Changelog

AES-GCM IV Length Optimization:

• IV (Initialization Vector) length changed from 16 bytes to 12 bytes
• 12 bytes is the NIST-recommended standard for AES-GCM mode
• More efficient and follows industry best practices

PBKDF2 Iteration Optimization:

• Reduced from 1,000,000 to 700,000 iterations
• Exceeds OWASP minimum of 600,000 for PBKDF2-SHA256
• ~30% faster encryption/decryption operations
• Better user experience without compromising security

Breaking Change:

• EnvLinks created with v3.x and earlier cannot be decrypted with v4.0.0
• Users need to upgrade CLI and recreate EnvLinks

Increased Payload Capacity:

• Maximum encrypted payload size increased to 2.5MB (with 3MB server-side grace space)
• Removed obsolete file count limit (previously 10 files per EnvLink)
• No limit on number of files - only total encrypted payload size matters

Documentation:

• Updated FAQ with clear examples and comparison table
• Clarified file size limits across all documentation

Password-Protected EnvLinks:

• Password hashing upgraded from SHA-256 to PBKDF2 with 1,000,000 iterations
• Each password attempt now requires 1 million hash operations, making offline brute-force attacks significantly harder
• Added password length validation (minimum 4 characters) to prevent weak passwords and reduce unnecessary server requests

Note: Optional-password EnvLinks are not affected by these changes.

EnvLinks created with v2.x and earlier won't work with v3.0.0. You need to upgrade CLI and recreate your EnvLinks.

Skipped to v3.0.0 due to breaking changes.

• Simplified Error Output: Runningenvlinkwithout arguments now shows a clean error message instead of the full help menu
• Dependency Updates: Updated siteviews package to version 2.2.1

• Cleaner terminal experience with better visual separation between commands
• Less overwhelming error output for new users
• Users can still access full help withenvlink --helpwhen needed

• Fixed CLI Error Handling: Resolved issue whereinstall,info, andexpirecommands threw unhandled exceptions with stack traces when missing or invalid EnvLink IDs were provided
• Added Issue Reporting: All error messages now include a helpful link to report bugs on GitHub
• Improved Error Messages: Replaced ugly stack traces with clean, user-friendly error messages

• Better user experience with clear error messages
• Easy bug reporting directly from error output
• More robust error handling across CLI commands
• Cleaner terminal output without technical stack traces

• Unified Repository: Server moved into main EnvLink repository at /server for easier maintenance and self-hosting
• Self-Hosting Documentation: Comprehensive self-hosting guide added with complete server setup instructions
• API Documentation: Simplified API endpoint documentation with clear descriptions

• Self-hosting is now fully documented and accessible with server included in main repo

• Fixed Password Update Encryption Bug: Resolved critical issue where updating only the password left data encrypted with the old password, causing decryption failures on subsequent installs
• When updating password without changing files, the system now properly re-encrypts stored data with the new password
• Improved error handling for password update operations

• Added automatic data re-encryption during password-only updates
• System now fetches current encrypted data, decrypts with old password, and re-encrypts with new password
• Ensures data remains accessible after password changes

• Password-protected EnvLinks can now be updated safely without breaking subsequent installs
• Better data consistency between password and encryption key
• Enhanced reliability for password management workflows

• Removed Unused Types: EliminatedApiErrorResponseinterface that was no longer being used
• Simplified Error Handling: Streamlined API client error handling logic without functional changes
• Code Cleanup: Removed unnecessary type abstractions to improve maintainability

• Cleaner error handling implementation in API client
• Reduced code complexity by removing unused interfaces
• Better code maintainability through simplified architecture
• No functional changes - internal refactoring only

• Improved code readability and maintainability
• Reduced technical debt through cleanup of unused code
• Simplified codebase without affecting user functionality
• Better developer experience for future contributions

• Fixed Reference Updates: Resolved issue where--refoption in update command was not being recognized as a valid update option
• Improved Error Handling: Enhanced network error detection to show user-friendly messages for connection issues while preserving server error messages

