Differences
This shows you the differences between the selected revisions of the page.
| history 2025-11-27 | history 2026-06-15 16:07 (current) | ||
| Line 3: | Line 3: | ||
| This is a full list of changes for each release of WinSCP. See also [[project_history|Project history]] and [[incompatible_changes|Incompatible changes between versions]]. | This is a full list of changes for each release of WinSCP. See also [[project_history|Project history]] and [[incompatible_changes|Incompatible changes between versions]]. | ||
| - | ===== [[6.6]] 6.6 (not released yet) ((2025-11-27)) ===== | + | ===== [[6.6.2]] 6.6.2 (not released yet) ((2026-06-15)) ===== |
| + | |||
| + | * Experimental 64-bit version of WinSCP. [[bug>618]] | ||
| + | * Optionally not showing error message when connection is lost while idle. [[bug>2360]] | ||
| + | * SSH core and SSH private key tools (PuTTYgen and Pageant) upgraded to [[&url(puttychanges)|PuTTY 0.84]]. \\ It brings the following change: | ||
| + | * Security issue: fixed a remotely triggerable double-free in RSA key exchange. [[pbug>rsakex-double-free]] | ||
| + | * Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. [[pbug>ecdsa-remotely-triggerable-assertion]] | ||
| + | * Bug fix: spurious //"Network error: Socket is not connected"// when authenticating to some HTTP proxies. [[pbug>http-proxy-auth-wsaenotconn]] | ||
| + | * TLS/SSL core upgraded to OpenSSL 3.5.7. | ||
| + | * XML parser upgraded to Expat 2.8.1. | ||
| + | * Restored faster C TLS/SSL AES implementation. | ||
| + | * Configurable warning when opening large file in an internal editor. [[bug>2437]] | ||
| + | * Informing that when preserving directory timestamps is enabled, using multiple connections for transfer is not possible. [[bug>2439]] | ||
| + | * Warning when pasting a session URL with unsafe settings. | ||
| + | * When opening session in PuTTY to a host for which WinSCP has multiple host keys cached, using the last key or the key that PuTTY has cached. [[bug>2440]] | ||
| + | * Always (re)registering drag&drop shell extension during installation, even when the extension is not replaced. | ||
| + | * Allowed Console interface tool to have ''.exe'' extension to avoid false positive detections by some antiviruses. [[bug>2434]] | ||
| + | * Using //"username"// and //"hostname"// as one word. | ||
| + | * Reading all system settings from 64-bit registry. | ||
| + | * Allow assigning ''null'' to ''Session.SessionLogPath''. [[bug>2438]] | ||
| + | * Avoiding using ''SSH_FXF_EXCL'' together with ''SSH_FXF_TRUNC'' SFTP file opening flags. [[bug>2444]] | ||
| + | * Optimized file system monitoring when looking for dummy directory during drag&drop downloads. [[bug>2445]] | ||
| + | * Change: Not allowing WebDAV redirects to other hosts by default. [[bug>2447]] | ||
| + | * Change: Not allowing WebDAV redirects to an unencrypted URL by default. [[bug>2448]] | ||
| + | * Bug fix: Failure when trying to connect via HTTP proxy to FTP host with excessively long login details. [[bug>2435]] | ||
| + | * Bug fix: Buffer overflow in Console interface tool. [[bug>2436]] | ||
| + | * Bug fix: Failure setting ''Session.DebugLogPath'' when running in impersonated context. [[bug>2441]] | ||
| + | * Bug fix: Message boxes from secondary windows (like the internal editor) caused application to move to the background when when the main window was minimized. [[bug>2443]] | ||
| + | * Bug fix: Heap over-read via crafted encrypted filename. [[bug>2449]] | ||
| + | * Bug fix: Slashes in filenames can cause path traversal when invalid filename characters replacement is disabled. [[bug>2450]] | ||
| + | |||
| + | ===== [[6.6.1]] 6.6.1 beta ((2026-04-01)) ===== | ||
| + | |||
| + | * Support for OpenSSH ssh-agent. [[bug>1682]] | ||
| + | * Optionally connecting all workspace/folder sessions immediately. [[bug>1026]] | ||
| + | * Preserving panel scroll position after rename. [[bug>2425]] | ||
| + | * ''Ctrl+C'' works in list views on 'Server and protocol information' dialog. | ||
