Skip to content

release: 2.1.0 - #97

Merged
StuartMeeks merged 1 commit into
mainfrom
release/2.1.0
Sep 21, 2026
Merged

StuartMeeks merged 1 commit into
mainfrom
release/2.1.0

Conversation

@StuartMeeks

Copy link
Copy Markdown
Owner

Cuts 2.1.0. Bumps <Version> to 2.1.0 and finalizes the CHANGELOG [Unreleased] → [2.1.0] — 2026-09-21 with the compare/tag link refs.

Why minor

No provider-facing interface changed (ICredentialManager, IAuthenticationService<,>, ICredentialCollector, ICredentialSummaryProvider all untouched), so the provider packages need no re-cut and their [2.0.0, 3.0.0) range resolves against 2.1.0. No public API break; existing keystores migrate on upgrade.

Headlines

  • Fix (data loss): a Windows feature update no longer invalidates the local keystore.
  • Change (security model): the KEK drops all machine/user/OS identity and derives from a random per-keystore salt (keystore format v3, v1/v2 auto-migrate). Behaviour change for upgraders: a default-mode credentials directory is now portable; real binding is AdditionalEntropy / DPAPI / keychain.
  • Change: net10 dependency floor → 10.0.12.

Release build produces NextIteration.SpectreConsole.Auth.2.1.0.nupkg (+ symbols) cleanly.

Publish is not triggered by merging this — it fires on the v2.1.0 tag push. Holding that irreversible step for explicit confirmation.

🤖 Generated with Claude Code

Bump Version to 2.1.0 and cut the CHANGELOG [Unreleased] section to
[2.1.0] — 2026-09-21, adding the compare/tag link refs.

Minor, not major: no provider-facing interface changed, so the provider packages
need no re-cut and their [2.0.0, 3.0.0) range resolves against 2.1.0 unchanged.
The headline is a data-loss fix in the local file backend — a Windows feature
update rotated the machine-derived KEK and left credentials undecryptable — and
the redesign behind it: the KEK now derives from a random per-keystore salt with
no machine/user/OS identity, so no OS update or rename can break the store again;
existing v1/v2 keystores migrate themselves on first load.

Behaviour change called out for upgraders: a default-mode credentials directory
is now portable (machine binding removed — it was a tripwire, not a boundary).
Also raises the net10 dependency floor to 10.0.12.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@StuartMeeks
StuartMeeks merged commit 40d0957 into main Sep 21, 2026
11 checks passed
@StuartMeeks
StuartMeeks deleted the release/2.1.0 branch September 21, 2026 07:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant