rustconn (0.23.15-1) unstable; urgency=medium

  * Version bump to 0.23.15
  * Fixed: the mouse pointer no longer vanishes on the "Session disconnected"
    screen after a remote RDP box reboots - the embedded RDP viewer now forces
    the default arrow on disconnect regardless of the cursor state the session
    ended in (issue #383)
  * Fixed: same invisible-pointer fix applied to the embedded VNC reconnect
    banner, restored centrally in the state-change handler
  * Changed: removed stale editor backup files (*.bak) from the source tree
  * Updated: inout 0.2.3 to 0.2.4 (clears a yanked-version warning), zip,
    openh264, lzma-rust2, zstd and several compatible dependencies

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 17 Oct 2026 00:00:00 +0000

rustconn (0.23.14-1) unstable; urgency=medium

  * Version bump to 0.23.14
  * Fixed: password login no longer fails on servers that offer both
    keyboard-interactive and password - the SSH_ASKPASS helper no longer
    deletes the secret file after its first read, so the per-method second
    prompt still finds the password (issue #382)
  * Changed: development toolchain pinned to Rust 1.99.0 (was 1.97.1); MSRV
    unchanged at 1.95. Fixed two newly-stabilised clippy lints surfaced by the
    bump
  * Updated: inout 0.2.2 to 0.2.3

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 15 Oct 2026 00:00:00 +0000

rustconn (0.23.13-1) unstable; urgency=medium

  * Version bump to 0.23.13
  * Added: expand and collapse sidebar groups with the arrow keys, RTL-aware
    (issue #380)
  * Added: optional drag-to-resize for the sidebar - one Sidebar width value
    (180-500, default 320) that both Settings and the opt-in drag rewrite, the
    handle hidden when the option is off (issue #3)
  * Fixed: Bitwarden root-search now finds an entry titled by the leaf of a
    slash-separated connection name (issue #353)
  * Updated: rustls, sha2, tokio, zip and several compatible dependencies

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 14 Oct 2026 00:00:00 +0000

rustconn (0.23.12-1) unstable; urgency=medium

  * Version bump to 0.23.12
  * Added: Sidebar row spacing and text size are now adjustable, independent of
    Compact interface (issue #379)
  * Changed: Quick Connect uses idiomatic Adwaita rows
  * Fixed: Quick Connect is now keyboard-first - the Host field is focused on
    open and Enter connects from any field
  * Fixed: split-pane colour 1 (green) and 5 (pink) now match across the panel
    border, tab stripe and sidebar marker
  * Fixed: the sidebar connecting-status icon has a single, correct colour
  * Fixed: the Monitoring activity-timer spins grey out when the mode does not
    use them
  * Fixed: three user actions that failed silently now report the failure -
    saving a tunnel, deleting a snippet, and toggling hardware video
    acceleration
  * Dependencies: zip 8.6.0->9.0.2 plus semver-compatible aws-lc-rs, aws-lc-sys,
    libz-sys and syn bumps

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 13 Oct 2026 12:00:00 +0300

rustconn (0.23.11-1) unstable; urgency=medium

  * Version bump to 0.23.11
  * Fixed: opening a Local Shell as the second pane of a fresh RDP split no
    longer crashes - the host-tab restore and focus grab are deferred to the
    next idle so GTK finishes reparenting the new VTE before focus is touched,
    breaking a Wayland use-after-free
  * Documentation: documented running ChromaTerm and other output filters from a
    sandboxed build via flatpak-spawn --host (issue #343)
  * Documentation: clarified the snap's external FreeRDP client and added a
    core26 migration checklist to snapcraft.yaml and docs/SNAP.md (issue #342)
  * Updated: cc 1.7.0->1.8.0, serde_json 1.0.152->1.0.154, syn 3.0.7->3.0.8,
    unicode-ident 1.0.26->1.0.27, zopfli 0.8.3->0.8.4

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 12 Oct 2026 12:00:00 +0300

rustconn (0.23.10-1) unstable; urgency=medium

  * Version bump to 0.23.10
  * Added: "Move to New Window" for a split-view pane, as a corner button and a
    context-menu item (Shift+F10), composing the existing Remove-from-Split and
    detach-session paths
  * Fixed: the split-pane controls no longer sit on top of the RDP/VNC session
    toolbar - they moved to the vertical centre of the pane's right edge, and
    the revealed buttons stack vertically
  * Fixed: snippet variable prompts now list fields in template order via one
    canonical extractor shared by the GUI and the snippet manager
  * Fixed: the split-pane reveal arrow now meets the HIG 44x44 touch-target
    minimum
  * Fixed: a session recording that fails to start now shows an error toast
    instead of only logging
  * Fixed: embedded RDP/VNC status now carries a shape (glyph), not colour
    alone, for grayscale and colour-vision accessibility
  * Changed: the split-pane and session-toolbar reveal handles rest a little
    more transparently; the two floating-control settings have clearer wording

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 11 Oct 2026 22:50:00 +0300

rustconn (0.23.9-1) unstable; urgency=medium

  * Version bump to 0.23.9
  * Fixed: RDP now connects to KRdp / NLA-less Linux hosts that reject the
    embedded client's CredSSP by handing the session once to external FreeRDP
    pinned to TLS (/sec:tls), matching Remmina (issue #366)
  * Fixed: an RDP tab no longer hangs on "Starting RDP..." / "running in
    external window" after the external client closes (issue #366)
  * Fixed: the embedded Wayland FreeRDP fallback now honours the security layer
    and NLA switches
  * Fixed: the deprecated wlfreerdp client is now tried last in a Wayland
    session, after XWayland, because it SIGSEGVs against KDE KRdp (issue #366)
  * Dependencies: serde_json 1.0.151->1.0.152, proptest 1.11.0->1.12.0,
    bit-set 0.8.0->0.11.1, bit-vec 0.8.0->0.10.1, rand_xorshift 0.4.0->0.5.0

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 11 Oct 2026 12:00:00 +0300

rustconn (0.23.8-1) unstable; urgency=medium

  * Version bump to 0.23.8
  * Fixed: recording rename/delete/list failures are surfaced in a modal dialog
    or status page instead of a silent tracing warning
  * Fixed: tunnel stop and delete-save failures are no longer silent - a stop
    failure shows a toast and a failed delete-save raises a modal dialog
  * Fixed: adding an SSH key reports failure in a modal dialog, not a toast,
    matching its sibling failure paths
  * Fixed: the "Enable Cloud Sync?" confirmation now defaults to Cancel so Enter
    has a defined, safe action
  * Fixed: the new-theme name prompt keeps Create disabled until the name is
    non-empty, so it can no longer be dismissed into a silent no-op
  * Fixed: the Theme Editor dialog is wide enough to read its colour rows
  * Fixed: the on-startup "open a connection" picker is now type-to-search
  * Changed: Terminal/Interface settings rows migrated to native adw::SpinRow and
    adw::ComboRow; connection password and Variables secret fields migrated to
    revealable native password rows
  * Changed: embedded RDP/VNC status/placeholder screens follow the light/dark
    theme instead of a fixed dark background
  * Changed: split-view pane actions gained a keyboard and hidden-header route
    (Shift+F10 / Menu) per the GNOME HIG
  * Changed: window minimum height lowered to the HIG 360x294 phone-portrait floor
  * Changed: writing-style polish in Settings (System information, consistent
    startup-action header caps)
  * Dependencies: cc 1.6.0->1.7.0, smallvec 1.16.2->1.16.3, syn 3.0.6->3.0.7,
    uuid 1.27.0->1.28.0; advisories clean

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 10 Oct 2026 18:00:00 +0300

rustconn (0.23.7-1) unstable; urgency=medium

  * Version bump to 0.23.7
  * Added: setting to hide the split-pane hover controls - a new Settings >
    Interface > Window toggle hides the top-right hover-reveal arrow on split
    panes; off by default, independent of the connection-name labels, applied
    live (#374)
  * Fixed: the sidebar's per-session controls (Close, Remove from Split, Move to
    New Window) are hidden when a connection has two or more live sessions, since
    they would act on an arbitrary one; they remain per-tab where each targets its
    own session (#374)
  * Fixed: sidebar Close is now offered for any connected session, routed through
    the same close-tab-by-id teardown, and no longer styled destructive - only
    Delete stays red (#374)
  * Fixed: a re-split after closing a split's owner tab no longer leaves a dead,
    actionless pane - stale per-session bridge entries are dropped and a panel
    with no resolvable content falls back to the empty placeholder
  * Changed: sidebar action toolbars restyled to match GNOME Files - no divider
    above the bottom row, icons spread evenly, flat Select Connections buttons,
    multi-select moved to the bottom toolbar, Create Cluster dropped from the bar
    (#374)
  * Changed: split-pane close/detach controls follow the GNOME HIG instead of a
    hover-only reveal - a pane-header context menu with a long-press equivalent,
    the hover arrow kept as an independent fallback with a close confirmation,
    sidebar split/window actions, and the dead Move to New Window removed from
    split tabs (#374)
  * Dependencies: updated tokio-util 0.7.19->0.7.20, toml 1.1.7->1.1.8, toml_edit
    0.25.16->0.25.17, toml_parser 1.1.4->1.1.5, zstd-sys 2.1.0->2.1.1; advisories
    clean

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 10 Oct 2026 12:00:00 +0300

rustconn (0.23.6-1) unstable; urgency=medium

  * Version bump to 0.23.6
  * Added: OSC 52 remote-clipboard support, opt-in - a yank in a remote Neovim or
    tmux (set-clipboard external) can reach the local clipboard. Off by default;
    reads are never served, the payload is zeroized, and an enabled offer is kept
    out of the session transcript too (PR #372)
  * Added: Save Output - a terminal tab's right-click menu can write the session's
    full scrollback to a text file; in a split tab the focused pane is saved (#371)
  * Fixed: RDP Performance Mode now reaches the external FreeRDP client - a Speed
    profile emits -wallpaper/-themes to xfreerdp instead of being dropped, mirroring
    the embedded client and the .rdp exporter (#370)
  * Documentation: API docs no longer link to renamed or removed items; cargo
    doc now runs with -D warnings in CI
  * Dependencies: updated dirs 6.0->7.0, tray-icon 0.25.1->0.26.1, muda
    0.20.0->0.21.2; advisories clean

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 09 Oct 2026 12:00:00 +0300

rustconn (0.23.5-1) unstable; urgency=medium

  * Version bump to 0.23.5
  * Fixed: default ~/.ssh/config import now actually imports under Flatpak - the
    importer probes both the sandbox $HOME/.ssh and the real host ~/.ssh (via a
    new flatpak::host_home_dir helper), so the automatic SSH Config source no
    longer reports success while importing nothing (#368)
  * Fixed: import no longer claims success when it found nothing - an empty import
    now says "Nothing was imported" instead of "Successfully imported 0
    connection(s)" (#368)
  * Fixed: header bar height now matches other GNOME apps - the icon-only header
    button floor drops from 44px to libadwaita's native 34px, so the header is no
    longer taller than native on a pointer session (#369)
  * Fixed: the Shell button stays as an icon on a narrow window instead of
    disappearing, shrinking to icon-only rather than being dropped (#369)
  * Fixed: auto-compact no longer trips on a normal-height window - the height
    trigger is lowered from 800px to 600px (#369)
  * Changed: compact-interface settings polish - the auto-compact toggle is
    greyed out while manual compact is on, and compact header/sidebar tap targets
    stay touch-safe under auto-compact
  * Dependencies: updated serde_spanned, the toml parser family and the zerocopy
    pair (semver-compatible patch bumps); picky-krb held at 0.12.4 (0.12.5 breaks
    the pinned sspi 0.21.3)

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 08 Oct 2026 18:00:00 +0300

rustconn (0.23.4-1) unstable; urgency=medium

  * Version bump to 0.23.4
  * Added: a connection can request an Admin/console RDP session (/admin) - a
    per-connection switch in the RDP editor that connects to the server's console
    session (no RDS CAL), avoiding the licence exchange that fails embedded
    IronRDP; external FreeRDP only for now (#366)
  * Added: a pinned tab stays pinned across a restart - the session-restore
    snapshot now carries the tab's pin and reapplies it when the tab reopens
    (needs "Restore sessions on startup" enabled) (#367)
  * Fixed: vault root-search now matches a connection's name and host, not only
    its UUID, so KeePass/Bitwarden entries titled by hostname or display name are
    found (#353)
  * Dependencies: updated async-recursion, cc, font-types, mio, objc2, powerfmt,
    tokio and uuid (semver-compatible); picky-krb held at 0.12.4 (0.12.5 breaks
    the pinned sspi 0.21.3)

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 08 Oct 2026 13:00:00 +0300

rustconn (0.23.3-1) unstable; urgency=medium

  * Version bump to 0.23.3
  * Fixed: compact mode now actually shrinks the header bar on Linux - the 44 px
    tap-target floor moved from a Rust set_size_request to a CSS class, and a
    deliberate compact lowers it to 28 px (auto-compact keeps the 44 px target)
  * Fixed: compact-mode density made consistent for the Welcome rows, the sidebar
    bulk-actions bar and the banner note
  * Fixed: external FreeRDP no longer exits 255 after an embedded-client hand-off
    - the version probe timeout is raised to 5 s and a failed probe is no longer
    cached as unknown for the whole process
  * Fixed: the empty strip below the sidebar's bottom toolbar in compact mode is
    collapsed
  * Changed: the informational macOS Homebrew CI build is fixed and
    false-positive CI annotations are silenced (all non-gating)

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 07 Oct 2026 12:00:00 +0300

rustconn (0.23.2-1) unstable; urgency=medium

  * Version bump to 0.23.2
  * Fixed: the high-contrast tab-bar divider is neutralised on GTK < 4.22 too -
    the override now out-specifies libadwaita with a window tabbar .box selector
    instead of a prefers-contrast media query that old GTK rejected
  * Changed: compact mode density overhaul - header bars, toolbar buttons, tabs,
    sidebar rows, search entry, popovers and the monitoring bar all shrink, and
    the sidebar title is hidden
  * Changed: on macOS, dialog action buttons (Save, Test, Create, Rename, Move,
    Connect, Export, Import, Apply) move to the right side, away from the
    left-side window-close button
  * Dependencies: feature ladder raised (adw-1-10, gtk-4-24); Flatpak runtime
    GNOME 50 -> 51, bundled VTE 0.80.5 -> 0.84.1; Snap migrated to core26
    (libadwaita 1.8); CI runners pinned to ubuntu-26.04; want 0.3.1 -> 0.3.2
    (picky-krb held at 0.12.4: 0.12.5 breaks pinned sspi)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 06 Oct 2026 18:00:00 +0300

rustconn (0.23.1-1) unstable; urgency=medium

  * Version bump to 0.23.1
  * Added: a Local Shell tab can be named with Rename Tab...; the label is kept
    across Session Restore and workspace save (issue #365)
  * Added: a tab's group now survives Session Restore (connections from a saved
    workspace and SPICE with a pre-connect port check still restore ungrouped)
  * Added: opt-in directional tab-close items (Close to the Left/Right) behind a
    Settings switch, off by default
  * Changed: the tab context menu is lighter - the Copy block moved to the
    sidebar menu, and Monitor is now a submenu of radio modes
  * Changed: the tab bar's divider is painted in the window background tone so
    the bar reads as part of the window
  * Changed: New Connection, New Group, the Tools managers and Import/Export are
    back in the sidebar menu (beside the list they act on), not only in the main
    menu
  * Dependencies: spki 0.8.0 -> 0.8.1, zerocopy 0.8.59 -> 0.8.60 (picky-krb held
    at 0.12.4: 0.12.5 breaks pinned sspi)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 06 Oct 2026 12:00:00 +0300

rustconn (0.23.0-1) unstable; urgency=medium

  * Version bump to 0.23.0
  * Added: GNOME HIG sidebar/header redesign - two real panels each with its
    own headerbar, a hamburger menu grouping every list action, an optional
    hierarchy-path subtitle, and a Filter menu replacing the protocol pills
  * Added: read-only mode and search-from-root for every secret backend -
    Bitwarden, 1Password, Passbolt, pass and KeePass/kdbx (issue #353)
  * Added: on-demand Cisco OpenH264 download for H.264 RDP graphics, opt-in
    and consent-gated, effective on the next connection with no restart
    (issue #262)
  * Added: per-connection command macros and regex cluster auto-membership
  * Changed: CI/release hardening - cargo-nextest, feature-powerset and
    semver-checks jobs, a SHA256SUMS manifest and an embedded dependency SBOM
  * Fixed: the YubiKey touch cue now fires on KeePass reads (connect, password
    load, root-search), not only writes (issue #350)
  * Fixed: the RDP frame-statistics counter is fed from the real paint path, and a toast
    reports when H.264 falls back to RemoteFX (issue #262)
  * Fixed: the Welcome tab closes on the first real tab, not only the second
  * Fixed: group sync matches connections and subgroups by stable id, so a
    rename or move is an update rather than delete+recreate (issue #263)
  * Fixed: a deleted jump host is detected and warned about instead of silently
    going direct
  * Fixed: import/export round-trip fixes (native, Ásbrú, .rdp); the RDP
    Multipath TCP toggle reaches the client; CLI can set Kerberos NLA
    (issue #351)
  * Fixed: the stored password now reaches keyboard-interactive logins such as
    ESXi, not only OpenSSH's own password prompt, while still never answering a
    passphrase, OTP, sudo or password-change prompt (issue #364)
  * Fixed: the config forward-compat marker now covers every config file, and a
    startup crash when protocol filters were restored
  * Dependencies: updated async-recursion, cc, font-types, mio, objc2,
    powerfmt, tokio and uuid to their latest compatible versions

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 05 Oct 2026 14:00:50 +0300

rustconn (0.22.15-1) unstable; urgency=medium

  * Version bump to 0.22.15
  * Added: a Copy submenu for connections that lists only what a connection
    has: host, port, address, username, password (cleared after 30 s), SSH
    command and custom properties (issue #357)
  * Added: Edit Connection and Copy in a session tab's context menu
    (issue #357)
  * Added: a Zero Trust session whose cloud sign-in expired offers Log In to
    AWS, Google Cloud, Azure, OCI, Cloudflare, Teleport, Boundary or Hoop.dev
    and reconnects after a successful login
  * Added: keyboard passthrough hands Alt+Tab, Super and similar desktop
    shortcuts to an embedded RDP or VNC session; Super+Esc gives them back
    (issue #356)
  * Changed: fullscreen hides the tab bar together with the header bar; both
    slide in at the top edge (issue #354)
  * Changed: Copy Username and Copy Password moved into the Copy submenu
    (issue #357)
  * Fixed: smart-folder Edit, Wake On LAN, Check if Online and Delete act on
    the right-clicked connection instead of the previous selection
  * Fixed: the Fullscreen checkmark follows the window, and the revealed
    fullscreen header has an opaque background (issue #354)
  * Fixed: keyboard passthrough no longer lets the tab bar take Ctrl+Tab,
    Ctrl+Page Up/Down and Alt+digit (issue #356)
  * Fixed: the terminal scrollbar can be dragged again in a split pane
    (issue #358)
  * Fixed: a duplicate of a favorite is not a favorite, and a duplicate of a
    dynamic-folder entry survives the folder's refresh
  * Dependencies: libc 0.2.189 -> 0.2.190; picky-krb held at 0.12.4
    (0.12.5 breaks pinned sspi)

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 03 Oct 2026 00:00:00 +0000

rustconn (0.22.14-1) unstable; urgency=medium

  * Version bump to 0.22.14
  * Added: in fullscreen the header bar comes back over the session when the
    pointer touches the top edge of the screen, or with F10 (issue #354)
  * Fixed: split-view panes can now be dragged to another panel or tab by their
    connection-name header, which shows a grab cursor and the full connection
    name (issue #355)
  * Changed: fullscreen hides the header bar for every session, not only
    embedded RDP/VNC; attention banners such as group broadcast and the
    hardware-key touch request stay visible (issue #354)
  * Changed: split-view panes show their connection-name header by default on
    new installations; an existing configuration keeps its stored value
    (issue #355)
  * Dependencies: Flatpak fast_float 8.2.10 -> 8.3.0; picky-krb held at 0.12.4
    (0.12.5 breaks pinned sspi)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 02 Oct 2026 00:00:00 +0000

rustconn (0.22.13-1) unstable; urgency=medium

  * Version bump to 0.22.13
  * Added: the RDP connection editor gains a KDC Address row for Kerberos
    sign-in; an empty row falls back to the realm's DNS name (issue #351)
  * Fixed: Group Sync no longer loses a connection's per-connection monitoring
    override on a Master/Import sync (issue #352)
  * Fixed: a connection's monitoring setting can follow the global switch again
    (Use global setting / Enabled / Disabled); Settings and CLI gain a reset
    for connections pinned on by older versions (issue #352)
  * Fixed: RDP sign-in failures now say what went wrong (no KDC, KDC
    unreachable, clock skew, unknown server, disabled/locked account) instead
    of "Check username and password" (issue #351)
  * Fixed: a corrected vault entry is used on the next attempt after a refused
    sign-in, instead of only after a restart (issue #351)
  * Fixed: FreeRDP 2 is no longer launched, and an embedded FreeRDP session
    that ends at once is no longer shown as connected (issue #351)
  * Fixed: terminal highlight rules stay on their text after scrolling,
    resizing or moving the window (issue #343)
  * Fixed: a config file RustConn cannot read is backed up before defaults are
    used; a file written by a newer RustConn is backed up before an older one
    changes it
  * Fixed: Group Sync no longer trashes and recreates every connection when the
    Import group's name differs from the Master's
  * Fixed: saving a KeePass credential with a hardware key asks for far fewer
    touches, serializes concurrent writes, and shows what the key waits for
    (issue #350)
  * Changed: Debian and OBS packages no longer recommend FreeRDP 2 (issue #351)
  * Dependencies: refreshed the picky ASN.1 crates and three other transitive
    deps to their latest patch/minor releases (picky-krb held at 0.12.4)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 02 Oct 2026 00:00:00 +0000

rustconn (0.22.12-1) unstable; urgency=medium

  * Version bump to 0.22.12
  * Added: RDP can now authenticate NLA with Kerberos instead of NTLM, an
    opt-in per-connection switch for the embedded client; required for AD
    "Protected Users" hosts that disable NTLM domain-wide (issue #351)
  * Fixed: a SPICE connection's saved proxy URL and shared folders now reach
    remote-viewer; the launch mapping previously dropped both fields
  * Security: CLI-tool downloads (kubectl, tsh, tailscale, boundary, hoop) now
    all pass through the same checksum policy instead of writing unverified
    binaries; the "all downloads verified" claim is corrected
  * Security: saving a credential into a nested KeePass group no longer reports
    success when a parent group could not be created
  * Security: restoring settings from a backup archive now writes each file
    atomically (temp file + fsync + rename, 0600) like every other config write
  * Security: Asbru-CM export no longer writes unusable entries for SPICE,
    Serial and other unsupported protocols; it skips them with a warning
  * Changed: the embedded RDP smartcard_enabled/microphone_enabled config
    fields are now documented as reserved/not-yet-implemented (no-op)
  * Dependencies: yoke-derive 0.8.3 -> 0.8.4 (0.8.3 was yanked from crates.io)

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 01 Oct 2026 00:13:26 +0300

rustconn (0.22.11-1) unstable; urgency=medium
  * Version bump to 0.22.11
  * Fixed: saving, renaming and deleting credentials in a KeePass database
    protected with a YubiKey Challenge-Response second factor now works; the
    write path and custom-path reads now pass the configured slot to
    keepassxc-cli as -y (follow-up to issue #350)
  * Dependencies: FreeRDP (Flatpak) 3.32.0 -> 3.32.1, a security and
    regression release (fixes clipboard copy of larger content)
 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 30 Sep 2026 12:00:00 +0300
rustconn (0.22.10-1) unstable; urgency=medium

  * Version bump to 0.22.10
  * Added: KeePass databases protected with a YubiKey Challenge-Response
    second factor can now be unlocked, via a new optional "YubiKey slot"
    setting threaded through to keepassxc-cli (issue #350)
  * Added: the terminal can now paste on right-click instead of showing the
    context menu, an opt-in setting that still routes through the safe
    multi-line paste guard (issue #349)
  * Fixed: traced the embedded RDP artifacts in GFX/AVC420 mode to an upstream
    ironrdp-egfx bug (its AVC420 decoder ignores regionRects and copies partial
    updates from the frame origin); RustConn inherits it correctly and needs no
    local change, a fix has been submitted upstream (issue #262)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 29 Sep 2026 12:00:00 +0300

rustconn (0.22.9-1) unstable; urgency=medium

  * Version bump to 0.22.9
  * Added: a multi-line terminal paste now shows a preview and asks for
    confirmation first, guarding against pastejacking; single-line pastes are
    unchanged and it can be turned off with the confirm_multiline_paste setting
  * Added: the connection editor can detect a host's MAC address for
    Wake-on-LAN from the local ARP cache with a "Get MAC" button (Linux only,
    same LAN segment), warning when the address is a randomized private one
  * Added: a connection whose route changed since it last connected now warns
    before carrying stored credentials there, catching a silently re-pointed
    shared connection; the record is kept locally, out of the synced catalog
  * Fixed: SSH settings inherited from further than the immediate parent are now
    shown in the group editor instead of looking empty (issue #345)
  * Dependencies: vnc-rs 0.5.3 to 0.6.0, tokio-rustls 0.26.5 to 0.26.6

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 28 Sep 2026 12:00:00 +0300

rustconn (0.22.8-1) unstable; urgency=medium

  * Version bump to 0.22.8
  * Fixed: pinning a connection as a favorite now persists — the toggle no
    longer went through a save path that discarded the pinned flag, so the
    Favorites group appears (issue #344)
  * Added: favorite connections are reachable from the system tray via a
    Favorites submenu, shown above Recent and only when non-empty (issue #344)
  * Changed: the sidebar context menu names the favorite toggle "Add to
    Favorites" / "Remove from Favorites", a favorite shows a star at its real
    place in the tree, and the Favorites group has its own star icon (issue
    #344)

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 27 Sep 2026 12:05:00 +0300

rustconn (0.22.7-1) unstable; urgency=medium

  * Version bump to 0.22.7
  * Added: the Snap bundles FreeRDP's X11 client (xfreerdp3) for external
    RDP, RemoteApp and legacy servers (issue #342)
  * Fixed: terminal highlights are drawn on the text — cell size and origin
    come from VTE, wide characters and tab stops are counted as VTE counts
    them, and a text colour is drawn as an underline (issue #343)
  * Fixed: a non-ASCII character in a highlight or terminal colour value no
    longer crashes RustConn (issue #343)
  * Fixed: highlights follow a moved session, no longer stack on reconnect,
    reach open sessions when Settings are saved, and cover Zero Trust and
    Quick Connect sessions (issue #343)
  * Fixed: the highlight rule editors flag an invalid pattern or colour, for
    screen readers too, and call the foreground colour an underline
    (issue #343)
  * Fixed: a custom /smart-sizing argument no longer makes the external RDP
    client exit; smart sizing wins over dynamic resolution everywhere, and
    .rdp import and export keep both settings (issue #341)
  * Fixed: the FreeRDP client reported as installed is the one launched, and
    rustconn-cli connect uses the same choice, the pinned client and the
    sizing switches (issues #340, #341)
  * Fixed: embedded RDP "Save N Files" works against a real server, fetches
    one file at a time, times out, and no longer puts stale data on the
    local clipboard (issue #74)
  * Security: "Save N Files" no longer creates a hidden file named by the
    server, and the embedded wlfreerdp launch filters custom /shell:, /proxy:
    and password arguments like the external launcher (issue #74)
  * Documentation: Snap, install and user-guide corrections for the sandboxed
    builds, RD Gateway and highlighting (issues #341, #342, #343)
  * Dependencies: FreeRDP (Flatpak) 3.32.0, a security release
 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 27 Sep 2026 12:00:00 +0300
rustconn (0.22.6-1) unstable; urgency=medium

  * Version bump to 0.22.6
  * Fixed: terminal highlight rules could not be coloured — both rule editors
    now have Text and Background colour fields; a foreground colour is drawn as
    a colour wash plus underline; the built-in ERROR/WARNING/CRITICAL/FATAL
    rules can be turned off (issue #343)
  * Changed: the Snap now declares the network-status interface so the desktop
    portal network monitor works under strict confinement (issue #342)
  * Documentation: corrected the FreeRDP/VNC fallback claims for the Snap and
    the SDL-first FreeRDP detection order (issues #342, #340)
  * Dependencies: cc 1.5.1, hyper-util 0.1.21, wasm-bindgen 0.2.129,
    web-sys 0.3.106, zerocopy 0.8.59, smallvec 1.16.2 and related; both
    cargo-sources.json regenerated
 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 25 Sep 2026 12:00:00 +0300
rustconn (0.22.5-1) unstable; urgency=medium

  * Version bump to 0.22.5
  * Added: the external VNC viewer can now be chosen per connection (issue #340)
  * Added: the external FreeRDP client can now be chosen per connection
    (issue #340)
  * Added: dynamic resolution and smart sizing are now configurable for the
    external RDP client, for legacy servers on HiDPI displays (issue #341)
  * Fixed: a TLS failure on a legacy RDP server no longer suggests enabling a
    certificate setting that is already on; it points at the RDP security layer
    instead (issue #339)
  * Changed: the external RDP client-detection helper now prefers the SDL3
    client over the deprecated wlfreerdp, matching the launcher (issue #340)
  * Dependencies: thiserror 2.0.21, zerocopy 0.8.58

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 24 Sep 2026 18:10:21 +0300

rustconn (0.22.4-1) unstable; urgency=medium

  * Version bump to 0.22.4
  * Fixed: the Snap Store listing lost its Donations, Source code and
    Report-a-bug links after a release; the contact field held a bare e-mail,
    which the metadata spec treats as an invalid link entry, so the store
    dropped the whole links block on the metadata sync. The link fields are now
    lists and the contact e-mail carries a mailto: prefix.
  * Fixed: a saved password could be missed on the first connect right after
    startup, needlessly prompting, because the secret backend was not yet warm;
    the resolver now retries a transient backend read a few times with a short
    backoff before reporting a miss.
  * Fixed: a Web/SOCKS tunnel through a dead SSH host froze the window and
    mis-warned about a password; SSH tunnels now default to ConnectTimeout=8
    and the proxy is raised on a background thread.
  * Fixed: a Web bookmark wrongly warned it would prompt for a password;
    expects_password_prompt now returns false for Web connections.
  * Fixed: jump-host connections to an unreachable host hung and were shown as
    connected; a jump-host session is now treated as connected only once its
    terminal shows an interactive shell prompt.
  * Fixed: external RDP surfaced a cryptic "Unexpected keyword" with no way to
    diagnose it (issue #339); the failure is now reported as a client/argument
    mismatch and the launch path logs its argument vector at debug level.
  * Improved: external VNC and SPICE viewers now log the exact command they
    launch, so a rejected option is diagnosable from a log.
  * Dependencies: updated the macOS tray crates tray-icon 0.24->0.25 and
    muda 0.19->0.20 (behind the tray-macos feature; not built in the Linux
    packages).
 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 23 Sep 2026 12:00:00 +0300

rustconn (0.22.3-1) unstable; urgency=medium

  * Version bump to 0.22.3
  * Fixed: the window could livelock at 100% CPU on a session emitting a very
    long line with no newline (issue #338); the transcript writer used to
    rescan the whole growing buffer on every 8 KB PTY chunk, which is quadratic
    in the line length and ran on the GTK main thread. It now scans only the
    new bytes for a newline, looks for a prompt only in the buffer tail, and
    flushes an un-terminated run as a partial record at a byte cap.
  * Fixed: KeePass password inheritance still prompted on hosts set to
    "inherit" (issue #327); the inherit resolver passed the group's full
    RustConn/Groups/... path to the reader, which prepends RustConn/ itself, so
    it looked up a doubled path that never matched. It now uses the same
    prefix-free entry name as save and direct load, so all three agree.
 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 22 Sep 2026 12:00:00 +0300

rustconn (0.22.2-1) unstable; urgency=medium

  * Version bump to 0.22.2
  * Fixed: reconnecting a split-screen guest pane dropped it into a new tab
    (issue #328); prepare_for_reconnect now recognises a session living in a
    split pane, so the in-place reconnect reuses the pane's own widget and the
    session stays where it was with its scrollback intact.
  * Fixed: the Reconnect Session shortcut (default Ctrl+Shift+Y) could reset a
    live pane (issue #328); it now acts only on a disconnected session and is a
    silent no-op on a live pane.
  * Changed: group broadcast no longer shows a toast when enabled; the
    persistent banner alone announces the active state (GNOME HIG). Disabling
    still toasts, and split-view broadcast is unchanged.
  * Improved: the "only reconnect a disconnected session" guard now lives in
    the one function every in-place reconnect passes through, so no path can
    reset a live terminal (issue #328). No user-visible change today.
  * Dependencies: gtk4/gdk4/gsk4 0.11.4->0.11.5, gio/glib 0.22.9->0.22.10,
    rand 0.10.2->0.10.3.

