Differences
This shows you the differences between the selected revisions of the page.
| history 2021-02-08 | history 2026-09-11 (current) | ||
| Line 3: | Line 3: | ||
| This is a full list of changes for each release of WinSCP. See also [[project_history|Project history]] and [[incompatible_changes|Incompatible changes between versions]]. | This is a full list of changes for each release of WinSCP. See also [[project_history|Project history]] and [[incompatible_changes|Incompatible changes between versions]]. | ||
| - | (*===== [[6.0]] 6.0 beta (not released yet) ((tbd)) =====*) | + | ===== [[6.8]] 6.8 (not released yet) ((2026-08-22)) ===== |
| - | (* * Allow displaying all VMS file revisions with FTP protocol. [[bug>1944]]*) | + | |
| - | (* * Support reading S3 credentials from AWS CLI configuration. [[bug>1941]]*) | + | |
| - | (* * Removed the "compression" indicator from the status bar.*) | + | |
| - | (* * Confirm closing when multiple tabs are opened and auto workspace saving is not enabled, even when none of the tabs contain an active remote session.*) | + | |
| - | (* * Improved handling of long shell command error messages. [[bug>1949]] *) | + | |
| - | ===== [[5.18.3]] 5.18.3 (not released yet) ((2021-02-04)) ===== | + | ··* Word wrapping in the internal editor can be toggled from toolbar menu. [[bug>2451]] |
| - | ··* When opening or switching to a session whose local directory does not exist, open the nearest existing parent directory. [[bug>1951]] | + | ===== [[6.6.4]] 6.6.4 (not released yet) ((2026-09-11)) ===== |
| - | * Bug fix: Parsing of multiline VMS FTP listing entries is broken. [[bug>1950]] | + | |
| + | ··* Increased length limit of proxy host name for updates preferences. [[bug>2456]] | ||
| + | * Optionally default to keeping Login dialog open after opening session in PuTTY. [[bug>2459]] | ||
| + | * Improving placement of widows, particularly those opened, while the main window is not visible (notably during command-line operations). | ||
| + | * Bug fix: When selecting a site to perform a command-line operation with, it was possible to select a workspace or a folder, resulting in unexpected behaviour or failure. [[bug>2457]] | ||
| + | * Bug fix: After opening session in PuTTY, WinSCP process is never closed. [[bug>2458]] | ||
| + | * Bug fix: Invalid language code for Serbian was used for Microsoft Store package. [[bug>2460]] | ||
| + | ===== [[6.6.3]] 6.6.3 RC ((2026-09-03)) ===== | ||
| - | have a BUG ~~~~~AC | + | * Translations completed: Belarusian, Brazilian Portuguese, Catalan, Croatian, Czech, Danish, Dutch, Finnish, French, German, Hungarian, Italian, Japanese, Korean, Lithuanian, Macedonian, Polish, Portuguese, Romanian, Russian, Serbian, Simplified Chinese, Slovak, Slovenian, Spanish, Swedish, Tamil, Traditional Chinese and Turkish. |
| + | * Some parts of GUI (panel headers, scrollbars, buttons, checkboxes) show dark in dark theme even when system-wide app theme is light. | ||
| + | * SSH core and private key tools (PuTTYgen and Pageant) upgraded to [[&url(puttychanges)|PuTTY 0.85]]. \\ It brings the following change: | ||
| + | * Security issue: fixed a remotely triggerable use-after-free in Pageant. [[pbug>pageant-deferred-decryption-uaf]] | ||
| + | * Security issue: fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. [[pbug>etm-large-packet-overflow]] | ||
| + | * Security issue: fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. [[pbug>argon2-parameter-checks]] | ||
| + | * Denial-of-service security fixes: a server can trigger a tight loop in WinSCP, and even a MITM can make it consume unlimited memory at startup. [[pbug>maxpkt-0-tight-loop]] | ||
| + | * Bundled SSH private key tools (PuTTYgen and Pageant) are 64-bit. | ||
| + | * On Windows 11, using system dark tab theme, that uses different shades for active and disabled/disconnected tabs. [[bug>2452]] | ||
| + | * TLS/SSL core upgraded to OpenSSL 3.5.8. | ||
| + | * XML parser upgraded to Expat 2.8.4. | ||
| + | * Source code package build script supports 64-bit target. | ||
| + | * Installer upgraded to Inno Setup 6.7.3. | ||
| + | * 64-bit build is identified in version information. | ||
| + | * Resolving version of pwsh installed with MSIX. | ||
| + | * Thirdparty information from the About dialog can be copied to the clipboard even when the browser control malfunctions. | ||
| + | * Bug fix: No error is shown when connection fails. | ||
| + | * Bug fix: ''x-name'' URL parameter was incorrectly decoded. | ||
| + | * Bug fix: Incorrect number validation. | ||
| + | * Bug fix: Some controls (notably list view headers) do not correctly apply dark mode in 64-bit build. [[bug>2453]] | ||
| + | * Bug fix: 64-bit build did not identify its system to be 64-bit, what among other prevented it from identifying 64-bit COM registrations. | ||
| + | * Bug fix: Some strings use incorrect translation in 64-bit version. [[bug>2455]] | ||
