[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps sapientorius/nodepass from 3e9e833 to 93b9324.

Changelog

Sourced from sapientorius/nodepass's changelog.

Changelog

Versions before 1.0 may include breaking changes in minor releases. Patch releases contain compatible fixes. Release candidates are intended for evaluation with synthetic data or a separate representative copy.

[0.1.6]

Fixed

• sysPass XML imports verify the original export's signed encrypted-node hash and accept separate export and original master passwords. The import form explains both passwords in all 14 supported languages.
• Incorrect import passwords and damaged encrypted data return actionable validation errors instead of a generic server error. Correcting an error and retrying clears the previous message; successful previews clear uploaded XML and password fields.
• Added interoperability regressions using original upstream sysPass XML fixtures, including preview, atomic import, rejected-input cleanup and one-time import challenges.

Compatibility and upgrade notes

• Existing nodePass XML exports remain importable, including the earlier authenticated hash format. New exports use the original sysPass hash convention. Unencrypted sysPass XML still requires the original master password for encrypted account passwords.
• No database schema change is introduced. Preserve existing secrets, persistent volumes and historical backup keys, and update using the release's verified image digest.
• The cumulative security catalogue retains NP-2026-001 and NP-2026-002 from version 0.1.3; this release adds no new advisory identifiers.

[0.1.5]

Added

• A dedicated Backups page lists, creates, downloads and deletes backup files, with background progress and persistent status. Application administrators can configure automatic backups with timezone-aware scheduling, bounded retries and retention of verified automatic versions.
• Application administrators can restore a listed or uploaded nodePass backup after full validation, explicit database confirmation and renewed identity confirmation. Restore creates a verified safety backup, enters maintenance, revokes sessions and recovers interrupted replacements on startup.
• Group and permission-profile member dialogs provide paginated user lists. Group membership can be filtered by primary or additional membership, and administration tables support sorting.

Changed

• Identity confirmation offers clearer passkey, authenticator and recovery-code choices while preserving pending actions.
• Event logs resolve user login names and show translated event descriptions. Backup, restore, membership and confirmation workflows have expanded browser and database regression coverage.

Fixed

• Page headings wrap their actions on narrow screens so longer translated administration titles do not overflow the viewport.

Compatibility and upgrade notes

• No database schema change is introduced. Preserve existing secrets, persistent volumes and historical backup keys, and update using the release's verified image digest.
• Automatic backups remain disabled until explicitly configured. Retention applies only to verified automatic backups; manual, safety and unclassified backups are preserved.
• Web restore requires the backup's original deployment key, sufficient protected working space and exclusive database access through one application process. Restored users, credentials, permissions and factors replace the current ones; automatic backups must be reviewed and re-enabled afterward. See backup and restore operation.
• The cumulative security catalogue retains NP-2026-001 and NP-2026-002 from version 0.1.3; this release adds no new advisory identifiers.

[0.1.4]

Added

• Sensitive actions can request identity confirmation with a registered passkey, TOTP or recovery code, or a password when no second factor is registered. Pending forms are preserved for an explicit retry after confirmation.
• Permission profiles show translated descriptions, and user management explains which users can be edited or have their passwords reset.
• Expanded browser and database regression coverage for identity confirmation, session changes and delegated user management.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)