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 20 Sep 2026 15:03:35 +0300

rustconn (0.22.1-1) unstable; urgency=medium

  * Version bump to 0.22.1
  * Added: broadcast keystrokes to a group of tabs (issue #329). Membership is
    an explicit per-session opt-in; typing in a member tab mirrors to the other
    members, a non-member tab types only into itself, and the mode toggles with
    Ctrl+Shift+A. Only terminal sessions participate; it is independent of the
    split-view broadcast.
  * Added: reconnect any pane in a split view, not only the split owner
    (issue #328). Reconnect is reachable from the tab menu, a pane's menu, a
    banner inside the disconnected pane, and a configurable shortcut
    (default Ctrl+Shift+Y).
  * Added: rustconn-cli add --tunnel-via <NAME|UUID> for Web connections, so a
    host-only web UI can be reached through an existing SSH connection's host.
  * Fixed: multi-hop SSH with an identity key failed on every hop past the
    first; identity-only chains now use OpenSSH -J with the key in the agent.
  * Fixed: the monitoring bar could open for a jump-host session that never
    connected; the contains_ssh_failure guard is now applied to the monitoring
    start too.
  * Fixed: reconnect sometimes did not send the vault password past the cache
    TTL (issue #330); reconnect now falls back to a blocking vault resolve.
  * Fixed: rapidly opening RDP connections could pop a password prompt for a
    saved credential; vault backend operations are now serialised and the RDP
    path caches resolved credentials like the other protocols.
  * Fixed: the RDP password dialog had no visible close button; the native
    close button is restored on the start side (GNOME HIG).
  * Fixed: rustconn-cli add --protocol web was rejected despite being
    advertised; the parser now accepts web, http and https.
  * Fixed: rustconn-cli add --aws-profile help described the wrong field; it
    now matches the code (sets the AWS profile, not the instance ID).
  * Changed: embedded RDP status text no longer names the underlying client;
    labels now read "Starting RDP..." and "external window".
  * Fixed: "Select Tab" in a split pane did not open the tab picker, most
    stubbornly in the right pane of a vertical split (issue #328); the picker
    now opens downward from the unclipped panel container with a size-capped
    list, so it always fits.
  * Fixed: a duplicate-GtkStack-name warning from the tab menu on multi-monitor
    setups; the detach-to-monitor submenu is now flat menu items.
  * Dependencies: cc 1.4.6->1.4.7.

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 19 Sep 2026 12:00:00 +0200

rustconn (0.22.0-1) unstable; urgency=medium

  * Version bump to 0.22.0
  * Added: import mRemoteNG connections from confCons.xml. Container nodes
    become nested groups; SSH/RDP/VNC/Telnet keep their protocol, Raw and
    Rlogin map to Telnet, HTTP/HTTPS become Web bookmarks. Only unencrypted
    documents are read and no password is imported. Attribute and protocol
    names were verified against mRemoteNG's own serializer.
  * Added: import PuTTY and KiTTY sessions from a Windows Registry export
    (.reg). SSH key file, agent/X11 forwarding and compression are carried
    across; the live registry is never read, only the exported file.
  * Fixed: KeePass group passwords could be saved but not loaded (issue #327).
    The load path looked up a doubled RustConn/RustConn/Groups/... entry; both
    group load sites now share a helper that forms the key symmetrically with
    the save path. Per-connection passwords were unaffected.
  * Improved: the welcome screen no longer lists Import twice and its columns
    are balanced; the Import Formats panel now lists every supported source.
  * Improved: split view divider ratio is restored from a workspace profile
    instead of always reopening at an even 50/50.
  * Improved: the snippet dialog builds a Snippet from one grouped context
    struct instead of ten loose arguments (no behaviour change).
  * Dependencies: cfg-if 1.0.4->1.0.5, redox_users 0.5.2->0.5.3,
    rustix 1.1.4->1.1.5, syn 3.0.5->3.0.6, unicode-ident 1.0.24->1.0.26,
    yuv 0.8.18->0.8.19.

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 18 Sep 2026 12:00:00 +0200

rustconn (0.21.14-1) unstable; urgency=medium

  * Version bump to 0.21.14
  * Added: embedded RDP now verifies the server certificate on a
    trust-on-first-use basis (issue #324). The embedded IronRDP client used to
    accept any TLS certificate silently; it now records the SHA-256 fingerprint
    on first connection and raises the same "Certificate changed" dialog as the
    FreeRDP path when it changes. A separate known_hosts-style store in
    RustConn's config directory, kept apart from FreeRDP's known_hosts2. The
    "Ignore Certificate" toggle still skips the check.
  * Fixed: the tabless external RDP path showed no certificate dialog (issue
    #324 follow-up). A connection opening the external client directly went
    through an older launcher that captured stderr only, inherited stdin, and
    had no certificate-change detection. It now captures stdout, uses
    /dev/null for stdin, forces console callbacks on SDL variants, and raises
    the confirmation dialog on the changed-certificate banner.
  * Dependencies: clap 4.6.6->4.6.7 and family, clap_complete 4.6.9->4.6.11,
    cryptoki 0.12.0->0.12.1, ppmd-rust 1.4.1->1.5.0, zlib-rs 0.6.7->0.6.8.

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 16 Sep 2026 12:00:00 +0200

rustconn (0.21.13-1) unstable; urgency=medium

  * Version bump to 0.21.13
  * Added: export RDP connections to Microsoft .rdp files (mstsc.exe, FreeRDP),
    as "RDP Files (.rdp)" in the export dialog and rustconn-cli export
    --format rdp-file. One file per connection in a directory; no password is
    written; every value has its control characters stripped so a newline
    cannot append a key the client honours.
  * Added: FIDO2/WebAuthn passkey redirection for RDP (external client, the
    FreeRDP /fido flag), for authenticating to a remote Windows session with a
    local security key.
  * Added: elevated credentials for SSH and SFTP — answer sudo, su, doas and
    enable prompts with the connection password, with a 0-5000 ms delay and
    optional custom patterns. The credential is resolved only because a rule
    asks, scrubbed at session end, answered only on the active prompt line, not
    twice for the same prompt, and no more than three times per rule.
  * Added: output filter (postpend command) for terminal sessions — pipe a
    session's stdout through ChromaTerm, ccze or pv before display. Applies to
    SSH, Telnet, Serial, Kubernetes, MOSH and Zero Trust, on connect and
    reconnect; also rustconn-cli update --postpend-command.
  * Added: expect rules can carry a delay applied between the match and the
    response, for equipment that prints a prompt before it can read the reply.
  * Fixed: SDL-FreeRDP now shows the certificate dialog (issue #324 follow-up)
    via +force-console-callbacks.
  * Fixed: a delayed expect response is dropped if the prompt left the active
    line during the delay, closing a path by which a credential could be typed
    into a shell after the prompt was gone.
  * Fixed: a repeating expect rule no longer answers the same prompt twice on a
    redraw, and a credential rule stops after three prompts.
  * Fixed: an output filter that exists but is not executable is refused before
    the pipeline is built, and a refused filter is reported in a toast.
  * Fixed: output filters are re-applied when a non-SSH session reconnects.
  * Fixed: elevated credentials are honoured on SFTP connections.
  * Improved: sidebar search history increased from 10 to 20 entries.
  * Improved: the export dialog can no longer omit a format from its list.
  * Dependencies: cc 1.4.5->1.4.6, rustls 0.23.44->0.23.45,
    tinyvec 1.13.2->1.13.3; advisories clean.

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 14 Sep 2026 12:00:00 +0200

rustconn (0.21.12-1) unstable; urgency=medium

  * Version bump to 0.21.12
  * Fixed: external RDP now shows the certificate confirmation dialog when the
    server certificate changed. FreeRDP prints its certificate report to stdout
    while the error codes go to stderr, and only stderr was being classified,
    so the change produced no dialog, no error and no session. Both streams are
    now read together, the client no longer inherits stdin so it cannot block
    on a prompt nobody can answer, and detection uses the banner rather than
    the prompt, which is printed without a trailing newline and is therefore
    invisible to a line reader while the client waits. (Closes: #324)
  * Fixed: the dialog now quotes the new and previously trusted fingerprints,
    so accepting a changed certificate is no longer done blind.
  * Fixed: the external-RDP watchdog watched for three seconds, too short for a
    certificate report arriving behind a gateway or a slow link. The
    certificate check now runs for thirty seconds while the early-exit check
    keeps its original window, so a client exiting later is not misreported.
  * Fixed: a changed certificate could leave the session in an error state with
    no message when no certificate callback was registered.
  * Fixed: forgetting a stored certificate for the ignore-certificate path used
    a stale duplicate that matched host entries by substring, so clearing
    db.example.com also cleared my-db.example.com, and it never looked in the
    FreeRDP 3.x store.
  * Fixed: the macOS icon step no longer decides whether the prebuilt icon is
    current by modification time, which git does not record and which therefore
    sent an arbitrary subset of builds into the iconutil failure on macOS 27.
    It compares the source SVG's content hash instead.
  * Improved: the embedded-browser autofill path no longer creates an
    un-zeroized plaintext copy of a cached password.
  * Dependencies: bytemuck_derive 1.12.1, crc32fast 1.5.2, libredox 0.1.24,
    yuv 0.8.18.

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 12 Sep 2026 12:00:00 +0300

rustconn (0.21.11-1) unstable; urgency=medium

  * Version bump to 0.21.11
  * Security: session recordings now redact passwords, API keys and tokens as
    the documentation promised; previously they were stored in clear text.
  * Security: session log files and the session-restore file are created 0600;
    they were world-readable under the process umask.
  * Security: dangerous VNC viewer arguments from an imported connection are
    blocked on both launch paths, including the double-dash spelling and a
    blocked option's separate value.
  * Security: a Script password source no longer logs its command line, whose
    arguments can carry a token.
  * Fixed: a log rotation could delete *.log files the user owns when the log
    path pointed outside the directory RustConn manages.
  * Fixed: RDP gateway connections launched through the CLI work on FreeRDP 3.x.
  * Fixed: external FreeRDP starts on macOS, which has no XDG_RUNTIME_DIR.
  * Fixed: SSH keep-alive defaults now reach CLI sessions and tunnels, not only
    GUI terminals.
  * Fixed: an empty SSH Custom Option no longer breaks the connection and now
    defers that option to ~/.ssh/config.
  * Fixed: Dynamic Folder entries honour their documented sub-group path, and
    generated sub-groups no entry uses any more are cleaned up.
  * Fixed: macOS packaging — H.264 accelerated RDP has its runtime dependency,
    and the icon step reports which file is bad instead of failing opaquely.
  * Improved: the packaging feature-ladder gate now covers every channel,
    including the Flatpak manifests it previously skipped.
  * Dependencies: bitflags 2.13.1→2.13.2, open 5.4.3→5.4.4,
    smallvec 1.16.0→1.16.1, toml 1.1.5→1.1.6,
    toml_edit 0.25.13→0.25.15, uuid 1.26.0→1.26.1.

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 11 Sep 2026 12:00:00 +0300

rustconn (0.21.10-1) unstable; urgency=medium

  * Version bump to 0.21.10
  * Fixed: connection search no longer matches entries with no visible relation
    to the query; the fuzzy matcher now requires the whole query as a subsequence.
  * Fixed: the Jump Host pickers in the Tunnel wizard, the connection wizard and
    a group's SSH settings now filter as you type.
  * Added: the New/Edit Cluster dialog can filter its connection list.
  * Improved: macOS support for external viewers and browsers.
  * Dependencies: reqwest 0.13.4→0.13.5, zerocopy 0.8.56→0.8.57,
    hybrid-array 0.4.14→0.4.15, font-types 0.12.4→0.12.5.

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 09 Sep 2026 16:00:00 +0300

rustconn (0.21.9-1) unstable; urgency=medium

  * Version bump to 0.21.9
  * Added: "Open Browser via Tunnel" on an SSH connection — one right-click
    raises a SOCKS proxy to the host and opens a browser (embedded or external
    Chromium) routed through it, with a configurable start page (presets for
    Google/DuckDuckGo/ifconfig.me plus Custom) and an external-browser command;
    auto-detection respects the system default browser and falls back to the
    embedded browser with a toast when no Chromium browser is available.
  * Added: a Web connection can browse through an SSH host (SOCKS tunnel) in the
    embedded and a Chromium browser.
  * Added: interactive "ASK" variables — prompt for a value at connect time
    (@ask:, @ask?:, @ask:|list).
  * Added: a dynamic SOCKS forward can pick a free local port automatically
    (stored local port 0).
  * Added: built-in date, time and environment variables in ${...} substitutions.
  * Added: built-in Expect templates cover the newer OpenSSH host-key prompt and
    bare "any key to continue" banners.
  * Fixed: an embedded Web connection to an unreachable host no longer leaves a
    blank browser tab open.
  * Fixed: the Jump Host and Tunnel dropdowns' search box now filters the list.
  * Fixed: a ProxyCommand relay no longer leaves the target session hung at the
    password prompt (#322).
  * Fixed: the "Executing:" echo now quotes a ProxyCommand value so it no longer
    looks ignored (#322).

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 08 Sep 2026 16:40:00 +0300

rustconn (0.21.8-1) unstable; urgency=medium

  * Version bump to 0.21.8
  * Fixed (security): a password typed at an interactive prompt could be written
    to the session log in the clear (#321). The logger now redacts the input
    record that follows a sensitive prompt.
  * Fixed: an Expect-rule response could not resolve a connection-local variable
    (#317); local variables are now included in what a response resolves against.
  * Fixed: embedded RDP clipboard file transfer now works in both directions.
    Downloads ("Save N Files") were crossed with uploads, told size and data
    replies apart by length, and truncated large files. Dragging a file onto the
    session now offers it through IronRDP's file-copy API (a hand-built offer
    left IronRDP's file list empty and the server's request failed with
    "Unspecified error"), and the file transfers in full.
  * Improved: a file dropped on an RDP session confirms with a toast — it goes to
    the remote clipboard, so press Ctrl+V in the session to paste it.
  * Fixed (security): a clipboard filename from the server could be written
    outside the chosen folder — an absolute path or ".." escaped it. Names are
    reduced to one safe component; ".", "..", empty and NUL names are refused;
    an existing file is never clobbered.
  * Fixed: the failed-write report panicked (RefCell already borrowed); a
    refused file left the batch never reporting a result; a hostile server
    could loop the download forever or make it corrupt. A 512 MiB per-file cap,
    a re-entry guard, monotonic stream ids and directory filtering address these.
  * Fixed (security): a server could make the client allocate up to 4 GiB for
    one clipboard file request; the read is now capped at 8 MiB per response.
  * Fixed (security): SecretSettings and Credentials derived Debug could print
    stored credentials in the clear; both redact by hand now, with tests.
  * Fixed: secret-backend CLI calls (Bitwarden, 1Password, Passbolt) could hang
    the caller forever; all are bounded by a 30-second timeout that also kills
    the child, so a hung tool no longer orphans a vault session.
  * Improved: the auto-login timeout can now be set on a group, not just a
    connection.
  * Improved: the macOS window header is closer to a native titlebar height.
  * Dependencies: rustls 0.23.43->0.23.44.

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 07 Sep 2026 15:10:00 +0300

rustconn (0.21.7-1) unstable; urgency=medium

  * Version bump to 0.21.7
  * Fixed: the Session Logs dialog could not be made narrow — a gtk::Paned kept
    both panes on screen at every width. It is an adw::OverlaySplitView now, with
    a breakpoint that collapses the file list into an overlay below 500sp and a
    header toggle that appears only once collapsed.
  * Fixed: two boxed lists were drawn inside a second border, and the Credentials
    Storage row carried both an "ℹ" character and an information icon. The extra
    gtk::Frame is gone and the duplicated glyph removed.
  * Fixed: client detection on Preferences ▸ Clients reported its result by colour
    and a glyph alone. Each indicator now carries the state as words —
    "Installed", "Not found", "Using embedded client" — as both accessible label
    and tooltip.
  * Fixed: the Keyboard Shortcuts page showed internal action identifiers as row
    subtitles. The subtitle is gone; the title already names the action.
  * Fixed: three switches in Preferences ▸ Secrets were bare GtkSwitch widgets in
    an AdwActionRow suffix rather than AdwSwitchRow. All three are AdwSwitchRow now.
  * Fixed: a smart folder whose icon was an icon name displayed the name as text;
    the folder row now tells an emoji from a themed icon name. The section header
    and default folder icon are symbolic icons that follow the icon theme.
  * Fixed: the Smart Folders context menus were invisible to a screen reader and
    unusable from the keyboard. They go through the shared show_popover builder now,
    with proper menu roles, arrow-key navigation, Escape and a height cap.
  * Fixed: the embedded VNC status screen was English-only and its Copy button did
    nothing; both now go through i18n() and the RDP clipboard helper.
  * Fixed: the connection wizard threw away the icon when "Advanced…" was pressed,
    and the connection editor kept calling a URL a Host and left empty rows behind
    when hiding fields.
  * Changed: every ellipsis in the interface is one "…" character instead of three
    periods; 111 strings across 31 files normalised, merging duplicated msgids.
  * Removed: around 390 lines of unreachable UI code, including a fullscreen button
    that flipped a private bool and called no window API.
  * Dependencies: crossbeam-channel 0.5.16→0.5.17, crossbeam-deque 0.8.7→0.8.8,
    crossbeam-epoch 0.9.20→0.9.21, crossbeam-utils 0.8.22→0.8.23, der 0.8.1→0.8.2,
    ipnet 2.12.1→2.12.2

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 06 Sep 2026 20:02:56 +0300

rustconn (0.21.6-1) unstable; urgency=medium

  * Version bump to 0.21.6
  * Added: an optional second confirmation before a snippet runs (#315) — a
    Confirm before running switch in the snippet editor. Off by default, so
    existing snippets keep running on a single action. It covers every route a
    snippet can be started from: the picker, the Execute button in the snippet
    manager, the variable-input dialog, the inline entries in the terminal's
    right-click menu, and the Scripts menu of an embedded RDP session.
  * Added: rustconn-cli snippet honours the same flag — --confirm on add,
    --confirm [true|false] on edit, and snippet run --execute prompts on stderr.
    With no terminal on stdin it refuses rather than prompting into a pipe;
    --force is the opt-out for scripts that mean it.
  * Fixed: Bitwarden auto-unlock did nothing in every interface language but
    English (#312). The vault state was compared as a translated display string
    against the literal "Locked", so outside English the guard read "not locked"
    and skipped the unlock. The state is an enum now and the decision is made on
    the variant, with the label rendered separately. It also fires on an
    inconclusive probe, which was a second route to the same silence.
  * Fixed: the startup banner announced that Bitwarden could not store passwords
    while Bitwarden was storing them (#312). The readiness probe ran bw status
    without BW_SESSION, so the CLI could not see the session and answered
    locked, correctly. The probe now builds its command the way the backend does.
  * Fixed: a Bitwarden password was written to the vault and reported as refused
    at the same time (#312). One store is three bw processes and a network round
    trip each; the ten-second budget expired mid-write while bw carried on and
    completed it. The budget is now chosen per backend, 45s for the four
    CLI-backed ones, and the message states the budget actually applied.
  * Fixed: every bw unlock ran without a deadline. Up to three child processes
    were spawned and none was bounded, so an unlock stalled on a network sync
    blocked its caller indefinitely. All four bw invocations now share one 30s
    ceiling. Two smaller things found alongside: the unlock logged the master
    password's length, and raw bw stderr could carry a session key into a log
    and into the error the Secrets page renders.
  * Fixed: Add SSH Key did nothing and there was no way to find out why. The
    file chooser's callback discarded every failure, so a dismissal, a real
    error and a callback that never fires were indistinguishable. Dismissal is
    now told apart from failure, and a second click supersedes the first request
    instead of leaving the button unable to open a chooser at all.
  * Fixed: the Add Key passphrase dialog had no visible way out — Cancel in the
    header now, and Enter in the passphrase field submits.
  * Fixed: global variables that could not be written to disk were reported as
    saved. The edits survived until the next start and then were simply gone.
  * Fixed: a standalone SSH tunnel could fail in complete silence while the
    diagnosis was being built and thrown away. health_check now returns what it
    found, so a tunnel that exited on its own reports Failed rather than
    Stopped, with a warning icon and ssh's own words in a Last Error row. A
    failed start opens a dialog; a tunnel dying on its own raises a toast. The
    remedy names the package that is actually missing — mptcpize ships with the
    Multipath TCP tools, not with the OpenSSH client. The tunnel manager is also
    redrawn while it is open, which is where the failure was invisible before.
  * Fixed: running a snippet from the terminal's right-click menu could do
    nothing at all when a variable could not be resolved. It opens the variable
    dialog now, with whatever did resolve pre-filled.
  * Fixed: the embedded RDP confirmation showed the command untruncated. The
    terminal gate caps the preview at 400 characters because the dialog grows
    with its body until it stops being readable; the RDP gate passed the
    command whole, so a generated one-liner made the dialog unreadable on
    exactly the snippets a confirmation is worth having for.
  * Fixed: RUST_LOG=debug wrote the RDP account password into the log in clear.
    sspi logs the encoded CredSSP TSRequest at debug level, and field [2] of
    TSPasswordCreds is the password as plain UTF-16LE, so the log carried a
    decodable byte array — while the same line printed "password: Secret" in
    its span fields, the wrapper working perfectly on the field RustConn owns.
    An sspi=warn directive now joins the three ironrdp ones, added after
    EnvFilter::from_default_env() so RUST_LOG cannot re-enable it. Anyone who
    ran 0.21.5 or earlier with RUST_LOG=debug against an RDP host should treat
    that account's password as disclosed.
  * Fixed: a clean shutdown reported that every terminal child had ignored
    SIGTERM. still_our_group_leader answers true for a zombie, and on shutdown
    that is the normal state — the reaper is GLib's child watch and its main
    loop is gone by then, so a child that obeyed promptly is still in the
    process table when the grace period ends. The check reads state Z from
    /proc/<pid>/stat now and both escalation sites say which they found. The
    SIGKILL to the process group stays in either branch, since an ssh with a
    ProxyCommand shares its group with helpers the parent's exit does not
    reach; only the message was wrong.
  * Fixed: an unset console keymap made every RDP session US English.
    localectl status prints VC Keymap above X11 Layout, and on a desktop the
    console keymap is normally unconfigured, so the parser returned "(unset)"
    and fell back to US English with the layout it wanted on the next line.
    The server then interprets every scancode against the wrong table, so a
    German or French keyboard types the wrong characters with nothing in the UI
    pointing at the cause. X11 Layout now wins wherever it appears, the
    placeholders systemd prints for an unset value are rejected rather than
    read as layout names, and both sources report the whole group list.
  * Fixed: with LibSecret, a password saved on a connection in no group was
    never found again (#316). generate_store_key_with_group takes an
    Option<&str> group path with three meanings, and four call sites built it
    themselves: saving and deleting passed Some(""), while resolving and the
    connection dialog's load and test buttons passed None. So the password went
    to RustConn/{name} ({protocol}) and was looked for at {name} ({protocol}),
    and the Secret Service matches attributes exactly. A grouped connection
    escaped it because there the two keys differ and the legacy second lookup
    hits. The decision now lives in one function,
    generate_store_key_for_connection, taking the group id rather than a
    pre-joined path, and save, resolve, delete, migrate and the credential
    transfer all call it. Four tests pin the GUI's key against the resolver's.
  * Fixed: the shutting-down flag was set after the session exits it exists to
    explain. APP_SHUTTING_DOWN was set from connect_shutdown, which GTK runs
    from app.quit() — after shutdown_sessions_for_exit has already signalled
    every session child — so on the ordinary quit path both guards that ask the
    question got false, and the one that suppresses a reconnect banner and a
    failure toast for a session the teardown just killed was unreachable. It is
    set at the top of that teardown now, which every exit funnels through and a
    tray-minimize never reaches. The post-disconnect command is also skipped at
    shutdown, and says so, instead of being started on a worker thread the
    process exits from under with nothing able to log the outcome.
  * Fixed: a second Quit stacked a second confirmation instead of raising the
    first. close_confirmation_dialog is reached from the window's close_request
    and from the app.quit action, where Ctrl+Q, the primary menu and the tray's
    Quit item all arrive, and neither asked whether the question was already on
    screen — so the first click looked ignored while its dialog sat behind
    another window or hidden to the tray. Both go through one helper now, which
    returns the dialog to wire up or raises the window carrying the pending
    one; nothing is ever read as consent, and the quit action logs which of the
    three outcomes happened.
  * Improved: the four hand-rolled bw unlock invocations on the Secrets page are
    gone; they all call one core function that has the extended PATH, the
    deadline and the verbose fallback.
  * Improved: one confirmation prompt in rustconn-cli instead of three. The
    copies differed in whether a non-interactive stdin is a silent abort or an
    error naming --force, which a bool cannot carry; the shared helper reports
    three outcomes and never treats "nobody to ask" as consent.
  * Improved: OpenH264 was probed again on every RDP connection. The embedded
    client dlopens a decoder rather than linking one, and each connection
    rewalked the whole candidate list from scratch, re-emitting the same loader
    warnings — three connections in one log produced nine identical lines
    about a distribution libopenh264 failing the hash check, at the one
    severity users actually read. The outcome is cached now, the path that
    loaded or nothing, and a fresh decoder is built from it per session; a
    failure to build one from an already-proven path is a warning rather than a
    silent fall back to RemoteFX. The trade is that installing a Cisco blob
    into a running RustConn is not picked up until restart.
  * Improved: a KeePass lookup paid for one database open that could never
    match. Connecting to a host whose password is not in the database took
    2.9 s before the prompt appeared: three keepassxc-cli invocations at
    roughly 700 ms each, since every run reopens the KDBX and pays its Argon2
    cost again. For a grouped connection one candidate was the un-prefixed
    path, which build_entry_path has never written — it can only match the
    ungrouped case, and there it stays. The construction moved into a pure
    function so the order is pinned by tests rather than by reading it, and
    find_keepassxc_cli remembers a successful find instead of redoing a PATH
    walk — plus, inside a Flatpak sandbox, a host child process — for every
    reader and writer in the module.
  * Documentation: three claims that were not true of the code —
    docs/CLI_REFERENCE.md said snippet run resolves ${VARIABLE} from Global
    Variables before execution, which it cannot, since a global may be
    vault-backed and the CLI has no session to unlock it with;
    rustconn-cli/AGENTS.md required every user-facing string to go through
    i18n() in a crate that has never contained one, so the rule was followed by
    nobody and following it once would have produced output in two languages;
    and the comment listing the routes to the snippet picker omitted the
    terminal context menu's own entry, which is that action's main caller.
  * Documentation: the debug-logging instructions did not say what a debug log
    discloses. docs/USER_GUIDE.md told users to run with RUST_LOG=debug and
    attach the output to a bug report, which names every host, username and
    connection opened, and until the leak fixed above carried the RDP account
    password itself. The warning now comes before the command rather than after
    it, while there is still a decision to make.
  * Dependencies: cc 1.4.4-1.4.5, find-msvc-tools 0.1.11-0.1.12, indexmap
    2.14.1-2.14.2, js-sys 0.3.104-0.3.105, syn 3.0.4-3.0.5, tinyvec
    1.12.0-1.13.2, tokio-rustls 0.26.4-0.26.5, wasm-bindgen 0.2.127-0.2.128
    together with its -futures, -macro, -macro-support and -shared crates,
    web-sys 0.3.104-0.3.105, zstd-safe 7.2.4-7.3.0, zstd-sys 2.0.16-2.1.0. Six
    of the fifteen are the wasm-bindgen family, and nothing this project ships
    compiles them: cargo tree --invert finds no path to wasm-bindgen on the host
    target, so they are reachable only behind a wasm32 target and are recorded
    because Cargo.lock moved, not because a binary did. indexmap is the one with
    real reach, arriving three ways — through h2/hyper/reqwest, through
    serde_yaml_ng, and through toml_edit behind the GTK macro crates. Thirteen
    further crates remain behind their latest release on semver grounds, a count
    this run leaves unchanged, and cargo deny check advisories is clean against
    the new lockfile.
  * Dependencies: FreeRDP (Flatpak) 3.31.0-3.31.1. Upstream calls it a papercut
    release, so no advisory behind it, but it fixes flickering in the SDL3 client
    on displays scaled other than 1.0, maps keys that client used to drop, and
    makes WinPR read JSON files in binary mode — the sdl-freerdp.json path the
    bundled cJSON module exists to enable. Only Flatpak/Flathub bundle FreeRDP;
    this package uses the distribution's copy and is unaffected.
  * Dependencies: openh264 2.6.0 is now bundled in all three Flatpak manifests,
    not just the release one. The embedded RDP client dlopens a decoder rather
    than linking one, so the Flathub build had none at all and every AVC420 or
    AVC444 session negotiated down to RemoteFX; a local flatpak-builder run had
    none either. Does not affect this package.
  * Dependencies: the nine other bundled Flatpak modules were checked against
    upstream and are already current, so only FreeRDP moved.

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 05 Sep 2026 01:14:07 +0300

rustconn (0.21.5-1) unstable; urgency=medium

  * Version bump to 0.21.5
  * Added: terminal colours can follow the desktop's light/dark preference — a
    new Follow System entry at the top of Preferences > Terminal > Theme. The
    System colour scheme previously reached only the GTK chrome, so a light
    desktop could surround a dark terminal with no setting that paired them.
    Terminals also repaint when the desktop switches mid-session (#99), without
    undoing a per-session Backspace/Delete choice (#271).
  * Added: a monitoring mode that fires when the remote shell reports a command
    finished — Command finished, alongside Off, Activity and Silence. The other
    modes are timing heuristics over raw output; this one reads VTE's
    vte.shell.postexec termprop, set by the remote shell through OSC 133, so it
    carries the exit code and can distinguish success from failure (#236). Needs
    shell integration on the remote host and a build against VTE 0.78+.
  * Added: every monitoring notification now also sets AdwTabPage:needs-attention,
    so the tab keeps a mark until it is selected. This also repairs a latent gap
    in Activity and Silence, whose only tab-level signal was indicator-icon — one
    slot with five writers and a priority guard between two of them.
  * Fixed: the window rendered light on a dark desktop whenever the theme was set
    to System. A notify handler cleared the very property AdwStyleManager uses to
    tell GTK it resolved to dark, so the app undid libadwaita's decision within
    milliseconds. Only the one-shot clear before adw::init() is kept.
  * Fixed: every OBS Debian and Ubuntu package was built without any libadwaita
    feature and without the in-tab browser. debian.rules detected the versions
    correctly and then discarded them: a comment line inside a make continuation
    chain ends it, and each chain gets its own shell, so the feature variables
    were empty by the time cargo ran. Debian 13 and Ubuntu 26.04 shipped the
    libadwaita 1.5 baseline as a result.
  * Fixed: the RPM spec chose features from a hand-written distro table that had
    gone stale and had no VTE branch at all; the RPM on every GitHub release and
    every Homebrew install on macOS were in the same position. All of them now ask
    pkg-config --atleast-version, which also closes a second trap: a glob over
    --modversion does not match libadwaita 1.10.
  * Fixed: the Flatpak and Flathub builds passed only adw-1-8, so the new Command
    mode was unreachable in the channel most users install from. Both now build
    with adw-1-8, vte-0-78 and gtk-4-22, which the GNOME 50 runtime backs.
  * Fixed: four declarations in the application stylesheet had never applied —
    .monitoring-bar used margin-start/margin-end, which GTK's CSS does not have.
    The margins now appear. A new gate, scripts/check-css.sh, parses the sheet
    through the installed GTK and fails on any complaint.
  * Fixed: the monitoring mode picker no longer needs editing when a mode is
    added; seven hand-written index maps across four files are now one helper.
  * Fixed: openSUSE Slowroll had no package at all, because it was being handed a
    Rust built for a newer base than its own — "unresolvable: nothing provides
    libm.so.6(GLIBC_2.44)(64bit) needed by rust1.98". Slowroll and Tumbleweed take
    Rust from the same devel:languages:rust/openSUSE_Tumbleweed repository, but
    Tumbleweed sits on Factory with glibc 2.44 while Slowroll is a delayed Factory
    snapshot on 2.43, so the newest visible Rust is one it cannot install. Slowroll's
    own repository has rust1.97.1, above the 1.95 MSRV, but the path could not be
    dropped because cargo-packaging exists only in devel:languages:rust. Slowroll now
    builds with the bundled toolchain, as Fedora, Debian and Ubuntu already did, which
    removes the need for rust, cargo and cargo-packaging there. The four sites that
    must agree are driven by a single bundled_rust flag rather than a distro test
    repeated four times. Verified by parsing the spec in three colours before
    uploading: Tumbleweed unchanged, Slowroll switched, Fedora unchanged.
  * Fixed: no OBS Debian or Ubuntu package had ever contained the in-tab browser,
    because one build-dependency list was checked against another that did not have
    it. OBS assembles the chroot from the Build-Depends in debian.dsc, and
    dpkg-checkbuilddeps inside that chroot then validates debian.control — two
    separate lists that nothing keeps in sync. libwebkitgtk-6.0-dev was in neither,
    and debian.control asked for libwebkitgtk-6.0-dev | libglib2.0-dev, whose second
    branch is already present through libgtk-4-dev, so the check passed while
    WebKitGTK was never installed. debian.rules then probes with pkg-config, that
    probe failed, and web-embedded was compiled out of a build that reported success.
    Measured across all three deb targets in the 0.21.5 logs: libwebkitgtk-6.0-dev
    appears zero times and the detection line printed an empty web field. It is now
    listed in both files, so Debian 13, Ubuntu 24.04 and Ubuntu 26.04 get the
    embedded browser for the first time. Fixing only debian.control proves the
    mechanism — the build then fails with "dpkg-checkbuilddeps: unmet build
    dependencies", which is what happened when this was first attempted in 0.20.10
    and was then papered over by weakening debian.control instead of correcting the
    .dsc. Availability was checked on all three repositories first (2.52.6
    everywhere, above the 2.40 floor the bindings need). The RPMs were never
    affected — the spec has always required pkgconfig(webkitgtk-6.0) outright.
  * Fixed: the .deb and .rpm attached to a GitHub release named three fewer
    libraries than the binary loads, so the .deb failed in the dynamic linker
    before reaching main() with "error while loading shared libraries:
    libwebkitgtk-6.0.so.4" — on a package that had installed without complaint
    (#313, reported by Phil Clifford). Both artifacts are assembled by hand in the
    release workflow, the .deb with an inline control packed by dpkg-deb and the
    .rpm by fpm with an explicit --depends list, so neither ran the dependency
    machinery a normal build provides, and both lists fell behind the binary when
    web-embedded entered the crate's default features. Against the recursive
    closure of the old Depends (266 packages) three were unreachable:
    libwebkitgtk-6.0-4, libjavascriptcoregtk-6.0-1 and libasound2t64, the last
    from the RDP audio feature. The lists are now derived instead of remembered —
    dpkg-shlibdeps over the staged binaries for the .deb, --rpm-autoreqprov for
    the .rpm — and both steps fail the build if WebKitGTK is absent from the
    result. openssh-client and the gtk4 4.14 floor stay declared by hand, being a
    program and a version no referenced symbol proves. The .deb also regains the
    two Recommends its inline list had dropped, picocom among them.
  * Fixed: every tray menu item that opens a session did nothing — Local Shell,
    Quick Connect and all of Recent Connections, on KDE's StatusNotifier and on
    the macOS tray alike, since both feed the same dispatch. They went through
    the widget action muxer, which picks a group by splitting the name on the
    first dot, carrying names spelled for the window's own action group; with no
    prefix there was no group to find, the call returned FALSE and that was
    discarded. Recent Connections was broken twice over: it named connect, which
    is declared without a parameter and acts on the sidebar selection, so the
    connection picked in the tray had nowhere to arrive. All three now activate
    on the window's own action group, and tray messages are logged on arrival —
    this path had no logging at all, so a silent failure and a click that never
    reached the app looked identical.
  * Fixed: local shell tabs never took part in activity monitoring, in any mode.
    Resolving the configuration gave up when a session had no connection record,
    and the caller read that as "do not monitor this session", returning before
    the command-finished subscription was wired — so the new Command mode could
    not fire on a local shell whatever the shell emitted, Activity and Silence
    were equally absent, and there was no "Activity monitoring started" line to
    show any of it. A connection-less session now takes the global defaults,
    which is what they are for, and notifications use the tab's own name.
  * Fixed: five icon names had been dropped by adwaita-icon-theme 50 and drew as
    missing-image placeholders, one of them the success mark of the new Command
    mode. The app forces the Adwaita theme at startup for consistent
    availability, so a name the theme no longer carries resolves nowhere and GTK
    reports nothing — it surfaces only as a broken glyph. All nine call sites now
    use names verified present in the theme: the success mark, the four sync
    indicators, the Statistics empty state and two RDP quick actions.
  * Fixed: KeePassXC reported "Could not read the password" for a database that
    was open and healthy, in every non-English interface language. keepassxc-cli
    exits 1 for "entry not found", "wrong database key" and "database unreadable"
    alike, so they are told apart by matching its English prose — but it is a Qt
    program that translates that prose, and RustConn exports LANGUAGE to honour
    its own language setting. A merely missing entry was therefore classified as
    an unreadable database, which produced a misleading modal and, because that
    path returns an error rather than "no entry", also skipped "Also read from
    the encrypted file" — making a password sitting in credentials.enc
    unreachable. The child now gets LC_MESSAGES=C with LANGUAGE cleared, in the
    one place all six callers build their command, so the four other stderr
    matchers in that file are fixed by the same two lines. The character
    encoding is deliberately left as the user had it, so a non-ASCII group name
    or a database named Паролі.kdbx still works.
  * Fixed: two strings added in 0.21.4 — the Login Timeout row and its subtitle —
    shipped untranslated in all 17 languages. The template was never regenerated,
    so the completeness check passed by comparing against a template that was
    missing them too. Both are now translated everywhere.
  * Changed: packagers can build against GTK 4.18, 4.20 and 4.22 via new
    gtk-4-18/gtk-4-20/gtk-4-22 features. Enabling 4.22 surfaced three
    deprecations, all resolved.
  * Changed: new installations default to the Follow System terminal theme.
  * Dependencies: mio 1.2.2→1.2.3, open 5.4.2→5.4.3, toml 1.1.4→1.1.5