| - | ===== [[5.18.2]] 5.18.2 beta ((2021-02-02)) ===== | + | ===== [[6.6.2]] 6.6.2 RC ((2026-06-17)) ===== |
| - | * Compatibility with Google Cloud Storage when using S3 protocol to access the buckets. [[bug>1939]] | + | * Experimental 64-bit version of WinSCP. [[bug>618]] |
| - | * Bug fix: Failure when closing with no tab. [[bug>1947]] | + | * Optionally not showing error message when connection is lost while idle. [[bug>2360]] |
| - | * Bug fix: Debug information is printed at the end of the scripting session when debug logging level is set even if logging is turned off. [[bug>1948]] | + | * SSH core and SSH private key tools (PuTTYgen and Pageant) upgraded to [[&url(puttychanges)|PuTTY 0.84]]. \\ It brings the following changes: |
| + | * Security issue: fixed a remotely triggerable double-free in RSA key exchange. [[pbug>rsakex-double-free]] | ||
| + | * Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. [[pbug>ecdsa-remotely-triggerable-assertion]] | ||
| + | * Bug fix: spurious //"Network error: Socket is not connected"// when authenticating to some HTTP proxies. [[pbug>http-proxy-auth-wsaenotconn]] | ||
| + | * TLS/SSL core upgraded to OpenSSL 3.5.7. | ||
| + | * XML parser upgraded to Expat 2.8.1. | ||
| + | * Restored faster C TLS/SSL AES implementation. | ||
| + | * Configurable warning when opening large file in an internal editor. [[bug>2437]] | ||
| + | * Informing that when preserving directory timestamps is enabled, using multiple connections for transfer is not possible. [[bug>2439]] | ||
| + | * Warning when pasting a session URL with unsafe settings. | ||
| + | * When opening session in PuTTY to a host for which WinSCP has multiple host keys cached, using the last key or the key that PuTTY has cached. [[bug>2440]] | ||
| + | * Always (re)registering drag&drop shell extension during installation, even when the extension is not replaced. | ||
| + | * Allowed Console interface tool to have ''.exe'' extension to avoid false positive detections by some antiviruses. [[bug>2434]] | ||
| + | * Using //"username"// and //"hostname"// as one word. | ||
| + | * Reading all system settings from 64-bit registry. | ||
| + | * Allow assigning ''null'' to ''Session.SessionLogPath''. [[bug>2438]] | ||
| + | * Avoiding using ''SSH_FXF_EXCL'' together with ''SSH_FXF_TRUNC'' SFTP file opening flags. [[bug>2444]] | ||
| + | * Optimized file system monitoring when looking for dummy directory during drag&drop downloads. [[bug>2445]] | ||
| + | * Change: Not allowing WebDAV redirects to other hosts by default. [[bug>2447]] | ||
| + | * Change: Not allowing WebDAV redirects to an unencrypted URL by default. [[bug>2448]] | ||
| + | * Updated to JCL library 2.9 commit c669fd12. | ||
| + | * Bug fix: Failure when trying to connect via HTTP proxy to FTP host with excessively long login details. [[bug>2435]] | ||
| + | * Bug fix: Buffer overflow in Console interface tool. [[bug>2436]] | ||
| + | * Bug fix: Failure setting ''Session.DebugLogPath'' when running in impersonated context. [[bug>2441]] | ||
| + | * Bug fix: Message boxes from secondary windows (like the internal editor) caused application to move to the background when when the main window was minimized. [[bug>2443]] | ||
| + | * Bug fix: Heap over-read via crafted encrypted filename. [[bug>2449]] | ||
| + | * Bug fix: Slashes in filenames can cause path traversal when invalid filename characters replacement is disabled. [[bug>2450]] | ||
| - | ===== [[5.18.1]] 5.18.1 beta ((2021-01-27)) ===== | + | ===== [[6.6.1]] 6.6.1 beta ((2026-04-01)) ===== |
| - | * Improved FTP support for VMS servers (and potentially for other non-Unix-like systems). [[bug>49]] | + | * Support for OpenSSH ssh-agent. [[bug>1682]] |
| - | * Translations completed: Brazilian Portuguese, Catalan, Czech, Dutch, Finnish, German, Hungarian, Italian, Japanese, Norwegian, Polish, Portuguese, Russian, Simplified Chinese, Slovak, Spanish, Swedish, Traditional Chinese, Ukrainian and Turkish. | + | * Optionally connecting all workspace/folder sessions immediately. [[bug>1026]] |
| - | · * TLS/SSL core upgraded to OpenSSL 1.1.1i. | + | * Preserving panel scroll position after rename. [[bug>2425]] |
| - | * Switch-like raw session settings can be configured using ''on''/''off''/''auto'' keywords. | + | * ''Ctrl+C'' works in list views on 'Server and protocol information' dialog. |
| - | * Preserve file permissions when overwritten files are recycled and transfer resume is disabled. [[bug>1929]] | + | * Preventing moving or copying a file or folder over ancestor folder with the same name. [[bug>2427]] |
| - | * Keyboard-interactive authentication challenges can be copied to the clipboard and links contained in the challenges can be opened. [[bug>1930]] | + | * WebDAV/HTTP core upgraded to neon 0.37.1. |