| + | * Preventing moving or copying a file or folder over ancestor folder with the same name. [[bug>2427]] | ||
| + | * WebDAV/HTTP core upgraded to neon 0.37.1. | ||
| + | * XML parser upgraded to Expat 2.7.5. | ||
| + | * Bug fix: Some menus were not working on displays to the left or above the primary display. [[bug>2423]] | ||
| + | * Bug fix: Mouse wheel downwards scrolling did not work on toolbar drop down lists. | ||
| + | * Bug fix: Once any control of permissions popup box was focused the popup no longer closed when user clicked outside of it. | ||
| + | * Bug fix: Failure when closing Transfer settings dialog with //X// button while a permissions popup box control is focused. [[bug>2420]] | ||
| + | * Bug fix: Failure when switching to a session that is being reconnected. | ||
| + | * Bug fix: Failure when the first bit of an SFTP response is set. [[bug>2422]] | ||
| + | * Bug fix: Copying to clipboard with ''Ctrl+C'' from 'Server and protocol information' was broken. | ||
| + | * Bug fix: Protocol additional information scrolling was broken. | ||
| + | * Bug fix: Master password dialog was missing //Help// button. | ||
| + | * Bug fix: Checking if edited/opened file was modified externally didn't work for inactive sessions. [[bug>2426]] | ||
| + | * Bug fix: Wrapped settings values from Raw Site Settings dialog were not preserved. | ||
| + | * Bug fix: Some files modified by local custom command in SCP session fail to upload back. [[bug>2428]] | ||
| + | * Bug fix: Whole //Key exchange// page was incorrectly hidden when //"Handles SSH key re-exchange badly"// bug was enabled. | ||
| + | * Bug fix: Some message boxes leak GDI handle. [[bug>2430]] | ||
| + | * Bug fix: Login dialog leaks GDI handles. [[bug>2431]] | ||
| + | |||
| + | ===== [[6.6]] 6.6 beta ((2026-02-02)) ===== | ||
| * Synchronize two local directories. [[bug>2020]] | * Synchronize two local directories. [[bug>2020]] | ||
| Line 19: | Line 75: | ||
| * Optimized GUI when working with large subdirectory selection. [[bug>2396]] | * Optimized GUI when working with large subdirectory selection. [[bug>2396]] | ||
| * Change: Default to UTF-8 encoding in internal editor. [[bug>2397]] | * Change: Default to UTF-8 encoding in internal editor. [[bug>2397]] | ||
| - | * TLS/SSL core upgraded to OpenSSL 3.5.4. | + | * New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries. |
| + | ··* TLS/SSL core upgraded to OpenSSL 3.5.5. | ||
| * WebDAV/HTTP core upgraded to neon 0.36.0. | * WebDAV/HTTP core upgraded to neon 0.36.0. | ||
| - | * Installer upgraded to Inno Setup 6.4.2. | + | * XML parser upgraded to Expat 2.7.4. |
| + | ··* Installer upgraded to Inno Setup 6.7.0 with dark mode support enabled. | ||
| * Increased WinSCP memory limit to 4 GB. [[bug>2412]] | * Increased WinSCP memory limit to 4 GB. [[bug>2412]] | ||
| + | * Defined and implemented interface for the .NET library. By @mjkent. [[bug>856]] | ||
| * Optimized TLS/SSL AES implementation. | * Optimized TLS/SSL AES implementation. | ||
| * Restoring ability to restart Explorer to allow upgrade of drag&drop shell extension, when installing for current user, as after-restart replacement is not possible without Administrator privileges. [[bug>2381]] | * Restoring ability to restart Explorer to allow upgrade of drag&drop shell extension, when installing for current user, as after-restart replacement is not possible without Administrator privileges. [[bug>2381]] | ||
| * MSI toolset updated to WiX 5. | * MSI toolset updated to WiX 5. | ||
| * Commands to copy paths to the clipboard on the Synchronization checklist window. | * Commands to copy paths to the clipboard on the Synchronization checklist window. | ||
| + | * Cryptography optimization. | ||
| * Support long AWS/S3 session tokens. [[bug>2403]] | * Support long AWS/S3 session tokens. [[bug>2403]] | ||