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 03 Sep 2026 13:01:55 +0300

rustconn (0.21.4-1) unstable; urgency=medium

  * Version bump to 0.21.4
  * Fixed: a SPICE connection with a stored password failed outright in Flatpak
    with "connection type cannot be detected from URI" (#308), a regression from
    the 0.21.2 fix in the same issue. The .vv connection file that carries the
    password was written to the sandbox $XDG_RUNTIME_DIR, whose path does not
    exist for the host remote-viewer launched through flatpak-spawn. The path is
    now translated to the host's own view and verified with a readability probe;
    when none can be confirmed the launch drops back to the URI and the viewer
    prompts, as it did before 0.21.2. No new Flatpak permissions.
  * Fixed: rustconn-cli add/update silently dropped --key and --auth-method for
    non-SSH protocols; both now reject the flags for any protocol other than SSH
    and SFTP, and update honours them for SFTP (previously ignored).
  * Fixed: --window-mode reported SPICE as supported while ignoring it; SPICE is
    always external, so it is excluded from supports_window_mode() and the code,
    CLI help and reference now agree.
  * Added: the automatic-login timeout (login_timeout_secs) is now editable in
    the connection editor's Automation tab; it was previously reachable only by
    hand-editing connections.toml.
  * Documentation: CLI reference and user guide realigned with the code —
    version headers, the --audio-mode and --printer RDP flags, web as a protocol,
    the update --mptcp/--skip-port-check semantics, the sync inventory
    subcommand, the full backend list and two missing split-view shortcuts.
  * Dependencies: aws-lc-rs 1.18.0→1.18.1, aws-lc-sys 0.44.0→0.45.0

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 02 Sep 2026 02:40:01 +0300

rustconn (0.21.3-1) unstable; urgency=medium

  * Version bump to 0.21.3
  * Fixed: a password the selected backend refused was moved into the encrypted
    file without asking, where the connect path never looks. Saving walked the
    fallback chain and wrote to credentials.enc, while connect-time resolution
    queries the selected backend alone — so a locked vault produced a password
    that was saved and, to the connection, missing. Saving now targets the
    selected backend only; a refusal opens a dialog naming the backend and
    offers the encrypted file as a deliberate choice. Reads still walk the
    chain so pre-switch passwords keep resolving.
  * Fixed: secret backends disagreed on how to report a failure, and three of
    them called an unreadable store a missing entry. KeePassXC turned every
    non-zero keepassxc-cli exit except invalid credentials into "entry not
    found"; pass treated any non-zero pass show as a miss and had no readiness
    check; and the KeePass resolve path fell through to the generic chain, so a
    locked database could serve a password from libsecret or the encrypted
    file. All three now separate "opened, entry absent" from "did not open" and
    answer like every other backend.
  * Fixed: secret status was reported with the wrong words, the wrong store, or
    not at all — "Secret Backend Not Configured" shown to a locked backend, a
    startup banner describing every backend as a keyring, Passbolt and Pass
    stuck on "Detecting…", and the pass readiness probe reading a different
    store than the backend uses. Each now reports the backend in force and
    whether it can store a password.
  * Fixed: the Bitwarden master password was demoted out of its Zeroizing
    wrapper before use, leaving copies in freed heap; both copies stay wrapped
    now, and the session-key length is no longer logged.
  * Fixed: an embedded RDP session against a Windows 11 host could be killed by
    the server's own keepalive (#262). ironrdp-session decodes every PDU on the
    MCS message channel as an auto-detect request, but that channel also carries
    the Heartbeat PDUs Windows 11 sends every one to two seconds; the first
    failed to decode and the session ended as a plain "Session error". A PDU the
    session layer cannot decode is now survivable when it arrived on the message
    channel, while a failure to parse the MCS framing itself stays fatal.
  * Fixed: an idle window with no connections showed network warnings during a
    Wi-Fi flap, the first reading "active sessions may be interrupted" when
    there were none. All transition paths now announce only when something is at
    stake, counted through the open session count; the socket sweeps still run
    on every transition.
  * Changed: "Enable fallback" is now "Also read from the encrypted file" and
    governs reads only — where a write goes is decided at save time, per the fix
    above.
  * Changed: the Secrets page reports whether the selected backend can actually
    store a password, with one Status line per backend, re-checked after
    settings are saved. SecretManager::retrieve_reported now reports which
    backend answered a read.
  * Documentation: the Bitwarden guide, architecture, user guide and build docs
    updated for the read/write asymmetry and for where the Bitwarden CLI keeps
    its login state under Flatpak (#312, #129).

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 01 Sep 2026 12:00:00 +0300

rustconn (0.21.2-1) unstable; urgency=medium

  * Version bump to 0.21.2
  * Fixed: SSH through a jump host could hang at the target password prompt
    when the ProxyCommand step was slow (#301). The target password was typed
    by a watcher that read the terminal and gave up after a fixed 10-second
    window measured from spawn, so a slow proxy handshake ate the whole budget
    and the session sat at "password:". SSH no longer types the password into
    the terminal at all; it is handed to OpenSSH through SSH_ASKPASS, which has
    no deadline to miss. The terminal watcher still logs Telnet and Serial in,
    and its window is now measured from the last terminal activity.
  * Changed: a stored SSH password is now given to OpenSSH through SSH_ASKPASS
    instead of typed into the terminal, with the secret in a mode-0600 runtime
    file whose path alone reaches the SSH environment. The helper answers only
    the prompt OpenSSH generates for the password method and refuses
    passphrase, host-key, keyboard-interactive and password-change prompts. No
    authentication method is pinned: a method the helper declines fails without
    consuming the secret and OpenSSH moves on, so an inherited group key is
    still offered and a server that tries keyboard-interactive first still
    reaches the password prompt. Where askpass does not apply — security-key or
    keyboard-interactive auth, a PKCS#11 token, a custom authentication or
    routing option, or a proxy declared in ~/.ssh/config (detected with
    ssh -G) — the terminal watcher does the typing as before, including the
    per-connection expected password prompt from #254.
  * Fixed: a SPICE connection asked for the password every time, whatever the
    password source (#308). SPICE runs in remote-viewer, and RustConn resolved
    and cached the password but never handed it to the viewer. It is now passed
    through a mode-0600 virt-viewer .vv connection file that the viewer deletes
    after reading; the secret never touches the command line or environment.
  * Fixed: the embedded web browser lost its login on every restart (#309). The
    per-connection network session was persistent, but WebKitGTK keeps cookies
    in a separate subsystem that stays in memory until set_persistent_storage
    is called. Cookies are now written to disk so a session survives a restart.
  * Fixed: a new Local Shell tab in Flatpak could open at the wrong size when
    the window had changed size since the last tab (#294). The spawn now waits
    for the terminal grid to settle before starting the host shell.

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 31 Aug 2026 12:00:00 +0300

rustconn (0.21.1-1) unstable; urgency=medium

  * Version bump to 0.21.1
  * Fixed: connections that authenticate with a key waited on a password
    manager lookup before every connect, then warned about the password they
    never wanted (#307). A user whose hosts are all key-authenticated, with no
    stored passwords at all, paid a full round trip each time; against the
    Bitwarden CLI that is several seconds, because it decrypts on every read,
    and the answer was the same every time. The empty answer is now remembered
    for five minutes, and the notice is only shown when the connection is
    actually set up to want a password. Which credential a connection uses is
    untouched: the cache sits after that decision, so a stale record can cost a
    lookup, never hand a connection the wrong password
  * Fixed: Local Shell failed to open on a host without script (#306). The
    button reported "Failed to start command: script" and nothing opened. The
    host shell is wrapped in script (util-linux) because that is what gives the
    shell job control — Ctrl-Z, fg, bg — and it was called unconditionally.
    Fedora moved the binary into a package of its own, util-linux-script, in
    F42, so a minimal install does not have it. The host is now probed and the
    shell is run directly when script is missing. Job control is lost in that
    fallback, which is a real downgrade and still better than a button that
    does nothing
  * Fixed: quitting from the tray put the confirmation dialog on a window the
    user was not looking at. Quitting with sessions open asks for confirmation,
    which is correct, and the tray route presented the window first only when
    it was hidden — but a window can be visible and still be behind others, on
    another workspace, or simply unfocused, and in each of those cases the
    dialog was drawn on a surface nobody was watching. The window is now
    presented whenever there is something to confirm
  * Fixed: the embedded browser was missing from every OBS .deb, so Web
    connections there offered only System and Custom with nothing to say why.
    debian.rules decides the feature for itself with pkg-config --exists
    webkitgtk-6.0, and nothing installed the dev package in the build chroot.
    It is now requested as libwebkitgtk-6.0-dev | libglib2.0-dev, so a
    repository that ships WebKitGTK 6.0 opts in and one that does not resolves
    to a package libgtk-4-dev already pulls in. All three deb targets ship it.
    The RPMs and the .deb attached to the GitHub release were never affected

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 28 Aug 2026 20:00:00 +0000

rustconn (0.21.0-1) unstable; urgency=medium

  * Version bump to 0.21.0
  * Fixed: a Jump Host set on a group or in Preferences was ignored when the
    connection actually opened (#301). It was stored, shown in the editor as
    inherited and synced between machines, then dropped at connect time — for
    SSH when picked from the dropdown, and for RDP, VNC and SPICE however it
    was set. The 0.20.9 notes said inheritance read the same for every
    protocol; it did not. All seven places that start a connection now resolve
    it the same way, including the check that stops the target's password being
    offered to the bastion's own prompt (#191). A free-text ProxyJump set on a
    group or globally still does not reach RDP, VNC or SPICE, which need a
    saved connection to open a tunnel through
  * Fixed: the Secrets page in Settings could stay empty instead of listing the
    password managers it found. Each manager is probed by running its
    command-line tool, the probes run together, and the page waited for the
    slowest — so one tool that never answered held all of them. The three most
    likely to do that are the three that reach out over the network or wait for
    a fingerprint prompt. Every probe now gives up after five seconds and
    reports that manager as unavailable
  * Fixed: a KeePass operation could freeze RustConn with no way out. Every
    call to keepassxc-cli waited indefinitely, so a database on a network share
    that had gone away, or one locked by another program, left the window
    unresponsive. Reads now give up after ten seconds and writes after thirty,
    and the message says what to look at — including a database whose
    key-derivation settings are too heavy for the machine, which is the cause
    nothing used to mention
  * Fixed: printing from an RDP session could stall the session itself.
    RustConn asks the local print system for the queue list when the connection
    opens, and sends the document through it when the guest prints; none of
    those waits had a limit. They are now bounded at two seconds, and losing
    the answer costs the printer list rather than the session
  * Security: nine advisory warnings are gone from the dependency list. The
    macOS tray brought in the entire GTK3 binding stack, unmaintained since
    2024, because the two crates behind it were taken with their default
    features. None of that code was ever compiled — it is Linux-only inside
    those crates and the tray is built only on macOS — but the advisories were
    reported on every platform, since the tools that report them read the lock
    file. Thirty-nine packages removed
  * Fixed: a translatable string could ship untranslated with every check
    reporting the catalogues complete, because nothing verified that the
    translation template still described the strings in the source. That had
    happened in three releases in a row. It is now checked, and the check runs
    before a release as well as in CI
  * Fixed: a Flatpak build could be stopped by any one of seven download hosts
    having a bad day, and one did — the 0.20.11 release build failed twice on a
    GNU mirror outage. The bundled sources now carry verified fallback mirrors
  * Changed: the interface for saving a password into a KeePass database now
    takes a protected string type rather than a plain one. No caller was
    leaking, but the old signature did not prevent the next one from doing so.
    This is a breaking change for anything building against rustconn-core
  * Improved: CI now builds and tests the macOS-specific code. Nothing outside
    the maintainer's own machine had ever compiled it, and a test guarding one
    of the low-level system calls had been failing there unnoticed
  * Dependencies: argon2 0.5 to 0.6 — the key derivation behind the encrypted
    credential stores. Existing files still open; that is now proved by a fixed
    test vector rather than assumed. quick-xml 0.41 to 0.42 in the connection
    importers

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 28 Aug 2026 12:00:00 +0000

rustconn (0.20.11-1) unstable; urgency=medium

  * Version bump to 0.20.11
  * Fixed: a telnet session left its process running after RustConn was closed
    (#304). Closing the window, pressing Ctrl+Q or quitting from the tray with
    session tabs open ended the application and left every telnet, ssh, picocom
    and shell child alive, so a device that allows one connection at a time
    stayed occupied. The per-tab kill added for #172 works; quitting never
    closes the pages, so it never ran
  * Fixed: quitting from the tray tore nothing down at all (#304, and #209/#236
    with it) — it called app.quit() directly, reaching neither the window's
    close handler nor the quit action, so it skipped the close confirmation,
    the external-viewer shutdown and the detached-window close as well. That is
    the exit path a tray user actually takes
  * Fixed: a pre_exec contract test in rustconn-pty-sys had never passed on
    macOS — it accepted ENOTTY and EPERM, and macOS answers ENODEV for
    /dev/null. CI has no macOS runner, so the one test guarding the unsafe
    block behind SSH password prompts failed only on the maintainer's platform
  * Fixed: SPICE refused to launch with "Install virt-viewer" on a machine that
    had virt-viewer, and Settings -> Clients called it not installed. Client
    detection spawned /usr/bin/which, so every probe reported "missing" on a
    system without that binary. Lookup is now resolved in process, for every
    client probe in the application, and SPICE additionally gained the Flatpak
    and snap search paths plus a flatpak-spawn --host fallback
  * Improved: binary lookup now searches /app/bin under Flatpak,
    $SNAP/{usr/bin,bin,usr/local/bin} under snap, the writable per-application
    CLI directories of either, and the Homebrew prefixes a macOS bundle launched
    from Finder does not inherit. The host probe is bounded at two seconds
  * Improved: one session teardown for every way the application can exit. The
    close handler, the quit action and the tray's Quit item each carried their
    own list and none was complete; three divergent copies is what #304 was
  * Improved: the CI clippy gate was passing on a cache hit rather than on a
    check — it caches target/ keyed on Cargo.lock, so an unchanged lock
    restored an already-linted tree and reported zero warnings without looking.
    Nineteen warnings had accumulated behind it; all are fixed, because this
    release changes both Cargo.lock and rustconn-core/src/lib.rs and so forces
    a real re-lint
  * FreeRDP (Flatpak) updated 3.30.0 -> 3.31.0. Upstream calls it a security
    release, lists 22 advisories and asks distributors to update immediately.
    Only Flatpak/Flathub bundle FreeRDP; the deb only recommends the
    distribution's own package, which its own security updates cover
  * waypipe (Flatpak) updated 0.11.0 -> 0.11.2
  * Dependency updates: chacha20 0.10.2, libredox 0.1.21, rtoolbox 0.0.6,
    uuid 1.26.0, wide 1.7.0. cargo audit and cargo deny report no
    vulnerabilities across 733 dependencies

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 27 Aug 2026 12:00:00 +0000

rustconn (0.20.10-1) unstable; urgency=medium

  * Version bump to 0.20.10
  * Note: no 0.20.9 package was ever built. Every 0.20.9 build job failed on
    the compile error below, so everything listed under 0.20.9 reaches users
    with this release. The 0.20.9 tag was left in place rather than moved,
    which would be destructive for anyone who already fetched it
  * Fixed: rustconn-cli did not compile with --features full, the set every
    package enables — 0.20.9 gave build_sftp_browser_uri a fourth argument
    for the new global jump-host tier and one call site, the file-manager
    branch of the sftp command, still passed three. That branch sits behind
    #[cfg(feature = "client-launch")] and the crate defaults to no features,
    so no local gate and no CI clippy run compiled it at all
  * Improved: scripts/verify.sh now runs clippy over rustconn-cli with
    --features full, and passes -D warnings on the existing clippy gate, so
    the local gate no longer approves a tree the packaging jobs reject

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 26 Aug 2026 12:00:00 +0000

rustconn (0.20.9-1) unstable; urgency=medium

  * Version bump to 0.20.9
  * Added: a connection can take its jump host from its group or from the
    application — three tiers are consulted, nearest first: the connection's
    own Jump Host, then the group chain, then a new Settings → Connection →
    Network group holding a Global Jump Host and a Global ProxyJump. A new
    Network Mode row on the editor's Basic page chooses between "Inherit from
    group or global" and "Direct" — on Basic rather than on the SSH page
    because the choice applies to every protocol and the protocol pages show
    only one at a time; rustconn-cli gained --network-mode inherit|direct
    (issue #301)
  * Added: the external RDP client can be told how to size its window — a new
    External Window row in the editor's Display group offers Fit to screen
    (the default), Fullscreen, Custom resolution and All monitors. It governs
    both the External client mode and the window an embedded session hands
    over to when IronRDP cannot serve the server; rustconn-cli gained
    --rdp-display-mode and --rdp-resolution
  * Fixed: an external RDP window opened at about a quarter of a 4K screen —
    the size handed to FreeRDP came from the embedded viewer's own widget
    geometry in logical pixels. Every RDP profile also stored a 1920x1080
    resolution nobody chose, which that path then applied; a connection that
    deliberately used a fixed size needs Custom resolution selected once
  * Fixed: External client mode ignored an RD Gateway completely and never
    filtered custom FreeRDP arguments, while Display Scale and Color Depth
    were collected from every connection and emitted by nobody. The three
    argument builders are now the single one in rustconn-core
  * Fixed: a group's Jump Host was never used — the picker stored the choice
    and showed it again when reopened, but nothing read it at connect time.
    Two further defects in the same dialog: a group configured with only a
    jump host opened with the SSH switch off and threw the host away on the
    next save, and the bastion rows were hidden until an authentication
    method was chosen (issue #301)
  * Fixed: whether a connection inherited its proxy depended on where it got
    its SSH key — the group chain was walked only when the key source was
    "Inherit from group", which made a group bastion and a connection-level
    key file mutually exclusive, while RDP, VNC and SPICE inherited
    unconditionally with no way to refuse. Inheritance now keys off Network
    Mode and reads the same for every protocol
  * Fixed: rustconn-cli group set --ssh-proxy-jump "" produced ssh -J "" — an
    empty value now clears the setting, for --ssh-agent-socket too, and a
    blank counts as unset at all three tiers, the hand-editable global one
    included
  * Fixed: a pinned connection's real row never updated — a pinned connection
    is in the sidebar twice and the four update walkers stopped at the first
    match, so the row in its group or at the root had no status icon,
    recording dot, external-viewer emblem or split marker, and its context
    menu offered Connect for a session that was already open (issue #302)
  * Fixed: the recording dot, the external-viewer emblem and the split marker
    vanished on any sidebar reload — a rename, a duplicate, a pin toggle, a
    re-sort or a drag-drop cleared them until the next session event
  * Fixed: the Simplified Chinese translation has never loaded, in any
    package — every install path derives the locale directory from the
    catalogue filename, so zh-cn.po was installed to share/locale/zh-cn/
    while gettext looks up zh_CN. The catalogue is now po/zh_CN.po and a
    stored zh-cn language choice keeps working
  * Fixed: Settings populated its connection dropdowns before it was given
    the connection list, so the startup-action picker had nothing to choose
  * Changed: the sidebar's "Open new session" is offered whenever there is a
    session to duplicate, not only for external-viewer sessions (issue #302)
  * Changed: a server that runs RDS licensing is named as such instead of
    "incompatible" — the session still falls back to the external FreeRDP
    client, which connects; the cause is upstream (IronRDP #1629)
  * Changed: an OpenH264 library that is installed but refused now says why —
    the loader compares its SHA-256 against the binaries Cisco itself
    publishes, so no distribution build can pass. RUSTCONN_OPENH264 names a
    library to try before anything else
  * Improved: every Secret Service call has a deadline, not just the GUI's
    whole credential resolution — rustconn-cli had no bound at all and could
    wait forever on a locked keyring
  * Improved: the ProxyJump row's subtitle names the bastion a connection has
    inherited, or says that Direct is ignoring one
  * Localisation: Simplified Chinese now loads; 13 new strings translated in
    all 17 locales
  * Dependencies: combine 4.6.7→4.6.8

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 26 Aug 2026 12:00:00 +0000

rustconn (0.20.8-1) unstable; urgency=medium

  * Version bump to 0.20.8
  * Fixed: the sidebar context menu did not open when there was no room for it
    below the pointer — the menu's minimum height was its full content, around
    700px, so near the bottom of a short display GTK had nowhere to place the
    popup and it never appeared. The menu now scrolls within a cap derived from
    the monitor height (issue #298)
  * Fixed: Embedded mode on Web connections reverted to System permanently —
    a build without the web-embedded feature read a stored "embedded" as
    System, and the next save of any connection rewrote the file, destroying
    the choice for every Web bookmark. All modes now exist in every build; the
    feature decides only whether Embedded can be run
  * Fixed: rustconn-cli --browser-mode embedded stored System instead
  * Fixed: editing a Web connection reset its page zoom and its certificate
    exception, and could adopt the custom browser command or user agent of the
    previously edited connection
  * Fixed: embedded RDP and VNC toolbars were barely readable on a light theme
    — a fixed dark background carried theme-coloured labels, so Copy, Paste
    and Autotype were near-black on near-black. All embedded toolbars now
    follow the local theme
  * Fixed: config writes contended with each other inside a single process,
    logging "waiting for another rustconn instance" with no other instance
    running; the wait was unbounded from the GTK thread, the async write held a
    blocking lock, and a single failure in the shutdown flush discarded all
    three pending files
  * Fixed: one credential lookup opened 25 encrypted Secret Service sessions —
    a separate D-Bus connection per credential field, times five lookup keys.
    Each operation now opens one, and the availability probe is cached
  * Dependencies: h2 0.4.18→0.4.19, open 5.4.1→5.4.2, syn 3.0.3→3.0.4

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 24 Aug 2026 12:00:00 +0000

rustconn (0.20.7-1) unstable; urgency=medium

  * Version bump to 0.20.7
  * Fixed: SSH sessions offered no way to reconnect once the connection ended
    — the disconnect handler was evicted by session logging, which registers
    on the same signal from an async callback, so no reconnect banner, sidebar
    offline indicator or auto-reconnect ever ran. Handlers are now keyed by
    purpose as well as by session (issue #297)
  * Fixed: cloned connections could not be edited and their right-click menu
    did not open — a recycled list row reported an invalid position, which
    cleared the sidebar selection every action re-resolves through, and an
    unresolved right-click was still claimed, cancelling the fallback gesture
    that would have worked (issue #298)
  * Fixed: sidebar context menu opened and vanished within a frame on GNOME
    Wayland — the menu was parented to a widget the list recycles, and the
    per-row menu held no input grab, which a Wayland compositor cancels.
    Menus are now parented to the enclosing scrolled window and take the grab
    on Wayland (issue #299)
  * Changed: moving the sidebar context menu between rows takes a second
    right-click on Wayland, a consequence of the grab above; X11 is unchanged
  * Dependencies: cc 1.4.3→1.4.4, cfg-expr 0.20.8→0.20.9, crc32fast
    1.5.0→1.5.1, font-types 0.12.3→0.12.4, icu_provider 2.3.0→2.3.1, keccak
    0.2.1→0.2.2, log 0.4.33→0.4.34, rustls-webpki 0.103.14→0.103.15, uuid
    1.24.1→1.25.0, zerovec-derive 0.11.5→0.11.6

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 23 Aug 2026 12:00:00 +0000

rustconn (0.20.6-1) unstable; urgency=medium

  * Version bump to 0.20.6
  * Fixed: RDP used the RemoteFX path even with OpenH264 installed — the H.264
    probe looked only for the unversioned libopenh264.so, which ships in the
    -dev package, so a runtime-only install of libopenh264-8 was reported as
    "not found". The known library directories are now scanned for versioned
    sonames, newest ABI first
  * Fixed: portable file passphrase could be discarded without saying why —
    the confirmation requirement was outranked by the strength advice, was not
    re-checked when the file path changed, and was reported nowhere after the
    Preferences window closed
  * Fixed: warning logged about a portable passphrase that was never entered
  * Fixed: spurious "Session not found" warnings when quitting with sessions
    open — the child is normally reaped before teardown asks to terminate it
  * Fixed: macOS Dock icon changed to a generic tile when the app was pinned
    and closed; the bundle is now registered with LaunchServices
  * Improved: sidebar connection status is set once per change instead of twice
  * Improved: header bar Shell button restyled flat so it no longer competes
    with the welcome screen's primary action
  * Improved: macOS UI font scaling, icon-only Settings tabs, tighter welcome
    rows
  * Packaging: libopenh264 added as a recommended package

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 21 Aug 2026 12:00:00 +0000

rustconn (0.20.5-1) unstable; urgency=medium

  * Version bump to 0.20.5
  * Fixed: Flatpak terminal still started at 24x80 on some hosts — the host
    shell now starts once the terminal widget has been allocated, so the
    host-side PTY that script creates inherits the real size (issue #294)
  * Fixed: shortcut recorder did not warn about conflicts with fixed
    shortcuts like Ctrl+V (Paste connection) — the checker now consults all
    eleven non-rebindable shortcuts (issue #295)
  * Removed: the stty call that claimed to forward window resizes to a
    Flatpak host shell; it acted on the wrong terminal and never worked
  * Documentation: WSL guide updated with Flatpak install option

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 21 Aug 2026 12:00:00 +0300

rustconn (0.20.4-1) unstable; urgency=medium

  * Version bump to 0.20.4
  * Added: portable encrypted file backend — passphrase-protected credential
    file that can be synced between machines via cloud storage, including
    across Linux and macOS (issue #293)
  * Fixed: terminal starts at the real window size instead of 24x80
    (issue #294)
  * Fixed: keyboard shortcuts window shows remapped bindings instead of
    defaults, and lists the shortcuts that cannot be rebound (issue #295)
  * Improved: rustconn-cli --backend accepts encrypted-file and portable
  * Security: credential store temp files are created 0600 rather than
    chmod'ed after the write
  * Localisation: new strings translated in all 16 locales

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 19 Aug 2026 12:00:00 +0300

rustconn (0.20.3-1) unstable; urgency=medium

  * Version bump to 0.20.3
  * Added: keyboard passthrough state is now saved across restarts
    (issue #274 follow-up)
  * Improved: sidebar tooltips show full tree path for nested items

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 17 Aug 2026 18:15:57 +0300

rustconn (0.20.2-1) unstable; urgency=medium

  * Version bump to 0.20.2
  * A polish release merging all outstanding community pull requests.
  * Added: Settings > Interface > Open session toolbar on hover — controls
    whether the floating RDP/VNC toolbar opens on pointer proximity or requires
    an explicit click (PR #286, contributed by Felipe Schneider)
  * Fixed: duplicating a connection with vault credentials left the duplicate
    without a stored secret — connecting prompted for a password (PR #280,
    contributed by Felipe Schneider)
  * Fixed: a reconnected terminal stacked child-exited handlers, running the
    disconnect path N+1 times after N reconnects (PR #283, contributed by
    Felipe Schneider)

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 15 Aug 2026 00:00:00 +0300

rustconn (0.20.1-1) unstable; urgency=medium

  * Version bump to 0.20.1
  * Added: Settings > Interface > Window > Show connection name in split panes —
    a compact colored header at the top of each split pane showing the
    connection name and protocol, off by default (#277)
  * Fixed: group names are now unique per parent folder rather than globally, so
    hierarchies like "Site A/RDP" and "Site B/RDP" are possible and CSV imports
    no longer merge unrelated branches (#291)
  * Fixed: a split pane could not be closed at all when its connection had the
    floating toolbar switched off — the panel's own detach and close buttons
    were suppressed along with the session toolbar (#260 follow-up)
  * Fixed: RDP — xrdp hosts no longer stop at their own greeter after a
    successful NLA exchange; INFO_AUTOLOGON is now set when credentials are
    available (#290)
  * Fixed: opening the connection dialog crashed the application when an SSH
    agent key had a non-ASCII comment — the comment was sliced at byte offsets
    and is now measured and cut in characters (#278)
  * Fixed: vault credentials were not found for connections inside a group —
    saving used the hierarchical key and resolving searched only the flat one,
    so every connection in a folder prompted for a password (#289)
  * Fixed: minimizing to tray silently destroyed port forwards, recordings and
    external viewers; the tray decision now runs before any teardown (#279)
  * Fixed: a post-disconnect automation task froze the entire application for up
    to 60 seconds — it now runs on a background thread (#281)
  * Fixed: remote session recordings were lost when quitting the application;
    the retrieval now runs inline on shutdown, bounded by ConnectTimeout=5 (#282)
  * Fixed: Web embedded — links requesting a new view (target="_blank",
    window.open) did nothing; the URI is now loaded in the same view (#288)
  * Fixed: the network monitor reported a false outage on every Flatpak launch,
    and its debounce erased short down-up flaps so the recovery sweep never
    ran (#284)
  * Fixed: a session closed with "exit" was silently reconnected on the next
    Wi-Fi roam — the sweep now requires explicit eligibility, not just a
    visible reconnect banner (#285)
  * Fixed: Web embedded — the toolbar's reveal handle was unreachable in a split
    pane, buried under the split view's own panel arrow at the same corner; the
    handle is back at the top centre for every viewer
  * Fixed: three strings new in this release reached only Ukrainian, one of them
    never extracted into the POT at all; all 16 catalogues are complete again
  * Improved: scripts/release.sh now runs "typos", the last CI gate it did not,
    so a red Hygiene job cannot reach a tag
  * Dependencies: cc 1.4.3, inotify 0.11.5, pkg-config 0.3.34, safe_arch 1.2.0
    and the ICU/zerovec family at 2.3.0, all transitive