| - | * Added method ''RemotePath.EscapeOperationMask'' to .NET assembly. | + | * XML parser upgraded to Expat 2.7.5. |
| - | * Added method ''ComparisonDifference.Reverse'' to .NET assembly. | + | * Bug fix: Some menus were not working on displays to the left or above the primary display. [[bug>2423]] |
| - | * Implemented method ''ComparisonDifference.ToString'' in .NET assembly. | + | * Bug fix: Mouse wheel downwards scrolling did not work on toolbar drop down lists. |
| - | * ''Write'', ''CanWrite'', ''Length'' and ''Position'' methods and properties of the ''Stream'' returned by the ''Session.GetFile'' behave as expected for a read-only steam. | + | * Bug fix: Once any control of permissions popup box was focused the popup no longer closed when user clicked outside of it. |
| - | * Allowed using SFTP servers that have problems with SSH_FXP_REALPATH requests. [[bug>1933]] | + | * Bug fix: Failure when closing Transfer settings dialog with //X// button while a permissions popup box control is focused. [[bug>2420]] |
| - | * Bug fix: Target file name with escaped operation mask special symbols was incorrectly interpreted as an actual operation mask on some dialogs (upload, duplicate, etc), resulting in misplaced warnings | + | * Bug fix: Failure when switching to a session that is being reconnected. |
| - | * Bug fix: Local path argument of ''Session.PutFileToDirectory'' is incorrectly escaped. [[bug>1931]] | + | * Bug fix: Failure when the first bit of an SFTP response is set. [[bug>2422]] |
| - | * Bug fix: Path argument of ''Session.PutFile'' is incorrectly escaped. | + | * Bug fix: Copying to clipboard with ''Ctrl+C'' from 'Server and protocol information' was broken. |
| - | * Bug fix: Failure when using from single-file bundle. [[bug>1932]] | + | * Bug fix: Protocol additional information scrolling was broken. |
| - | * Bug fix: ''Session.GetFile'' can fail, if the server responds too quickly. | + | * Bug fix: Master password dialog was missing //Help// button. |
| - | * Bug fix: Failure when S3 bucket contains a folder with an empty name. [[bug>1934]] | + | * Bug fix: Checking if edited/opened file was modified externally didn't work for inactive sessions. [[bug>2426]] |
| - | * Bug fix: When the active tab was disconnected, closing window with another active session did not require a confirmation. | + | * Bug fix: Wrapped settings values from Raw Site Settings dialog were not preserved. |
| - | * Bug fix: Setting the logging level to -1 (Reduced) does not work in .NET assembly. [[bug>1936]] | + | * Bug fix: Some files modified by local custom command in SCP session fail to upload back. [[bug>2428]] |
| - | * Bug fix: Ellipses from German command names are not stripped from toolbar buttons. | + | * Bug fix: Whole //Key exchange// page was incorrectly hidden when //"Handles SSH key re-exchange badly"// bug was enabled. |
| - | * Bug fix: Hang when the stream returned by ''Session.GetFile'' is closed before the download finished. | + | * Bug fix: Some message boxes leak GDI handle. [[bug>2430]] |
| - | * Bug fix: Failure when looking for PuTTY key tools and the ''PATH'' contain invalid paths. [[bug>1942]] | + | * Bug fix: Login dialog leaks GDI handles. [[bug>2431]] |
| - | * Bug fix: Prevent loading session settings that can lead to remote code execution from handled URLs. [[bug>1943]] | + | |
| - | * Bug fix: Hang when S3 server returns a truncated listing with folders only. [[bug>1946]] | + | |
| - | ===== [[5.18]] 5.18 beta ((2020-11-30)) ===== | + | ===== [[6.6]] 6.6 beta ((2026-02-02)) ===== |
| - | * A complete list of files that are part of a background transfer can be shown. [[bug>1785]]·· | + | * Synchronizing two local directories. [[bug>2020]] |
| - | * ''Stream'' interface in .NET assembly. [[bug>1738]] | + | * Compiler upgraded to Clang/bcc32c. [[bug>618]] |
| - | * With SFTP protocol files can be streamed to stdout and from stdin in scripting. | + | * Inactive sessions can be automatically reconnected. [[bug>2232]] |
| - | * Support SHA-256 fingerprints of TLS/SSL certificates. [[bug>1842]] | + | * Added dark theme support to: [[bug>1696]] |
| - | ·* Extension //[[extension_synchronize_another_server|*]]//. | + | ···* Login dialog. [[bug>2345]] |
| - | ·* When connecting to new SSH host, its host key can be automatically accepted in scripting and .NET assembly. | + | ···* Transfer Options dialog. |
| - | ·* Optional case-sensitive synchronization. [[bug>71]] | + | ···* Message boxes. |
| - | ·* Enabled TLS 1.3 by default. | + | ···* Queue column headers. [[bug>2356]] |
| - | ·* XML parser upgraded to Expat 2.2.10. | + | ···* Progress window. |
| - | * SSH core upgraded to [[&url(puttychanges)|PuTTY 0.74]]. It brings the following change: | + | ···* Authentication Progress window. [[bug>2358]] |