| * Prevent hang when new device is attached or removed while some mapped network drive is not available. [[bug>2382]] | * Prevent hang when new device is attached or removed while some mapped network drive is not available. [[bug>2382]] | ||
| Line 35: | Line 95: | ||
| * Provide SNI when opening FTP data connection. [[bug>2410]] | * Provide SNI when opening FTP data connection. [[bug>2410]] | ||
| * Optimized synchronization checklist sorting. | * Optimized synchronization checklist sorting. | ||
| + | * Support for Beyond Compare 5 in Compare Files extension. [[bug>2417]] | ||
| * Convert unsupported SSH proxy to SSH tunnel when importing site from PuTTY. [[bug>2408]] | * Convert unsupported SSH proxy to SSH tunnel when importing site from PuTTY. [[bug>2408]] | ||
| + | * FTP directory listing falls back to the other active/passive mode, consistently with file transfers. | ||
| * Consistently calling command to open window with specific directory //Explore//, instead of sometimes //Browse//. | * Consistently calling command to open window with specific directory //Explore//, instead of sometimes //Browse//. | ||
| * Consistently referring to file last modification timestamp column as //Date modified//. | * Consistently referring to file last modification timestamp column as //Date modified//. | ||
| Line 42: | Line 104: | ||
| * Made taskbar flashing configurable in GUI. [[bug>2411]] | * Made taskbar flashing configurable in GUI. [[bug>2411]] | ||
| * Control labels on transfer settings dialogs do not show keyboard accelerator cue, until ''Alt'' key is pressed. | * Control labels on transfer settings dialogs do not show keyboard accelerator cue, until ''Alt'' key is pressed. | ||
| + | * Not using drag images even with directory trees. [[bug>1274]] | ||
| * Allow configuring checksum commands. [[bug>2394]] | * Allow configuring checksum commands. [[bug>2394]] | ||
| * Updated to JCL library 2.8.1. | * Updated to JCL library 2.8.1. | ||
| Line 48: | Line 111: | ||
| * Opening //Default Apps// //Settings// page directly to open it in the foreground and avoid flashing //Control Panel// window. | * Opening //Default Apps// //Settings// page directly to open it in the foreground and avoid flashing //Control Panel// window. | ||
| * Improving order in which Windows Narrator reads window controls. | * Improving order in which Windows Narrator reads window controls. | ||
| - | * All edit boxes with history consistently do not auto complete as show 16 entries in the drop down. | + | * All edit boxes with history consistently do not auto complete and show 16 entries in the drop down. |
| + | * Removed obsolete //Preserve remote timestamp// session settings. | ||
| * Bug fix: Local file with invalid characters replaced could not be explored from the Synchronization checklist window. | * Bug fix: Local file with invalid characters replaced could not be explored from the Synchronization checklist window. | ||
| * Bug fix: Files modified by local custom command are not always uploaded to the correct remote directory. [[bug>2370]] | * Bug fix: Files modified by local custom command are not always uploaded to the correct remote directory. [[bug>2370]] | ||
| Line 58: | Line 122: | ||
| * Bug fix: Pasting cut files from the clipboard into a local panel copies them instead of moving them. [[bug>2400]] | * Bug fix: Pasting cut files from the clipboard into a local panel copies them instead of moving them. [[bug>2400]] | ||
| * Bug fix: Some edits did not save their value to history when submitting with ''Enter''. | * Bug fix: Some edits did not save their value to history when submitting with ''Enter''. | ||
| - | * Bug fix: Too long edit history dropdown can overflow monitor bounds. | + | * Bug fix: Too long edit history dropdown can overflow monitor bounds. [[bug>2432]] |
| * Bug fix: Message box texts and some control labels are not visible to screen readers. [[bug>2413]] | * Bug fix: Message box texts and some control labels are not visible to screen readers. [[bug>2413]] | ||
| + | * Bug fix: Failure when clicking tab close button while the session is already being closed. [[bug>2416]] | ||
| - | ===== [[6.5.6]] 6.5.6 (not released yet) ((2025-11-26)) ===== | + | ===== [[6.5.7]] 6.5.7 (not released yet) ((2026-06-12)) ===== |
| - | * Translation updated: Russian. | + | * Translations completed: Croatian, Finnish, Georgian, Italian and Serbian. |
| + | * TLS/SSL core upgraded to OpenSSL 3.3.7. | ||
| + | * Back-propagated fixes from 6.6.2 beta release: | ||
| + | * Bug fix: Failure setting ''Session.DebugLogPath'' when running in impersonated context. [[bug>2441]] | ||
| + | * Security issue: fixed a remotely triggerable double-free in RSA key exchange. [[pbug>rsakex-double-free]] | ||
| + | * Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. [[pbug>ecdsa-remotely-triggerable-assertion]] | ||
| + | * Bug fix: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. CVE-2026-45447 fix from OpenSSL 3.4.6. | ||
| + | |||
| + | ===== [[6.5.6]] 6.5.6 ((2026-03-25)) ===== | ||
| + | |||
| + | * Translations completed: Macedonian, and updated: Lithuanian, and Russian. | ||
| + | * TLS/SSL core upgraded to OpenSSL 3.3.6. | ||
| + | * Back-propagated improvements from 6.6–6.6.1 beta release: | ||
| + | * New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries. | ||
| + | * XML parser upgraded to Expat 2.7.5. | ||
| + | * Support for Beyond Compare 5 in Compare Files extension. [[bug>2417]] | ||
| + | * Bug fix: Checking if edited/opened file was modified externally didn't work for inactive sessions. [[bug>2426]] | ||
| ===== [[6.5.5]] 6.5.5 ((2025-11-19)) ===== | ===== [[6.5.5]] 6.5.5 ((2025-11-19)) ===== | ||
| Line 74: | Line 155: | ||
| ===== [[6.5.4]] 6.5.4 ((2025-10-16)) ===== | ===== [[6.5.4]] 6.5.4 ((2025-10-16)) ===== | ||
| - | * Translations updated: Georgian and Belarusian. | + | * Translations updated: Belarusian and Georgian. |
| * TLS/SSL core upgraded to OpenSSL 3.3.5. | * TLS/SSL core upgraded to OpenSSL 3.3.5. | ||
| * XML parser upgraded to Expat 2.7.3. | * XML parser upgraded to Expat 2.7.3. | ||
| Line 132: | Line 213: | ||
| * Translations completed: Belarusian, Brazilian Portuguese, Catalan, Czech, Dutch, Finnish, French, German, Hungarian, Italian, Japanese, Korean, Polish, Portuguese, Romanian, Russian, Simplified Chinese, Slovak, Spanish, Swedish, Tamil, Traditional Chinese and Turkish; updated: Norwegian; and started: Georgian. | * Translations completed: Belarusian, Brazilian Portuguese, Catalan, Czech, Dutch, Finnish, French, German, Hungarian, Italian, Japanese, Korean, Polish, Portuguese, Romanian, Russian, Simplified Chinese, Slovak, Spanish, Swedish, Tamil, Traditional Chinese and Turkish; updated: Norwegian; and started: Georgian. | ||
| * SSH core and SSH private key tools (PuTTYgen and Pageant) upgraded to [[&url(puttychanges)|PuTTY 0.83]]. \\ It brings the following change: | * SSH core and SSH private key tools (PuTTYgen and Pageant) upgraded to [[&url(puttychanges)|PuTTY 0.83]]. \\ It brings the following change: | ||
| - | * Bug fix: crash in Pageant if an SSH connection is abandoned while waiting for a deferred decryption passphrase. | + | * Bug fix: crash in Pageant if an SSH connection is abandoned while waiting for a deferred decryption passphrase. [[pbug>pageant-aborted-decrypt-crash]] |
| * TLS/SSL core upgraded to OpenSSL 3.3.3. | * TLS/SSL core upgraded to OpenSSL 3.3.3. | ||
| * Installer upgraded to Inno Setup 6.4.1. | * Installer upgraded to Inno Setup 6.4.1. | ||
| Line 142: | Line 223: | ||
| * Bug fix: //Columns > Reset layout// command does not reset width of by-default hidden columns. [[bug>2347]] | * Bug fix: //Columns > Reset layout// command does not reset width of by-default hidden columns. [[bug>2347]] | ||
| * Bug fix: Some translation file were duplicitously interpreted as another additional language. | * Bug fix: Some translation file were duplicitously interpreted as another additional language. | ||
| - | * Bug fix: Unicode contents in web sources was incorrectly decoded | + | * Bug fix: Unicode contents in web sources was incorrectly decoded. |