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 14 Aug 2026 12:00:00 +0300

rustconn (0.20.0-1) unstable; urgency=medium

  * Version bump to 0.20.0
  * Added: opening a cluster now labels every member tab with a tab group named
    after the cluster, so it reads "[cluster] host"; Close All in Group on any
    member closes the whole cluster and Close All Ungrouped keeps open clusters
  * Added: signed build provenance for every .deb, .rpm, AppImage and Flatpak
    bundle attached to a GitHub release — verify a download with
    "gh attestation verify <file> --repo totoshko88/RustConn"
  * Added: Web embedded mode — auto-hide floating toolbar with reveal zone
    matching RDP/VNC behavior
  * Added: Settings > Interface > Rendering — Automatic, Hardware (GPU) or
    Software (Cairo), applied at the next start (#274)
  * Fixed: an RDP, VNC, SPICE or Web member of a cluster was never registered in
    it, so "Disconnect all cluster sessions" could not close it — cluster
    membership is now resolved for every protocol, not just terminals
  * Fixed: a tab returning from a split pane lost its "[group]" title label
  * Fixed: the floating viewer toolbar was revealed but not clickable for its
    first two seconds in RDP, VNC and Web sessions; it only became usable
    after auto-hiding once and being re-revealed from the arrow handle
  * Fixed: choosing a non-system interface language cost macOS users the tray
    icon — applying the language re-executed the process, which destroys the
    LaunchServices scene registration the tray needs; the re-exec is gone (#158)
  * Fixed: Web zoom shortcuts (Ctrl+/-/0) did not work in split view —
    keyboard events were intercepted by WebKitGTK before reaching the
    application's EventControllerKey
  * Fixed: Web toolbar clipped instead of collapsing in a narrow split
    panel; it now folds Home, Autofill and Zoom into a "..." popover like
    the RDP and VNC toolbars, and the collapse point is measured from the
    toolbar rather than compared against a fixed pixel breakpoint
  * Fixed: the Web reveal handle sat over the top centre of the page, where
    sites put their logo and navigation, and the floating toolbar ignored the
    local theme — a light URL bar inside a dark bar on a light desktop
  * Fixed: a failed Web page load left the toolbar logic unrun, and the
    60-second load timeout reported nothing to the user
  * Fixed: the header bar's busy spinner lost its accessible name
  * Fixed: macOS inside a virtual machine had input lag, late frames and
    stuttering scroll — the paravirtualised GPU has no accelerated OpenGL,
    so the automatic renderer choice now detects a hypervisor and selects
    the Cairo renderer (#274)
  * Fixed: seven translatable strings were present in the source but in no
    catalogue, rendering as English in every locale; now translated in all
    16 locales
  * Fixed: POTFILES.in did not list the two modules extracted from
    terminal/mod.rs, failing the i18n check
  * Changed: the 60-second Web load timeout now reports itself in the
    reconnect banner with a Reload button
  * Improved: neither the X11 Cairo fallback nor the language selection
    re-execs the process any more — both environment writes moved into the new
    rustconn-env-sys crate, which guards them the way rustconn-locale-sys
    guards setlocale, so startup spawns two processes fewer and macOS shares
    the same code path
  * Improved: terminal/mod.rs split into three modules — 4365 lines down to
    3052, with tab_lifecycle.rs and session_lifecycle.rs extracted
  * Improved: adw::Spinner is used where the runtime has it (libadwaita
    1.6+, via the opt-in adw-1-6 feature) and gtk4::Spinner where it does
    not; the choice moved from six call sites into one module. The build
    baseline stays libadwaita 1.5, so Ubuntu 24.04 and snap core24 still
    build
  * Improved: build dependencies now state the versions the crate features
    require — libadwaita-1-dev (>= 1.5), libvte-2.91-gtk4-dev (>= 0.76)
  * Improved: the three FFI crates now inherit the workspace clippy lint set;
    they had been the only crates in the workspace with no lints at all
  * Documentation: how to verify a downloaded release artifact, in
    docs/INSTALL.md and SECURITY.md

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 13 Aug 2026 12:00:00 +0300

rustconn (0.19.22-1) unstable; urgency=medium

  * Version bump to 0.19.22
  * Fixed: KeePassXC "Don't save" mode did not unlock the database on
    demand, reporting credentials as missing (#273)
  * Improved: Sidebar search uses a cached search engine with result
    caching for better responsiveness on large databases
  * Improved: Keyboard group dropdowns now show what "Automatic" actually
    sends — Automatic (^?) for Backspace, Automatic (\e[3~) for Delete —
    so users know which option to select when the default fails (#271)

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 12 Aug 2026 17:00:00 +0300

rustconn (0.19.21-1) unstable; urgency=medium

  * Version bump to 0.19.21
  * Fixed: RustConn did not start at all on Fedora 44 — the setlocale
    guard required exactly one live thread, a state an application
    cannot arrange, and aborted the process at startup (#271)
  * Changed: the thread-count clause of the setlocale contract is
    documented as a judgement rather than a proof (#267)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 11 Aug 2026 23:26:05 +0300

rustconn (0.19.20-1) unstable; urgency=medium

  * Version bump to 0.19.20
  * Added: SSH/MOSH connections can choose what Backspace and Delete
    send (#271)
  * Fixed: Saving Preferences threw away the Backspace/Delete choice on
    a live session (#271)
  * Fixed: SFTP connections offered a Keyboard group that did nothing
    and could overwrite the stored value (#271)
  * Fixed: RDM JSON import still aborted on an integer field, and one
    bad entry cost the whole file (#234)
  * Fixed: Royal TS Telnet sessions were imported as SSH on port 22
    (#234)
  * Fixed: Royal TS import gave no hint why connections came in without
    a password (#234)
  * Fixed: Import warnings were permanently English (#234)
  * Fixed: An import that produced nothing claimed success (#234)
  * Fixed: KeePass database password was never written to the system
    keyring (#272)
  * Fixed: Re-entering a vault password in Settings was discarded as
    no change (#272)
  * Fixed: Bitwarden, 1Password and Passbolt had the same keyring hole
    as KeePass (#272)
  * Fixed: 1Password and Passbolt wrote a placeholder literal to disk
    (#272)
  * Fixed: Moving a secret from encrypted file to system keyring
    destroyed it (#272)
  * Fixed: Turning a backend off left the old keyring entry behind
    (#272)
  * Fixed: A failed keyring write was a log line under a Settings saved
    toast (#272)
  * Changed: RUSTSEC-2026-0244 resolved via new rustconn-locale-sys
    crate (#267)
  * Dependencies: gettext-rs 0.7.7→0.8.0

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 11 Aug 2026 12:00:00 +0200

rustconn (0.19.19-1) unstable; urgency=medium

  * Version bump to 0.19.19
  * Fixed: Deleting a connection now removes its credential from the
    password vault (#263)
  * Fixed: Renaming a connection in the configuration panel now updates
    the vault entry (#263)
  * Fixed: Credentials of connections outside any group were missed by
    vault cleanup and migration
  * Fixed: System Keyring entries are now visible in KDE Wallet — the
    item label uses / instead of : as separator (#264)
  * Fixed: Moving a connection between groups no longer orphans its
    keyring entry (#264)
  * Fixed: Deleting a group with a vault password no longer leaves a
    mangled orphan entry in KeePass
  * Fixed: macOS Keychain credentials were stored where the resolver
    never looked
  * Improved: Keyring credential retrieval wipes its intermediate
    plaintext buffers
  * Changed: Saved interface language is now applied only during startup,
    before any thread exists (RUSTSEC-2026-0244 mitigation)

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 09 Aug 2026 20:00:00 +0200

rustconn (0.19.18-1) unstable; urgency=medium

  * Version bump to 0.19.18
  * Fixed: Renaming a connection now updates the credential entry in
    the password vault (#263)
  * Fixed: System Keyring password collision for same-named connections
    in different groups (#264)
  * Fixed: KeePass database password keyring entry now namespaced with
    RustConn prefix (#265)
  * Changed: System Keyring credentials transparently migrated to new
    hierarchical key format on first access

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 09 Aug 2026 18:00:00 +0200

rustconn (0.19.17-1) unstable; urgency=medium

  * Version bump to 0.19.17
  * Fixed Settings panel wiping in-memory KeePassXC database password on
    close (#259)
  * Fixed OCI CLI version detection showing Python tracebacks
  * Improved Settings dialog: dirty-tracking, async vault unlock/check,
    background keyring saves, SSH agent error toast
  * Improved Import dialog: async file parsing, clear error messaging
  * Improved Export dialog: non-blocking open location

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 08 Aug 2026 18:00:00 +0200

rustconn (0.19.16-1) unstable; urgency=medium

  * Version bump to 0.19.16
  * Fixed embedded RDP reading the local clipboard on every desktop copy
    instead of only when the server requests a paste (#261)
  * Fixed Clipboard Off setting not gating toolbar Copy, Paste and
    Type Clipboard buttons (#261)

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 08 Aug 2026 12:00:00 +0200

rustconn (0.19.15-1) unstable; urgency=medium

  * Version bump to 0.19.15
  * Fixed embedded RDP sessions in Automatic graphics mode showing a frozen
    desktop: now advertises only AVC420, not AVC444 (#262)
  * Fixed scrolling, window drags and solid fills silently discarded in GFX
    sessions: the handler now composites SolidFill, SurfaceToSurface,
    SurfaceToCache and CacheToSurface operations (#262)
  * Fixed sessions with no OpenH264 opening a GFX channel they could not
    paint through (#262)
  * Fixed session status bar reporting a graphics pipeline the session was
    not using (#262)
  * Fixed pressing Backspace in a session killing the whole window due to a
    VTE assertion failure
  * Fixed embedded RDP clipboard watcher leak causing coredumps (#261)
  * Improved embedded RDP rendering performance: cached scale, skip
    unnecessary background paint, nearest-neighbor filtering
  * Improved split view panel buttons auto-hide behind an arrow indicator

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 07 Aug 2026 12:00:00 +0300

rustconn (0.19.14-1) unstable; urgency=medium

  * Version bump to 0.19.14
  * Added a Local Shell button to the empty split panel, next to Select Tab,
    for starting a scratch shell in that panel
  * Fixed closing one pane taking the whole split layout apart
  * Fixed session logs losing output and repeating whole screens: the
    transcript is now written from the session's own PTY instead of being
    read back out of the terminal widget (#247)
  * Fixed opening Settings panel corrupted KeePassXC config (#259)
  * Improved: one PTY path for every session on every platform (#175)

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 06 Aug 2026 12:45:00 +0300

rustconn (0.19.13-1) unstable; urgency=medium

  * Version bump to 0.19.13
  * Added US Dvorak RDP keyboard layout (PR #258)
  * Fixed RDM JSON import rejecting real-world Devolutions exports containing
    numeric fields where strings were expected (#234)
  * Improved session transcript to capture initial output within 500 ms
    instead of waiting 5 seconds (#247)
  * Improved embedded RDP and VNC toolbar: now floats as an auto-hide overlay
    that does not consume vertical space or affect session resolution

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 06 Aug 2026 02:09:30 +0300

rustconn (0.19.12-1) unstable; urgency=medium

  * Version bump to 0.19.12
  * Added preservation of terminal history across a reconnect, with a dim rule separating the old output from the new session (#253)
  * Added automatic login for Telnet and serial sessions, with configurable Username Prompt and Password Prompt fields inherited down the group chain (#254)
  * Added Remove from Split (Ctrl+Shift+R) and Remove Split (Ctrl+Shift+J) so a session can leave a split view without being closed (#252)
  * Fixed connect detection and prompt detection reading the oldest scrollback instead of the visible screen (#253)
  * Fixed an expect-rule response being written to the application log in clear text
  * Fixed "Move to New Tab" and "Close Connection" in a split pane's context menu doing nothing (#252)
  * Fixed a collapsed split leaving its layout behind, which the next split then reused
  * Fixed broadcast mirroring keystrokes out of a session that had left the split
  * Fixed SFTP being unable to reach a host behind a jump host: mc's sh:// VFS now receives the connection's SSH options through a generated ssh_config behind a PATH wrapper (#255)
  * Fixed a jump host picked from the connection list being invisible to every SFTP path; chain resolution moved into rustconn-core::connection::jump_chain
  * Fixed rustconn-cli sftp refusing connections whose protocol is SFTP
  * Fixed a pre-connect port check running against hosts reachable only through a hand-typed ProxyJump
  * Fixed ${password} in an expect-rule response resolving to an empty string: the four built-in placeholders are now supplied from the connection at connection time, and substitution validates for a terminal instead of for a shell, so a password containing shell metacharacters survives (#257)
  * Fixed a backslash inside a resolved expect-rule value being reinterpreted as an escape sequence
  * Fixed a failed expect-rule substitution typing the literal placeholder into the session; the rule is now skipped with a warning
  * Improved prompt watching by replacing three duplicated implementations with window::prompt_autofill::install_login_autofill
  * Improved testability by moving prompt matching into rustconn-core::connection::login_prompt
  * Improved the file-manager SFTP path, which now warns that it cannot route through a jump host instead of failing silently
  * Updated dependencies: ipnet 2.12.0 to 2.12.1, libredox 0.1.18 to 0.1.19
  * Documented Automatic Login for Telnet and Serial in the user guide

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 04 Aug 2026 12:00:00 +0300

rustconn (0.19.11-1) unstable; urgency=medium

  * Version bump to 0.19.11
  * Fixed the Homebrew release automation patching only commented-out examples, which left the tap formula pinned to v0.19.6 since that release (#251)
  * Fixed KeePassXC group passwords failing to load when the database is password-protected: both group dialogs now pass the stored master password (#250)
  * Fixed the snap keyring error naming the exact snap connect command instead of implying the keyring is broken (#249)
  * Improved embedded RDP CPU usage for background tabs: the polling loop now skips 15 of every 16 ticks when the drawing area is not mapped
  * Improved connection and group listing with list_connections_owned and list_groups_owned, removing the intermediate Vec<&T> at 39 window call sites and in both persist paths
  * Improved the readability of setup_ironrdp_polling by extracting its event handling into polling_handlers.rs behind two borrowed context structs
  * Improved allocation behaviour in hot paths with with_capacity hints for trash, the group hierarchy index and sidebar filtering
  * Improved responsiveness of emptying the trash by moving webkit session directory removal to a background thread
  * Removed PackageManager, detect_package_manager and get_system_install_command from the rustconn-core re-exports
  * Documented password-manager-service as a manual snap interface, which it has always been

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 02 Aug 2026 12:00:00 +0300

rustconn (0.19.10-1) unstable; urgency=medium

  * Version bump to 0.19.10
  * Added "Session Logs..." to the primary menu and "Session Log..." to a connection's context menu, opening the directory that connection actually writes to (#247)
  * Added expansion of a leading ~ in a log path template; a relative template now resolves inside the log directory from Settings (#247)
  * Fixed session logging configured on a connection never writing anything: the Logs tab settings had no reader outside the dialog (#247)
  * Fixed session logs recording typed passwords in clear text; every written line is now redacted (#247)
  * Fixed "Retention (days)" never deleting a file: age-based pruning now also runs when a session log is opened (#247)
  * Fixed the "Timestamps" switch doing nothing; it now controls the session transcript layout (#247)
  * Fixed a log file that could not be created failing silently; the failure now raises an error toast naming the reason (#247)
  * Fixed the KDBX "Use password" and "Use key file" switches only hiding rows without changing which credentials opened the database
  * Fixed eight RDP and VNC dropdown labels being untranslated in every language
  * Fixed RDP and VNC sessions freezing instead of reconnecting after the computer woke from sleep: both embedded clients now set TCP keepalive and TCP_USER_TIMEOUT (#248)
  * Added resume detection so a session frozen by a suspend is dimmed and offered its reconnect banner immediately (#248)
  * Fixed picking a key from the SSH agent not restricting which key was offered: the choice is now passed as -i with IdentitiesOnly=yes
  * Changed an empty per-connection Log Path to mean the log directory from Settings
  * Removed the Encrypted Documents feature, which was never reachable from the user interface
  * Removed ProgressDialog, a second unused retry model, three unreachable menu actions and two configuration fields nothing read
  * Updated time 0.3.54 to 0.3.55

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 01 Aug 2026 12:00:00 +0300

rustconn (0.19.9-1) unstable; urgency=medium

  * Version bump to 0.19.9
  * Added a three-state RDP audio setting: play on this computer, on the remote computer, or not at all (#245)
  * Fixed the RDP audio setting being ignored at connect time, which left every session with audio disabled (#245)
  * Fixed custom FreeRDP arguments being dropped silently in embedded mode (#245)
  * Fixed the disabled audio backend still advertising volume control (#245)
  * Pinned the PulseAudio and ALSA backends in the bundled FreeRDP so it cannot ship without sound (#245)
  * Fixed the snap package failing to start because WebKitGTK libraries were missing from the runtime (#244)
  * Added a CI check that resolves every snap binary's shared libraries before publishing (#244)
  * Fixed RDP through an RD Gateway resolving the target host locally and failing (#246)
  * Fixed the RD Gateway tunnel sending an empty user name and a portless endpoint (#246)
  * Fixed a failed gateway tunnel stranding the session instead of falling back to FreeRDP (#246)
  * Fixed gateway connections to a target port other than 3389 going to the wrong port (#246)
  * Fixed .rdp import reading the gateway port from a non-standard field (#246)
  * Updated clap 4.6.4 to 4.6.5

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 01 Aug 2026 09:47:55 +0300

rustconn (0.19.8-1) unstable; urgency=medium

  * Version bump to 0.19.8
  * Added a setting to open a new session on every double-click (#242)
  * Fixed Remote Desktop Manager JSON import aborting on the first entry: ConnectionType is a numeric enum in real exports (#234)
  * Fixed RDM import losing usernames, passwords and the folder hierarchy: Url/UserName/nested Credentials and Group paths are now read (#234)
  * Fixed Royal TS import skipping every RDP connection: the object is RoyalRDSConnection with RDPPort (#234)
  * Fixed Royal TS connections importing without a username: credentials assigned by name, typed inline, or inherited from the folder are now resolved (#234)
  * Added support for compressed .rtsz containers and uncompressed .rtsx Royal TS documents (#234)
  * Fixed XML entities corrupting imported Royal TS names (#234)
  * Fixed Royal TS export writing RoyalRDPConnection, an element Royal TS cannot read
  * Unsupported import entries are now reported as skipped with their source type (#234)
  * Updated dependencies: hybrid-array 0.4.13→0.4.14, wide 1.5.0→1.6.0

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 31 Jul 2026 01:14:04 +0300

rustconn (0.19.7-1) unstable; urgency=medium
  * Version bump to 0.19.7
  * Fixed double-click on a connection focusing a disconnected tab instead of connecting (#242)
  * Fixed Enter in the connection sidebar doing nothing
  * Implemented "Restore sessions on startup", which had no effect at all (#243)
  * Fixed an unresolvable hostname aborting the connection instead of skipping the probe (#241)
  * Added host-side resolution of mDNS .local names inside Flatpak (#241)
  * Added ${password} to Custom Command templates, passed via environment, never via a command line (#151)
  * Fixed Host, Port, Username and password not being editable for a Custom Command (#151)
  * Fixed a password-only connection never caching its resolved credential
 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 30 Jul 2026 00:06:00 +0300

rustconn (0.19.6-1) unstable; urgency=medium

  * Version bump to 0.19.6
  * Fixed auxiliary keyring operations using Linux-only secret-tool on macOS
  * Added local-only macOS CI, dependency, signing, and bundle audit workflow
  * Improved the canonical macOS app and DMG to bundle and relocate 58 non-system dylibs
  * Added explicit ad-hoc and Developer ID hardened-runtime signing plus notarization and stapling
  * Expanded cargo-deny checks to aarch64 and x86_64 macOS targets
  * Synchronized the canonical macOS feature profile across build and packaging paths
  * Updated dependencies: displaydoc 0.2.6→0.2.7, toml 1.1.3→1.1.4

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 29 Jul 2026 12:00:00 +0300

rustconn (0.19.5-1) unstable; urgency=medium

  * Version bump to 0.19.5
  * Fixed SSH session dying with "path too long for Unix domain socket" on long hostnames (issue #239)
  * Fixed ${variable} placeholders never substituted in a Custom Command template (issue #151)
  * Fixed Custom Command leaving a dead terminal tab behind after a one-shot launcher exits
  * Fixed Tags field hidden for Custom Command and other Zero Trust connections
  * Fixed in-place reconnect breaking a Custom Command line
  * Fixed folders could not be nested by drag and drop in the sidebar (issue #237)
  * Fixed multi-codepoint emoji icons (ZWJ sequences, flags, keycaps) saved but never drawn
  * Improved fallback to a visible icon when the active theme lacks the stored icon name
  * Improved localization: new string translated in all 16 languages
  * Updated dependencies: socket2 0.5→0.6, aes, clap_complete, event-listener, toml_parser, tray-icon

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 28 Jul 2026 00:01:23 +0300

rustconn (0.19.4-1) unstable; urgency=medium

  * Version bump to 0.19.4
  * Added detachable session windows (issue #236)
  * Fixed RDP connection failing when the server only supports Standard RDP Security (issue #235)
  * Fixed FreeRDP fallback broken on FreeRDP 3.24/3.25 due to the args-from file: prefix
  * Fixed CredSSP logon failures triggering a pointless FreeRDP fallback
  * Removed dead external_window module (ExternalWindowManager)
  * Improved RDP failure classification moved into rustconn-core
  * Improved single code path for building a session's tab content
  * Improved localization: new strings translated in all 16 languages

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 27 Jul 2026 01:57:32 +0300

rustconn (0.19.3-1) unstable; urgency=medium

  * Version bump to 0.19.3
  * Added option to hide Welcome tab at startup (issue #232)
  * Fixed FreeRDP fallback fails on FreeRDP 3.26+ due to args-from exclusivity (issue #234)
  * Fixed RDP clipboard syncing even when disabled in connection settings (issue #233)
  * Fixed SSH MPTCP used non-existent TCPMultipath option (issue #231)

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 23 Jul 2026 22:00:00 +0300

rustconn (0.19.2-1) unstable; urgency=medium

  * Version bump to 0.19.2
  * Added Multipath TCP (MPTCP) support for SSH, RDP, and VNC connections
  * Fixed VPN connect/disconnect no longer kills healthy SSH sessions

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 23 Jul 2026 01:06:02 +0300

rustconn (0.19.1-1) unstable; urgency=medium

  * Version bump to 0.19.1
  * Fixed RDP certificate mismatch causing silent connection failure (exit 255)
  * Fixed SSH password auto-fill intermittently stuck on prompt

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 21 Jul 2026 18:00:00 +0300

rustconn (0.19.0-1) unstable; urgency=medium

  * Version bump to 0.19.0
  * Added embedded WebKitGTK 6.0 web browser for Web connections (Linux)
  * Added browser mode selection: Embedded, System, or Custom browser command
  * Added per-connection persistent sessions with isolated cookies and local storage
  * Added navigation toolbar with back/forward/reload/home and zoom controls
  * Added credential autofill via JavaScript injection and HTTP Basic Auth
  * Added JavaScript enable/disable toggle per connection
  * Added split view support for embedded web alongside terminals
  * Added web-embedded feature flag (default on Linux, excluded on macOS)

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 20 Jul 2026 00:17:13 +0300

rustconn (0.18.12-1) unstable; urgency=medium

  * Version bump to 0.18.12
  * Added Graphics Pipeline selector for embedded RDP connections (issue #218)
  * Fixed missing mouse cursor on remote Wayland VNC sessions (issue #220)

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 18 Jul 2026 12:00:00 +0200

rustconn (0.18.11-1) unstable; urgency=medium

  * Fixed: Missing mouse cursor on remote Wayland sessions over VNC (#220)
  * Fixed: Embedded RDP retry without GFX pipeline before falling back to
    external FreeRDP (#218) — avoids NLA race on single-session servers
  * Fixed: Nix flake tests no longer run during nix build (doCheck = false)
  * Fixed: Nix flake duplicate CHANGELOG entry merged

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 16 Jul 2026 14:00:00 +0200

rustconn (0.18.10-1) unstable; urgency=medium

  * Added Nix flake for NixOS / Nix users
  * Fixed: Embedded RDP to Windows Server 2019 with AD auth false
    "Server Incompatible" fallback (#218) — watchdog timeout raised to 15s
  * Fixed: FreeRDP fallback "Authentication failed" on single-session servers
  * Dependencies: bitflags 2.13.0→2.13.1, clap 4.6.1→4.6.2, ksni 0.3.5→0.3.6,
    regex 1.13.0→1.13.1, sspi 0.21.1→0.21.2, uuid 1.23.5→1.24.0

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 16 Jul 2026 12:00:00 +0200

rustconn (0.18.9-1) unstable; urgency=medium

  * Security: vault password retrieval now returns Zeroizing<String>
  * Security: clipboard password wrapped in Zeroizing<String>
  * Fixed: pre/post-connect tasks enforce 60s timeout ceiling
  * Fixed: keyring save operations have 5s timeout
  * Improved: deny.toml cleanup (removed stale ignores)
  * Dependencies: FreeRDP 3.28.0 → 3.29.0 (22 security fixes)

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 15 Jul 2026 12:00:00 +0200

rustconn (0.18.8-1) unstable; urgency=medium

  * Version bump to 0.18.8
  * Fixed: Connections stop working when switching network interfaces (#217)
  * Fixed: SSH connections hang for minutes after VPN/network change
  * Fixed: New SSH connections fail after interface switch
  * Fixed: Terminal keyboard shortcuts work after remapping (#216)
  * Improved: Network monitor skips reconnect behind captive portals
  * Improved: Network monitor rate-limits reactions during VPN loops
  * Improved: Embedded RDP/VNC sessions reconnect on network change

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 14 Jul 2026 12:00:00 +0200

rustconn (0.18.7-1) unstable; urgency=medium

  * Version bump to 0.18.7
  * Headless core-cli cleanup: rustconn-core defaults to empty features,
    rustconn-cli is minimal by default with optional client-launch and
    secret-management features
  * System keyring (oo7/macOS Keychain) gated behind system-keyring feature
  * NO_COLOR env var handling follows the no-color.org spec
  * Disabled keyring backends now log at warn level
  * Updated lockfile: cc 1.2.67, http-body 1.1.0, mio 1.2.2, open 5.4.0,
    rand 0.9.5, rustls 0.23.42, uuid 1.23.5

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 13 Jul 2026 12:00:00 +0200

rustconn (0.18.5-1) unstable; urgency=medium

  * Version bump to 0.18.5
  * Added EGFX graphics pipeline with H.264/AVC decoding via OpenH264 (dlopen)
    for dramatically better image quality over WAN connections
  * Added Native Display Scale mode uses real fractional compositor scale for
    pixel-perfect rendering on 125%/150% displays
  * Fixed 3-4 redundant screen repaints on initial RDP connection (toolbar
    layout race condition)
  * Improved adaptive session polling reduces idle CPU usage by 3x on static
    desktops (16ms active / 50ms idle)
  * Improved clipboard file transfers no longer stall the RDP event loop
    (async I/O via spawn_blocking)
  * Improved password intermediate is now zeroized immediately after handoff
    to IronRDP connector
  * Improved Cairo downscale filter quality (Filter::Good) when Display Scale
    exceeds 1x
  * Many bug fixes for terminal search, settings persistence, snippet editor,
    tunnel builder, sidebar indicators, and more
  * New dependencies: ironrdp-egfx 0.3.0, openh264 0.9.7, safe_arch, wide

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 11 Jul 2026 12:00:00 +0200

rustconn (0.18.4-1) unstable; urgency=medium

  * Version bump to 0.18.4
  * Added SFTP file browser now opens in the login home directory instead of the
    server root, with an optional SFTP Remote Directory field to pin a path (#212)
  * Fixed external viewers (TigerVNC, FreeRDP, remote-viewer) left as zombies when
    shutdown() ran without the process exiting; they are now reaped
  * Improved sidebar bottom toolbar to match the header bar's icon size and spacing
  * Improved SFTP home-directory resolution: failed probes are cached, a per-connection
    SSH agent socket is honoured, and keepalives stop a stalled probe pinning the worker
  * Dependency updates: libadwaita 0.9.1 -> 0.9.2 (pin lifted), plus der, inotify, regex,
    regex-automata, zerocopy, zerocopy-derive, zlib-rs patch bumps

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 09 Jul 2026 12:00:00 +0200

rustconn (0.18.3-1) unstable; urgency=medium

  * Version bump to 0.18.3
  * Added external-session tracking for VNC/RDP/SPICE external-viewer sessions: a
    lightweight process registry with a shared poll timer, a sidebar
    external-viewer emblem, Disconnect / Stop tracking context-menu actions, a
    split-membership marker, and a smart double-click that focuses an existing
    session instead of opening a duplicate
  * Fixed VNC/RDP/SPICE connections in External Window mode leaving a dead notebook
    tab; the session is now surfaced in the sidebar instead (#209)
  * Fixed Telnet connections stuck on the Vault password source (#210)
  * Improved orthogonal (shape + icon, color-independent) sidebar state indicators
    that remain distinguishable in grayscale
  * Dependency updates: bytes 1.12.1, memchr 2.8.3

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 09 Jul 2026 01:17:50 +0300

rustconn (0.18.2-1) unstable; urgency=medium

  * Version bump to 0.18.2
  * SPICE unix socket connections (spice+unix://) with Browse button in the SPICE tab
  * Compact interface: primary-menu toggle + Ctrl+Shift+D shortcut, automatic mode on small windows, larger tap targets
  * Compact mode extended to monitoring bar, split panels, and playback toolbar
  * Fixed SPICE CA-certificate Browse button (was wired to no handler)
  * Fixed CLI/GUI SPICE viewer USB-redirection flag divergence (shared URI builder)
  * Fixed compact mode inflating the header/banner area instead of shrinking it
  * FreeRDP (Flatpak) updated 3.27.1 -> 3.28.0
  * Dependency updates: zbus 5.17, zvariant 5.13

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 08 Jul 2026 00:55:05 +0300

rustconn (0.18.1-1) unstable; urgency=medium

  * Version bump to 0.18.1
  * Split view generalized to embedded RDP/VNC/SPICE tabs; mixed terminal+desktop splits
  * Embedded viewers adapt toolbar and resolution to narrow panels/small windows
  * External-viewer sessions declined from split with a clear message
  * Keystroke broadcast restricted to terminal sessions
  * Disconnecting inside a split keeps the panel open
  * Fixed split-owner tab close stranding guest sessions on placeholder
  * Fixed embedded RDP small-window scaling (huge cursor), blank-after-unsplit, and resize loop
  * Fixed clicking on embedded panel in split not passing mouse events to remote desktop
  * Fixed SSH ProxyCommand parallel connections failing with "Permission denied (publickey)"
  * Fixed workspace restore skipping RDP/VNC/SPICE connections (vault credential resolution)
  * Fixed workspace split restore for async connections, Local Shell tabs, multi-panel layouts, balanced splitting, and duplicate guest indices
  * Updated dependencies: cc, crossbeam-channel, crossbeam-deque, crossbeam-epoch, crossbeam-utils, inotify, jobserver, lzma-rust2, num-bigint, zerocopy, zerocopy-derive

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 07 Jul 2026 00:03:17 +0300

rustconn (0.18.0-1) unstable; urgency=medium

  * Added a Native (full HiDPI) Display Scale option for embedded RDP/VNC — a
    "retina" mode that follows the live display scale, alongside Auto and
    125–400% (#207)
  * Fixed embedded VNC showing noise on Tight/JPEG rectangles — the client now
    decodes JPEG to BGRA and re-enables the Tight encoding
  * Fixed embedded VNC leaving stale regions after a server-side scroll or
    window move — CopyRect is now mirrored into the Cairo-backed buffer
  * Fixed the RDP display scale being lost on dynamic resize, and the HiDPI
    cursor rendering half-missing and mis-sized (#207)
  * Fixed several UI strings never being translated because their \u{…} escapes
    leaked into the message catalog; typographic strings now localise correctly
  * Changed operation-result feedback to non-blocking toasts, and a secret-save
    failure to a blocking dialog to prevent silent credential loss
  * Improved performance — fewer allocations in search results, removed
    redundant per-frame VNC/RDP buffer copies, no per-keystroke connection clone
  * Removed the abandoned native embedded SPICE experiment, an unused KeePassXC
    browser-integration backend, a parallel tracing-init subsystem, and dead
    render buffers / Wayland placeholders (SPICE still works via external viewer)
  * Updated dependencies — cpal 0.18, muda 0.19, tray-icon 0.24

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 05 Jul 2026 12:00:00 +0200

rustconn (0.17.10-1) unstable; urgency=medium

  * Fixed embedded RDP/VNC requesting a scale-inflated resolution on HiDPI
    displays — the remote desktop is now requested at the widget's logical size
    (device pixels ÷ compositor scale) instead of device pixels, cutting HiDPI
    bandwidth roughly 4× at 2× scale and restoring comfortable remote UI sizing;
    explicit Display Scale values still request a higher resolution for sharpness
  * Fixed embedded SPICE showing a black, unresponsive screen by default — the
    bundled spice-client does not forward frames or input in embedded mode, so
    the spice-embedded feature is no longer enabled by default; SPICE now uses
    the working external viewer (opt in with --features spice-embedded)
  * Fixed embedded VNC rendering garbage against TightVNC/TigerVNC — the Tight
    encoding (whose JPEG rectangles were drawn as raw pixels) is removed from
    the defaults; ZRLE, CopyRect and Raw remain
  * Fixed VNC input momentarily stalling the UI — commands are now sent
    non-blocking on the GTK main thread
  * Improved embedded RDP frame handling — removed a redundant per-frame buffer
    copy on the IronRDP path (~33 MB per frame at 4K)
  * Improved sidebar search — result lookup is now O(1) instead of O(n) per hit
  * Removed a dead multi-monitor detection placeholder; wrapped remaining
    user-facing strings for translation; dropped the unused futures dependency

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 04 Jul 2026 12:00:00 +0200

rustconn (0.17.9-1) unstable; urgency=medium

  * Fixed SSH multi-hop password chains still crashing when a bastion's host
    key is unknown — every hop authenticating via forced SSH_ASKPASS now sets
    StrictHostKeyChecking=accept-new, so a first-seen host-key prompt is no
    longer routed to the password helper (which answered with the password and
    looped until the bastion dropped the connection); a changed key is still
    rejected, preserving MITM protection (#203)
  * Fixed the embedded RDP first frame being blurry and never sharpening — once
    the session layout has settled the desktop is re-requested at the drawing
    area's real size over MS-RDPEDISP, so the first real frame arrives at a 1:1
    pixel map; the renderer also blits 1:1 when within a few pixels instead of
    rescaling (#206)
  * Fixed the embedded RDP initial snap causing a visible connect → reconnect
    flicker (and occasional connection resets) — the snap now runs only when the
    DisplayControlReady event confirms the channel is negotiated and resizes
    smoothly over MS-RDPEDISP; it is never forced on a timer, so a slow server no
    longer triggers a full reconnect. If the server never negotiates Display
    Control the frame is simply scaled to fit (#206)
  * Fixed a stale seam/line left on the embedded RDP screen after a resolution
    change — the client now sends a full-desktop Refresh Rect PDU on every
    resize so the server repaints the whole screen instead of leaving an
    untouched strip with its old fill (#206)
  * Fixed over-conservative embedded RDP resolution rounding — dimensions are
    now rounded to the minimum the protocol requires (both forced even) and
    clamped to 7680×4320, so a resize on a >4K display is no longer silently
    rejected