| - | * Security fix: If an SSH server accepted an offer of a public key and then rejected the signature, WinSCP could access freed memory, if the key had come from an SSH agent. [[pbug>vuln-agent-keylist-used-after-free]] | + | * Bug fix: Scrollbar colors did not always reflect the color theme |
| - | * Resume transfer when FTP data connection disconnects. [[bug>1878]] | + | * Using modern directory selection dialog that scales correctly and allows creating new directory. [[bug>2373]] [[bug>2389]] |
| - | * Support for ''curve25519-sha256'' KEX. [[bug>1865]] | + | * Optimized GUI when working with large subdirectory selection. [[bug>2396]] |
| - | * Support for authentication using temporary credentials from AWS Security Token Service (STS). [[bug>1839]] | + | * Change: Default to UTF-8 encoding in internal editor. [[bug>2397]] |
| - | * Support for SNI with FTP. [[bug>1895]] | + | * New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries. |
| - | * Installer upgraded to Inno Setup 6.1.2. | + | * TLS/SSL core upgraded to OpenSSL 3.5.5. |
| - | ···* Change: Installer needs Windows 7 SP1/2008 R2 SP1. | + | * WebDAV/HTTP core upgraded to neon 0.36.0. |
| - | * Alternative way to provide credentials in scripting/command-line without URL-encoding. [[bug>1821]] | + | ·* XML parser upgraded to Expat 2.7.4. |
| - | * Compatibility with WebDAV servers that incorrectly encode file URL. [[bug>1876]] | + | * Installer upgraded to Inno Setup 6.7.0 with dark mode support enabled. |
| - | * Optimizing S3 connection buffers for speed. [[bug>1732]] | + | * Increased WinSCP memory limit to 4 GB. [[bug>2412]] |
| - | * Edited/opened files from a disconnected session can now be attached to new session even if its username was entered only during authentication instead of directly on the Login dialog. [[bug>1890]] | + | * Defined and implemented interface for the .NET library. By @mjkent. [[bug>856]] |
| - | * Returning to Login dialog, when ad-hoc connection fails. [[bug>1909]] | + | * Optimized TLS/SSL AES implementation. |
| - | * Local ports for active FTP mode can be limited. [[bug>958]] | + | * Restoring ability to restart Explorer to allow upgrade of drag&drop shell extension, when installing for current user, as after-restart replacement is not possible without Administrator privileges. [[bug>2381]] |
| - | * Allow explicit navigation to a hidden local folder by enabling showing of hidden files and folder, if not enabled yet. [[bug>1905]] | + | * MSI toolset updated to WiX 5. |
| - | * Added full //Go To// submenu to context menu of panel path label | + | * Commands to copy paths to the clipboard on the Synchronization checklist window. |
| - | ·* Automatically restore external editor defaults when changing editor command from Notepad to 3rd party editor. [[bug>1872]] | + | * Cryptography optimization. |
| - | * Suppress errors when opened/edited files are locked. [[bug>1832]] | + | * Support long AWS/S3 session tokens. [[bug>2403]] |
| - | * Support clearing GID/UID flag on directories with new versions of GNU coreutils. [[bug>1850]] | + | * Prevent hang when new device is attached or removed while some mapped network drive is not available. [[bug>2382]] |
| - | * Added ''/nointeractiveinput'' to usage screen. | + | * Copy and paste improvements: |
| - | * List encrypt-then-MAC algorithms in ''/info'' listing. [[bug>1917]] | + | ···* Consistently renaming local files dropped or pasted back to their source directory to avoid collisions. |
| - | * Not using a transfer via temporary file for files that would exceed system length limit with the temporary extension. [[bug>1922]] | + | ···* Bug fix: When copying local files to clipboard from system context menu, "cut" state of previously cut files was not cleared. |
| - | * Automatically closing timed out ''Session''. [[bug>1923]] | + | * Not redundantly verifying WebDAV or S3 certificate in Windows Certificate store if it is already marked as trusted in session settings. [[bug>2404]] |
| - | * Logging IANA encryption algorithm names. [[bug>1886]] | + | * Provide SNI when opening FTP data connection. [[bug>2410]] |
| - | * Displaying, what directory is being read at the end of login to a server, in a tooltip. [[bug>1916]] | + | * Optimized synchronization checklist sorting. |
| - | * Use dark window title for the main window in the dark mode on Windows 10 2004. [[bug>1920]] | + | * Support for Beyond Compare 5 in Compare Files extension. [[bug>2417]] |
| - | * Clarified that WinSCP may crash in the warning message when trying to load too big file into the internal editor. [[bug>1847]] | + | * Convert unsupported SSH proxy to SSH tunnel when importing site from PuTTY. [[bug>2408]] |
| - | * Do not prevent WinSCP from working when jump list cannot be updated. [[bug>1857]] | + | * FTP directory listing falls back to the other active/passive mode, consistently with file transfers. |
