[skip ci] update changelog

to run app with maven

.github/workflows/appimage.yml

@@ -48,6 +48,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: '26.0.1+8'
@@ -75,9 +78,9 @@ jobs:
             openjfx-sha: 'e3fd682354346845d2944a2da2b1ff2b6cb9259d92027f2f9c121b9b93c5e42f'
             appimagetool-sha: 'f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -220,7 +223,7 @@ jobs:
           if-no-files-found: error
       - name: Publish AppImage on GitHub Releases
         if: inputs.upload-to-draft
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: true
           fail_on_unmatched_files: true

.github/workflows/aur-bin.yml

@@ -9,6 +9,9 @@ on:
         description: 'Source or Release tag'
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
@@ -33,7 +36,7 @@ jobs:
           pacman-key --populate archlinux
           pacman -Syu --noconfirm --needed git base-devel sudo gnupg maven unzip github-cli curl pacman-contrib
       - name: Checkout cryptomator/aur-bin
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: 'cryptomator/aur-bin'
           token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}

.github/workflows/av-whitelist.yml

@@ -34,6 +34,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   download-file:
     name: Downloads the file into the VM

.github/workflows/build.yml

@@ -17,19 +17,23 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   test:
     name: Compile and Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
           cache: 'maven'
       - name: Cache SonarCloud packages
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar

.github/workflows/check-jdk-updates.yml

@@ -15,6 +15,8 @@ env:
       }
     }
 
+permissions: {}
+
 jobs:
   check-version:
     name: Checkout latest jdk version
@@ -26,7 +28,7 @@ jobs:
         run: echo 'JDK_MAJOR_VERSION=${{ env.JDK_VERSION }}'.substring(0,2) >> "$env:GITHUB_ENV"
         shell: pwsh
       - name: Checkout latest JDK ${{ env.JDK_MAJOR_VERSION }}
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           java-version: ${{ env.JDK_MAJOR_VERSION}}
           distribution: ${{ env.JDK_VENDOR }}

.github/workflows/debian.yml

@@ -32,6 +32,9 @@ env:
   OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/25.0.3/openjfx-25.0.3_linux-aarch64_bin-jmods.zip'
   OPENJFX_JMODS_AARCH64_HASH: 'e3fd682354346845d2944a2da2b1ff2b6cb9259d92027f2f9c121b9b93c5e42f'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
@@ -45,7 +48,7 @@ jobs:
     env:
       INPUT_PPAVER: ${{ inputs.ppaver }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - id: deb-version
         name: Determine deb-version
         run: |
@@ -63,7 +66,7 @@ jobs:
         env:
           DEB_BUILD_DEPENDS: ${{ env.DEB_BUILD_DEPENDS }}
       - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}

.github/workflows/dependency-check.yml

@@ -5,6 +5,9 @@ on:
   workflow_dispatch:
 
 
+permissions:
+  contents: read
+
 jobs:
   check-dependencies:
     uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@8356563bf7b8d1c8d693f75ca487e8f57573cec9 # v3.1.0

.github/workflows/dl-stats.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0/15 * * * *' # run every 15 min - don't forget to adjust the "interval" in the json sent to the metrics endpoint
 
+permissions:
+  contents: read
+
 jobs:
   report-download-stats:
     runs-on: ubuntu-latest
@@ -53,7 +56,7 @@ jobs:
           INTERVAL: 900
           JSON_DATA: ${{ steps.get-stats.outputs.result }}
       - name: Upload Results
-        uses: fjogeleit/http-request-action@f98bb26551cd1af7d3eb2674578a80754ece88db # v2.0.1
+        uses: fjogeleit/http-request-action@551353b829c3646756b2ec2b3694f819d7957495 # v2.0.0
         with:
           url: 'https://graphite-us-central1.grafana.net/metrics'
           method: 'POST'

.github/workflows/draft-release.yml

@@ -16,6 +16,8 @@ defaults:
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
+    permissions:
+      contents: read
     with:
       version:  ''
 