• Updated validation logic to include reference updates alongside other update options
• Better distinction between network failures and HTTP errors in API client
• More informative error messages for update command usage

• Reference labels can now be properly updated usingenvlink update <id> --ref <new-reference> --current-pass <password>
• Clearer error messages help users understand available update options
• Better user experience with appropriate error messaging

• Refactored Environment Configuration: Introduced centralizedENVobject withIS_DEVproperty and dynamicAPI_URLgetter
• Enhanced Error Handling: Environment-aware error messages - detailed errors in development, user-friendly generic messages in production
• Improved API Client: Updated to use new configuration structure for better maintainability

• Better separation between development and production error messaging
• Cleaner configuration management with getter methods
• Improved code maintainability and consistency

• Better user experience with appropriate error messages per environment
• Enhanced developer experience with detailed development errors
• More maintainable configuration structure

• Refactored Crypto Constants: ConsolidatedPBKDF2_CONFIGandCRYPTO_CONFIGinto unified configuration
• Simplified Module Structure: Removed redundant shared crypto module and consolidated functionality
• Enhanced Code Consistency: Aligned crypto implementations between CLI and server codebases
• Improved Error Handling: Streamlined encryption/decryption error messages
• Better Code Organization: Moved interfaces and utility functions to appropriate modules

• Unified crypto configuration across client and server
• SimplifiedderiveKeyfunction implementation usingutil.promisify
• Eliminated duplicate code patterns
• Enhanced maintainability through better module organization
• Consistent naming conventions across projects

• Cleaner, more maintainable codebase
• Reduced complexity in crypto module management
• Better separation of concerns
• Consistent API patterns between CLI and server

• Breaking Change: Default behavior now creates optional-password EnvLinks (no password required)
• Use--passflag to create password-protected EnvLinks
• --passwithout value prompts for password interactively
• Maintains backward compatibility with--optional-passflag (now deprecated)
• Updated commands documentation to reflect new defaults

• Simpler default experience for quick file sharing
• Zero-knowledge security by default
• More intuitive command structure
• Better alignment with modern CLI patterns

• Ultra-Clean Zero-Knowledge Architecture: Optional-password EnvLinks now provide complete zero-knowledge security
• Server can no longer decrypt any user data for both EnvLink types
• Access keys never leave client machines - embedded in extended IDs only
• Note: This change makes previous tutorials about optional-password security outdated

• Breaking Change: Optional-password IDs now use concatenated format (35 chars total)
• Old format:el_baseId_accessKey
• New format:el_baseIdaccessKey

• Added dedicated changelog page
• Updated documentation theme consistency
• Clarified access keys are for decryption, not authentication
• Enhanced security model explanations
• Updated terminology consistency
• Improved documentation accuracy

• Optional-password EnvLinks created with previous versions will not work
• Server API no longer accepts accessKey in request payload
• CLI automatically uses new format for all new optional-password EnvLinks

• Improved error handling for invalid password proofs
• Enhanced CLI test suite with 100% success rate
• Optimized server authentication middleware
• Enhanced file selection UI for install command

• Fixed optional-password creation with reference validation
• Improved error messages for invalid EnvLink IDs
• Enhanced file selection UI for install command

• Updated FAQ with security comparison table
• Added workflow examples in commands documentation

• Resolved CLI installation issues on certain Node.js versions
• Fixed file path handling on Windows systems
• Improved error handling for network connectivity issues

• Fixed compatibility issues with latest Node.js LTS versions
• Improved CLI startup performance
• Resolved dependency conflicts in certain environments

• Core Features: Create, install, update, and expire password-protected EnvLinks
• Security: PBKDF2-based zero-knowledge authentication
• Encryption: AES-256-GCM encryption for all data
• Expiration: Flexible expiration options from minutes to never
• Multi-file Support: Handle multiple environment files in single EnvLink

• Initial npm package registration