| - | * Allow forcing use of ''LIST'' command to retrieve file information in scripting for FTP servers that has broken support for ''MDTM''/''SIZE'' commands. [[bug>1921]] | + | * Consistently calling command to open window with specific directory //Explore//, instead of sometimes //Browse//. |
| - | * //Duplicate// and //Rename// commands work even for disconnected sessions. | + | * Consistently referring to file last modification timestamp column as //Date modified//. |
| - | * IPv6 literals with scope or literals that are already escaped in square brackets are formatted standardly in session URL (instead of URL-encoding them). | + | * With INI file provided on command-line, using the same INI file when starting a new instance. |
| - | * Allowed longer input on Edit file input box. [[bug>1911]] | + | * Windows shell local file copy status window is centered on the main window. |
| - | * Added help link to Add extension box and making the box wider. | + | * Made taskbar flashing configurable in GUI. [[bug>2411]] |
| - | · * GSSAPI key exchange authentication can be turned on. [[bug>1863]] | + | * Control labels on transfer settings dialogs do not show keyboard accelerator cue, until ''Alt'' key is pressed. |
| - | * When trying to open an inaccessible local directory, display an error message, instead of silently doing nothing. | + | * Not using drag images even with directory trees. [[bug>1274]] |
| - | * Cleanup application data dialog labels cache cleanup checkbox label updated to reflect previously updated functionality. | + | ··* Allow configuring checksum commands. [[bug>2394]] |
| - | * Disabling tips controls until some tips are actually available. | + | * Updated to JCL library 2.8.1. |
| - | * Optionally disable moving using drag&drop. [[bug>1884]] | + | * Updating jump list only when running with GUI. |
| - | * Main window follows Login dialog to another monitor, when switched using keyboard shortcuts ''Shift+Win+Left''/''Right''. [[bug>1907]] | + | * Made space on permissions box for longer translations. [[bug>2398]] |
| - | * When path to an existing local directory is specified on the Download options dialog without an operation mask, a noop operation mask is implied. | + | * Opening //Default Apps// //Settings// page directly to open it in the foreground and avoid flashing //Control Panel// window. |
| - | * Workaround for wrong description of ''Num *'' keyboard shortcut in menus with German keyboard. [[bug>1889]] | + | * Improving order in which Windows Narrator reads window controls. |
| - | * Files with the same name except for a letter case are sorted deterministically. [[bug>1894]] | + | * All edit boxes with history consistently do not auto complete and show 16 entries in the drop down. |
| - | * Not offering pasting from clipboard on the file panels if the clipboard contains multi-line text. | + | * Removed obsolete //Preserve remote timestamp// session settings. |
| - | * Extending transfer dialog drop down menu size to 16 entries. | + | * Bug fix: Local file with invalid characters replaced could not be explored from the Synchronization checklist window. |
| - | * Bug fix: Local file panel ignored changes in latter case of files and folders. [[bug>1885]] | + | * Bug fix: Files modified by local custom command are not always uploaded to the correct remote directory. [[bug>2370]] |
| - | * Bug fix: Local custom commands that need session but no remote files were not disabled when session was not connected. | + | * Bug fix: List of network drives in drive drop down and directory tree did not always match. |
| - | * Bug fix: Correct letter case variant of remote directory in directory tree was not always selected. [[bug>1891]] | + | * Bug fix: Host key prompt did not have the default button. |
| - | * Bug fix: With no connected session, shared bookmarks modifications are not preserved. | + | * Bug fix: When the local path specified on Open directory/Location profile dialog is not existing, when browsing for a new path, the trailing part of the nonexisting path was appended to the new path. |
| - | * Bug fix: Using list header color appropriate for the actual light/dark column background color (list headers are not dark, unless system wide app dark mode is enabled). | + | * Bug fix: Trying to enter an invalid link in local panel fails silently. |
| - | * Bug fix: ''Session.ParseUrl'' cannot accept fingerprint parameter for sessions over TLS. [[bug>1925]] | + | * Bug fix: After FTP data connection fails to open further use of the session is broken. |
| - | * Bug fix: Custom command patterns ''!S''/''!E'' do not include fingerprint of TLS certificate. | + | * Bug fix: Pasting cut files from the clipboard into a local panel copies them instead of moving them. [[bug>2400]] |
| - | * Bug fix: Cannot work with filenames ending with space with FTP protocol. [[bug>1900]] | + | * Bug fix: Some edits did not save their value to history when submitting with ''Enter''. |
