Repository navigation
Releases
Releases · signalapp/libsignal
v0.107.0
- BackupJsonExporter.export_frames now sanitizes certain information, such as some keys, as a defense-in-depth measure. It also now returns (per-frame) validator errors if a disappearing message or view-once attachment is included. - SVRB: resurrect support for Nitro enclaves (no enclaves yet trusted) - Java: `GroupCipher.decrypt` now throws InvalidVersionException and InvalidKeyException, and `SessionCipher.decrypt(PreKeySignalMessage)` now throws InvalidVersionException, instead of wrapping them in an AssertionError. Callers will need to handle or declare the new checked exceptions. - Use different expiration time for sandbox login purchase permits
v0.106.2
- Implement cryptography used in device provisioning - Typed APIs - AuthAccountsService.answerChallenge - Added `getProfile()` (auth) and `setProfile()`. (Not yet bridged to clients) - SGX attestation: Verify correct Intel intermediate certs used for signing.
v0.106.1
- Swift: LibSignalClient is now distributed using Swift Package Manager instead of CocoaPods. See swift/README.md for more information.
v0.106.0
- protocol: Session management now uses Tahini instead of Sesame. Archived sessions are never made active again, a tiebreaker is used to pick an active session in common race conditions, and conversations that keep switching back and forth between sessions are detected and settled. There are no wire format changes. Session records gain new fields but are readable by earlier libsignal versions. - protocol: Each session record now keeps at most 3 archived sessions (previously 40). Records with more are trimmed the next time a new session is archived. - Rust: `process_prekey` is no longer public and `message_decrypt_prekey` now returns a `PreKeyDecryptResult` instead of a `Vec<u8>`. There is a new export: `initiate_session`. Java, Swift, and Typescript APIs are unchanged.
v0.105.4
- Explicitly distrust certain compromised intermediate CA keys, even when using native platform verifiers.
v0.105.3
- Bump rustls-webpki and webpki-root-certs
v0.105.2
- SVR2/B: Remove references to 2026Q1 release.
- New typed APIs:
- AuthAccountsService.getAccountCapabilities (just getCapabilities for Kotlin)
v0.105.1
- Simplified zkcredential presentations involving multiple attribute encryption keys. The previous form only fully established proof-of-knowledge when the public keys were all known in advance by the verifying server, which the library cannot guarantee. Signal does not currently use zkcredential for any credentials with multiple attribute encryption keys (the only one is ProfileKeyCredential, which is still using a manually-written implementation), so there is no compatibility break for Signal's services, but external uses of zkcredential may need to adjust.
- Backups: flatten the FavoriteSticker proto
- New typed APIs:
- Donations.createDonationPermits
- Donations.redeemDonationReceipt
- AuthAccountsService.getAccountEntitlements (just getEntitlements for Kotlin)
v0.105.0
- Net: `ChatConnection.info()` now reports whether the connection is direct (`isDirect`), as opposed to going through a reflector or a proxy. - Java: Connection info is now also available in Java. - Typed APIs - Add `expectedLevel` argument to `createLoginReceiptCredential()`
v0.104.0
- backups:
- Support audio waveform and duration on FilePointer.
- Support for hidden sticker packs and favorite stickers.
- Java: Renamed CreateLoginReceiptCredentialException to ReceiptCredentialException.
- Swift: Renamed the four SignalError `ReceiptCredentialError…` cases to `receiptCredentialError…`.
- New typed APIs:
- UnauthProfilesService.getProfileKeyCredential
- Messages.reportMessage
- UnauthSubscriptionsService.getSubscriptionReceiptCredential (just `getReceiptCredential` for Kotlin)
- Internal: libsignal now uses Android Gradle Plugin 9.4.0 and Gradle 9.6.0.