@@ -23,16 +25,19 @@ jobs:
     name: Compile and Test
     runs-on: ubuntu-latest
     needs: get-version
+    permissions:
+      contents: read
+      pull-requests: read
     if: needs.get-version.outputs.versionType != 'unknown'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Check the git tag is signed
         run: git cat-file -p "${GITHUB_REF_NAME}" | grep "BEGIN SSH SIGNATURE"
       - name: Check the git tag is on release or main branch
         run: git branch -r --contains "${GITHUB_REF_NAME}" | grep -E '^\s*origin/(main|release/.*)\s*$'
-      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -42,7 +47,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
       - name: Draft a release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: true
           discussion_category_name: releases
@@ -60,7 +65,7 @@ jobs:
           GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
       - name: Publish asc on GitHub Releases
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: true
           fail_on_unmatched_files: true
@@ -71,6 +76,8 @@ jobs:
   build-exe-and-msi:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/win-exe.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -80,6 +87,8 @@ jobs:
   build-dmg-arm64:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/mac-dmg.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -89,6 +98,8 @@ jobs:
   build-dmg-x64:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/mac-dmg-x64.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -98,6 +109,8 @@ jobs:
   build-appimages:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/appimage.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -107,12 +120,14 @@ jobs:
   update-sha256sums:
     runs-on: ubuntu-latest
     needs: [get-version, build-exe-and-msi, build-dmg-arm64, build-dmg-x64, build-appimages]
+    permissions:
+      contents: read
     env:
       TAG: ${{ github.ref_name }}
       SEMVER: ${{ needs.get-version.outputs.semVerStr }}
       GH_TOKEN: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Compute source tarball SHA256
         id: src-sha256
         run: |

.github/workflows/error-db.yml

@@ -6,6 +6,9 @@ on:
   discussion_comment:
     types: [created, edited, deleted]
 
+permissions:
+  discussions: read
+
 jobs:
   update-error-db:
     runs-on: ubuntu-latest

.github/workflows/get-version.yml

@@ -28,6 +28,9 @@ env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: 26
 
+permissions:
+  contents: read
+
 jobs:
   determine-version:
     name: 'Determines the version following semver'
@@ -39,11 +42,11 @@ jobs:
       revNum: ${{ steps.versions.outputs.revNum }}
       type: ${{ steps.versions.outputs.type}}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}

.github/workflows/linux-flatpak.yml

@@ -23,6 +23,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
@@ -49,16 +52,16 @@ jobs:
     env:
       SRC_GIT_SHA: ${{ inputs.src-tag || github.sha}}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: flathub/org.cryptomator.Cryptomator
           submodules: true
       - name: Checkout build script
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: build-scripts
       - name: Checkout app source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: cryptomator
           ref: ${{ env.SRC_GIT_SHA }}
@@ -176,7 +179,7 @@ jobs:
           fi
         env:
           SRC_TAG: ${{ inputs.src-tag }}
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: flathub/org.cryptomator.Cryptomator
           submodules: true #TODO: Update submodule!
@@ -184,7 +187,7 @@ jobs:
       - name: Checkout release branch
         run: |
           git checkout -b release/${{ needs.get-version.outputs.semVerStr }}
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: cryptomator
       - name: Download source tarball and compute checksum

.github/workflows/linux-makepkg.yml

@@ -23,6 +23,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
@@ -44,7 +47,7 @@ jobs:
           pacman-key --init
           pacman-key --populate archlinux
           pacman -Syu --noconfirm --needed git base-devel sudo gnupg maven unzip
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: cryptomator
       - name: Create build user
@@ -108,7 +111,7 @@ jobs:
         env:
           TAG: ${{ needs.get-version.outputs.semVerStr || github.event.release.tag_name }}
       - name: Checkout cryptomator/aur repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: 'cryptomator/aur'
           token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}

.github/workflows/mac-dmg-x64.yml

@@ -62,6 +62,9 @@ env:
   VERSION_SUFFIX: ${{ inputs.semVerSuffix || ''}}
 
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}
@@ -79,9 +82,9 @@ jobs:
           openjfx-url: 'https://download2.gluonhq.com/openjfx/25.0.3/openjfx-25.0.3_osx-x64_bin-jmods.zip'
           openjfx-sha: '3512fabe43aee467538d329cfbbaab3c53dff2a810f0d54e381f461d5e0fac43'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -192,7 +195,6 @@ jobs:
           -Dlicense.includedScopes=compile
           -Dlicense.excludedGroups=^org\.cryptomator
           -Dlicense.failOnMissing=true
-          -Dlicense.licenseMergesUrl=file://${{ github.workspace }}/license/merges
       - name: Install codesign certificate
         run: |
           # create variables
@@ -312,7 +314,7 @@ jobs:
           if-no-files-found: error
       - name: Publish dmg on GitHub Releases
         if: inputs.upload-to-draft
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: true
           fail_on_unmatched_files: true

