreSQL.
  • Improved relational data modeling and query performance for key, vault, and session handling.
  • Strengthened database consistency and schema validation for all security critical models.

• HTTPS & Development Setup

  • Added complete HTTPS setup for nextpgp-dev.com and local development environments.
  • Introduced new scripts for running local secure servers to test CSRF, cookie, and header behavior under HTTPS.

---

🔒 Security Highlights

• Strengthened client side cryptographic boundaries ensuring all sensitive data is processed locally.
• Enforced secure request flow with consistent CSRF validation and strict request size constraints.
• Hardened PGP key handling routines against malformed data and injection attempts.
• Introduced automatic security header enforcement for all API routes.
• Added rate limiting and session validation to mitigate bruteforce or abuse attempts.

---

🧾 Summary

This release introduces major security enhancements, database upgrades, and UI refinements — continuing NextPGP’s vision of a zero-knowledge, end-to-end encrypted PGP management system built for both performance and privacy.

V15.16.1

🛠️ Bug Fixes

• Infinite Refresh
  • Fixed breaking changes in the app updater causing infinite refreshes during local production testing.