| - | * Bug fix: Canceling remote path drop down did not reset it back to the current path. | + | * Bug fix: Too long edit history dropdown can overflow monitor bounds. [[bug>2432]] |
| - | * Bug fix: Folders in a drive root showed incorrect type name sometimes. | + | * Bug fix: Message box texts and some control labels are not visible to screen readers. [[bug>2413]] |
| - | * Bug fix: Customizing custom commands from Synchronization checklist window was not working. [[bug>1908]] | + | * Bug fix: Failure when clicking tab close button while the session is already being closed. [[bug>2416]] |
| - | * Bug fix: Whole local drive could have been scanned when trying to browse to non-existing or hidden folders. | + | |
| - | * Bug fix: Timed out status bar note was not added to history popup box, while a session is disconnected. | + | |
| - | * Bug fix: //Duplicate// command in remote file context menu operated over selected files instead of the focused file. | + | |
| - | * Bug fix: *nix shell special characters were unintentionally escaped in PuTTY/SSH terminal command patterns. [[bug>1906]] | + | |
| - | ===== [[5.17.10]] 5.17.10 ((2021-01-26)) ===== | + | ===== [[6.5.9]] 6.5.9 (not released yet) ((2026-09-10)) ===== |
| - | * Back-propagated security fixes from 5.18.1 release: | + | * Back-propagated fixes from 6.6.4 release: |
| - | * TLS/SSL core upgraded to OpenSSL 1.1.1i. | + | * Bug fix: Invalid language code for Serbian was used for Microsoft Store package. [[bug>2460]] |
| - | * Bug fix: Prevent loading session settings that can lead to remote code execution from handled URLs. [[bug>1943]] | + | |
| - | ===== [[5.17.9]] 5.17.9 ((2020-11-20)) ===== | + | ===== [[6.5.8]] 6.5.8 ((2026-09-10)) ===== |
| - | * Translation updated: German. | + | * This is Microsoft Store-only release that fixes packaging problem of 6.5.7. The actual binaries are still 6.5.7. |
| - | * Bug fix: Failure when using S3/AWS access ID or region longer than 32 characters. [[bug>1914]] | + | ···* Bug fix: Cannot install from Microsoft Store because of invalid 'sr' language. [[bug>2460]] |
| - | ·* Bug fix: Failure when opening some menus while having long text of specific length copied to the Clipboard. [[bug>;1915]] | + | |
| - | ··* Bug fix: Failure when directory contains a file with too long name. [[bug>1924]] | + | |
| - | ===== [[5.17.8]] 5.17.8 ((2020-10-15)) ===== | + | ===== [[6.5.7]] 6.5.7 ((2026-09-09)) ===== |
| - | * TLS/SSL core upgraded to OpenSSL 1.1.1h. | + | * Translations completed: Croatian, Finnish, Georgian, Italian and Serbian, and updated: Slovenian. |
| - | * Allow using Windows Store apps aliases as terminals (particularly Windows Terminal). [[bug>1901]] | + | ··* TLS/SSL core upgraded to OpenSSL 3.3.7. |
| - | * Limiting error report and message search URLs to 4 KB, as larger URLs fail to open in some browsers. | + | * SSH private key tools (PuTTYgen and Pageant) upgraded to [[&url(puttychanges)|PuTTY 0.85]]. SSH core upgraded to include some fixes. \\ It brings the following change: |
| - | ·* SSH private key tools (PuTTYgen and Pageant) upgraded to PuTTY 0.74. | + | * Security issue: fixed a remotely triggerable use-after-free in Pageant. [[pbug>pageant-deferred-decryption-uaf]] |
| - | * Bug fix: ''Session.CompareDirectories'' handles incorrectly files with names containing reserved XML characters. [[bug>1897]] | + | * Security issue: fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. [[pbug>etm-large-packet-overflow]] |
| - | * Bug fix: //Keep local directory up to date// extension fails if error occurs before session URL is parsed. | + | ···* Security issue: fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. [[pbug>argon2-parameter-checks]] |
| - | ··* Bug fix: SFTP uploads started over already disconnected session do not reconnect automatically. [[bug>1913]] | + | * Denial-of-service security fixes: a server can trigger a tight loop in WinSCP, and even a MITM can make it consume unlimited memory at startup. [[pbug>maxpkt-0-tight-loop]] |
| + | ···* Security issue: fixed a remotely triggerable double-free in RSA key exchange. [[pbug>rsakex-double-free]] | ||
| + | * Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. [[pbug>ecdsa-remotely-triggerable-assertion]] | ||
| + | * Back-propagated fixes from 6.6.2 beta release: | ||
| + | ····* Bug fix: Failure setting ''Session.DebugLogPath'' when running in impersonated context. [[bug>2441]] | ||
| + | * Bug fix: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. CVE-2026-45447 fix from OpenSSL 3.4.6. | ||
| - | ===== [[5.17.7]] 5.17.7 ((2020-07-24)) ===== | + | ===== [[6.5.6]] 6.5.6 ((2026-03-25)) ===== |
| - | * WebDAV core upgraded to neon 0.31.2. | + | * Translations completed: Macedonian, and updated: Lithuanian, and Russian. |