.github/workflows/mac-dmg.yml

@@ -60,6 +60,9 @@ env:
   VERSION_SUFFIX: ${{ inputs.semVerSuffix || ''}}
 
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}
@@ -77,9 +80,9 @@ jobs:
           openjfx-url: 'https://download2.gluonhq.com/openjfx/25.0.3/openjfx-25.0.3_osx-aarch64_bin-jmods.zip'
           openjfx-sha: 'a52014d625b8b04e57fd71650f881c1397542b4018e1b04f1b4e66c8800a1f34'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -191,7 +194,6 @@ jobs:
           -Dlicense.includedScopes=compile
           -Dlicense.excludedGroups=^org\.cryptomator
           -Dlicense.failOnMissing=true
-          -Dlicense.licenseMergesUrl=file://${{ github.workspace }}/license/merges
       - name: Install codesign certificate
         run: |
           # create variables
@@ -311,7 +313,7 @@ jobs:
           if-no-files-found: error
       - name: Publish dmg on GitHub Releases
         if: inputs.upload-to-draft
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: true
           fail_on_unmatched_files: true

.github/workflows/no-response.yml

@@ -12,7 +12,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           days-before-stale: 14
           days-before-close: 0

.github/workflows/post-publish.yml

@@ -4,6 +4,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   notify:
     runs-on: ubuntu-latest
@@ -142,4 +144,3 @@ jobs:
           token: ${{ secrets.CRYPTOBOT_WORKFLOW_DISPATCH_TOKEN }}
           repository: cryptomator/docs
           client-payload: '{ "version": "${{ github.event.release.tag_name }}", "release": ${{ toJson(github.event.release.assets) }} }'
-

.github/workflows/pullrequest.yml

@@ -11,13 +11,16 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs: 
   test:
     name: Compile and Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}

.github/workflows/release-check.yml

@@ -14,14 +14,17 @@ env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: 26
 
+permissions:
+  contents: read
+
 jobs:
   check-preconditions:
     name: Validate commits pushed to release/hotfix branch to fulfill release requirements
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}

.github/workflows/stale.yml

@@ -12,7 +12,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           days-before-stale: 365
           days-before-close: 90

.github/workflows/win-exe.yml

@@ -71,6 +71,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   build-msi:
     name: Build .msi Installer
@@ -86,9 +89,9 @@ jobs:
             java-version: '26.0.1+8'
             java-package: 'jdk'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ matrix.java-dist }}
           java-version: ${{ matrix.java-version }}
@@ -269,7 +272,6 @@ jobs:
           "-Dlicense.includedScopes=compile"
           "-Dlicense.excludedGroups=^org\.cryptomator"
           "-Dlicense.failOnMissing=true"
-          "-Dlicense.licenseMergesUrl=file:///${{ github.workspace }}/license/merges"
         shell: pwsh
       - name: Create file association file from template
         working-directory: dist/win
@@ -352,7 +354,7 @@ jobs:
             java-version: '26.0.1+8'
             java-package: 'jdk'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install wix and extensions
         run: |
           dotnet tool install --global wix --version ${WIX_VERSION}
@@ -368,7 +370,7 @@ jobs:
       - name: Strip version info from msi file name
         run: mv dist/win/bundle/resources/Cryptomator*.msi dist/win/bundle/resources/Cryptomator.msi
       - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: ${{ matrix.java-dist }}
           java-version: ${{ matrix.java-version }}
@@ -384,7 +386,6 @@ jobs:
           "-Dlicense.includedScopes=compile"
           "-Dlicense.excludedGroups=^org\.cryptomator"
           "-Dlicense.failOnMissing=true"
-          "-Dlicense.licenseMergesUrl=file:///${{ github.workspace }}/license/merges"
         shell: pwsh
       - name: Download WinFsp
         run: |
@@ -481,7 +482,7 @@ jobs:
           merge-multiple: true
       - name: Publish installers on GitHub Releases
         id: publish
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: true
           fail_on_unmatched_files: true