| * Bug fix: Intermediate translation ''.islu'' files were included in MSI installer. | * Bug fix: Intermediate translation ''.islu'' files were included in MSI installer. | ||
| * Bug fix: Monospace font is not remembered if SSH banners are administratively forced. | * Bug fix: Monospace font is not remembered if SSH banners are administratively forced. | ||
| Line 263: | Line 344: | ||
| * Bug fix: Caption of permissions group labels disappears when hovered over on Windows 11. | * Bug fix: Caption of permissions group labels disappears when hovered over on Windows 11. | ||
| - | ===== [[6.3.8]] 6.3.8 (not released yet) ((2025-10-31)) ===== | + | (*===== [[6.3.9]] 6.3.9 (hotfix) ((2026-06-01)) =====*) |
| + | (**) | ||
| + | (* * Back-propagated fix from 6.6.2 beta release:*) | ||
| + | (* * Security issue: fixed a remotely triggerable double-free in RSA key exchange. [[pbug>rsakex-double-free]]*) | ||
| + | (* * Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. [[pbug>ecdsa-remotely-triggerable-assertion]]*) | ||
| + | (**) | ||
| + | ===== [[6.3.8]] 6.3.8 (hotfix) ((2026-04-08)) ===== | ||
| * TLS/SSL core upgraded to OpenSSL 3.2.6. | * TLS/SSL core upgraded to OpenSSL 3.2.6. | ||
| - | * Back-propagated fixes from 6.4.3–6.5.5 releases: | + | * Back-propagated fixes from 6.4.3–6.5.6 releases: |
| + | * New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries. | ||
| * Change: Skipping symlinks in //Search for Text// extension. [[bug>2365]] | * Change: Skipping symlinks in //Search for Text// extension. [[bug>2365]] | ||
| - | * XML parser upgraded to Expat 2.7.3. | + | * XML parser upgraded to Expat 2.7.5. |
| * Bug fix: Local directories sometimes cannot be deleted. [[bug>2380]] | * Bug fix: Local directories sometimes cannot be deleted. [[bug>2380]] | ||
| * Bug fix: Failure or silently missing headers when when S3 request headers were too long. | * Bug fix: Failure or silently missing headers when when S3 request headers were too long. | ||
| * Bug fix: Incorrect hostname validation when connecting to S3 endpoint with certificate that does not cover root S3 hostname. [[bug>2409]] | * Bug fix: Incorrect hostname validation when connecting to S3 endpoint with certificate that does not cover root S3 hostname. [[bug>2409]] | ||
| - | |||
| - | ===== [[6.3.7]] 6.3.7 ((2025-02-20)) ===== | ||
| - | |||
| - | * Translation completed: Belarusian. | ||
| - | * TLS/SSL core upgraded to OpenSSL 3.2.4. | ||
| - | * Back-propagated fixes and improvements from upcoming 6.4.2 beta release: | ||
| - | * Added new ''ap-southeast-7'' and ''mx-central-1'' AWS regions. | ||
| - | * Bug fix: Failure when opening two SSH sessions at the same time. [[bug>2334]] | ||
| - | * Bug fix: Tunneled session password is not remembered. [[bug>2335]] | ||
| - | * Bug fix: Stray ''set'' command in source code package build script. [[bug>2340]] | ||
| - | * Bug fix: Source code package build script exits parent ''cmd'' console on error. [[bug>2341]] | ||
| - | |||
| - | ===== [[6.3.6]] 6.3.6 ((2024-11-25)) ===== | ||
| - | |||
| - | * Back-propagated improvements and fixes from 6.4.1 beta and 6.4.2 beta releases: | ||
| - | * Compatibility with new OneDrive WebDAV interface. [[bug>2321]] | ||
| - | * XML parser upgraded to Expat 2.6.3. | ||
| - | * Added new ''ap-southeast-5'' AWS region. | ||
| - | * Bug fix: After delete operation is moved to background, some operations (notably editing) do not work anymore. [[bug>2319]] | ||
| - | * Bug fix: ''Shift+Ctrl+P'' keyboard shortcut on Login dialog to open site in PuTTY without closing the dialog does not work. [[bug>2320]] | ||
| - | * Bug fix: Hang when trying to open an inaccessible drive from drive drop down menu. | ||
| - | * Translations completed: Danish, and updated: Belarusian. | ||
| [[history_old|Older versions]] | [[history_old|Older versions]] | ||
| ~~NOTOC~~ | ~~NOTOC~~ | ||
| ~~ARCHIVE=history_old~~ | ~~ARCHIVE=history_old~~ | ||