| - | · * Security fix from [[&url(puttychanges)|PuTTY 0.74]]: If an SSH server accepted an offer of a public key and then rejected the signature, WinSCP could access freed memory, if the key had come from an SSH agent. [[pbug>vuln-agent-keylist-used-after-free]] | + | * TLS/SSL core upgraded to OpenSSL 3.3.6. |
| - | * Displaying progress of synchronization in //Keep local directory up to date// extension. [[bug>1887]] | + | * Back-propagated improvements from 6.6–6.6.1 beta release: |
| - | * Displaying session name and operation status in console title of //Keep local directory up to date// extension. [[bug>1888]] | + | ···* New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries. |
| - | * Translation updated: German. | + | ···* XML parser upgraded to Expat 2.7.5. |
| - | ·* Removed workaround for lack of support for ''max-keys'' parameter in Backblaze S3 API, as it is supported now. [[bug>1871]] | + | ···* Support for Beyond Compare 5 in Compare Files extension. [[bug>2417]] |
| - | ·* Bug fix: Failure while changing path using path label while another command was executing already. [[bug>1877]] | + | ···* Bug fix: Checking if edited/opened file was modified externally didn't work for inactive sessions. [[bug>2426]] |
| - | * Bug fix: Failure when system settings change during synchronization. [[bug>1879]] | + | |
| - | ·* Bug fix: Failure when trying to close WinSCP while reading a remote directory. [[bug>1880]] | + | |
| - | ·* Bug fix: Failure after using files from a disconnected session (for example saving an edited file). [[bug>1881]] | + | |
| - | * Bug fix: Directory reading cannot be cancelled for SFTP servers that provide optional ''end-of-list'' field. [[bug>1883]] | + | |
| - | * Bug fix: Going to root folder in the local panel does not update selection in the directory tree. | + | |
| - | ===== [[5.17.6]] 5.17.6 ((2020-05-28)) ===== | + | ===== [[6.5.5]] 6.5.5 ((2025-11-19)) ===== |
| - | * Added new ''af-south-1'' and ''eu-south-1'' AWS regions. [[bug>1864]] | + | * Translation updated: Vietnamese. |
| - | ··* Translation updated: Brazilian Portuguese. | + | * Bug fix: Pasting files using local directory tree context menu pastes them to the current directory, instead of the selected one. |
| - | * Not defaulting to Documents folder on a network drive even if it is mapped. [[bug>1869]] | + | * Bug fix: Failure when opening site imported from PuTTY with unsupported SSH proxy. [[bug>2407]] |
| - | * Workaround for lack of support for ''max-keys'' parameter in Backblaze S3 API. [[bug>1871]] | + | * Bug fix: Incorrect hostname validation when connecting to S3 endpoint with certificate that does not cover root S3 hostname. [[bug>2409]] |
| - | * Installer upgraded to Inno Setup 6.0.5. | + | |
| - | * Change: Installer does not support Windows Vista/2008 anymore. | + | |
| - | * Bug fix: Transfer settings are not preserved when starting synchronization in new window. | + | |
| - | * Bug fix: //Keep remote directory up to date// window cannot be restored after it was minimized to tray using //Minimize to System Tray// command, when the window was opened from command-line or using //Start in New Window// command. [[bug>1868]] | + | |
| - | * Bug fix: Starting synchronization in a new window should be disabled when //Selected files only// option is selected, as that combination is not implemented. [[bug>1870]] | + | |
| - | * Bug fix: Starting a synchronization in a new window does not work if the remote path consist of one level only. | + | |
| - | * Bug fix: Failure when canceling an authentication of an ad-hoc session from a workspace opened from command-line. [[bug>1875]] | + | |
| - | * Bug fix: GSSAPI key exchange authentication is off by default as it caused failures when old version of MIT Kerberos was installed on the machine. [[bug>1874]] | + | |
| - | ===== [[5.17.5]] 5.17.5 ((2020-04-27)) ===== | + | ===== [[6.5.4]] 6.5.4 ((2025-10-16)) ===== |
| - | * Translations completed: Brazilian Portuguese; and updated: German and Russian. | + | * Translations updated: Belarusian and Georgian. |
| - | * Bug fix: Failure when starting fresh installation on high DPI displays. [[bug>1862]] | + | * TLS/SSL core upgraded to OpenSSL 3.3.5. |
| - | + | * XML parser upgraded to Expat 2.7.3. | |
| - | ===== [[5.17.4]] 5.17.4 ((2020-04-24)) ===== | + | * Added new ''ap-southeast-6'' AWS region. |
| - | + | * Bug fix: When restored after operation completed while minimized the window is disabled. [[bug>2393]] | |
| - | * TLS/SSL core upgraded to OpenSSL 1.1.1g. | + | * Bug fix: Command ''md5sums'' is incorrectly used to calculate MD5 checksum instead of ''md5sum''. [[bug>2392]] |
| - | * WebDAV core upgraded to neon 0.31.1. | + | * Bug fix: Incomplete FTP upload when the source stream/stdin reads less than requested. [[bug>2395]] |
| - | * Local file panel honors preferred drop action of source application. [[bug>1848]] | + | * Bug fix: ''Shift''-clicking //OK// button on Synchronization checklist window when synchronization in the background was not possible still closed the window. |