.github/workflows/winget.yml

@@ -7,6 +7,8 @@ on:
         description: 'Release tag'
         required: true
 
+permissions: {}
+
 jobs:
   winget:
     name: Publish winget package
@@ -18,7 +20,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
       - name: Submit package
-        uses: vedantmgoyal2009/winget-releaser@b3a5dae0047c6180023acba3f548c55fdf6b7193 # no_specific_version
+        uses: vedantmgoyal2009/winget-releaser@7bd472be23763def6e16bd06cc8b1cdfab0e2fd5 # no_specific_version
         with:
           identifier: Cryptomator.Cryptomator
           version: ${{ inputs.tag }}

CHANGELOG.md

@@ -9,8 +9,17 @@ Changes to prior versions can be found on the [Github release page](https://gith
 
 
 ## [Unreleased](https://github.com/cryptomator/cryptomator/compare/1.19.3...HEAD)
+### Fixed
+* Fixed "Locate encrypted file" opening the file instead of revealing it in the file manager on Linux ([#4272](https://github.com/cryptomator/cryptomator/issues/4272))
+
 ### Changed
-* Updated Jackson to 2.21.6
+* Improved usability of the trust on first use dialog ([#4295](https://github.com/cryptomator/cryptomator/pull/4295))
+* Migrated code to common JDK 25 APIs and constructs
+* Added Maven profile to run the app from the command line ([#4317](https://github.com/cryptomator/cryptomator/pull/4317))
+* Updated dependencies:
+  - `org.cryptomator:integrations-linux` from 1.7.0 to 1.8.0-beta1
+  - `com.fasterxml.jackson.core:jackson-databind` from 2.21.4 to 2.21.6
+  - `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.21.4 to 2.21.6
 
 
 ## [1.19.3](https://github.com/cryptomator/cryptomator/releases/1.19.3) - 2026-06-29
@@ -19,7 +28,8 @@ Changes to prior versions can be found on the [Github release page](https://gith
 
 ### Fixed
 * Fixed Cryptomator file extensions were not registered on Windows ([#4219](https://github.com/cryptomator/cryptomator/issues/4219))
-* Fixed warning was displayed when accessing update tab in settings even though an update check did not ran ([#4199](https://github.com/cryptomator/cryptomator/pull/4199))
+* Fixed warning was displayed when accessing update tab in settings even though an update check did not ran ([#4194](https://github.com/cryptomator/cryptomator/pull/4194))
+* Fixed the same vault could be added several times to the vault list ([#4243](https://github.com/cryptomator/cryptomator/pull/4243))
 * Fixed several Decrypt Name dialogs could be opened on the same vault ([#4164](https://github.com/cryptomator/cryptomator/pull/4164))
 * Fixed not all mount options in vault specific settings could be displayed ([#4227](https://github.com/cryptomator/cryptomator/pull/4227))
 * Fixed localhost alias on Windows was not removed on uninstall ([#3993](https://github.com/cryptomator/cryptomator/issues/3993))
@@ -31,6 +41,9 @@ Changes to prior versions can be found on the [Github release page](https://gith
 * Drop signing with Actalis issued certificate ([#4169](https://github.com/cryptomator/cryptomator/pull/4169), [#4262](https://github.com/cryptomator/cryptomator/pull/4262))
 * Fix dagger binding graph issues ([#4147](https://github.com/cryptomator/cryptomator/pull/4147))
 * Added flatpak build to CI ([#4199](https://github.com/cryptomator/cryptomator/pull/4199))
+* Added monthly distribution builds to CI ([#4187](https://github.com/cryptomator/cryptomator/pull/4187))
+* Replaced Guava cache with Caffeine
+* Updated translations ([#4223](https://github.com/cryptomator/cryptomator/pull/4223))
 * Updated dependencies:
   - `org.cryptomator:webdav-nio-adapter` from 3.0.1 to 3.0.2
   - `org.cryptomator:integrations-api` from 1.8.0 to 1.9.0

README.md

@@ -89,6 +89,20 @@ For more information on the security details visit [cryptomator.org](https://doc
 
 This will build all the jars and bundle them together with their OS-specific dependencies under `target`. This can now be used to build native packages.
 