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 03 Jul 2026 14:00:00 +0200

rustconn (0.17.8-1) unstable; urgency=medium

  * Fixed nested groups losing their parent when importing an Asbru-CM config
    with three or more group levels — the topological group sort now tracks
    already-sorted IDs in a dedicated set instead of a map populated later, so
    arbitrarily deep hierarchies are preserved deterministically on every
    import (#205)
  * Fixed a too-large minimum window width in some locales (notably German)
    that prevented tiling or resizing the window narrow — the runtime width
    measurement now collapses the sidebar first, as the narrow layout tier
    does, so localized sidebar labels no longer inflate the minimum (#204)
  * Fixed the welcome-screen hint holding the window wider in verbose locales —
    the hint now wraps instead of reporting its full translated width (#204)
  * Dependencies: updated arrayvec 0.7.7→0.7.8, num-bigint 0.4.6→0.4.7

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 03 Jul 2026 12:00:00 +0200

rustconn (0.17.7-1) unstable; urgency=medium

  * Fixed narrow-window layout — window controls no longer vanish when the
    window is narrow; the window shrinks smoothly to a measured minimum via a
    two-tier adaptive breakpoint cascade that sheds non-essential header buttons
    and auto-hides the sidebar; the welcome screen reflows its columns in a
    FlowBox instead of wrapping shortcut labels character-by-character (#204)
  * Fixed SSH multi-hop password chain — only one bastion received a password;
    entry bastions in nested ProxyCommand now get their own per-hop SSH_ASKPASS
    helper with indexed env vars (_RC_JH_PW, _RC_JH_PW_1, …) (#203)
  * Fixed Snap build failing on Launchpad with Snapcraft 9.0 — switched from
    plugin: rust (whose environment validation requires rustup before parts run)
    to plugin: nil with an explicit rustup install in the rust-deps part
  * Security: updated quick-xml 0.39.4→0.41.0 to close RUSTSEC-2026-0194 and
    RUSTSEC-2026-0195 — crafted XML could trigger unbounded allocation via
    namespace/attribute flooding on the RoyalTS/libvirt import paths
  * Dependencies: updated inotify-sys 0.1.6→0.1.7, rand 0.10.1→0.10.2

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 02 Jul 2026 00:00:00 +0000

rustconn (0.17.6-1) unstable; urgency=medium

  * Fixed RDP sessions still aborting on resize — RustConn no longer requests
    bulk (MPPC/NCRUSH/XCRUSH) compression at all, matching the ironrdp-client
    default, so the server never sends compressed FastPath updates that
    desynchronised across a Deactivation-Reactivation Sequence (#200)
  * Fixed Saving Preferences wiping persisted window/sidebar state — window
    size/maximized, expanded sidebar groups, and search history are now
    preserved instead of reset to defaults (#202)
  * Fixed credentials being silently lost when the system keyring is
    unavailable — RustConn probes real backend availability, raises an
    actionable dialog pointing to Settings → Secrets, and falls back to the new
    encrypted-file store (#201)
  * Added: window now remembers its maximized state across restarts (#202)
  * Added an application-managed encrypted-file secret backend (AES-256-GCM
    with an Argon2id-derived key) for hosts without a working system keyring
  * Added proactive keyring availability surfacing at startup and in
    Settings → Secrets
  * Changed: the system keyring path migrated to the in-process oo7 client on
    Linux/BSD, removing the bundled libsecret/secret-tool from the Flatpak
    manifests; macOS keeps using the system Keychain
  * Dependencies: updated aws-lc-rs, aws-lc-sys, clap_complete, inotify-sys,
    libredox, rustls-pki-types, time, and zlib-rs to latest compatible releases

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 01 Jul 2026 00:00:00 +0000

rustconn (0.17.5-1) unstable; urgency=medium

  * Fixed embedded RDP sessions aborting when resized — the reactivation
    handler now rebuilds a fresh decompressor for the negotiated compression
    type (RDP4/5/6/6.1), so compressed FastPath updates keep decoding after a
    Deactivation-Reactivation Sequence (#200)
  * Fixed RDP to GNOME Remote Desktop dead-ending — the protocol-
    incompatibility detector now matches the actual error wrapper and the
    IronRDP "invalid state" bug signature, so these servers transparently fall
    back to the external FreeRDP client (#199)
  * Fixed the native arm64 snap link step — the build now prepends the SDK
    arch-triplet lib dir to the rustc link search path so both halves of pango
    resolve from the SDK (#198)
  * Fixed Variable password auto-login on network equipment — detection now
    reads the line under the cursor and matches via a pure looks_like_password_
    prompt helper, with an idle re-check for the prompt-render race (#194)
  * Fixed jump host authenticating with its own Variable/Vault password,
    delivered out-of-band via SSH_ASKPASS so the target password never leaks to
    the bastion prompt (#191)
  * Added a "Send terminal control shortcuts to the session" setting so
    readline chords (Ctrl+F/P/N/W/H/M/I) reach the focused terminal or embedded
    RDP/VNC/SPICE viewer instead of the app accelerators (#197)
  * Added a native arm64 (aarch64) snap build alongside amd64
  * Changed: refreshed the gtk4-rs stack and other Cargo dependencies to their
    latest compatible patch releases; dropped the unused pathdiff

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 30 Jun 2026 00:00:00 +0000

rustconn (0.17.4-1) unstable; urgency=medium

  * Fixed RDP vault login sending the correct domain — when credentials came
    from the secret vault, the domain field was passed as an empty string
    instead of the configured value, causing NLA/CredSSP to reject DOMAIN\user
    logins with STATUS_LOGON_FAILURE; the vault path now falls back to the
    connection's saved domain (#188)
  * Fixed Variable password auto-login on network equipment — the password
    auto-fill relied solely on VTE's contents-changed signal, which does not
    fire reliably for SSH password prompts in no-echo mode with cursor-
    positioning escapes; detection now also subscribes to cursor-moved (#194)
  * Changed: CUPS printer redirection forwards all local queues — the embedded
    IronRDP printer channel previously announced a single dummy "RustConn"
    printer; it now enumerates all local CUPS queues (or a configured subset
    via with_printers) and registers each as its own redirected printer,
    routing print jobs back to the correct local queue (#192)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 27 Jun 2026 00:00:00 +0000

rustconn (0.17.3-1) unstable; urgency=medium

  * Fixed switching GNOME workspaces with Super+digit breaking RDP keyboard
    input — the compositor grabbed the Super chord before its key-release
    reached the widget, so the embedded session treated Super as stuck down
    until a reconnect; held keys are now released when the widget loses focus
    (#193)
  * Fixed RD Gateway connections with FreeRDP 3.x — the launcher emitted the
    removed 2.x aliases /g: /gu: /gp:, which 3.x rejects; it now builds the
    unified /gateway:g:HOST:PORT option and reuses the session credentials
    (#187)
  * Fixed multi-hop (double) jump hosts in Flatpak — each hop now gets its own
    nested ProxyCommand so it inherits the identity key and Flatpak known_hosts
    (terminal SSH, RDP/VNC/SPICE tunnels, monitoring probe) (#191 follow-up)
  * Fixed multi-hop jump host order outside Flatpak — the -J hop list is now
    reversed to match OpenSSH's client-first order, so chains of three or more
    bastions connect; single-bastion connections are unaffected
  * Added RDP printer redirection: a "Printer Redirection" toggle maps the local
    printer into the session (issue #192). The embedded IronRDP client announces
    a virtual PostScript printer over RDPDR and forwards print jobs to the local
    CUPS spooler off the session thread; the external xfreerdp3 client passes
    /printer. Available in the GUI, the CLI (--printer), and imported from .rdp
    files (redirectprinters)
  * Changed: external RDP now prefers the maintained SDL3 client (sdl-freerdp3)
    for RD Gateway, RemoteApp, and IronRDP fallback launches; embedded mode
    still uses wlfreerdp where present

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 26 Jun 2026 13:00:00 +0200

rustconn (0.17.2-1) unstable; urgency=medium

  * Security: the password generator's Copy now auto-clears the clipboard after
    30 seconds (only if it still holds that password)
  * Security: the auto-login SSH password is wrapped in Zeroizing so plaintext
    is wiped right after it is handed to VTE
  * Security: fixed an SSH tunnel askpass file race by adding a per-tunnel UUID
    to the helper script filename
  * Fixed SSH jump host authenticating with the target's password instead of
    its own; the bastion now uses its own saved password (#191)
  * Fixed RDP dynamic resize requesting sub-640x480 desktops; RD Gateway
    password now sent (/gp:) for same-account gateways via a single-use 0600
    args file; shared-folder names with commas no longer corrupt drive
    redirection; multilingual SSH password-prompt detection on reconnect
  * Added Simple Sync — bidirectional multi-device sync of connections, groups
    (full create/update/delete), templates, snippets, and non-secret variables
    via full-sync.rcn with UUID merge and deletion tombstones
  * Added SSH config import following Include directives (globs, ~/.ssh
    relative paths, 16-level recursion cap, each file parsed once)
  * Changed: tab groups persist in workspaces; jump-host / SSH-args resolution
    deduplicated; dynamic-connection IDs now use stable UUID v5
  * Updated uuid 1.23.3->1.23.4 and the wasm-bindgen/js-sys/web-sys ecosystem

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 25 Jun 2026 00:00:00 +0300

rustconn (0.17.1-1) unstable; urgency=medium

  * Added a WinBox connection preset (Remote Desktop category) for MikroTik
    RouterOS management (#190)
  * Added native PKCS#11 / YubiKey SSH authentication via a "PKCS#11 Provider"
    field, also imported from ~/.ssh/config and injected into ProxyJump hops (#189)
  * Fixed Flatpak Generic commands failing with "Failed to start command: script"
    on hosts without a reachable script binary, and GUI tools (e.g. WinBox) not
    launching — the host command now runs through a login shell that falls back
    to a plain sh -c when script is absent (#190)
  * Internal: removed the dead VNC FFI stub, archived-spec traceability comments,
    and unused performance scaffolding (~1900 LOC)
  * Updated chacha20 0.10.0->0.10.1

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 24 Jun 2026 00:00:00 +0300

rustconn (0.17.0-1) unstable; urgency=medium

  * Security: kubectl and Zero Trust Generic sessions now spawn argv directly
    instead of via `sh -c`, preventing shell-metacharacter command injection
    from imported/untrusted configs
  * Security: removed the obsolete legacy XOR credential fallback (only
    AES-256-GCM credentials are read); documented the machine-key threat model
    and the Passbolt passphrase Known Issue in SECURITY.md
  * Security: wrap transient Bitwarden/KeePassXC serialized buffers in Zeroizing
  * Added workspace split-layout restore on Open
  * Improved terminal highlight rendering (pre-parsed colours, allocation-free
    hot path) and connection sort (cached lowercase keys)
  * Converted the embedded-RDP autotype dialog to adw::Dialog; header-bar icon
    buttons now meet the 44x44 minimum tap target
  * Build: narrowed the tokio feature set from "full" to the features used
  * Updated rustls 0.23.40->0.23.41

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 23 Jun 2026 00:00:07 +0300

rustconn (0.16.13-1) unstable; urgency=medium

  * Added RDP round-trip time (latency) display — embedded IronRDP sessions
    show RTT in the toolbar when the server reports network characteristics
    via the Auto-Detect PDU; the Echo virtual channel is also registered
  * Dynamic RDP resolution change now works in embedded mode — the Display
    Control channel is now registered, so window resizes no longer force a
    full reconnect on servers that support it
  * Updated ironrdp 0.15->0.16 (session, dvc, displaycontrol, echo) plus
    minor crates (quote, time, zlib-rs)

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 22 Jun 2026 12:00:00 +0300

rustconn (0.16.12-1) unstable; urgency=medium

  * Added workspace profiles — save and restore named sets of connections
    via Tools → Workspaces menu
  * Added built-in port knocking — send TCP/UDP knock sequences before
    connecting without external CLI tools
  * Added fwknop SPA configuration model (packet builder in next release)
  * Integrated port knock execution into the pre-connect chain
  * Added port knock sequence field in the Advanced connection editor tab

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 21 Jun 2026 20:34:00 +0300

rustconn (0.16.11-1) unstable; urgency=medium

  * Fixed the connection wizard's "Zero Trust" card showing only a
    custom-command field instead of the provider list — it now restores the
    full provider picker (AWS SSM, GCP IAP, Azure, Cloudflare, Teleport,
    Tailscale, Boundary, Hoop.dev) and defaults to AWS Session Manager, like
    the Advanced editor
  * Fixed the RDP Mouse Jiggler never actually running in Embedded (IronRDP)
    mode (#185) — the timer was only ever armed from set_state, which embedded
    connections bypass, so neither the mouse-move nor the Scroll Lock keep-alive
    was ever sent; it is now armed directly from the embedded connection events
  * Fixed External RDP (sdl-freerdp) ignoring its sdl-freerdp.json in the
    Flatpak build (#183) — the bundled FreeRDP had no JSON backend, so WinPR
    silently discarded the config and its SDL hotkeys could not be remapped;
    a static cJSON module is now built ahead of FreeRDP
  * Fixed RDP connections created through the New Connection wizard never
    storing the typed password (#188) — they were created with no usable
    credential, causing an immediate NLA authentication failure; the wizard now
    persists the password to the vault, mirroring the full editor
  * Fixed RDP through an RD Gateway rendering a broken/black session in embedded
    mode (#187) — gateway connections now go directly to the external client,
    which wires up gateway routing, instead of falling through to embedded
    wlfreerdp which never emits the gateway arguments
  * The Advanced connection editor now has a distinct "New Connection
    (Advanced)" window title through every entry point, including the wizard's
    Advanced hand-off
  * Updated bundled dependencies — cJSON (Flatpak) 1.7.18->1.7.19, arrayvec
    0.7.6->0.7.7

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 20 Jun 2026 13:00:00 +0300

rustconn (0.16.10-1) unstable; urgency=medium

  * Fixed RDP Mouse Jiggler not preventing the remote desktop from locking
    (#185) — in Embedded (IronRDP) mode the jiggler only moved the mouse, which
    keeps the session alive but does not reset the Windows workstation lock
    timer; each tick now also taps Scroll Lock (a no-op, state-preserving
    keystroke) so unattended desktops stay unlocked
  * Documented that the Mouse Jiggler works in Embedded mode only (the External
    FreeRDP client has no input channel from RustConn)
  * Updated cc 1.2.64->1.2.65
  * FreeRDP (Flatpak) 3.27.0->3.27.1

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 19 Jun 2026 13:00:00 +0300

rustconn (0.16.9-1) unstable; urgency=medium

  * Fixed RDP Quick Actions and shell launchers typing wrong characters on
    non-QWERTY remote keyboard layouts (#184) — Run-dialog commands and the
    PowerShell/CMD launchers are now sent via layout-independent Unicode
    keyboard events instead of hard-coded US-QWERTY scancodes
  * Internal cleanup — removed the dead ad-hoc broadcast controller, the unused
    virtual-scroll tuning API and protocol-layout builder setters, and stale
    dead_code overrides; corrected stale doc comments
  * Updated bitvec 1.0.1->1.1.1

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 19 Jun 2026 12:00:00 +0300

rustconn (0.16.8-1) unstable; urgency=medium

  * Fixed KeePassXC not being detected in Flatpak ("keepassxc-cli not found")
    (#182) — detection and all KDBX operations now resolve and run the host
    binary via flatpak-spawn --host, so the host's KeePassXC is found and piped
    database/entry passwords reach it
  * Fixed KDBX status text overflowing the row (#182) — the status label now
    ellipsizes at a capped width and shows the full text as a tooltip
  * Fixed the Settings → Interface theme segmented control not reflecting the
    saved colour scheme on libadwaita >= 1.7 builds — the toggle group is now
    held in its wrapper box and the loader sets the active segment from the
    saved scheme
  * Documented the external FreeRDP SDL client keyboard shortcuts (Right Shift
    hotkeys) and where to place sdl-freerdp.json for the Flatpak build (#183)
  * Updated dependencies: ironrdp-graphics 0.8.0->0.8.1,
    ironrdp-rdpsnd 0.8.0->0.8.1, bytes 1.11.1->1.12.0,
    crypto-bigint 0.7.3->0.7.4, getrandom 0.4.2->0.4.3, syn 2.0.117->2.0.118

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 18 Jun 2026 12:00:00 +0300

rustconn (0.16.7-1) unstable; urgency=medium

  * Fixed sidebar right-click menu rows rendering invisible under KDE / the
    Breeze GTK theme (#181) — the custom popover now pins its colours to the
    libadwaita popover palette so the menu rows stay legible under any GTK theme
  * Fixed the smart-folder right-click menus (folder actions and connections
    inside a smart folder) sharing the same invisible-rows defect — they now
    reuse the same popover styling; the destructive Delete keeps its red accent
  * Updated bundled Flatpak components: FreeRDP 3.26.0->3.27.0,
    fast_float 8.0.2->8.2.10

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 16 Jun 2026 12:00:00 +0300

rustconn (0.16.6-1) unstable; urgency=medium

  * Fixed Activity Monitor doing nothing on most connections and the per-tab
    "Monitor" menu being stuck on Off (#180) — monitoring is now wired from a
    single session-creation choke point, so it works for every terminal
    protocol and every connect path (sidebar, command palette, cluster) and for
    both synchronous and port-checked connections; sessions are registered even
    when Off so the tab menu can cycle Off -> Activity -> Silence on a live
    session, and in-place reconnect re-arms monitoring
  * Fixed silence notification reporting the wrong connection name when several
    monitored tabs were open — the name is now resolved per session
  * Updated h2 0.4.14->0.4.15

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 15 Jun 2026 12:00:00 +0300

rustconn (0.16.5-1) unstable; urgency=medium

  * Fixed external FreeRDP client closing immediately with no explanation
    (#177 follow-up) — stderr is now captured and forwarded to the log, and a
    startup watchdog (~3s) detects an immediate exit and surfaces a clear error
  * Fixed wrong default secret backend on macOS — a fresh install now defaults
    to the system Keychain (MacOsKeychain) instead of the unavailable libsecret;
    the Secrets backend selector shows/persists "macOS Keychain" there
  * Fixed misleading "not installed" message for any terminal spawn failure on
    macOS — only a genuine missing executable uses that wording; other failures
    show the actual error
  * Skipped the Linux/KDE/XFCE dark-theme (gtk-application-prefer-dark-theme)
    workaround on macOS, where it fought the system NSAppearance
  * Suppressed the harmless CSS theme-parser warning flood (libadwaita >= 1.9
    stylesheet vs GTK4 parser) that buried real log messages
  * macOS Keychain: secret bytes are now zeroized on a UTF-8 decode failure
  * Improved RDP connection diagnostics (selected binary, session type, args,
    first-frame timing) at debug level
  * Updated yuv 0.8.15->0.8.16

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 14 Jun 2026 16:00:00 +0300

rustconn (0.16.4-1) unstable; urgency=medium

  * Fixed MobaXterm import/export losing nested folder structure (#178) —
    SubRep paths like Production\Web now rebuild the full folder tree on
    import and round-trip correctly on export
  * Fixed SecureCRT export mangling folders nested 3+ levels deep (#178) —
    paths built by walking the parent chain; empty intermediate folders kept
  * Fixed Asbru-CM export dropping parent links on deep hierarchies (#178) —
    group UUID map built up front so nesting survives any group order
  * Updated: time 0.3.47→0.3.49, time-core 0.1.8→0.1.9,
    time-macros 0.2.27→0.2.29

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 14 Jun 2026 12:00:00 +0300

rustconn (0.16.3-1) unstable; urgency=medium

  * Added RDP "Fit resolution to window" toolbar button — re-requests the
    session resolution to match the window (servers without dynamic resolution)
  * Added error details in Connection History — failed entries show a button
    that opens a dialog with the captured error (the toast is transient)
  * Fixed failed connections missing from history — pre-connection port-check
    timeouts are now recorded across all protocols (SSH, RDP, VNC, SPICE,
    Telnet, MOSH, SFTP)
  * Fixed RDP connects but the desktop never appears (#177) — first-frame
    watchdog falls back to external FreeRDP for GFX/H.264-only servers
  * Updated: openssl 0.10.80→0.10.81, zeroize 1.8.2→1.9.0,
    wasm-bindgen 0.2.123→0.2.125 (and js-sys/web-sys), wasip2 1.0.3→1.0.4

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 13 Jun 2026 15:30:00 +0300

rustconn (0.16.2-1) unstable; urgency=medium

  * GNOME HIG follow-up audit:
    - Critical errors shown as blocking alert dialogs instead of toasts
      (vault password save, secret load, smart folder deletion)
    - Error alert dialogs no longer style OK button as destructive
    - Sidebar drag-and-drop indicators use libadwaita accent color
  * Dead code cleanup: removed unused ContainerState, is_split/is_welcome,
    load_variable_from_vault, stale #[allow(dead_code)] attributes
  * Fixed F10 opening application menu in keyboard passthrough mode —
    primary flag dropped during passthrough
  * Fixed Ctrl+T (SSH Tunnel Manager) ignoring passthrough and not
    customizable — now a regular keybinding in the central registry
  * Updated: block-buffer 0.12.0→0.12.1, cc 1.2.63→1.2.64,
    memchr 2.8.1→2.8.2, smallvec 1.15.1→1.15.2, yuv 0.8.14→0.8.15

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 13 Jun 2026 00:01:35 +0300

rustconn (0.16.1-1) unstable; urgency=medium

  * Settings dialog GNOME HIG pass:
    - Secret fields migrated to adw::PasswordEntryRow (built-in peek icon,
      caps-lock warning, focus on row click)
    - Highlight-rules editor rebuilt: one expandable row per rule with
      proper EntryRows, enable switch and delete button
    - Rows with suffix controls (language, startup action, keybinding,
      SSH key, cloud-sync import) activatable via the row itself
    - Reset All to Defaults for shortcuts now asks for confirmation
    - Restart to apply after settings restore is a dialog with Quit now
    - Backup/restore failures shown to user instead of only logged
    - Removed extra suggested-action styling from inline buttons;
      error dialog headings unified to sentence case; ZIP filter name
      translatable
  * Fixed Settings dialog taking 5+ seconds to appear with Bitwarden
    backend (flatpak) — keyring calls moved to gio::spawn_blocking
  * Fixed UI froze for seconds after startup with Bitwarden (flatpak) —
    resolve_bw_cmd() moved to background thread
  * Fixed sidebar context menu dismissed on deeply nested rows
    (KDE Plasma, #157) — fallback/keyboard menus take grab immediately

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 12 Jun 2026 12:00:00 +0200

rustconn (0.16.0-1) unstable; urgency=medium

  * Added batch edit for multi-selected connections — change group, tags,
    or icon for all selected connections in one pass with undo
  * Added notes badge in the sidebar — connections with a description show
    a document-edit-symbolic badge (tooltip shows the note text)
  * Added search matches connection notes (weight below name/host/tags)
  * Added Windows (WSL2) guide — step-by-step setup in docs/WSL.md (#137)
  * Structured validation errors in core — ValidationError enum with
    thiserror, callers pattern-match variants
  * Fixed sidebar context menu failing to open on KDE Plasma (#157) —
    deferred unparent to idle, KWin autohide fallback
  * Internal: dialogs/connection/dialog.rs split into 7 submodules
  * Security: RDP/SPICE client Debug output leak regression-tested
  * New property tests for shell_escape and smart_folder

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 11 Jun 2026 18:00:00 +0200

rustconn (0.15.14-1) unstable; urgency=medium

  * External RDP/VNC sessions no longer freeze the window for 1.5s on
    connect — non-blocking spawn with 250ms poll for early failures
  * Tray messages are now event-driven instead of polled — async-channel
    awaited on the main context, no wakeups when idle
  * Secret backend detection in Settings is parallel and cached (30s) —
    scoped threads instead of sequential, 50ms timer instead of idle loop
  * Connection history writes are debounced (2s) and off the main thread
  * One suggested action per dialog (GNOME HIG)
  * Added async-channel 2.5.0
  * Updated crypto-primes 0.7.1 -> 0.7.2

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 11 Jun 2026 12:00:00 +0200

rustconn (0.15.13-1) unstable; urgency=medium

  * Added Menu key / Shift+F10 to open the sidebar context menu for the
    selected row — keyboard fallback where right-click on nested rows is
    unreliable (#157)
  * Added confirmation before closing with open session tabs (window close
    button and Ctrl+Q share one dialog; skipped with minimize-to-tray)
  * Added a recording indicator (red dot) in the sidebar while any session
    of a connection is being recorded
  * Added import duplicate handling — Cancel / Skip Duplicates / Import All
    instead of silently creating renamed copies
  * Added a persistent cloud-sync failure banner (manual Sync Now and
    background auto-export); transient toasts kept for success only
  * Added touch long-press to open the sidebar context menu
  * Improved context-menu keyboard navigation and screen-reader roles, error
    message wording (GNOME HIG), and 44x44 px sidebar tap targets
  * Fixed sidebar context menu not opening for rows nested deeper than the
    root level on some systems (KDE Plasma) (#157)
  * Fixed crash (SIGSEGV) in pango when opening a new SSH tab or on screen
    unlock — refresh VTE fonts on fontconfig change, defer child-exited work
    to idle (#171)
  * Updated crypto-primes 0.7.0 → 0.7.1, ksni 0.3.4 → 0.3.5, regex 1.12.3 →
    1.12.4, zerocopy 0.8.50 → 0.8.52

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 10 Jun 2026 19:00:00 +0300

rustconn (0.15.12-1) unstable; urgency=medium

  * Fixed macOS SSH password authentication always failing with "Permission
    denied" — the native PTY child now claims the slave PTY as its
    controlling terminal (setsid + TIOCSCTTY), so ssh can open /dev/tty to
    read the password prompt; also affected ssh run in a Local Shell (#175)
  * Added rustconn-pty-sys crate to isolate the controlling-terminal FFI
    (pre_exec) so the main crates keep unsafe_code = "forbid"
  * Updated uuid 1.23.2 → 1.23.3 and wasm-bindgen 0.2.122 → 0.2.123 (with
    related js-sys, web-sys, wasm-bindgen-futures)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 09 Jun 2026 18:00:00 +0300

rustconn (0.15.11-1) unstable; urgency=medium

  * Fixed keybinding recorder still not registering keystrokes on Flatpak —
    replaced the inline recorder with a dedicated modal capture dialog that
    owns its own keyboard focus scope (#170, #167)
  * Fixed keybinding overrides not displayed in Settings after reopening or
    restart — direct Label references replace the fragile widget-tree
    traversal that broke after groups are reparented (#170)
  * Fixed Snap package still failing to start on Ubuntu 26.04 — moved to a
    core24 base with the gnome extension for a correctly confined GTK4
    environment; removed the custom launcher wrapper (#174)
  * Changed keybinding recorder to store shortcuts in a layout-independent
    (Latin) form so they keep working after switching keyboard layout (#170)
  * Changed Snap base core26 -> core24 (GNOME 46 / libadwaita 1.5, built
    without adw-1-8); Snap CI installs Snapcraft from latest/stable

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 07 Jun 2026 18:00:00 +0300

rustconn (0.15.10-1) unstable; urgency=medium

  * Fixed keybinding overrides not displayed correctly after reopening
    Settings — category-grouped order now used before zipping rows (#170)
  * Fixed keybinding conflict detection ignoring modifier order —
    accelerators compared via gtk4::accelerator_parse normalisation
  * Fixed Snap package failing to start on Ubuntu 26.04 (AppArmor error) —
    removed build-base: devel, changed grade to stable (#174)
  * Documentation: SNAP.md and INSTALL.md no longer reference the removed
    host-usr-bin interface
  * Updated bitflags 2.12.1 → 2.13.0

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 05 Jun 2026 18:00:00 +0300

rustconn (0.15.9-1) unstable; urgency=medium

  * Lazy init secret backends — only preferred backend is initialized at
    startup and when opening Settings; other backends loaded on-demand
  * KeePass keyring failure toast at startup when password not loaded
  * Connection wizard: ComboRow model lazy init eliminates auth method flash
  * Fixed KeePass vault credentials not resolved on Flatpak after restart (#170)
  * Fixed crash (SIGSEGV) when opening new SSH tab or on screen lock/unlock —
    deferred close_tab via idle_add_local_once, terminal.reset() in
    mark_tab_disconnected (#171)
  * Fixed connection wizard auth method label overflow — replaced radio
    buttons with adw::ComboRow (#169)
  * Fixed Telnet connection not closed when closing the tab — explicit
    SIGTERM to process group on tab close (#172)
  * Fixed 1Password/Passbolt credentials not passed in vault entry lookups
  * Fixed connection wizard redundant Method dropdown for non-SSH protocols

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 05 Jun 2026 14:00:00 +0300

rustconn (0.15.8-1) unstable; urgency=medium

  * Fixed keybinding reassignment not registering keystrokes — recorder
    moves focus to parent ActionRow and disables PreferencesDialog search
  * Fixed sidebar right-click context menu not appearing for hosts in groups
  * Fixed secret variable with vault entry name writing duplicate to vault
  * Fixed sidebar status icon size inconsistent with custom icons
  * Variable dialog: vault entry UX hints — placeholder and tooltip
  * Updated: chrono 0.4.44→0.4.45, log 0.4.31→0.4.32, yoke 0.8.2→0.8.3

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 04 Jun 2026 14:00:00 +0300

rustconn (0.15.7-1) unstable; urgency=medium

  * Variable password source: discoverability — subtitle hint and "+"
    button to open Variables manager directly from connection dialog
  * Variable password source: custom vault entry name — secret variables
    can now reference an existing entry in Bitwarden/1Password/Passbolt/Pass
    by its exact name instead of the default rustconn/var/{name} key
  * Fixed Proxmox SPICE inline PEM CA certificate now saved automatically
    on import from .vv file
  * Fixed keybinding reassignment not working — accelerators suspended
    during recording, EventControllerKey uses Capture phase

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 03 Jun 2026 14:00:00 +0300

rustconn (0.15.6-1) unstable; urgency=medium

  * VNC: new "Accept Certificate" toggle for VeNCrypt servers with
    self-signed TLS certificates
  * CLI --ignore-certificate now works for both RDP and VNC connections
  * Fixed Welcome screen "Remote host monitoring" icon missing on macOS
  * Fixed sidebar right-click context menu not opening for nested items
  * Updated: bitflags 2.11.1→2.12.1, log 0.4.30→0.4.31,
    lzma-rust2 0.16.2→0.16.4; removed sha2 0.10.9
  * Flathub: inetutils 2.7→2.8

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 02 Jun 2026 14:00:00 +0300

rustconn (0.15.5-1) unstable; urgency=medium

  * IronRDP 0.14→0.15: bulk compression (XCRUSH/MPPC), slow-path rendering,
    alternate_shell/work_dir for RemoteApp, multitransport dispatch,
    clipboard file contents handling, pixel format fix (no more R↔B swap)
  * macOS: fixed passwords not saving to Keychain (wrong backend dispatch)
  * macOS: fixed tray icon missing when launched from .app bundle
  * macOS: fixed AWS SSM "session-manager-plugin not found"
  * Compact mode: denser sidebar rows, slimmer bottom toolbar, search bar,
    popover menu items, filter buttons, embedded session toolbar
  * Compact mode enabled by default on macOS for new installations
  * Hamburger menu restructured: Tools and Sessions submenus reduce top-level
    items from 24 to ~14
  * Upgraded: ironrdp 0.14→0.15 (+ ironrdp-bulk 0.1 new transitive)
  * Updated: inotify 0.11.2, ironrdp-tls 0.2.1, rustls-native-certs 0.8.4,
    unicode-segmentation 1.13.3

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 01 Jun 2026 18:00:00 +0200

rustconn (0.15.4-1) unstable; urgency=medium

  * Fixed macOS UI hang when editing connection with broken/throttled ssh-agent (#163)
  * SSH agent probe now runs asynchronously with a 5-second timeout

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 31 May 2026 11:00:00 +0200

rustconn (0.15.3-1) unstable; urgency=medium

  * Snap base bumped to core26 (Ubuntu 26.04 / GNOME 50 / libadwaita 1.8)
  * Removed system-files (host-usr-bin) plug; external CLIs now download on demand inside the sandbox
  * Renamed Flatpak Components dialog to Components; now available in both snap and Flatpak
  * External CLI download mechanism (Components dialog) now works inside snap
  * Added is_sandboxed() predicate unifying snap/Flatpak CLI logic
  * Snap confinement message now guides users to connect personal-files plugs
  * Fixed broken Ukrainian translation for Protocol Clients section
  * Updated all 16 language catalogs for the Components rename
  * Updated docs (ZERO_TRUST.md, BITWARDEN_SETUP.md) for snap parity
  * Dependencies: hyper 1.10.0→1.10.1, uuid 1.23.1→1.23.2, zbus 5.15.0→5.16.0, zerocopy 0.8.49→0.8.50, zvariant 5.11.0→5.12.0

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 30 May 2026 12:00:00 +0200

rustconn (0.15.2-1) unstable; urgency=medium

  * Corrected misleading copy-pasted #[allow]/#[expect] reasons across rustconn-core and property tests; lints that fire now use #[expect]
  * Removed dead notify_tx field (and its #[allow(dead_code)]) from DirectoryWatcher
  * rustconn-cli update: replaced .position(...).unwrap() with a proper CliError instead of panicking
  * Shortcuts help dialog now lists SSH Tunnel Manager (Ctrl+T), Open Menu (F10), Ctrl+W and font-zoom shortcuts; added a test guarding against keybinding-registry drift
  * Docs: fixed Create Group shortcut (Ctrl+Shift+G, not Ctrl+Shift+N), removed non-existent Ctrl+K, added Ctrl+Shift+B (Toggle Split Broadcast)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 29 May 2026 16:00:00 +0200

rustconn (0.15.1-1) unstable; urgency=medium

  * Flatpak: language switch had no effect for any of the 16 translations because /app/share/locale/<lang>/ is split by flatpak-builder into per-language Locale extension subsets — fixed by relocating to /app/share/rustconn/locale/ and pointing LOCALEDIR there (#158)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 29 May 2026 12:00:00 +0200

rustconn (0.15.0-1) unstable; urgency=medium

  * RDP RemoteApp: password no longer leaked via /proc/PID/cmdline (uses single-use args file in $XDG_RUNTIME_DIR)
  * Migrated ~350 #[allow] overrides to #[expect(reason = "...")]; ~50 stale overrides dropped
  * Manual Debug impls for all secret backends with leak-protection unit tests
  * # Errors documentation on every public CLI command function
  * Settings-save failures now surface a toast instead of being silently dropped
  * EntryRowBuilder requires pre-translated titles so xgettext extracts every UI label
  * GUI spacing now consistently follows GNOME HIG steps (6/12/18/24 px)