| - | * Increased maximal length of proxy and tunnel credentials. [[bug>1849]] | + | * Bug fix: Failure after reloading file panel when number of files decreases. [[bug>2402]] |
| - | * Truncating too long directory names in session tab title. | + | * Bug fix: Failure or silently missing headers when when S3 request headers were too long. |
| - | * Optionally do not distinguish multiple sessions opened to the same site by current path. [[bug>1734]] | + | |
| - | * Bug fix: Failure when fallback SSH channel fails to open. [[bug>1845]] | + | |
| - | * Bug fix: Failure when creating shortcut for jumplist fails. [[bug>1846]] | + | |
| - | * Bug fix: Window position is not restored, if its left or top edge was aligned to monitor edge. [[bug>1852]] | + | |
| - | * Bug fix: Wrong layout of Login dialog on monitors with low vertical resolution. [[bug>1463]] | + | |
| - | * Bug fix: FTP file uploads are interrupting with TLS 1.3. [[bug>1834]] | + | |
| - | * Bug fix: Empty directories are not uploaded to FTP server when transferring in background. [[bug>1859]] | + | |
| - | * Bug fix: Percent sign (''%'') in PuTTY session settings (such as IPv6 scope syntax) is misinterpreted when importing. [[bug>1860]] | + | |
| - | * Bug fix: Failure when starting with automatic workspace opening when none of the workspace sites exist. [[bug>1861]] | + | |
| - | + | ||
| - | ===== [[5.17.3]] 5.17.3 ((2020-04-01)) ===== | + | |
| - | + | ||
| - | * TLS/SSL core upgraded to OpenSSL 1.1.1f. | + | |
| - | * WebDAV core upgraded to neon 0.31.0. | + | |
| - | * Installer upgraded to Inno Setup 6.0.4. | + | |
| - | * Translation updated: French. | + | |
| - | * Importing site-specific key files from FileZilla. [[bug>1841]] | + | |
| - | * Showing session name in Synchronization checklist and Keep remote directory up to date windows, when the operation was executed in a new window/from a command line. [[bug>1838]] | + | |
| - | * ''Session.ScanFingerprint'' now works even for Amazon S3 protocol. | + | |
| - | * Bug fix: Failure after resuming system from sleep. [[bug>1829]] | + | |
| - | * Bug fix: Option to disconnect a session was available even while deleting local files, and caused failure when selected while no session was actually opened. [[bug>1836]] | + | |
| - | * Bug fix: Failure when primary SSH channel fails to open. [[bug>1837]] | + | |
| - | * Bug fix: ''SHA-1'' fingerprint of TLS/SSL certificate was incorrectly presented as ''MD5'' by ''Session.ScanFingerprint''. | + | |
| - | * Bug fix: When dragging file via temporary directory it is deleted too early. [[bug>1844]] | + | |
| - | + | ||
| - | ===== [[5.17.2]] 5.17.2 ((2020-03-09)) ===== | + | |
| - | + | ||
| - | * Disabling TLS 1.3 by default until it is better tested. [[bug>1835]] | + | |
| - | * Bug fix: Cannot connect to SSH-1 servers. [[bug>1833]] | + | |
| - | * Bug fix: TLS session resumption is not working for FTP transfers with TLS 1.3. [[bug>1831]] | + | |
| - | + | ||
| - | ===== [[5.17.1]] 5.17.1 ((2020-02-27)) ===== | + | |
| - | + | ||
| - | * Bug fix: Confirmation to close WinSCP does not have a help page associated (to explain the workspace). [[bug>1825]] | + | |
| - | * Bug fix: Failure when loading extension with filename containing some special characters (like a dash). [[bug>1826]] | + | |
| - | * Bug fix: SCP fallback is no longer working. [[bug>1827]] | + | |
| - | * Bug fix: Path on Address bar of Explorer interface cannot be submitted. [[bug>1828]] | + | |
| - | * Bug fix: Cannot use TLS/SSL client certificate. [[bug>1830]] | + | |
| - | * Bug fix: TLS/SSL client certificate could be configured for S3 protocol even though it is not supported. | + | |
| - | + | ||
| - | ===== [[5.17]] 5.17 ((2020-02-18)) ===== | + | |
| - | + | ||
| - | * Optionally using ''Ctrl+F4'' to close session tab. [[bug>1823]] | + | |
| - | + | ||
| - | ===== [[5.16.7]] 5.16.7 RC ((2020-02-13)) ===== | + | |
| - | + | ||
| - | * New DigiCert EV code signing certificate valid until February 2023 is used for signing binaries. | + | |
| - | * Ignoring incorrect timestamps in ''MDTM'' response, while autodetecting timezone difference. [[bug>1818]] | + | |
| - | * Storage configuration on Preferences dialog handles INI files specified on a command-line better. | + | |
| - | * Added an example for using Win32-OpenSSH ''ssh.exe'' as an SSH terminal. [[bug>1822]] | + | |
| - | * It is possible to configure TLS 1.3 restrictions. | + | |
| - | * Bug fix: Using directory exclude mask while searching caused all non excluded folder to be unintentionally included in the search results. | + | |
| - | * Bug fix: It is not possible to recursively search for a folder. [[bug>1819]] | + | |
| [[history_old|Older versions]] | [[history_old|Older versions]] | ||
| ~~NOTOC~~ | ~~NOTOC~~ | ||
| ~~ARCHIVE=history_old~~ | ~~ARCHIVE=history_old~~ | ||