+### Running the app
+
+```
+./mvnw -Prun compile exec:exec
+```
+
+This starts the app with the defaults defined in `pom.xml`. The OS-specific parameters are picked automatically.
+
+Add the `dev` profile to use the `Cryptomator-Dev` settings, log and mount directories instead, so a development run does not interfere with an installed Cryptomator:
+
+```
+./mvnw -Prun,dev compile exec:exec
+```
+
 ## License
 
 This project is dual-licensed under the GPLv3 for FOSS projects as well as a commercial license for independent software vendors and resellers. If you want to modify this application under different conditions, feel free to contact our support team.

dist/common/config.properties

@@ -1,7 +1,7 @@
 # This is the Cryptomator administrative configuration file.
 # It is a simple key-value pair file.
 # Lines starting with '#' are comments and will be ignored.
-# For more info, read the docs at https://docs.cryptomator.org/desktop/advanced-settings/
+# For more info, read the docs at https://docs.cryptomator.org/desktop/admin-config/
 #
 # Example:
 # Sets the plugin directory and enables plugin loading

dist/mac/dmg/build.sh

@@ -143,8 +143,7 @@ cp ../embedded.provisionprofile ${APP_NAME}.app/Contents/
     -Dlicense.fileTemplate=resources/licenseTemplate.ftl \
     -Dlicense.includedScopes=compile \
     -Dlicense.excludedGroups=^org\.cryptomator \
-    -Dlicense.failOnMissing=true \
+    -Dlicense.failOnMissing=true
-    -Dlicense.licenseMergesUrl=file://$(pwd)/../../../license/merges
 
 # codesign
 if [ -n "${CODESIGN_IDENTITY}" ] && [ -n "${TEAM_IDENTIFIER}" ]; then

dist/win/build.ps1

@@ -213,8 +213,7 @@ Invoke-CommandWithExitCheck -Command `
     "-Dlicense.outputDirectory=$buildDir\resources\", `
     "-Dlicense.includedScopes=compile", `
     "-Dlicense.excludedGroups=^org\.cryptomator", `
-    "-Dlicense.failOnMissing=true", `
+    "-Dlicense.failOnMissing=true")
-    "-Dlicense.licenseMergesUrl=file:///$buildDir/../../license/merges")
 
 # patch app dir
 Copy-Item "contrib\*" -Destination "$AppName"
@@ -260,8 +259,7 @@ Invoke-CommandWithExitCheck -Command `
 	"-Dlicense.outputDirectory=$buildDir\bundle\resources\", `
 	"-Dlicense.includedScopes=compile", `
 	"-Dlicense.excludedGroups=^org\.cryptomator", `
-	"-Dlicense.failOnMissing=true", `
+	"-Dlicense.failOnMissing=true")
-	"-Dlicense.licenseMergesUrl=file:///$buildDir/../../license/merges")
 
 # download Winfsp
 $winfspMsiUrl= 'https://github.com/winfsp/winfsp/releases/download/v2.1/winfsp-2.1.25156.msi'

license/merges

@@ -1,7 +1,7 @@
 Apache License v2.0|Apache License, Version 2.0|The Apache License, Version 2.0|The Apache Software License, Version 2.0|Apache 2.0|Apache Software License - Version 2.0|Apache-2.0
 MIT License|MIT|The MIT License (MIT)|The MIT License|MIT license
-LGPL 2.1|LGPL, version 2.1|GNU Lesser/Library General Public License version 2|GNU Lesser General Public License Version 2.1|GNU Lesser General Public License
+LGPL 2.1|LGPL, version 2.1|GNU Lesser/Library General Public License version 2|GNU Lesser General Public License Version 2.1|GNU Lesser General Public License|LGPL-2.1-only
 GPLv2|GNU General Public License Version 2
 GPLv2+CE|CDDL + GPLv2 with classpath exception
 Eclipse Public License - Version 1.0|Eclipse Public License - v 1.0
-Eclipse Public License - Version 2.0|Eclipse Public License - v 2.0
+Eclipse Public License - Version 2.0|Eclipse Public License - v 2.0|EPL-2.0

pom.xml

@@ -72,9 +72,16 @@
 		<mvn-dependency.version>3.11.0</mvn-dependency.version>
 		<mvn-surefire.version>3.5.6</mvn-surefire.version>
 		<mvn-jar.version>3.5.0</mvn-jar.version>
+		<mvn-exec.version>3.5.1</mvn-exec.version>
 