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 27 May 2026 14:00:00 +0200

rustconn (0.14.10-1) unstable; urgency=medium

  * Hardened secret handling: SecretString accepted directly in vault save signatures
  * Backend deserializers (Bitwarden, KeePassXC, Passbolt, RDM, libvirt) now wrap passwords in SecretString immediately
  * Removed password_len field from Bitwarden unlock log
  * F10 now opens primary menu (set_primary on burger button)
  * Graceful exit on Tokio runtime failure instead of panic
  * PasswordGenerator surfaces RNG errors via PasswordGeneratorError::RngError
  * Named timeout constants for HTTP downloads, Bitwarden unlock, vault retrieve
  * Debug derived for protocol structs and small types

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 27 May 2026 12:00:00 +0200

rustconn (0.14.9-1) unstable; urgency=medium

  * Version bump to 0.14.9
  * Added Server Manager quick action in RDP admin tools menu
  * Improved Windows admin tools menu grouping with separator
  * Fixed split view panels losing content on subsequent splits
  * Fixed RemoteApp: external FreeRDP mode, Flatpak host xfreerdp3, FreeRDP 3.x /app: syntax, NTLM auth, /p: password passing

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 26 May 2026 22:00:00 +0200

rustconn (0.14.8-1) unstable; urgency=medium

  * Split-view broadcast toggle in header bar (#160)
  * Compact interface mode for reduced chrome (#157)
  * Fixed broadcast mode — rewired around split view (#160)
  * Fixed broadcast toggle visibility after Select Tab placement (#160)
  * Fixed broadcast doubling typed characters in split panels (#160)
  * Fixed language change in Flatpak (#158)
  * Improved tray icon visibility on dark panels (#157)

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 26 May 2026 20:00:00 +0200

rustconn (0.14.7-1) unstable; urgency=medium

  * Version bump to 0.14.7
  * Added Visual Tunnel Builder — 3-step wizard for SSH tunnels
  * Added Keyboard passthrough mode (Ctrl+Shift+Backspace)
  * Improved VNC client connection timeout
  * Improved document encryption key zeroization

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 25 May 2026 12:00:00 +0200

rustconn (0.14.6-1) unstable; urgency=medium

  * Version bump to 0.14.6
  * Variables dialog: collapsible rows with expander
  * Variables dialog: duplicate name validation
  * RDP toolbar: replaced PowerShell/CMD with Registry Editor and Device Manager
  * RDP scripts: instant clipboard paste via Ctrl+V
  * Snippet delivery mode (Auto/Clipboard/Autotype)

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 23 May 2026 12:00:00 +0200

rustconn (0.14.5-1) unstable; urgency=medium

  * Version bump to 0.14.5
  * All dialogs migrated to adw::Dialog (adaptive, bottom-sheet on narrow)
  * Edit Group dialog redesigned with 5 tabs
  * Connection dialog adapts to narrow windows
  * Connection Wizard: FIDO2 auth, back navigation
  * RDP Scripts v2: Shell Launchers (Win+R) + Autotype snippets
  * Snippet target platform (Terminal/Windows/Any)
  * Color scheme selector modernized (AdwToggleGroup)
  * Dialog sizes unified across the app
  * SSH Agent passphrase via env var (CoW-FS safe)
  * Quick Connect: user theme applied (#156)

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 22 May 2026 12:00:00 +0200

rustconn (0.14.4-1) unstable; urgency=medium

  * CLI: history, pin/unpin, tag, move, monitor commands — full connection management
  * CLI: import --auto / --dry-run — auto-detect sources and preview imports
  * CLI: export --csv-delimiter, --csv-fields — customize CSV export format
  * CLI: add/update — full GUI parity for SSH, RDP, VNC, SPICE, MOSH, Serial fields
  * Config file locking — exclusive advisory lock (fs2) on write; GUI + CLI no longer conflict
  * SSH agent: add_key() accepts &SecretString — intermediate strings wrapped in Zeroizing
  * Quick Connect: history persisted across sessions (up to 15 entries, no passwords)
  * RDP Quick Actions: 3 new Windows admin tools (diskmgmt.msc, resmon, compmgmt.msc)
  * Settings: Azure/gcloud/OCI CLI not detected in Flatpak — env vars now passed through
  * Settings: .version file fallback for CLI tools installed via Components dialog
  * Settings: SSH/RDP/Waypipe version strings — parser extracts version token only
  * Command Palette: fixed shortcut display Ctrl+Shift+N → Ctrl+Shift+G

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 20 May 2026 16:00:00 +0300

rustconn (0.14.3-1) unstable; urgency=medium

  * Settings: removed duplicate group titles above collapsible sections
  * CLI: secret set --password wrapped in Zeroizing immediately, added --password-stdin
  * External window: migrated to libadwaita (adw::ApplicationWindow + ToolbarView)
  * Settings: collapsible sections (GNOME HIG) for Terminal, Interface, and Edit Connection
  * Settings: credential storage as a 3-state ComboRow for all secret backends
  * Settings UI: 25 toggles converted from CheckButton to AdwSwitchRow (GNOME HIG)
  * Settings dialog field types unified to adw::SwitchRow

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 20 May 2026 12:00:00 +0300

rustconn (0.14.2-1) unstable; urgency=medium

  * CLI: fix `add --protocol web` port=0 error
  * CLI: add SecureCRT export/import format to CLI enums
  * CSV import: reject invalid port values instead of silent fallback
  * Security: return SecretString from keyring helpers, eliminate plain String intermediates
  * Fix tooltip showing wrong shortcut for New Group
  * i18n: localize connection dialog validation messages
  * i18n: localize Ctrl+Alt+Del button labels in embedded viewers
  * i18n: localize AlertDialog fallback OK button

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 19 May 2026 12:00:00 +0300

rustconn (0.14.1-1) unstable; urgency=medium

  * Version bump to 0.14.1
  * Added predefined connection templates (20 built-in for Docker, RustDesk, IPMI, etc.)
  * Added template grid in Connection Wizard Custom Command mode
  * Added template icon field with emoji support
  * Added per-connection "Skip port check" toggle
  * Fixed "Use Template" UI freeze
  * Fixed RDP Gateway "Host unreachable" before connection
  * Fixed highlight overlay underlines persisting after clear

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 18 May 2026 12:00:00 +0200

rustconn (0.14.0-1) unstable; urgency=medium

  * [Added] Connection Wizard (Ctrl+N) — step-by-step dialog for creating
    connections with 4-column protocol grid, adaptive fields, auth/appearance
  * [Added] Quick Connect runtime history — last 15 sessions with filtering
  * [Added] Duplicate via Wizard — clone and modify existing connections
  * [Fixed] Wizard: Zero Trust provider fields, Mosh port, Serial baud rate
  * [Changed] Ctrl+N opens Wizard; Ctrl+Shift+N opens full dialog
  * [Changed] Highlight Rules collapsed into ExpanderRow

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 18 May 2026 12:00:00 +0000

rustconn (0.13.17-1) unstable; urgency=medium

  * [Fixed] Cloud Sync in Flatpak — detect XDG Document Portal paths when
    selecting sync directory; show a warning dialog with flatpak override
    command instead of silently saving an unusable portal path (#152)
  * [Fixed] Highlight overlay not cleared by clear command — colored underlines
    and background highlights now disappear immediately when the terminal screen
    is erased (#154)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 16 May 2026 12:00:00 +0000

rustconn (0.13.16-1) unstable; urgency=medium

  * [Added] macOS port — native PTY, tray icon, Keychain backend, Homebrew
    formula, DMG packaging
  * [Added] macOS tray icon (tray-macos feature) — NSStatusItem with dynamic
    menu updates
  * [Added] macOS Keychain backend — native credential storage via
    Security.framework
  * [Fixed] macOS tray: main-thread initialization (NSStatusItem requirement)
  * [Fixed] macOS tray: dynamic menu rebuild on state change
  * [Fixed] X11 renderer fallback skipped on macOS
  * [Fixed] Cross-platform statvfs types, secret backend detection, PTY cleanup
  * [Dependencies] winnow 1.0.2→1.0.3

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 15 May 2026 12:00:00 +0200

rustconn (0.13.15-1) unstable; urgency=medium

  * [Added] Local Shell: custom command — new "Command" field in Settings →
    Terminal → Local Shell allows specifying a custom command to run instead
    of the default login shell (e.g. fish, bash --norc, neofetch && bash)
  * [Fixed] Split screen snippet execution — snippets now execute in the
    focused pane of a split terminal tab instead of always targeting the
    first pane; uses per-session split bridge to resolve the correct focused
    session before sending text
  * [Improved] Dynamic snippet context menu — when 5 or fewer snippets exist,
    they appear as individual items directly in the terminal right-click menu;
    when more than 5 exist, the previous "Execute Snippet…" picker is shown

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 14 May 2026 22:00:00 +0300

rustconn (0.13.14-1) unstable; urgency=medium

  * [Added] Welcome page: Import button — added Import action alongside New Connection and Quick Connect for easier migration from other tools
  * [Added] Template Manager: empty state — adw::StatusPage placeholder when no templates exist
  * [Added] Reconnect banner: auto-reconnect indicator — shows Auto-reconnecting status when background polling is active
  * [Fixed] Credential memory safety — intermediate password strings from expose_secret().to_string() now wrapped in zeroize::Zeroizing across VNC, RDP, and document password flows
  * [Fixed] Potential panic in resize debounce — replaced unwrap() on Instant::checked_sub() with unwrap_or_else fallback in terminal resize handler
  * [Fixed] CLI show command panic — replaced expect("json object") with proper let-else error propagation in rustconn-cli
  * [Fixed] Port overflow in SecureCRT/libvirt importers — replaced truncating as u16 casts with u16::try_from().ok() fallback to default port
  * [Fixed] Sync file path traversal — added validate_sync_filename() that rejects absolute paths, .. components, and directory separators

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 13 May 2026 22:00:00 +0300

rustconn (0.13.13-1) unstable; urgency=medium

  * [Added] SSH ProxyCommand support — custom proxy for .onion hosts and SOCKS proxies
  * [Fixed] SSH Startup Command not executing in GUI terminal
  * [Fixed] SSH ProxyCommand port format — jump hosts with non-standard ports
  * [Fixed] RDP/VNC/SPICE tunnel through nested jump hosts
  * [Improved] StringInterner: HashSet instead of HashMap — 50% less memory overhead per entry
  * [Improved] ConfigManager: ensure_config_dir() caching — skip filesystem check after first success
  * [Improved] ConnectionManager: collect_descendant_groups() O(n) instead of O(n²)
  * [Improved] ConnectionManager: sort_all() refactoring — extracted sort_ids_by_name() helper
  * [Improved] WolDialog: migrated to adw::Dialog — better focus management, auto Escape

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 12 May 2026 21:00:00 +0300

rustconn (0.13.12-1) unstable; urgency=medium

  * Auto-reconnect: per-connection RetryConfig with exponential backoff
  * Import: multi-file batch import
  * SSH: fix identity key -i duplicated in command
  * Terminal: fix per-connection white color displayed as grey

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 11 May 2026 12:00:00 +0200

rustconn (0.13.11-1) unstable; urgency=medium

  * [Improved] RDP: better diagnostics for IronRDP fallback to FreeRDP —
    error detection now includes detailed comments explaining the upstream
    limitation (IronRDP connector 0.8.0 does not handle ServerDeactivateAll
    during CapabilitiesExchange); submitted fix upstream (IronRDP#1253)
  * [Improved] Security: pre/post-connect tasks now use TaskExecutor —
    timeout enforcement, environment sanitization, variable substitution,
    conditional execution via FolderConnectionTracker
  * [Improved] UX: pre-connect task failure toast now shows specific error
    details instead of generic message
  * [Improved] Code quality: ConnectionDialog decomposed — extracted RDP,
    VNC, SPICE, Zero Trust options into separate modules (-20% dialog.rs)
  * [Removed] Dead code: ConnectionFallback module removed from rustconn-core
  * [Removed] Dead code: VirtualScrollConfig removed from public API

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 10 May 2026 14:00:00 +0000

rustconn (0.13.10-1) unstable; urgency=medium

  * [Added] Import/Export: SecureCRT session support — import connections
    from SecureCRT Config/Sessions/ directory (individual .ini files); export
    connections back to SecureCRT INI format as a directory tree; supports
    SSH2, Telnet, RDP, VNC protocols with hostname, port, username, SSH key
    path, X11/agent forwarding, compression; folder hierarchy preserved as
    connection groups (#140)
  * [Fixed] Backup/Restore: global variables lost after restore — restoring
    settings from a ZIP archive would show "Restored N files" but closing the
    settings dialog afterwards overwrote the restored config.toml with stale
    in-memory state; the dialog now reloads AppSettings from disk immediately
    after a successful restore (#142)
  * [Fixed] SSH: ControlMaster sockets now actually closed on application
    exit — shutdown handler scanned active_sessions() but all sessions were
    already Terminated by the time GTK fires connect_shutdown; replaced with
    filesystem scan of runtime directory for rc-* socket files; stale sockets
    that don't respond to ssh -O exit are force-removed (#125)
  * [Fixed] KeePass: custom entry path for variables ignored RustConn/
    prefix — added get_password_from_kdbx_exact() that queries the entry at
    the exact user-specified path without any prefix or fallback logic (#143)
  * [Dependencies] hashbrown 0.17.0 → 0.17.1

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 09 May 2026 14:00:00 +0200

rustconn (0.13.9-1) unstable; urgency=medium

  * [Fixed] Flatpak: Zero Trust Generic commands now execute on host —
    custom commands were failing with "No command specified" due to double
    sh -c wrapping; now automatically wrapped with flatpak-spawn --host
    with PTY allocation; single quotes in templates properly escaped (#132)
  * [Fixed] Split View: focus border not updating on click — clicking a
    terminal pane sent input correctly but the focus border remained on the
    previous pane; fixed by removing duplicate gesture controllers before
    adding new ones
  * [Improved] RDP: real disk space reported to Windows via shared folders —
    RDPDR backend now queries actual filesystem statistics using
    nix::sys::statvfs instead of returning hardcoded values; Windows Explorer
    and applications see correct total/available disk space; values normalized
    to 4096-byte allocation units; graceful fallback if statvfs call fails
  * [Dependencies] cc 1.2.61 → 1.2.62, filetime 0.2.27 → 0.2.28,
    quick-xml 0.39.3 → 0.39.4, tokio 1.52.2 → 1.52.3
  * [Dependencies] Added nix 0.31.2 (feature: fs) to rustconn-core for safe
    statvfs access

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 09 May 2026 12:00:00 +0200

rustconn (0.13.8-1) unstable; urgency=medium

  * [Fixed] Per-connection monitoring toggle not saving state — the
    "Enable Monitoring" switch always appeared enabled and did not persist
    the user's choice; now both ON and OFF states are stored as explicit
    overrides (enabled: Some(true) / Some(false)) (#125)
  * [Fixed] Flatpak: CLI tools not found by protocol detection —
    which_binary() now searches all get_cli_path_dirs() directories and
    passes the full resolved path to version detection
  * [Fixed] Hoop.dev CLI version not displayed — added parse_json_version()
    to extract the version field from JSON output; fixed get_version() to
    set extended PATH in Flatpak

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 08 May 2026 12:00:00 +0000

rustconn (0.13.7-1) unstable; urgency=medium

  * [Fixed] SSH: monitoring no longer triggers a second agent confirmation —
    monitoring waits up to 5s for ControlMaster socket, connects as slave
    only; falls back to own master if socket never appears (#125)
  * [Fixed] SSH: ControlMaster sockets cleaned up on application exit —
    all sockets gracefully closed via ssh -O exit on shutdown (#125)
  * [Fixed] SSH: control socket path shortened for macOS compatibility —
    ControlPath changed to rc-{host}-{port}-%r; uses /tmp on macOS to
    stay within 104-byte Unix socket path limit
  * [Fixed] Auto-reconnect: no longer loops infinitely on rapid crashes —
    if session crashes within 5s of starting, auto-reconnect is skipped
  * [Fixed] Flatpak: local shell PTY resize now propagates to host —
    VTE resize forwarded via flatpak-spawn stty to host-side PTY (#122)

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 08 May 2026 12:00:00 +0000

rustconn (0.13.6-1) unstable; urgency=medium

  * [Improved] Preferences: Monitoring moved to its own page with dedicated
    tab and utilities-system-monitor-symbolic icon (#125)
  * [Improved] CLI: machine-readable output (--format json|csv|table) for
    show, test, stats, group show commands; defaults to JSON when stdout is
    piped (non-TTY) (#132)
  * [Improved] i18n: MonitorMode and ExportFormat display_name() values now
    translatable via i18n() at call sites
  * [Improved] Security: intermediate password strings (RDP/VNC) now wrapped
    in zeroize::Zeroizing<String> so plaintext is overwritten on drop
  * [Improved] Reliability: host check no longer panics on runtime creation
    failure — proper Result propagation via HostCheckError::Io variant
  * [Fixed] SSH: single authentication prompt for connection + monitoring —
    VTE terminal uses ControlMaster=auto with shared ControlPath; monitoring
    reuses the same socket instead of opening a separate session (#125)
  * [Fixed] Repository hygiene: removed committed vim swap file; added *.swp,
    *.swo, *.po~ patterns to .gitignore

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 07 May 2026 12:00:00 +0300

rustconn (0.13.5-1) unstable; urgency=medium

  * Version bump to 0.13.5
  * Added Drag & Drop file paths into VTE terminals (#74)
  * Added Drag & Drop files to RDP clipboard via CLIPRDR (#74)
  * Added RDP "Reconnect on Resize" option for legacy servers
  * Fixed RDP dynamic resize without reconnect via Display Control Channel (#131)
  * Fixed SSH agent key selection not remembered in connection dialog (#125)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 06 May 2026 12:00:00 +0200

rustconn (0.13.4-1) unstable; urgency=medium

  * [Added] RDP Autotype: send text as keystrokes bypassing clipboard
    restrictions — new "Type Clipboard" and "Type Text…" toolbar buttons
    in embedded RDP sessions; sends text character-by-character using
    TS_UNICODE_KEYBOARD_EVENT PDU which is keyboard-layout independent;
    solves scenarios where server-side paste is blocked by GPO, Citrix
    policy, UAC dialogs, or password fields that reject Ctrl+V;
    per-connection configurable timing: inter-character delay (5–200ms,
    default 20ms) and initial delay (0–5000ms, default 0ms); iterates by
    Unicode grapheme clusters so composed characters are sent as single
    units; only available for embedded IronRDP mode (#127)
  * [Added] KeePass custom entry path for secret variables — secret
    variables can now reference an existing entry in the KeePass database
    instead of the default RustConn/rustconn/var/{name} path; new
    "KeePass entry" field in Variables dialog when variable is marked as
    Secret and KeePass backend is active (#114)
  * [Fixed] RDP toolbar Copy/Paste buttons do nothing on Wayland (COSMIC,
    GNOME) — replaced drawing_area.display().clipboard() with
    root().native().display().clipboard() which uses the top-level window
    surface; Paste button now shows status feedback instead of silently
    swallowing errors; CLIPRDR client_capabilities now advertises
    USE_LONG_FORMAT_NAMES flag required by Windows Server 2016+; added
    tracing for all clipboard button operations (#126)
  * [Dependencies] unicode-segmentation 1.13.2 (new),
    tower-http 0.6.8 → 0.6.9

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 05 May 2026 18:00:00 +0200

rustconn (0.13.3-1) unstable; urgency=medium

  * Version bump to 0.13.3
  * Added RDP Security Layer / TLS Compatibility options (#124)
  * Improved GNOME HIG: application menu restructured, manager dialogs unified
  * Improved Tray menu i18n
  * Fixed SSH agent multiple authentication prompts for saved connections (#125)
  * Fixed false KeePassXc backend unavailable toast (#123)
  * Fixed Flatpak Local Shell no job control warnings (#122)

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 04 May 2026 18:00:00 +0200

rustconn (0.13.2-1) unstable; urgency=medium

  * [Fixed] Mouse scroll not working in terminal sessions —
    set_enable_fallback_scrolling was incorrectly disabled by Mouse passthrough
    setting; VTE handles mouse forwarding natively; now always enabled (#121)
  * [Fixed] Flatpak local shell provides only a sandboxed minimal shell —
    Local Shell now spawns host shell via flatpak-spawn --host (#122)
  * [Removed] Mouse passthrough setting from Terminal preferences —
    VTE handles mouse event forwarding automatically
  * [Added] Per-connection monitoring toggle in connection dialog (#106)

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 04 May 2026 12:00:00 +0200

rustconn (0.13.1-1) unstable; urgency=medium

  * [Fixed] Crash when typing in sidebar search field —
    SearchEngine::find_case_insensitive used raw byte-position iteration
    and direct byte slicing which panics on multi-byte UTF-8 characters
    (Cyrillic, CJK, emoji); same bug in fuzzy_score_case_insensitive and
    fuzzy_score_optimized prefix checks; fixed by iterating over valid
    char_indices() boundaries and using str::get() for safe slicing (#116)
  * [Fixed] Export/re-import loses folder hierarchy, icons, SSH settings,
    and smart folders — native .rcn export/import had four data-loss bugs:
    hierarchy flattened (replaced with topological sort), folder fields
    dropped (now copies all fields via update_group), smart folders not
    exported (added to NativeExport format v3), smart folder group
    references not remapped (now remapped during import); CLI updated (#118)
  * [Added] Automation section in group edit dialog — Expect Rules and
    Post-login Scripts configurable directly in Edit Group dialog; full
    rule editor with pattern/response fields, priority/timeout controls,
    Insert Variable popover, From Template menu, Pattern Tester; CLI:
    group edit --add-expect-rule, --clear-expect-rules,
    --add-post-login-script, --clear-post-login-scripts (#117)
  * [Improved] Connection dialog Automation tab unified with group dialog —
    same vertical layout, Insert Variable popover, template picker with
    protocol hints, removed scroll-in-scroll anti-pattern (#117)
  * [Documentation] Remmina Flatpak import troubleshooting — added
    instructions to User Guide for importing Remmina connections when
    both apps are Flatpaks (#120)

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 03 May 2026 12:00:00 +0000

rustconn (0.13.0-1) unstable; urgency=medium

  * Version bump to 0.13.0
  * [Fixed] External RDP tab shows only toolbar, content area empty —
    added force_external parameter so external sessions always render
    the informational StatusPage
  * [Fixed] Group edit: SSH settings toggle reopens confirmation dialog
    in a loop — added guard flag to prevent re-entry
  * [Fixed] Incomplete translations for Dynamic Folder strings —
    provided correct translations and removed fuzzy flags for all 16 languages
  * [Fixed] Bulk actions: Move to Group icon missing — replaced with
    standard folder-drag-accept-symbolic from Adwaita
  * [Fixed] External RDP (FreeRDP) fails on changed server certificate —
    added ignore_certificate field and Accept Certificate checkbox (#112)
  * [Added] Smart Folders in sidebar — dynamically groups connections
    based on tag, protocol, host pattern, and group filters (#111)
  * [Added] Group-level Expect rules and post-login scripts inheritance —
    connections inherit automation config from parent group chain (#110)
  * [Improved] Vault entry missing toast notification (#114)
  * [Improved] Test credential resolution button in connection dialog (#114)
  * [Improved] Multi-language SSH password prompt detection (#114)
  * [Improved] GNOME HIG: sidebar toolbar decluttered — removed
    Import/Export buttons from bottom toolbar

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 02 May 2026 14:00:00 +0200

rustconn (0.12.9-1) unstable; urgency=medium

  * [Fixed] Export group exports entire tree instead of selected subtree —
    when exporting a specific group via the Export dialog's group filter,
    all groups were included in the output file even though connections
    were correctly filtered; now both connections and groups are filtered
    to the selected group and its descendants
  * [Added] Snippet variable substitution from Global Variables — snippets
    containing ${VARIABLE} placeholders now automatically resolve values
    from Global Variables before execution; if all variables are resolved,
    the snippet executes immediately without showing the input dialog
  * [Added] Dynamic Folders — new DynamicFolderConfig on ConnectionGroup
    allows generating connections from an external script; supports SSH,
    RDP, VNC, SPICE, Telnet, and MOSH protocols; connections are read-only
    with stable deterministic UUIDs across refreshes

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 01 May 2026 12:00:00 +0000

rustconn (0.12.8-1) unstable; urgency=medium

  * [Added] Generic async cache Cached<T> — new rustconn-core/src/cache.rs
    module providing a thread-safe, TTL-based cache with automatic refresh
    via the LoadCacheObject trait; uses double-checked locking with
    tokio::sync::RwLock for concurrent read access; supports incremental
    updates, explicit invalidation, and configurable TTL (default 60s)
  * [Added] Busy-state indicator BusyStack — new rustconn-core/src/busy.rs
    module providing a thread-safe RAII counter for tracking in-flight
    operations; callback fires on 0→1 (busy) and 1→0 (idle) transitions;
    nested operations handled correctly without extra callbacks
  * [Added] Extended ProtocolCapabilities — added 9 new capability flags:
    multi_monitor, usb_redirection, port_forwarding, wayland_forwarding,
    x11_forwarding, session_recording, remote_monitoring, command_snippets,
    wake_on_lan; enables UI to adapt controls per-protocol
  * [Added] Connection fallback chain ConnectionFallback<T> — generic
    mechanism for trying multiple connection strategies in priority order
  * [Added] Virt-viewer .vv file open support — open SPICE/VNC connections
    from libvirt, Proxmox VE, oVirt directly from the file manager
  * [Added] Connection failure toast with connection name
  * [Dependencies] Teleport CLI 18.7.5 → 18.7.6 (security patch)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 01 May 2026 12:00:00 +0000

rustconn (0.12.7-1) unstable; urgency=medium

  * [Fixed] Group credentials: Variable source shows password field
    instead of variable selector — now shows dropdown populated with
    secret global variables (#109)
  * [Fixed] Group credentials: saving Variable source stored empty
    string instead of actual variable name
  * [Improved] GNOME HIG: accessible labels, menu reorganization,
    Keyboard Shortcuts entry added to app menu

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 30 Apr 2026 12:00:00 +0200

rustconn (0.12.6-1) unstable; urgency=medium

  * [Fixed] Expect script variables not substituted — ${VAR} references
    in Expect rule responses were sent as literal text instead of being
    resolved; now uses VariableManager to substitute global variables
    before creating automation triggers (#105)
  * [Added] SSH verbose mode for connection debugging — new Verbose
    toggle in SSH connection settings adds -v flag to the SSH command,
    showing detailed debug output to help diagnose connection issues (#106)

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 29 Apr 2026 12:00:00 +0200

rustconn (0.12.5-1) unstable; urgency=medium

  * [Fixed] Settings dialog overflows after Hoop.dev install — hoop
    version outputs JSON; added dedicated parser that extracts only
    the version field
  * [Fixed] kubectl version not shown in settings — kubectl version
    --client --short fails on kubectl >= 1.28; switched to kubectl
    version --client and parse Client Version: vX.Y.Z
  * [Fixed] Tray icon SIGSEGV on restart — connect_shutdown did not
    drop the TrayManager; now explicitly drops tray manager in shutdown
    handler before flushing persistence
  * [Fixed] Teleport CLI download URL 404 — pinned version 18.7.6 did
    not exist on the CDN; corrected to 18.7.5
  * [Dependencies] Hoop.dev CLI 1.56.1 → 1.59.3
  * [Dependencies] Teleport CLI 18.7.6 → 18.7.5 (URL fix)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 29 Apr 2026 12:00:00 +0000

rustconn (0.12.4-1) unstable; urgency=medium

  * [Cleaned] Removed dead mosh.rs dialog module — MOSH settings already
    integrated into SSH tab via ssh::create_ssh_options()
  * [Cleaned] Removed legacy connect_password_load_button wrapper — all
    callers use connect_password_load_button_with_groups directly
  * [Cleaned] Removed unused add_available_file_row from Cloud Sync settings
  * [Dependencies] rpassword 7.4.0 → 7.5.0, rustls 0.23.39 → 0.23.40

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 28 Apr 2026 18:00:00 +0200

rustconn (0.12.3-1) unstable; urgency=medium

  * [Fixed] Sync toast shows raw placeholders instead of values —
    i18n_f() only supports {} placeholders; changed both sync message
    strings and all 16 translations to use {} format
  * [Accessibility] Added accessible labels to 24 icon-only buttons
    across 15 files for screen reader support
  * [Dependencies] Teleport CLI 18.7.4 → 18.7.6
  * [Dependencies] clap_complete 4.6.2 → 4.6.3, gio 0.22.5 → 0.22.6,
    glib 0.22.5 → 0.22.6, gtk4 0.11.2 → 0.11.3, pango 0.22.4 → 0.22.6,
    zbus 5.14.0 → 5.15.0, zvariant 5.10.0 → 5.10.1

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 28 Apr 2026 12:00:00 +0200

rustconn (0.12.2-1) unstable; urgency=medium

  * [Fixed] Flatpak SFTP ssh-add fails with missing askpass — strips
    SSH_ASKPASS from the environment for bare ssh-add calls (#102)
  * [Fixed] Blocking operations on GTK main thread — added 5s timeouts
    to has_secret_backend() and refresh_secret_backend_cache()
  * [Fixed] Missing timeouts on blocking async operations — added
    timeouts to flush_persistence (5s), resolve_with_hierarchy (30s),
    auto_unlock (30s), and vault store/retrieve/delete (10s)
  * [Translations] All 16 languages aligned to 1697 strings; fixed
    Italian PO syntax error

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 26 Apr 2026 12:00:00 +0200

rustconn (0.12.1-1) unstable; urgency=medium

  * [Fixed] Split view content disappearing on panel focus switch —
    removed switch_to_tab() call; focus handled via set_focused_pane()
    and grab_focus() (#101)
  * [Fixed] cargo-deny CI failure — removed deprecated unlicensed and
    copyleft keys from deny.toml [licenses] section
  * [Fixed] cargo-audit CI failure — added RUSTSEC-2023-0071 (rsa Marvin
    Attack) to [advisories].ignore in deny.toml; transitive dependency
    via ironrdp/sspi and spice-client with no upstream fix available
  * [Dependencies] Bitwarden CLI 2026.3.0 → 2026.4.1 (fixes supply chain
    attack in 2026.4.0), kubectl 1.35.4 → 1.36.0

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 25 Apr 2026 12:00:00 +0000

rustconn (0.12.0-1) unstable; urgency=medium

  * [Added] Cloud Sync — synchronize connections via shared cloud directory
    (Google Drive, Syncthing, Nextcloud, Dropbox, USB)
  * [Added] Group Sync — per-group .rcn files with Master/Import access model
  * [Added] Simple Sync — single-file bidirectional sync with UUID-based merge
  * [Added] SSH Key Inheritance — group-level SSH settings inherited by children
  * [Added] Credential Resolution UX — interactive dialogs for missing variables
  * [Added] CLI sync commands: sync status, list, export, import, now
  * [Added] Tab Overview — grid view of all open tabs via Ctrl+Shift+O
  * [Added] Tab Switcher in Command Palette — % prefix for fuzzy tab search
  * [Added] Tab Pinning — right-click tab → Pin Tab
  * [Added] Custom terminal themes — create/edit/delete color themes
  * [Added] Group Jump Host dropdown with SSH connection selection
  * [Added] Accessible labels for icon-only buttons
  * [Added] cargo-deny + cargo-audit in CI
  * [Added] Document dirty badge — CSS dot indicator
  * [Fixed] System tray SIGSEGV and empty menu — moved D-Bus updates to
    dedicated background thread, deferred TrayManager creation off GTK
    main thread, added Flatpak disable_dbus_name workaround
  * [Fixed] Tab Overview SIGSEGV with split-view tabs
  * [Fixed] Terminal theme reset when Settings dialog is closed
  * [Fixed] Pango assertion failure on zero font size
  * [Fixed] Highlight rules show color instead of hover-only underline

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 25 Apr 2026 12:00:00 +0300

rustconn (0.11.7-1) unstable; urgency=medium

  * [Fixed] Monitoring bar broken after scrollbar addition — wrapped the
    horizontal terminal+scrollbar row in a vertical outer container so the
    monitoring bar is correctly appended underneath
  * [Docs] User Guide restructured into 13 logically grouped sections;
    CLI Reference and Zero Trust Providers extracted to dedicated documents

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 23 Apr 2026 12:00:00 +0000

rustconn (0.11.6-1) unstable; urgency=medium

  * [Added] Terminal scrollbar — VTE terminals now display a vertical
    scrollbar; can be toggled in Settings → Terminal → Scrolling (#95)
  * [Added] "Execute Snippet…" in terminal right-click context menu (#95)
  * [Fixed] Sidebar status stays gray after reconnect — now shows
    "connecting" immediately when Reconnect is clicked (#96)
  * [Fixed] Context menu intermittently fails to open on right-click —
    reverted popover autohide to avoid GTK4 pointer grab conflict (#87)

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 23 Apr 2026 12:00:00 +0200

rustconn (0.11.5-1) unstable; urgency=medium

  * [Added] Simplified Chinese (zh-cn) translation — complete translation
    of all 1573 UI strings; contributed by GaaChun (PR #94)
  * [Added] User Guide: libvirt NSS hostname resolution troubleshooting
    section for VM connections via RDP/VNC (#91)
  * [Dependencies] picky-asn1-der 0.5.6, rustls-webpki 0.103.13,
    winnow 1.0.2, kubectl 1.35.4