 		<!-- Property used by surefire to determine jacoco engine -->
 		<surefire.jacoco.args></surefire.jacoco.args>
+
+		<!-- App runtime config used by the 'run' profile, mirroring .idea/runConfigurations. The 'dev' profile switches these to the Cryptomator-Dev variants. -->
+		<run.appDir>Cryptomator</run.appDir>
+		<run.linuxFuseArgs></run.linuxFuseArgs>
+		<run.macMountPointsDir>@{userhome}/Cryptomator</run.macMountPointsDir>
+		<run.macUpdateArgs>-Dcryptomator.updateMechanism=org.cryptomator.macos.update.DmgUpdateMechanism</run.macUpdateArgs>
 	</properties>
 
 	<repositories>
@@ -324,6 +331,11 @@
 					<artifactId>dependency-check-maven</artifactId>
 					<version>${dependency-check.version}</version>
 				</plugin>
+				<plugin>
+					<groupId>org.codehaus.mojo</groupId>
+					<artifactId>exec-maven-plugin</artifactId>
+					<version>${mvn-exec.version}</version>
+				</plugin>
 			</plugins>
 		</pluginManagement>
 		<plugins>
@@ -414,6 +426,9 @@
 			<plugin>
 				<groupId>org.codehaus.mojo</groupId>
 				<artifactId>license-maven-plugin</artifactId>
+				<configuration>
+					<licenseMergesUrl>${project.baseUri}license/merges</licenseMergesUrl>
+				</configuration>
 				<executions>
 					<execution>
 						<id>add-third-party</id>
@@ -425,7 +440,6 @@
 							<thirdPartyFilename>THIRD-PARTY.txt</thirdPartyFilename>
 							<includedScopes>compile</includedScopes>
 							<excludedGroups>org\.cryptomator</excludedGroups>
-							<licenseMergesUrl>file:///${project.basedir}/license/merges</licenseMergesUrl>
 							<fileTemplate>${project.basedir}/src/main/resources/license/template.ftl</fileTemplate>
 						</configuration>
 					</execution>
@@ -597,6 +611,102 @@
 				</dependency>
 			</dependencies>
 		</profile>
+
+		<!-- Launches the app from the command line: ./mvnw -Prun compile exec:exec (append ,dev for the Cryptomator-Dev variant) -->
+		<profile>
+			<id>run</id>
+			<build>
+				<plugins>
+					<plugin>
+						<groupId>org.apache.maven.plugins</groupId>
+						<artifactId>maven-dependency-plugin</artifactId>
+						<executions>
+							<!-- same split into module path and class path as the copy-mods/copy-libs executions used for packaging -->
+							<execution>
+								<id>build-run-modulepath</id>
+								<phase>validate</phase>
+								<goals>
+									<goal>build-classpath</goal>
+								</goals>
+								<configuration>
+									<includeScope>runtime</includeScope>
+									<excludeGroupIds>${nonModularGroupIds}</excludeGroupIds>
+									<outputProperty>run.modulePath</outputProperty>
+								</configuration>
+							</execution>
+							<execution>
+								<id>build-run-classpath</id>
+								<phase>validate</phase>
+								<goals>
+									<goal>build-classpath</goal>
+								</goals>
+								<configuration>
+									<includeScope>runtime</includeScope>
+									<includeGroupIds>${nonModularGroupIds}</includeGroupIds>
+									<outputProperty>run.classPath</outputProperty>
+								</configuration>
+							</execution>
+						</executions>
+					</plugin>
+					<plugin>
+						<groupId>org.codehaus.mojo</groupId>
+						<artifactId>exec-maven-plugin</artifactId>
+						<configuration>
+							<executable>${java.home}/bin/java</executable>
+							<commandlineArgs>--module-path "${project.build.outputDirectory}${path.separator}${run.modulePath}" --class-path "${run.classPath}" ${run.jvmArgs} --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator</commandlineArgs>
+						</configuration>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
+
+		<!-- Switches the 'run' profile to the Cryptomator-Dev variants, so a dev run does not touch the settings of an installed Cryptomator -->
+		<profile>
+			<id>dev</id>
+			<properties>
+				<run.appDir>Cryptomator-Dev</run.appDir>
+				<run.linuxFuseArgs>-Dfuse.experimental="true"</run.linuxFuseArgs>
+				<run.macMountPointsDir>@{userhome}/Library/Application Support/Cryptomator-Dev/mnt</run.macMountPointsDir>
+				<run.macUpdateArgs></run.macUpdateArgs>
+			</properties>
+		</profile>
+
+		<profile>
+			<id>run-win</id>
+			<activation>
+				<os>
+					<family>windows</family>
+				</os>
+			</activation>
+			<properties>
+				<run.jvmArgs>-Dcryptomator.settingsPath="@{appdata}/${run.appDir}/settings.json;@{userhome}/AppData/Roaming/${run.appDir}/settings.json" -Dcryptomator.ipcSocketPath="@{localappdata}/${run.appDir}/ipc.socket" -Dcryptomator.logDir="@{localappdata}/${run.appDir}" -Dcryptomator.pluginDir="@{appdata}/${run.appDir}/Plugins" -Dcryptomator.integrationsWin.keychainPaths="@{appdata}/${run.appDir}/keychain.json;@{userhome}/AppData/Roaming/${run.appDir}/keychain.json" -Dcryptomator.integrationsWin.windowsHelloKeychainPaths="@{appdata}/${run.appDir}/windowsHelloKeychain.json;@{userhome}/AppData/Roaming/${run.appDir}/windowsHelloKeychain.json" -Dcryptomator.p12Path="@{appdata}/${run.appDir}/key.p12;@{userhome}/AppData/Roaming/${run.appDir}/key.p12" -Dcryptomator.mountPointsDir="@{userhome}/${run.appDir}" -Dcryptomator.showTrayIcon=true -Dcryptomator.hub.enableTrustOnFirstUse=true -Xss2m -Xmx512m --enable-preview --enable-native-access=org.cryptomator.jfuse.win,org.cryptomator.integrations.win,javafx.graphics</run.jvmArgs>
+			</properties>
+		</profile>
+
+		<profile>
+			<id>run-mac</id>
+			<activation>
+				<os>
+					<family>mac</family>
+				</os>
+			</activation>
+			<properties>
+				<run.jvmArgs>-Dapple.awt.enableTemplateImages=true -Dcryptomator.settingsPath="@{userhome}/Library/Application Support/${run.appDir}/settings.json" -Dcryptomator.p12Path="@{userhome}/Library/Application Support/${run.appDir}/key.p12" -Dcryptomator.ipcSocketPath="@{userhome}/Library/Application Support/${run.appDir}/ipc.socket" -Dcryptomator.logDir="@{userhome}/Library/Logs/${run.appDir}" -Dcryptomator.pluginDir="@{userhome}/Library/Application Support/${run.appDir}/Plugins" -Dcryptomator.mountPointsDir="${run.macMountPointsDir}" -Dcryptomator.showTrayIcon=true -Dcryptomator.integrationsMac.keychainServiceName=Cryptomator ${run.macUpdateArgs} -Dcryptomator.hub.enableTrustOnFirstUse=true -Xss2m -Xmx512m -ea --enable-preview --enable-native-access=org.cryptomator.jfuse.mac,javafx.graphics</run.jvmArgs>
+			</properties>
+		</profile>
+
+		<profile>
+			<id>run-linux</id>
+			<activation>
+				<os>
+					<family>unix</family>
+					<name>linux</name>
+				</os>
+			</activation>
+			<properties>
+				<run.jvmArgs>-Dcryptomator.settingsPath="@{userhome}/.config/${run.appDir}/settings.json" -Dcryptomator.p12Path="@{userhome}/.config/${run.appDir}/key.p12" -Dcryptomator.ipcSocketPath="@{userhome}/.config/${run.appDir}/ipc.socket" -Dcryptomator.logDir="@{userhome}/.local/share/${run.appDir}/logs" -Dcryptomator.pluginDir="@{userhome}/.local/share/${run.appDir}/plugins" -Dcryptomator.mountPointsDir="@{userhome}/.local/share/${run.appDir}/mnt" -Dcryptomator.showTrayIcon=true -Dcryptomator.hub.enableTrustOnFirstUse=true ${run.linuxFuseArgs} -Xss20m -Xmx512m --enable-preview --enable-native-access=org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator,javafx.graphics</run.jvmArgs>
+			</properties>
+		</profile>
 	</profiles>
 
 </project>