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 22 Apr 2026 12:00:00 +0200

rustconn (0.11.4-1) unstable; urgency=medium

  * [Fixed] Sidebar flashes red during SSH connection — connecting via
    SSH (and other protocols with port check) briefly showed "failed"
    (red) status before switching to "connected" (green); introduced
    ConnectionStartResult enum to distinguish async port check in
    progress (Pending) from real failures (Failed); the sidebar now
    stays yellow ("connecting") until the port check completes
  * [Fixed] Context menu stays open when dialog opens — the sidebar
    context menu remained visible when opening a dialog via keyboard
    shortcut or toolbar button; switched popover to autohide (#93)
  * [Fixed] Sidebar stays "connecting" after cancelling password
    dialog — closing the VNC or RDP password prompt without entering
    credentials left the sidebar status stuck on yellow
  * [Fixed] VNC/RDP with "None" password source prompts immediately —
    first connection attempt now uses an empty password; the password
    dialog is only shown on retry if authentication fails
  * [Updated] Teleport CLI 18.7.3 → 18.7.4
  * [Updated] 1Password CLI 2.33.1 → 2.34.0

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 21 Apr 2026 18:00:00 +0200

rustconn (0.11.3-1) unstable; urgency=medium

  * [Added] CLI: --jump-host flag for add and update — set a jump host
    (SSH bastion) when creating or updating SSH, SFTP, and RDP connections
    via CLI; accepts connection name or UUID; validates that the referenced
    connection exists and prevents self-referencing
  * [Fixed] Flatpak: kubectl and Hoop.dev missing from Settings Clients
    tab and PATH — added Container Orchestration section, Hoop.dev to
    Zero Trust Clients, registered both in get_cli_path_dirs()

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 20 Apr 2026 18:00:00 +0200

rustconn (0.11.2-1) unstable; urgency=medium

  * [Fixed] Reconnect reuses existing tab for all VTE protocols — SSH,
    Telnet, Serial, Kubernetes, ZeroTrust, MOSH; tab position, group,
    and split view state fully preserved (#89)
  * [Fixed] RDP port check skipped with jump host — direct TCP probe
    always timed out for jump-host connections
  * [Fixed] Hoop.dev CLI download — switched to versioned URL (HTTP 403)
  * [Fixed] Azure/gcloud/OCI CLI wrapper test in Flatpak — Read-only
    file system crash during pip install verification
  * [Fixed] Flatpak SFTP always uses mc — xdg-open unreachable in sandbox
  * [Improved] Reconnect banner consistent across all protocols — RDP,
    VNC, SPICE now show bottom banner like SSH/Telnet
  * [Improved] Sidebar width tuned for HiDPI — 360px→320px default,
    old saved widths reset on upgrade
  * [Added] SSH Jump Host for RDP via ssh -L tunnel (#90)
  * [Added] Tab context menu: Close Others/Left/Right/All/Ungrouped
  * [Added] CLI: all 10 protocols and 11 Zero Trust providers
  * [Documentation] Complete CLI reference in User Guide
  * [Dependencies] open 5.3.4, openssl 0.10.78, typenum 1.20.0,
    Hoop.dev CLI 1.56.1

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 20 Apr 2026 12:00:00 +0200

rustconn (0.11.1-1) unstable; urgency=medium

  * [Fixed] Reconnect preserves tab position — new tab opens at the
    same position instead of appending to the end (#89)
  * [Fixed] Context menu handoff between items — right-clicking a
    second item while a menu is open now works correctly (#87)
  * [Fixed] Stale highlight on right-click — residual selection
    highlights no longer persist on previously right-clicked rows
  * [Fixed] Context menu requires single right-click — switching
    between items now works with one click instead of two
  * [Improved] Context menu layout follows GNOME HIG — items reordered
    to match GNOME Files conventions (primary action at top, properties
    before delete at bottom)
  * [Added] SSH Keep-Alive settings — dedicated spin rows for
    ServerAliveInterval and ServerAliveCountMax (#88)

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 19 Apr 2026 00:00:00 +0000

rustconn (0.11.0-1) unstable; urgency=medium

  * [Added] General tab migrated to adw:: widgets — PreferencesGroup,
    EntryRow, SpinRow, ComboRow, PasswordEntryRow; 30-element tuple
    replaced with BasicTabWidgets struct (TASK-004)
  * [Added] Legacy XOR encryption migration warning — toast notification
    shows count of migrated credentials; XOR removed in v0.12 (TASK-006)
  * [Added] State access helpers — with_state(), try_with_state(),
    with_state_mut(), try_with_state_mut() (TASK-008)
  * [Improved] RDP connection state structured — RdpConnectionContext
    struct replaces 13-parameter function signature (TASK-007)
  * [Security] Automation task validation hardened — property tests for
    shell metacharacters; sensitive env vars cleared before task
    execution (TASK-005)
  * [Fixed] Split view tab colors preserved across Settings (TASK-022)
  * [Fixed] Group Operations mode — compact pill icon buttons with
    animated Revealer instead of text buttons that broke sidebar layout
  * [Fixed] Split view context menu Copy/Paste/Select All now works —
    action group moved from TabView container to VTE terminal widget
  * [Fixed] Eliminated gdk_clipboard_write_async assertion — replaced all
    copy_clipboard_format calls with text_selected + clipboard().set_text
  * [Security] Lazy Bitwarden credential decryption — only when
    Bitwarden is the preferred backend
  * [Dependencies] libbz2-rs-sys 0.2.3, rand 0.8.6, rtoolbox 0.0.5

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 18 Apr 2026 23:00:00 +0200

rustconn (0.10.22-1) unstable; urgency=medium

  * [Fixed] Terminal context menu Copy/Paste now works — use VTE native
    context menu API instead of custom GestureClick popover (#84)
  * [Fixed] No more gdk_clipboard_write_async assertion on Copy
  * [Fixed] Blank menus on X11 (MATE, XFCE) — auto-detect X11 and fall
    back to Cairo GSK renderer via process re-exec (#85)
  * [Improved] Context menu labels localized (Copy, Paste, Select All)
  * [Dependencies] pxfm 0.1.28 → 0.1.29, tokio 1.52.0 → 1.52.1,
    uuid 1.23.0 → 1.23.1

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 17 Apr 2026 22:00:00 +0200

rustconn (0.10.21-1) unstable; urgency=medium

  * [Security] Machine key encryption hardened — removed predictable
    hostname+username fallback; /etc/machine-id uses HKDF-SHA256;
    .machine-key created with 0600 permissions (#83)
  * [Fixed] Groups expand/collapse on double-click entire row (#83)
  * [Fixed] Ctrl+K no longer hijacks terminal — only Ctrl+F for search (#83)
  * [Fixed] Right-click context menu works on all SSH profiles (#83)
  * [Fixed] Filter bar opens below search box, not above (#83)
  * [Improved] Sidebar accessible labels localized for screen readers

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 15 Apr 2026 22:00:00 +0200

rustconn (0.10.20-1) unstable; urgency=medium

  * Tab group chooser dialog with existing group selection
  * Close All in Group context menu action
  * Group name shown as tab title prefix instead of color indicator
  * Group name in tab tooltip
  * Tab group and split view colors no longer conflict
  * Welcome screen icon fix for Remote host monitoring
  * Updated FreeRDP 3.24.1 → 3.24.2 (security fixes)
  * Updated VTE 0.80.0 → 0.80.3

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 14 Apr 2026 22:00:00 +0200

rustconn (0.10.18-1) unstable; urgency=medium

  * [Added] Terminal font zoom — Ctrl+Scroll wheel, Ctrl+Plus/Minus, and
    Ctrl+0 to reset; uses VTE native font_scale for per-session zoom (#77)
  * [Added] Copy on select — optional X11-style auto-copy; selected text is
    automatically copied to clipboard; enable in Settings → Terminal (#78)

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 13 Apr 2026 12:00:00 +0000

rustconn (0.10.17-1) unstable; urgency=medium

  * [Fixed] clear command not working in Flatpak SSH sessions — Flatpak
    sandbox inherits TERM=dumb from host; now forces TERM=xterm-256color
    for all remote commands in Flatpak (#25)
  * [Fixed] Sidebar scroll position lost after editing/moving connections —
    restore_state() idle callbacks raced; now runs expansion synchronously
    then restores scroll in a chained callback
  * [Fixed] Sorting collapsed all expanded groups — sort_connections() and
    sort_recent() now preserve expanded group state

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 12 Apr 2026 12:00:00 +0000

rustconn (0.10.16-1) unstable; urgency=medium

  * [Fixed] Sidebar context menu actions still not working — PopoverMenu
    cannot resolve win.* actions inside ListView/TreeExpander; replaced with
    plain Popover + Button widgets that directly call activate_action (#75)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 10 Apr 2026 20:00:00 +0000

rustconn (0.10.15-1) unstable; urgency=medium

  * [Fixed] clear command not working in Flatpak — added ANSI escape
    sequence wrapper to all three Flatpak manifests (#25)
  * [Fixed] Keyboard shortcuts dialog showed wrong bindings — corrected
    19 discrepancies between shortcuts help dialog and actual GTK accelerators
  * [Fixed] Shortcuts dialog missing entries — added 13 missing shortcuts
  * [Improved] FreeRDP updated to 3.24.2 (CVE fixes for client-side
    vulnerabilities)
  * [Documentation] Keyboard shortcuts fully synchronized in User Guide
  * [Documentation] Terminal clear troubleshooting section added to User Guide

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 10 Apr 2026 12:00:00 +0000

rustconn (0.10.13-1) unstable; urgency=medium

  * Fixed SSH auto-reconnect infinite loop on authentication failures
  * Fixed duplicate child-exited signal handlers for SSH and Telnet sessions
  * FreeRDP 3.24.0 → 3.24.1 (security fix), Boundary CLI 0.21.1 → 0.21.2

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 08 Apr 2026 12:00:00 +0000

rustconn (0.10.12-1) unstable; urgency=medium

  * [Security] VNC password stored as SecretString — zeroized on drop,
    protected from accidental logging
  * [Security] VNC pixel buffer max resolution guard — clamp to 16384x16384
    preventing OOM from malicious VNC server
  * [Improved] RDP 4K frame conversion zero-copy — convert_to_bgra() returns
    Cow<[u8]> instead of Vec<u8>, avoiding 33 MB clone per frame
  * [Improved] Sidebar search highlight regex cached — compiled once per
    query change instead of once per visible item per keystroke
  * [Improved] Log sanitization custom patterns pre-compiled at construction
    time instead of recompiling on every sanitize_output() call
  * [Improved] Log sanitization redundant to_lowercase() removed
  * [Dead code] Removed wayland_surface.rs (~1050 lines)
  * [Dead code] Removed TracingOutput::OpenTelemetry variant
  * [Dead code] Removed RDPDR FileLock struct and notify_directory_change() stub
  * [Dead code] Removed commented-out code (set_allow_bold, --full-screen)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 07 Apr 2026 12:00:00 +0000

rustconn (0.10.11-1) unstable; urgency=medium

  * RDP Mouse Jiggler — prevents idle disconnect with periodic mouse movements
  * Connect All in Folder — open all connections in a group at once
  * Copy Username / Copy Password from sidebar context menu
  * Host Online Check — TCP probe with auto-connect when host comes online
  * WoL + Auto-Connect — WoL now polls and auto-connects when host is ready

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 04 Apr 2026 18:00:00 +0000

rustconn (0.10.10-1) unstable; urgency=medium

  * Flatpak: removed extra sandbox permissions rejected by Flathub lint
    (home/.hoop, xdg-run/gnupg, bitwarden data, xdg-run/ssh-agent);
    users can add them manually via flatpak override
  * User Guide: added Flatpak Sandbox Overrides section

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 04 Apr 2026 12:00:00 +0000

rustconn (0.10.9-1) unstable; urgency=medium

  * See CHANGELOG.md for full release notes
  * Corrected: v0.9.11 incorrectly stated Flatpak uses --device=serial;
    the actual permission is --device=all (required for serial port access)

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 02 Apr 2026 12:00:00 +0000

rustconn (0.10.8-1) unstable; urgency=medium

  * See CHANGELOG.md for full release notes

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 27 Mar 2026 12:00:00 +0000

rustconn (0.10.7-1) unstable; urgency=medium

  * See CHANGELOG.md for full release notes

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 26 Mar 2026 12:00:00 +0000

rustconn (0.10.6-1) unstable; urgency=medium

  * Fixed Passbolt CLI integration broken with CLI 0.4.2 — serde
    deserialization failed on lowercase JSON fields returned by
    passbolt CLI 0.4.2; added rename attributes for all underscore-prefixed
    fields; made id/name optional in resource detail (#69)
  * Fixed blurry/artifact RDP image on HiDPI displays — set device scale
    on Cairo surface for 1:1 pixel rendering; adaptive filter selection
  * Fixed 1Password JSON parse errors silently ignored — now logs warning
  * CLI downloads: 1Password CLI 2.33.0→2.33.1
  * Dependencies: ipconfig 0.3.2→0.3.4, libredox 0.1.14→0.1.15,
    proptest 1.10.0→1.11.0

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 24 Mar 2026 12:00:00 +0200

rustconn (0.10.5-1) unstable; urgency=medium

  * Fixed KeePassXC CLI integration — database password not passed to
    keepassxc-cli in vault write/rename/delete/copy operations (#68)
  * Fixed KeePassXC CLI silent error swallowing — added tracing warnings
  * Added -q flag to all keepassxc-cli show commands
  * Fixed GTK warnings on startup — suppressed deprecated
    gtk-application-prefer-dark-theme on KDE/XFCE; removed unsupported
    @media (prefers-reduced-motion) CSS media query
  * CI: replaced deprecated flatpak-builder@master (Node.js 20) with v6
  * Dependencies: deflate64 0.1.12, toml 1.1.0, zip 8.4.0

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 24 Mar 2026 12:00:00 +0200

rustconn (0.10.4-1) unstable; urgency=medium

  * Flatpak: Zero Trust CLIs crash on read-only filesystem fixed
  * Flatpak manifests: added missing FreeRDP and Waypipe modules
  * i18n: wrapped 5 untranslated UI strings, translated for 15 languages
  * Snap license corrected: GPL-3.0+ to GPL-3.0-or-later
  * ARM64 release builds added (deb, rpm, appimage)
  * Removed duplicate changelog entries in packaging files
  * Dependencies: moka 0.12.15, yuv 0.8.12
  * CLI downloads: Tailscale 1.94.2 to 1.96.2
  * Libvirt daemon import via virsh (#63)

  * Fixed MOSH connections not dispatched — added start_mosh_connection()
  * Fixed auto-recording not triggered from session_recording_enabled toggle
  * Fixed highlight rules not applied to terminal after connection
  * Fixed script command visible on recording start — delayed erase
  * Fixed double exit and UI freeze on recording stop — Ctrl+D + async SCP
  * Fixed lost commands in recording playback — strip_script_command_echo()
  * Fixed .rdp file association — MIME type XML for all packaging formats
  * Fixed sidebar stretching with long connection names — ellipsize
  * Fixed picocom not detected in Flatpak — which_binary() fallback
  * Fixed RDP error message when FreeRDP not installed
  * Fixed IronRDP debug log spam — filtered to warn level
  * Improved CSV import delimiter auto-detection
  * Improved script credentials test button with 30s timeout and feedback
  * Added config sync documentation to User Guide
  * Dependencies: shell-words 1.x (rustconn crate), aws-lc-rs 1.16.2, tar 0.4.45

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 20 Mar 2026 12:00:00 +0200

rustconn (0.10.1-1) unstable; urgency=medium

  * MOSH protocol — predict mode, SSH port, UDP port range, server binary
  * CSV import/export — RFC 4180, auto column mapping, delimiter options
  * Session recording — scriptreplay-compatible format, sanitization, REC indicator
  * Text highlighting rules — regex patterns, per-connection + global, VTE integration
  * Ad-hoc broadcast — send keystrokes to multiple terminals simultaneously
  * Smart Folders — dynamic connection grouping by protocol/tags/host/group
  * Script credentials — PasswordSource::Script with shell-words and 30s timeout
  * Per-connection terminal theming — background/foreground/cursor color overrides
  * 15 language translations for all new v0.10.1 UI strings
  * New dependencies: csv 1.x, glob 0.3, shell-words 1.x
  * Fixed Flatpak SSH key paths stale after rebuild — stable copy with fallback
  * Fixed SFTP ssh-add stale portal key path — resolve before use
  * Fixed SFTP mc opens when ssh-add fails — abort with toast error
  * Fixed script command format for modern util-linux (--log-out/--log-timing)
  * Fixed remote SSH recording using local paths
  * Fixed recording playback showing script header
  * Fixed script invocation visible in terminal
  * Fixed SCP host key verification prompts in stop_recording
  * Fixed RDP sidebar status not clearing after disconnect
  * Fixed PlaybackToolbar GtkSearchEntry finalization warning
  * Fixed cargo/config deprecation warning in Flatpak build
  * Flatpak local manifest runtime: GNOME 50beta to 50
  * Dependencies: euclid 0.22.14, toml 1.0.7, zerocopy 0.8.47, zip 8.3

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 18 Mar 2026 12:00:00 +0200

rustconn (0.10.0-1) unstable; urgency=medium

  * Note: Flatpak release will follow after March 18, 2026, when
    GNOME 50 runtime is published on Flathub
  * RDP file import in GUI — .rdp files can now be imported via Import dialog
  * CLI import: 4 new formats — rdp, rdm, virt-viewer, libvirt
  * Split view for Telnet, Serial, Kubernetes — all VTE-based protocols
  * Statistics: Most Used connections and Protocol Distribution with progress bars
  * 5 new customizable keybindings (31 total): Toggle Sidebar, Connection
    History, Statistics, Password Generator, Wake On LAN
  * Secret backend default changed from KeePassXc to LibSecret
  * RDP file association — double-click .rdp files to open and connect
  * FreeRDP 3.24.0 bundled in Flatpak — external RDP works out of the box
  * sdl-freerdp3 and unversioned FreeRDP binary detection
  * GTK4/libadwaita/VTE crate upgrade: gtk4 0.11, libadwaita 0.9,
    vte4 0.10, gdk4-wayland 0.11 — unlocks GNOME 48–50 widget APIs
  * MSRV bumped to 1.92 across all crates, CI, and packaging
  * Flatpak runtime bumped to GNOME 50 with VTE 0.80
  * AdwSpinner, AdwShortcutsDialog, AdwSwitchRow, AdwWrapBox migrations (cfg-gated)
  * CSS prefers-reduced-motion support for accessibility
  * Tiered distro feature flags in OBS packaging: adw-1-8 for
    Tumbleweed/Slowroll/Fedora 43+, adw-1-6 for Leap 16.0/Fedora 42
  * Fixed default window size too small on first start
  * Fixed RDP gateway ignored in embedded mode — auto-fallback to FreeRDP
  * Fixed external RDP sidebar icon stays green after tab close
  * Fixed SSH jump host broken in Flatpak
  * Fixed mc wrapper not found in Flatpak on openSUSE
  * Fixed ZeroTrust and Kubernetes connections broken in Flatpak —
    CLI tools detected and executed via flatpak-spawn --host;
    cloud CLI config dirs mounted into sandbox
  * Fixed split view text selection broken by GestureClick handler
  * Fixed untranslated protocol display names across all 15 languages
  * Codebase cleanup: removed unused CSS classes, consolidated futures-util,
    fixed metainfo.xml, removed dead code

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 16 Mar 2026 12:00:00 +0200

rustconn (0.9.15-1) unstable; urgency=medium

  * Added "Show Local Cursor" option for embedded RDP, VNC, and SPICE
    viewers — hides local OS cursor to eliminate double cursor effect;
    enabled by default for backward compatibility (#51)
  * Fixed VNC session ignores Display Mode setting — Fullscreen and
    External modes now work correctly (#50)
  * Fixed SSH port forwarding via UI broken — window/protocols.rs built
    SSH args manually, skipping port_forwards, X11 forwarding, compression,
    and ControlPersist from SshConfig; refactored to delegate to
    SshConfig::build_command_args() (#49)
  * Fixed SSH custom options -o prefix not stripped — parse_custom_options()
    now silently strips the -o prefix from pasted CLI snippets (#49)
  * Fixed SSH custom options placeholder misleading — updated dialog
    placeholder and subtitle to clarify correct Key=Value format (#49)

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 11 Mar 2026 18:00:00 +0200

rustconn (0.9.14-1) unstable; urgency=medium

  * Fixed SSH connection fails in Flatpak on KDE — host SSH_ASKPASS
    environment variable (e.g. ksshaskpass) stripped from VTE child
    environment since RustConn uses native VTE password injection (#48)
  * Fixed header bar buttons clipped when sidebar + monitoring enabled —
    added ellipsize to variable-length labels and overflow hidden on
    monitoring bar container (#47)
  * Dependencies: tokio 1.49→1.50, uuid 1.21→1.22, regex 1.11→1.12,
    proptest 1.9→1.10, tempfile 3.23→3.26, zip 8.1→8.2,
    criterion 0.8.1→0.8.2, rpassword 7.3→7.4

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 11 Mar 2026 12:00:00 +0200

rustconn (0.9.13-1) unstable; urgency=medium

  * Fixed RDP handshake timeout on heavily loaded servers — Phase 3
    (TLS upgrade + NLA + connect_finalize) now wrapped in tokio timeout
    with 2× configured timeout (minimum 60s)
  * Fixed ARM64 binary download mismatch — download_url_for_arch() no longer
    falls back to x86_64 URL; get_available_components() filters by arch
  * Added RDP Quick Actions menu — dropdown on embedded RDP toolbar with
    6 Windows admin shortcuts (Task Manager, Settings, PowerShell, CMD,
    Event Viewer, Services) via scancode key sequences

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 09 Mar 2026 12:00:00 +0200

rustconn (0.9.12-1) unstable; urgency=medium

  * Security: Removed sshpass dependency; SSH password auth now uses native
    VTE injection and SSH_ASKPASS mechanism
  * Security: Bitwarden master password zeroized on drop (Zeroizing<String>)
  * Security: SSH monitoring askpass script cleaned up automatically via RAII
  * Changed: SPICE embedded client enabled by default with remote-viewer fallback
  * Improved: Extracted vault operations from state.rs (~979 lines)
  * Improved: Extracted edit/terminal/split-view actions from window/mod.rs
    (~1671 lines total)
  * Removed: sshpass from all packaging manifests

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 08 Mar 2026 12:00:00 +0200

rustconn (0.9.11-1) unstable; urgency=medium

  * Security: Bitwarden session key uses SecretString with zeroization
  * Security: Config files written with 0600 permissions, config dir 0700
  * Security: SSH monitoring uses StrictHostKeyChecking=accept-new
  * Security: Session log sanitization active by default
  * Security: Flatpak device permissions scoped to --device=serial
  * Security: Monitoring password uses SecretString with zeroization
  * Security: RDP TLS certificate policy documented with tracing::warn
  * Fixed encrypted document format ambiguity with V2 magic header RCDB_EN2
  * Added monitoring: remote host private IP with IPv4/IPv6 tooltip
  * Added monitoring: live uptime counter updates on every polling tick
  * Added monitoring: stopped indication with warning icon and dimmed bar
  * Added monitoring: all mount points in disk tooltip (snap/tmpfs filtered)
  * Removed dead read_import_file_async from import traits

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 07 Mar 2026 12:00:00 +0200

rustconn (0.9.10-1) unstable; urgency=medium

  * Fixed Remmina import in Flatpak — now checks host path
    ~/.local/share/remmina/ (#44)
  * Fixed connection dialog Basic tab clipped by nested ScrolledWindow
  * Fixed missing minimum sizes on Import, Export, and Shortcuts dialogs
  * Connection dialog default height increased from 500→670px
  * Dependencies: serde_yaml_ng 0.9→0.10, cfg-expr 0.20.6→0.20.7,
    inotify 0.11.0→0.11.1, socket2 0.6.2→0.6.3, toml 1.0.4→1.0.6
  * CLI downloads: Teleport 18.7.1→18.7.2

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 07 Mar 2026 12:00:00 +0200

rustconn (0.9.9-1) unstable; urgency=medium

  * Fixed sshpass not installed in Flatpak (#42)
  * Fixed jump host connections fail port check — skipped when jump_host_id
    or proxy_jump is configured (#41)
  * Fixed jump host dropdown hard to use — added host address to labels
    and enabled search filtering
  * Fixed jump host monitoring fails — SSH commands now include -J jump
    host chain for metrics collection through bastion hosts (#41)
  * Fixed jump host false positive connection status — SSH status detection
    checks terminal text for failure patterns before marking connected (#41)
  * Dependencies: Bitwarden CLI 2026.1.0→2026.2.0, uuid 1.21.0→1.22.0,
    winnow 0.7.14→0.7.15

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 06 Mar 2026 12:00:00 +0200

rustconn (0.9.8-1) unstable; urgency=medium

  * Security: RDP password no longer exposed on command line (uses /from-stdin)
  * Fixed SSH connection status not turning green (VTE cursor axis + async port check)
  * Fixed automation cursor tracking, RDP keyboard duplication, username placeholder
  * Added protocol dialog improvements for SSH, RDP, VNC, SPICE, Serial, K8s, Telnet, Zero Trust
  * Added SFTP mc split view, context menu "New Connection", granular logging options
  * Connection dialog and embedded RDP decomposed into focused submodules

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 05 Mar 2026 12:00:00 +0200

rustconn (0.9.7-1) unstable; urgency=medium

  * Connection group not saved — dialog used separate Rc for groups_data
    in save closure, so selected subgroup was always lost on save
  * Secret variable values lost after settings reopen — values stored in
    vault were never restored when reopening Variables dialog or
    substituting ${VAR} in connections; added resolve_global_variables()
  * Crash on session reconnect — close_tab held immutable borrow on
    sessions while close_page synchronously fired signal handler needing
    mutable borrow; separated borrow from close call (#39)
  * Bitwarden credential lookup speed — removed per-retrieve bw sync and
    added 120s verification cache for bw status; vault syncs once on
    unlock, making reconnect and batch operations significantly faster

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 04 Mar 2026 12:00:00 +0200

rustconn (0.9.6-1) unstable; urgency=medium

  * Bitwarden Flatpak: build_command falls back to global session store (#28)
  * Bitwarden Settings auto-unlock uses resolved bw CLI path (#28)
  * Connection dialog credential download uses generate_store_key (UUID-based)
  * Vault credential resolve for non-KeePass backends via dispatch_vault_op
  * Inherit condition no longer blocked by kdbx_enabled for Bitwarden/1Password
  * Group password load dispatches to configured default secret backend
  * SSH known_hosts persists in Flatpak via writable UserKnownHostsFile path
  * Duplicate reconnect banner prevented via per-session tracking
  * SSH dialog hides key fields for Keyboard Interactive auth method

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 02 Mar 2026 12:00:00 +0200

rustconn (0.9.5-1) unstable; urgency=medium

  * SSH/Telnet pre-connect port check — fail fast with retry toast
  * Vault credential lifecycle — orphaned cleanup, paste duplication,
    group rename/move migrates KeePass entries
  * Consistent credential keys across all secret backends
  * SecretManager cache TTL — entries expire after 5 minutes
  * Inherit cycle protection via HashSet visited guard
  * Group change in connection dialog now correctly persists on save
  * Monitoring waits for SSH handshake before opening channel
  * SecretString migration for RDP/SPICE events, GUI structs, CLI input
  * VaultOp dispatch consolidation, mutex lock safety, error logging
  * CSS extraction, i18n consistency, CI --all-features coverage
  * Dead code removal: StateAccessError, unused sidebar methods

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 01 Mar 2026 18:00:00 +0200

rustconn (0.9.4-1) unstable; urgency=medium

  * Session Reconnect — disconnected VTE tabs show a Reconnect banner
  * Recursive Group Delete — keep children, cascade, or cancel
  * Cluster broadcast mode wired — keyboard input broadcasts to all terminals
  * Libvirt / GNOME Boxes import — VNC, SPICE, RDP from domain XML (#38)
  * TemplateManager — centralized template CRUD with search, import/export
  * Snippet shell safety check before --execute
  * Settings Backup/Restore as ZIP archive
  * Automation templates — 5 built-in expect rule presets
  * Fixed password inheritance for PasswordSource::Variable (#37)
  * Fixed VTE spawn failure — banner + toast instead of silent empty terminal
  * Fixed cluster session lifecycle and disconnect-all
  * Automation engine: one-shot rules, template picker, pre/post-connect tasks
  * User Guide major rewrite

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 01 Mar 2026 12:00:00 +0200

rustconn (0.9.3-1) unstable; urgency=medium

  * Added Waypipe Support — Wayland application forwarding for SSH
    connections via waypipe; auto-detected on Wayland sessions; per-connection
    toggle; graceful fallback to direct SSH (#36)
  * Added IronRDP Clipboard Integration — Bidirectional clipboard sync
    between local desktop and remote RDP session via cliprdr channel;
    feedback loop prevention via suppression flag
  * Fixed missing icons on KDE and non-GNOME desktops — replaced non-standard
    icon names with freedesktop equivalents; forced Adwaita icon theme;
    unified protocol icons via icons.rs (#35)
  * Fixed Serial/Kubernetes connection creation — no longer require host/port
    validation
  * Fixed Serial/Kubernetes missing client toast — shows user-friendly toast
    when picocom or kubectl is not installed
  * Fixed libsecret password storage panic — debug_assert crash on non-UUID
    lookup keys (#34)
  * Fixed libsecret password retrieval — is_available() check always returned
    false because secret-tool exits with code 2 without args
  * Fixed VNC/RDP identical icons — VNC now uses video-joined-displays-symbolic
  * Fixed SFTP via mc opens root instead of home — mc FISH VFS URI now
    includes /~ suffix; mc launched via sh -c for correct terminal sizing
  * Fixed SSH agent not inherited by VTE terminals — spawn_command now injects
    SSH_AUTH_SOCK from OnceLock into VTE-spawned processes
  * Added waypipe to Settings Clients detection tab
  * Dependencies: deflate64 0.1.10→0.1.11, dispatch2 0.3.0→0.3.1,
    objc2 0.6.3→0.6.4, zerocopy 0.8.39→0.8.40

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 27 Feb 2026 14:00:00 +0200

rustconn (0.9.2-1) unstable; urgency=medium

  * Custom Icons — set emoji/unicode or GTK icon names on connections
    and groups (#23)
  * Remote Monitoring — MobaXterm-style monitoring bar below SSH/Telnet/K8s
    terminals showing CPU, memory, disk, and network usage (#26)
  * Fixed new connections and groups appending to end of list instead
    of jumping to position 0
  * Fixed IronRDP fallback to FreeRDP on protocol negotiation failure (#33)
  * Fixed monitoring SSH password auth via sshpass
  * Fixed monitoring error spam — collector stops after 3 consecutive failures
  * Fixed Bitwarden CLI not found in Flatpak — bw command path now resolved
    dynamically instead of hardcoded (#28)
  * Added Bitwarden setup documentation (docs/BITWARDEN_SETUP.md)
  * CLI downloads: Teleport 18.7.0→18.7.1
  * Dependencies: vnc-rs 0.5.2→0.5.3, rustls 0.23.36→0.23.37,
    js-sys 0.3.89→0.3.90, wasm-bindgen 0.2.112→0.2.113

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 26 Feb 2026 12:00:00 +0200

rustconn (0.9.1-1) unstable; urgency=medium

  * Command Palette — VS Code-style quick launcher (Ctrl+P / Ctrl+Shift+P)
    with fuzzy search for connections and prefix modes for commands, tags, groups
  * Favorites / Pinning — pin connections to a dedicated sidebar section
  * Pass (passwordstore.org) secret backend — GPG-encrypted credential storage
    via pass CLI with Settings UI and CLI support (#32)
  * Tab coloring by protocol — optional colored indicators on terminal tabs
  * Snippet timestamps — created_at and updated_at fields with backward compat
  * Tab grouping — right-click context menu to assign named groups with colors
  * Custom Keybindings — fully customizable shortcuts via Settings → Keybindings
    with 30+ actions, Record button, per-shortcut Reset, and Reset All
  * Fixed Command Palette not dismissible via Escape or click-outside
  * Fixed Favorites group not updating immediately on pin/unpin
  * Fixed KDBX group visibility regression when loading saved backend preference
  * Improved i18n coverage — connection dialog tabs and all content strings
    now translatable across all 14 languages

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 24 Feb 2026 12:00:00 +0200

rustconn (0.9.0-1) unstable; urgency=medium

  * Ukrainian translation reviewed by Mykola Zubkov — 674 translations
    revised for accuracy and modern Ukrainian orthography

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 21 Feb 2026 12:00:00 +0200

rustconn (0.8.9-1) unstable; urgency=medium

  * SSH port forwarding — Local (-L), remote (-R), and dynamic SOCKS (-D)
    port forwarding rules per connection (#22)
  * Deferred secret backend initialization — Bitwarden vault unlock and KDBX
    password decryption run asynchronously after window presentation,
    eliminating 1–3 second startup delay
  * Security: input validation hardening across all protocols — custom_args,
    device paths, shell paths, hostnames, proxy URLs, shared folder names
    validated against injection attacks
  * Security: SSH config export blocks dangerous directives (ProxyCommand, etc.)
  * Security: KeePassXC socket responses capped at 10 MB
  * Security: VNC and RDP client passwords migrated to SecretString
  * Security: FreeRDP external launcher uses /from-stdin
  * Fixed Quick Connect RDP "Got empty identity" CredSSP error — NLA
    auto-disabled when credentials incomplete (#29)
  * Fixed Bitwarden duplicate vault writes, false "unlocked" status,
    auto-unlock after restart, CLI v2026.1.0 compatibility (#28)
  * Fixed RefCell borrow panic in EmbeddedRdpWidget, VNC polling mutex
    contention, RDP polling timer leak
  * Fixed several unwrap() panics (VNC, TaskExecutor, tray, build.rs)
  * ~40 eprintln! calls migrated to structured tracing
  * Dependencies: serde_yaml replaced with serde_yaml_ng 0.9 (maintained fork)
  * Dependencies: cpal 0.17.1→0.17.3, clap 4.5.59→4.5.60
  * Internal: architecture audit completed (51 findings, 49 resolved)

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 20 Feb 2026 12:00:00 +0200

rustconn (0.8.8-1) unstable; urgency=medium

  * Security: AES-256-GCM replaces XOR obfuscation for stored credentials
    (transparent migration from legacy format)
  * Security: FreeRDP password passed via stdin instead of command line
  * FreeRDP detection unified with Wayland-first priority
  * RDP build_args() decoupled from hardcoded binary name
  * ZeroTrust: provider-specific validation and CLI tool detection
  * Native export/import now includes snippets (format v2)
  * Removed dead code: Dashboard module, 5 unused GUI modules,
    tab_split_manager remnants

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 18 Feb 2026 12:00:00 +0200

rustconn (0.8.7-1) unstable; urgency=medium

  * Version bump to 0.8.7
  * Internationalization (i18n) — 14 languages: uk, de, fr, es, it, pl, cs,
    sk, da, sv, nl, pt, be, kk; gettext support via gettext-rs (#17)
  * SPICE proxy support for Proxmox VE tunnelled connections (#18)
  * RDP HiDPI fix — IronRDP uses device-pixel resolution on HiDPI displays (#16)
  * Security: variable injection prevention in command-building paths
  * Security: ChecksumPolicy enum replaces placeholder SHA256 strings
  * Security: sensitive CLI arguments masked in log output
  * Security: configurable document encryption strength (Standard/High/Maximum)
  * Security: SSH Agent passphrase handling via SSH_ASKPASS helper
  * CLI overhaul: modularized into 18 handler modules with structured logging
  * CLI: shell completions, man page, fuzzy suggestions, dry-run, pager, auto-JSON
  * CLI: --config flag now threads through all ConfigManager call sites
  * Czech translation improved by native speaker p-bo (PR #19)
  * Remmina RDP import: gateway_server, gateway_username, domain fields (#20)
  * Accessible labels added to 20+ icon-only buttons
  * VTE updated to 0.83.90 in Flatpak manifests
  * Flatpak components dialog hides unusable protocol clients in sandbox
  * SPDX license corrected: GPL-3.0+ → GPL-3.0-or-later in metainfo.xml

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 17 Feb 2026 12:00:00 +0200

rustconn (0.8.6-1) unstable; urgency=medium

  * Version bump to 0.8.6
  * Fixed Embedded RDP keyboard layout:
    - Fixed incorrect key mapping for non-US keyboard layouts (e.g. German QWERTZ)
      in IronRDP embedded client (#15)

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 16 Feb 2026 12:00:00 +0200

rustconn (0.8.5-1) unstable; urgency=medium

  * Version bump to 0.8.5
  * Added Kubernetes Protocol (#14):
    - Shell access to Kubernetes pods via kubectl exec -it
    - Two modes: exec into existing pod, or launch temporary busybox pod
    - KubernetesConfig: kubeconfig, context, namespace, pod, container, shell
    - GUI: Connection dialog Kubernetes tab, sidebar K8s quick filter
    - CLI: kubernetes subcommand with full parameter support
    - kubectl available as Flatpak downloadable component
    - Property tests updated with Kubernetes coverage
  * Added Serial Console Protocol (#11):
    - Full serial console support via picocom (GUI, CLI, Flatpak, Snap)
    - SerialConfig: device path, baud rate (9600-921600), data/stop bits,
      parity, flow control
    - 13 serial-specific property tests
  * Added SFTP File Browser (#10):
    - "Open SFTP" in sidebar context menu and SSH session toolbar
    - Opens system file manager via portal (Flatpak/Snap/native)
    - "SFTP via mc" option with Midnight Commander FISH VFS
    - Standalone SFTP connection type reusing SSH config
    - CLI: sftp subcommand (--cli, --mc, default opens file manager)
  * Added Responsive / Adaptive UI (#9):
    - All 17+ dialogs: reduced sizes, minimum sizes, all resizable
    - adw::Clamp (max 600px) on 7 list-style dialogs
    - Dashboard and Active Sessions upgraded to adw::Window
    - Main window breakpoint 600sp: hides split view buttons
  * Added Terminal Rich Search (#7):
    - Regex, Highlight All, case-sensitive toggles, wrap-around navigation
    - Keyboard shortcut: Ctrl+Shift+F
    - Session log timestamps: [HH:MM:SS] prepended to log lines
  * Changed: Session Logging moved from Terminal to Logging settings tab

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 15 Feb 2026 12:00:00 +0200

rustconn (0.8.4-1) unstable; urgency=medium

  * Version bump to 0.8.4
  * Added FIDO2/SecurityKey SSH authentication:
    - New SshAuthMethod::SecurityKey variant for FIDO2 hardware key auth
    - "Security Key (FIDO2)" option in connection and template dialogs
    - Exports map SecurityKey to publickey (Asbru) or ssh_auth=2 (Remmina)
    - All property test strategies updated with SecurityKey coverage
  * Added CLI auth-method support:
    - --auth-method flag for add and update commands
    - show command displays SSH auth method
    - update command supports --key for SSH key path changes
  * Fixed CLI version check timeout:
    - Increased VERSION_CHECK_TIMEOUT from 3 to 6 seconds
    - Azure CLI loads Python runtime and takes ~3.3s
  * Fixed WoL MAC Entry Disabled on Edit:
    - WoL settings fields remained disabled when editing existing connection
    - Removed per-widget sensitivity calls; wol_settings_group manages this
  * Refactored ConnectionManager watch channels:
    - Replaced 3x Arc<Mutex<Option<Vec<T>>>> with tokio::sync::watch channels
    - Extracted generic debounce_worker() async function
    - Struct fields reduced from 8 persistence-related to 3
  * Refactored EmbeddingError thiserror derive
  * Refactored FreeRDP mutex consolidation into single shared state struct
  * Refactored Embedded RDP module directory (7 flat files into module)
  * Refactored ConnectionDialog LoggingTab extraction (~310 lines removed)
  * Refactored OverlaySplitView sidebar with F9 toggle and gestures
  * Refactored responsive sidebar breakpoint (400sp for narrow windows)
  * Refactored Window module directory (14 flat files into module)
  * Refactored State access error thiserror derive
  * Refactored workspace clippy suppression audit (~80 redundant annotations removed)
  * Refactored Protocol trait with capabilities() and build_command() methods
  * Updated dependencies: resvg 0.46->0.47, usvg 0.46->0.47,
    tiny-skia 0.11->0.12, tiny-skia-path 0.11->0.12

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 14 Feb 2026 12:00:00 +0200

rustconn (0.8.3-1) unstable; urgency=medium

  * Version bump to 0.8.3
  * Added Wake On LAN from GUI (#8):
    - Right-click connection → "Wake On LAN" sends packet using configured MAC
    - Auto-WoL before connecting (fire-and-forget, does not block connection)
    - Standalone WoL dialog (Menu → Tools → "Wake On LAN...")
    - Retry with 3 packets at 500 ms intervals for reliability
    - Non-blocking: all sends run on background threads
    - Toast notifications for success/failure
  * Fixed Flatpak libsecret build:
    - Disabled bash_completion in libsecret module (EROFS in sandbox)
    - Renamed gcrypt option to crypto for libsecret 0.21.7
  * Fixed Thread Safety:
    - Removed std::env::set_var from FreeRDP spawned thread (data race since Rust 1.66+)
    - Env vars already set per-process via Command::env() in launch_freerdp()
  * Fixed Flatpak Machine Key:
    - get_machine_key() generates app-specific key in $XDG_DATA_HOME/rustconn/.machine-key
    - /etc/machine-id (inaccessible in Flatpak) is now a fallback
  * Fixed Variables Dialog Panic:
    - Replaced expect() with if-let pattern and tracing::warn! fallback
  * Fixed Keyring secret-tool Check:
    - keyring::store() checks is_secret_tool_available() before storing
    - Returns BackendUnavailable with user-friendly message if missing
  * Fixed Flatpak CLI Paths:
    - Secret backend CLI detection no longer adds /snap/bin/ and /usr/local/bin/
      paths inside Flatpak; checks get_cli_install_dir() instead
  * Fixed Settings Dialog Performance:
    - Moved CLI detection and keyring auto-load to background threads
    - Dialog opens instantly with "Detecting..." placeholders (~10s → instant)
  * Fixed Settings Clients Tab Performance:
    - Added 3-second timeout to all CLI version checks
    - Parallelized all CLI detections via std::thread::scope (~15s → ~3s)
  * Fixed Settings Dialog Instant Display:
    - Moved dialog.present() before load_settings() for immediate visibility
  * Fixed Settings Dialog Visual Render Blocking:
    - Replaced glib async pattern with std::thread::spawn + mpsc + idle_add_local
    - Dialog renders instantly while CLI detection runs in parallel

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 13 Feb 2026 12:00:00 +0200

rustconn (0.8.2-1) unstable; urgency=medium

  * Version bump to 0.8.2
  * Added Shared Keyring Module:
    - New rustconn-core::secret::keyring module with generic store(), lookup(),
      clear(), and is_secret_tool_available() functions for all backends
  * Added Keyring Support for All Secret Backends:
    - Bitwarden: refactored to use shared keyring module
    - 1Password: store/get/delete token in keyring
    - Passbolt: store/get/delete passphrase in keyring
    - KeePassXC: store/get/delete KDBX password in keyring
  * Added Auto-Load Credentials from Keyring:
    - On settings load, all backends with "Save to system keyring" enabled
      automatically restore credentials from keyring
  * Added secret-tool Availability Check:
    - Toggling "Save to system keyring" checks if secret-tool is installed;
      if missing, unchecks checkbox and shows warning
  * Added Passbolt Server URL Setting and UI:
    - Server URL entry and "Open Vault" button in Secrets tab
    - Auto-fills from go-passbolt-cli config on startup
  * Added Unified Credential Save Options:
    - All secret backends now offer consistent "Save password" and
      "Save to system keyring" options with mutual exclusion
  * Added new SecretSettings fields for unified credential persistence
  * Fixed Secret Lookup Key Mismatch:
    - libsecret store_unified() now uses correct key format
    - Bitwarden/1Password/Passbolt resolve functions try multiple key formats
  * Fixed Passbolt Server Address Always None:
    - Reads server address from go-passbolt-cli config
  * Fixed Passbolt "Open Password Vault" URL:
    - Opens configured server URL instead of hardcoded address
  * Fixed Variable Secrets Ignoring Preferred Backend:
    - save/load_variable_to/from_vault() now respect preferred_backend setting
  * Fixed Bitwarden Folder Parsing Crash:
    - BitwardenFolder.id now accepts null values
  * Fixed Bitwarden Vault Auto-Unlock:
    - Variable save/load automatically unlocks vault using saved credentials
  * Improved workspace dependency consistency:
    - Moved regex in rustconn crate to workspace dependency
  * Removed unused picky pin from rustconn-core
  * Updated dependencies: clap 4.5.57->4.5.58, clap_builder 4.5.57->4.5.58,
    clap_lex 0.7.7->1.0.0, deranged 0.5.5->0.5.6

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 11 Feb 2026 14:00:00 +0200

rustconn (0.8.1-1) unstable; urgency=medium

  * Version bump to 0.8.1
  * Added Passbolt Secret Backend (#6):
    - PassboltBackend implementing SecretBackend trait via go-passbolt-cli
    - Store, retrieve, and delete credentials as Passbolt resources
    - CLI detection and version display in Settings → Secrets
    - Requires `passbolt configure` CLI setup before use
  * Unified Secret Backends:
    - Replaced individual PasswordSource variants with single Vault variant
    - Connection dialog password source: Prompt, Vault, Variable, Inherit, None
    - Serde aliases preserve backward compatibility with existing configs
  * Added Variable Password Source:
    - PasswordSource::Variable(String) reads credentials from named secret variable
    - Connection dialog shows variable dropdown when Variable is selected
  * Variables Dialog Improvements:
    - Show/Hide toggle for secret variable values
    - Load from Vault button to retrieve secret values from configured backend
    - Secret variable values auto-saved to vault on dialog save
  * Fixed secret variables always using libsecret instead of configured backend
  * Fixed Variable dropdown showing empty when editing connections
  * Fixed Telnet backspace/delete: replaced stty wrapper with VTE EraseBinding API
  * Fixed split view left panel shrinking on nested splits

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 11 Feb 2026 12:00:00 +0200

rustconn (0.8.0-1) unstable; urgency=medium

  * Version bump to 0.8.0
  * Added Telnet Backspace/Delete Configuration (#5):
    - TelnetBackspaceSends and TelnetDeleteSends enums with Automatic/Backspace/Delete options
    - Connection dialog Keyboard group with two dropdowns for Backspace and Delete key behavior
    - stty erase shell wrapper in spawn_telnet() to apply key settings before connecting
    - Addresses common backspace/delete inversion issue reported by users
  * Added Flatpak Telnet Support:
    - GNU inetutils built as Flatpak module
    - telnet binary available at /app/bin/ in Flatpak sandbox
    - Added to all three Flatpak manifests (flatpak, flatpak-local, flathub)
  * Fixed OBS Screenshot Display:
    - Updated _service revision from v0.5.3 to current version tag
  * Fixed Flatpak AWS CLI:
    - Replaced awscliv2 pip package (Docker wrapper) with official AWS CLI v2
      binary installer from awscli.amazonaws.com
  * Fixed Flatpak Component Detection:
    - SSM Plugin, Azure CLI, OCI CLI now correctly detected after installation
    - Added explicit search paths and increased recursive search depth
  * Fixed Flatpak Python Version:
    - Wrapper scripts dynamically detect Python version instead of hardcoding
  * Updated dependencies: libc 0.2.180->0.2.181, tempfile 3.24.0->3.25.0,
    unicode-ident 1.0.22->1.0.23

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 10 Feb 2026 12:00:00 +0200

rustconn (0.7.9-1) unstable; urgency=medium

  * Version bump to 0.7.9
  * Added Telnet protocol support (#5):
    - Full implementation across all three crates (core, CLI, GUI)
    - TelnetConfig model with host, port (default 23), extra arguments
    - Protocol trait implementation using external telnet client
    - Import/export support: Remmina, Asbru, MobaXterm, RDM
    - CLI: rustconn-cli telnet subcommand
    - GUI: connection dialog, template dialog, sidebar filter, quick connect
    - Terminal: spawn_telnet() for launching sessions
    - All property tests updated with Telnet coverage
  * Fixed missing Telnet icon mapping in sidebar get_protocol_icon()
  * Fixed Telnet icon: changed from network-wired-symbolic to call-start-symbolic
    across all views (sidebar, filter buttons, dialogs, templates)
  * Fixed ZeroTrust sidebar icon: unified to folder-remote-symbolic for all providers

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 09 Feb 2026 12:00:00 +0200

rustconn (0.7.8-1) unstable; urgency=medium

  * Version bump to 0.7.8
  * Added Remmina password import:
    - Passwords from Remmina keyring are now transferred to the configured
      secret backend (libsecret, KeePassXC, etc.) during import
    - Imported connections use PasswordSource::Keyring for seamless auth
  * Fixed import error swallowing:
    - Replaced 14 unwrap_or_default() calls with proper error propagation
    - Import failures now display user-friendly messages
  * Fixed MobaXterm import double allocation:
    - Removed unnecessary clone on byte buffer during UTF-8 conversion
  * Improved import file size guard:
    - Added 50 MB file size limit to prevent OOM on large files
  * Improved native export/import streaming I/O:
    - to_file() uses BufWriter with serde_json::to_writer_pretty()
    - from_file() uses BufReader with serde_json::from_reader()
    - Version pre-check before full deserialization
  * Added centralized write_export_file() helper with BufWriter
  * Refactored export write consolidation across all exporters
  * Removed redundant TOCTOU path.exists() checks in importers
  * Removed unused imports in Asbru and MobaXterm exporters
  * Updated dependencies: memchr 2.7.6->2.8.0, ryu 1.0.22->1.0.23,
    zerocopy 0.8.38->0.8.39, zmij 1.0.19->1.0.20

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 08 Feb 2026 12:00:00 +0200

rustconn (0.7.7-1) unstable; urgency=medium

  * Version bump to 0.7.7
  * Fixed keyboard shortcuts intercepting VTE terminal input:
    - Delete, Ctrl+E, Ctrl+D no longer fire when terminal has focus (#4)
    - Shortcuts now scoped to sidebar only
  * Improved thread safety:
    - Audio mutex locks use graceful fallback instead of unwrap()
    - Search engine mutex locks use graceful recovery patterns
  * Security: VNC client logs warning when connecting without password
  * Refactored runtime consolidation:
    - Replaced 23 redundant tokio runtime calls with shared with_runtime()
  * Collection optimization: snippet tags use flat_map and sort_unstable
  * Dead code removal: removed deprecated credential methods and unused menu builder

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 07 Feb 2026 12:00:00 +0200

rustconn (0.7.6-1) unstable; urgency=medium

  * Version bump to 0.7.6
  * Flatpak Components Manager - On-demand CLI download for Flatpak environment:
    - Menu → Flatpak Components... (visible only in Flatpak)
    - Download and install CLIs to ~/.var/app/io.github.totoshko88.RustConn/cli/
    - Supports: AWS CLI, AWS SSM Plugin, Google Cloud CLI, Azure CLI, OCI CLI,
      Teleport, Tailscale, Cloudflare Tunnel, Boundary, Bitwarden CLI, 1Password CLI, TigerVNC
    - SHA256 checksum verification, progress indicators, cancel support
  * Snap Strict Confinement - Migrated from classic to strict confinement:
    - Snap-aware path resolution for data, config, and SSH directories
    - Uses embedded clients (IronRDP, vnc-rs, spice-gtk)
    - External CLIs accessed from host via system-files interface
  * UI/UX Enhancements - GNOME HIG compliance improvements:
    - Accessible labels for status icons and protocol filter buttons
    - Sidebar minimum width increased to 200px
    - Connection dialog uses adaptive adw::ViewSwitcherTitle
    - Toast notifications with proper priority levels
  * Settings → Clients - Improved client detection display:
    - All protocols show embedded client status with blue indicator
    - Fixed AWS SSM Plugin detection
  * Dialog Widget Builders - Reusable UI components (CheckboxRowBuilder, EntryRowBuilder, etc.)
  * Protocol Dialogs Refactoring - Applied widget builders to SSH, RDP, VNC, SPICE panels
  * Legacy Code Cleanup - Removed unused TabDisplayMode, TabLabelWidgets types

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 06 Feb 2026 12:00:00 +0200

rustconn (0.7.5-1) unstable; urgency=medium

  * Version bump to 0.7.5
  * Code Quality Audit - Comprehensive codebase analysis and cleanup:
    - Removed duplicate SSH/VNC/SPICE/ZeroTrust/RDP options code from dialog.rs (~1850 lines)
    - Extracted shared folders UI into reusable shared_folders.rs module
    - Created protocol_layout.rs with ProtocolLayoutBuilder for consistent protocol UI
    - Consolidated with_runtime() into async_utils.rs
    - Changed FreeRDP launcher to Wayland-first (force_x11: false by default)
    - Removed legacy no-op methods from terminal module
  * Updated dependencies: proptest 1.9.0→1.10.0, time 0.3.46→0.3.47

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 06 Feb 2026 12:00:00 +0200

rustconn (0.7.4-1) unstable; urgency=medium

  * Version bump to 0.7.4
  * Fixed Zero Trust Entry Field Alignment - converted all Zero Trust provider fields to adw::EntryRow
  * Refactored Connection Dialog Modularization - split into dialog.rs, ssh.rs, rdp.rs, vnc.rs, spice.rs
  * Refactored Import File I/O - extracted common file reading pattern into read_import_file() helper
  * Refactored Protocol Client Errors - consolidated duplicate error types into unified EmbeddedClientError
  * Refactored Config Atomic Writes - improved reliability with temp file + atomic rename pattern
  * Added GTK Lifecycle Documentation - module-level docs explaining #[allow(dead_code)] pattern
  * Code Quality - removed legacy types, standardized error patterns, reduced unnecessary clones

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 05 Feb 2026 12:00:00 +0200

rustconn (0.7.3-1) unstable; urgency=medium

  * Version bump to 0.7.3
  * Fixed Azure CLI Version Parsing - version now correctly extracted from unique output format
  * Fixed Flatpak XDG Config - removed unnecessary xdg-config/rustconn:create permission
  * Fixed Teleport CLI Detection - changed binary from teleport to tsh
  * Improved RDP Client Detection - FreeRDP 3.x with Wayland support (wlfreerdp3/xfreerdp3)
  * Unified Client Install Hints - format: deb-package (rpm-package)
  * Updated dependencies: bytes, flate2, regex

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 03 Feb 2026 12:00:00 +0200

rustconn (0.7.2-1) unstable; urgency=medium

  * Version bump to 0.7.2
  * Flatpak Host Command Support - New flatpak module for running host commands
  * Fixed Flatpak Config Access - connections and settings now persist correctly
  * Fixed Split View Equal Proportions - panels now split 50/50 reliably

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 03 Feb 2026 12:00:00 +0200

rustconn (0.7.1-1) unstable; urgency=medium

  * Version bump to 0.7.1
  * Refactored Sidebar - Split monolithic sidebar into modular components (TECH-03)
  * Refactored Drag & Drop - Strongly typed DragPayload (TECH-04)
  * Added Search Highlighting - Visual feedback for search matches (TECH-05)
  * Code Quality - Async persistence fixes and cleanup

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 01 Feb 2026 14:00:00 +0200

rustconn (0.7.0-1) unstable; urgency=medium

  * Version bump to 0.7.0
  * Fixed Asbru Import Nested Groups - two-pass algorithm preserves hierarchy
  * Fixed Asbru Export Description Field - exports connection and group descriptions
  * Added Group Description Field - New Group and Edit Group dialogs
  * Added Asbru Global Variable Conversion - <GV:VAR> to ${VAR} syntax
  * Added Variable Substitution at Connection Time
  * Dialog Size Unification - Export 750×650, Import 750×800, New Group 450×550

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 01 Feb 2026 12:00:00 +0200

rustconn (0.6.9-1) unstable; urgency=medium

  * Version bump to 0.6.9
  * Fixed Local Shell tabs not appearing in Split View "Select Tab" dialog

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 31 Jan 2026 12:00:00 +0200

rustconn (0.6.8-1) unstable; urgency=medium

  * Version bump to 0.6.8
  * 1Password CLI Integration - New secret backend for 1Password password manager
  * Bitwarden API Key Authentication - Support for automated workflows and 2FA
  * Bitwarden Keyring Storage - Store master password in system keyring

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 30 Jan 2026 12:00:00 +0200

rustconn (0.6.7-1) unstable; urgency=medium

  * Version bump to 0.6.7

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 29 Jan 2026 12:00:00 +0200

rustconn (0.6.6-1) unstable; urgency=medium

  * Version bump to 0.6.6

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 27 Jan 2026 12:00:00 +0200

rustconn (0.6.5-1) unstable; urgency=medium

  * Version bump to 0.6.5

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 17 Jan 2026 20:00:00 +0200

rustconn (0.6.4-1) unstable; urgency=medium

  * Update to version 0.6.4 - Snap Package Support and RDP/VNC Performance Modes
    - Snap Package - New distribution format for easy installation via Snapcraft
    - Classic confinement for full system access (SSH keys, network, etc.)
    - Automatic updates via Snap Store
    - GitHub Actions Snap Workflow - Automated builds and publishing
    - RDP/VNC Performance Modes - Quality/Balanced/Speed presets for different networks
    - Fixed RDP initial resolution matching actual widget size
    - Fixed RDP dynamic resolution with debounced reconnect (500ms)
    - Fixed sidebar fixed width (no longer resizes with window)
    - Fixed RDP cursor colors (BGRA→ARGB conversion)
    - Updated ironrdp 0.13 → 0.14, ironrdp-tokio 0.7 → 0.8

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 17 Jan 2026 18:00:00 +0200

rustconn (0.6.3-1) unstable; urgency=medium

  * Update to version 0.6.3 - Bitwarden Integration and Secret Backend Improvements
    - Bitwarden CLI Integration - New secret backend for Bitwarden password manager
    - Password Manager Detection - Automatic detection of installed managers
    - Enhanced Secrets Settings UI - Improved backend selection with dynamic config
    - Detects GNOME Secrets, KeePassXC, KeePass2, Bitwarden CLI, 1Password CLI

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 15 Jan 2026 18:00:00 +0200

rustconn (0.6.2-1) unstable; urgency=medium

  * Update to version 0.6.2 - MobaXterm Import/Export and UX Improvements
    - MobaXterm Import/Export - Full support for .mxtsessions files
    - Connection History Button - Quick access from sidebar toolbar
    - Run Snippet from Context Menu - Right-click on connection → "Run Snippet..."
    - Persistent Search History - Up to 20 recent searches saved across sessions
    - Updated quick-xml 0.38 → 0.39, resvg 0.45 → 0.46

 -- Anton Isaiev <totoshko88@gmail.com>  Wed, 15 Jan 2026 12:00:00 +0200

rustconn (0.6.1-1) unstable; urgency=medium

  * Update to version 0.6.1 - Credential Inheritance and Jump Host Support

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 12 Jan 2026 22:00:00 +0200

rustconn (0.6.0-1) unstable; urgency=medium

  * New upstream release - Code Audit & Cleanup
  * Removed check_structs.rs development artifact containing unsafe code
  * Replaced blocking_send() with try_send() in VNC input handlers
  * Replaced unwrap() with safe alternatives in sidebar.rs iterator access
  * Replaced expect() with proper error handling in validation.rs regex
  * Replaced module-level clippy allows with targeted function-level annotations
  * Improved app.rs initialization error handling
  * Updated Cargo.toml license from MIT to GPL-3.0-or-later
  * Updated Cargo.toml authors to Anton Isaiev
  * Added developer_name tag to metainfo.xml for AppStream compatibility
  * Updated dependencies: base64ct, cc, data-encoding, find-msvc-tools, flate2,
    getrandom, libc, toml, zbus, zbus_macros, zbus_names, zmij, zvariant
  * Removed unused cfg_aliases, nix, static_assertions dependencies

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 12 Jan 2026 12:00:00 +0200

rustconn (0.5.9-1) unstable; urgency=medium

  * New upstream release
  * Migrated Settings dialog from deprecated PreferencesWindow to PreferencesDialog
  * Updated libadwaita feature from v1_4 to v1_5
  * Migrated Template dialog to modern libadwaita patterns
  * Fixed Zero Trust (AWS SSM) connection status icon showing as failed
  * Fixed remote-viewer version parsing in Settings Clients tab
  * Fixed SSH Agent key selection when connecting
  * Improved agent key dropdown display in Connection Dialog

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 11 Jan 2026 12:00:00 +0200

rustconn (0.5.8-1) unstable; urgency=medium

  * New upstream release
  * Fixed SSH Agent Add Key button (opens file chooser)
  * Fixed SSH Agent plus buttons in Available Key Files (load keys with passphrase)
  * Fixed SSH Agent Remove Key button (actually removes keys from agent)
  * Fixed SSH Agent Refresh button (updates both loaded and available keys)

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 07 Jan 2026 20:00:00 +0200

rustconn (0.5.7-1) unstable; urgency=medium

  * New upstream release
  * Fixed Test button in New Connection dialog (async runtime issue with GTK)
  * Updated dependencies: h2, proc-macro2, quote, rsa, rustls, serde_json, url, zerocopy
  * Note: sspi and picky-krb kept at previous versions due to rand_core compatibility

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 07 Jan 2026 18:00:00 +0200

rustconn (0.5.6-1) unstable; urgency=medium

  * New upstream release
  * Migrated to native libadwaita architecture (adw::Application, adw::ApplicationWindow)
  * All dialogs redesigned to use adw::Window with adw::HeaderBar following GNOME HIG
  * Added KeePass status button in sidebar toolbar with visual integration indicator
  * Added Quick Filter functionality for protocol filtering (SSH, RDP, VNC, SPICE, ZeroTrust)
  * Enhanced terminal settings with color themes, cursor options, and behavior controls
  * Added Security Tips section to Password Generator dialog
  * Fixed Quick Filter logic and button state synchronization
  * Updated USER_GUIDE.md with complete v0.5.5+ feature documentation

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 07 Jan 2026 12:00:00 +0200

rustconn (0.5.5-1) unstable; urgency=medium

  * New upstream release
  * Added Kiro steering rules for commit and release checklists
  * Fixed Flatpak manifest version references

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 02 Jan 2026 17:30:00 +0200

rustconn (0.5.4-1) unstable; urgency=medium

  * New upstream release
  * Royal TS (.rtsz XML) import support with folder hierarchy and trash filtering
  * Royal TS (.rtsz XML) export support for SSH, RDP, VNC connections
  * Close Tab action implementation for terminal notebook (Ctrl+W)
  * Session Restore feature with configurable settings
  * Password Generator with strength evaluation and entropy calculation
  * Advanced session logging modes (activity, user input, terminal output)
  * Updated dependencies: cc, iri-string, itoa, libredox, proc-macro2, and others

 -- Anton Isaiev <totoshko88@gmail.com>  Fri, 02 Jan 2026 12:00:00 +0200

rustconn (0.5.3-1) unstable; urgency=medium

  * New upstream release
  * UI Unification: All dialogs now use consistent 750×500px dimensions
  * Connection history recording for all protocols (SSH, VNC, SPICE, RDP, ZeroTrust)
  * Protocol-specific tabs in Template Dialog matching Connection Dialog
  * Connection history and statistics dialogs with search and visualization
  * Common embedded widget trait for RDP/VNC/SPICE deduplication
  * Quick Connect now supports RDP and VNC protocols with templates
  * Property tests for history and session restore models
  * Refactored terminal.rs into modular structure
  * Removed duplicate Close/Cancel buttons from all dialogs
  * Renamed action buttons: "New X" → "Create", "Quick Connect" → "Connect"
  * Create Connection now always opens blank dialog (removed template picker)
  * Updated gtk4 dependency to 0.10.2

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 02 Jan 2026 12:00:00 +0200

rustconn (0.5.2-1) unstable; urgency=medium

  * New upstream release
  * Refactored window.rs into modular structure (reduced from 7283 to 2396 lines, -67%)
  * Refactored embedded_rdp.rs into modular structure (reduced from 4234 to 2803 lines, -34%)
  * Refactored sidebar.rs into modular structure (reduced from 2787 to 1937 lines, -30%)
  * Refactored embedded_vnc.rs into modular structure (reduced from 2304 to 1857 lines, -19%)
  * Fixed tab icons to match sidebar icons for all protocols
  * Fixed Snippet dialog Save button not clickable
  * Fixed Template dialog not showing all fields
  * Added wayland-native feature flag with gdk4-wayland integration
  * CI improvements: added libadwaita-1-dev, property tests job, OBS changelog generation

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 29 Dec 2025 12:00:00 +0200

rustconn (0.5.1-1) unstable; urgency=medium

  * New upstream release
    - Removed dead code and placeholder implementations
    - Code cleanup and documentation improvements

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 28 Dec 2025 12:00:00 +0200

rustconn (0.5.0-1) unstable; urgency=medium

  * New upstream release
    - RDP clipboard file transfer support (CF_HDROP format)
    - RDPDR directory change notifications and file locking support
    - Native SPICE protocol embedding using spice-client crate 0.2.0
    - Real-time connection status indicators in sidebar
    - Custom cursors in RDP sessions
    - Full Expect automation engine integration
    - Terminal context menu and keyboard shortcuts
    - Performance: lock-free audio callback, optimized fuzzy search, cached tokio runtime
    - Fixed SSH Agent key discovery for all private key formats (.pem, .key, header detection)
    - Fixed system tray menu intermittent issues
    - Updated thiserror from 1.0 to 2.0

 -- Anton Isaiev <totoshko88@gmail.com>  Sat, 27 Dec 2025 12:00:00 +0200

rustconn (0.4.2-1) unstable; urgency=medium

  * New upstream release
    - Fixed Asbru-CM import for installed configuration (environments key)
    - Fixed application icon resolution for all installation scenarios
    - Extended icon theme search paths

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 25 Dec 2025 21:00:00 +0200

rustconn (0.4.1-1) unstable; urgency=medium

  * New upstream release
    - IronRDP audio backend (RDPSND) with PCM format support
    - Optional rdp-audio feature for audio playback via cpal
    - Bidirectional clipboard improvements for embedded RDP
    - Updated MSRV to 1.86
    - Updated dependencies: tempfile 3.24, criterion 0.8, cpal 0.17

 -- Anton Isaiev <totoshko88@gmail.com>  Thu, 25 Dec 2025 12:00:00 +0200

rustconn (0.4.0-1) unstable; urgency=medium

  * New upstream release
    - Zero Trust: Improved UI by hiding irrelevant fields
    - Upgraded ironrdp to 0.13
    - Refactored rustconn-core
    - Made spice-embedded mandatory

 -- Anton Isaiev <totoshko88@gmail.com>  Tue, 24 Dec 2025 12:00:00 +0200

rustconn (0.3.1-1) unstable; urgency=medium

  * New upstream release
    - Code cleanup: fixed all Clippy warnings
    - Applied rustfmt formatting
    - Added Deactivation-Reactivation for RDP sessions
    - Removed sensitive clipboard debug logging

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 23 Dec 2025 21:00:00 +0200

rustconn (0.3.0-1) unstable; urgency=medium

  * New upstream release
    - IronRDP clipboard integration (bidirectional copy/paste)
    - IronRDP shared folders (RDPDR) support
    - RemoteFX codec for better RDP image quality
    - Migrated IronRDP from GitHub to crates.io (v0.11)

 -- Anton Isaiev <totoshko88@gmail.com>  Mon, 23 Dec 2025 18:30:00 +0200

rustconn (0.2.0-1) unstable; urgency=medium

  * New upstream release
    - Tree view state persistence (expanded/collapsed folders)
    - Fixed RDP embedded mode window sizing
    - Fixed native format import group hierarchy preservation
    - Updated dependencies: ksni 0.3, resvg 0.45, dirs 6.0
    - Dynamic version in About dialog
    - Zero Trust providers support (AWS SSM, GCP IAP, Azure Bastion)

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 22 Dec 2025 18:00:00 +0200

rustconn (0.1.0-1) unstable; urgency=medium

  * Initial release
    - GTK4 GUI for managing remote connections
    - SSH, RDP, VNC, SPICE support
    - Connection groups and import/export

 -- Anton Isaiev <totoshko88@gmail.com>  Sun, 22 Dec 2025 12:00:00 +0000
