[skip ci] update changelog

.github/workflows/appimage.yml

@@ -48,6 +48,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: '26.0.1+8'

.github/workflows/aur-bin.yml

@@ -9,6 +9,9 @@ on:
         description: 'Source or Release tag'
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/av-whitelist.yml

@@ -34,6 +34,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   download-file:
     name: Downloads the file into the VM

.github/workflows/build.yml

@@ -17,6 +17,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   test:
     name: Compile and Test

.github/workflows/check-jdk-updates.yml

@@ -15,6 +15,8 @@ env:
       }
     }
 
+permissions: {}
+
 jobs:
   check-version:
     name: Checkout latest jdk version

.github/workflows/debian.yml

@@ -32,6 +32,9 @@ env:
   OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/25.0.3/openjfx-25.0.3_linux-aarch64_bin-jmods.zip'
   OPENJFX_JMODS_AARCH64_HASH: 'e3fd682354346845d2944a2da2b1ff2b6cb9259d92027f2f9c121b9b93c5e42f'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/dependency-check.yml

@@ -5,6 +5,9 @@ on:
   workflow_dispatch:
 
 
+permissions:
+  contents: read
+
 jobs:
   check-dependencies:
     uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@8356563bf7b8d1c8d693f75ca487e8f57573cec9 # v3.1.0

.github/workflows/dl-stats.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0/15 * * * *' # run every 15 min - don't forget to adjust the "interval" in the json sent to the metrics endpoint
 
+permissions:
+  contents: read
+
 jobs:
   report-download-stats:
     runs-on: ubuntu-latest

.github/workflows/draft-release.yml

@@ -16,6 +16,8 @@ defaults:
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
+    permissions:
+      contents: read
     with:
       version:  ''
 
@@ -23,6 +25,9 @@ jobs:
     name: Compile and Test
     runs-on: ubuntu-latest
     needs: get-version
+    permissions:
+      contents: read
+      pull-requests: read
     if: needs.get-version.outputs.versionType != 'unknown'
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -71,6 +76,8 @@ jobs:
   build-exe-and-msi:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/win-exe.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -80,6 +87,8 @@ jobs:
   build-dmg-arm64:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/mac-dmg.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -89,6 +98,8 @@ jobs:
   build-dmg-x64:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/mac-dmg-x64.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -98,6 +109,8 @@ jobs:
   build-appimages:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/appimage.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -107,6 +120,8 @@ jobs:
   update-sha256sums:
     runs-on: ubuntu-latest
     needs: [get-version, build-exe-and-msi, build-dmg-arm64, build-dmg-x64, build-appimages]
+    permissions:
+      contents: read
     env:
       TAG: ${{ github.ref_name }}
       SEMVER: ${{ needs.get-version.outputs.semVerStr }}

.github/workflows/error-db.yml

@@ -6,6 +6,9 @@ on:
   discussion_comment:
     types: [created, edited, deleted]
 
+permissions:
+  discussions: read
+
 jobs:
   update-error-db:
     runs-on: ubuntu-latest

.github/workflows/get-version.yml

@@ -28,6 +28,9 @@ env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: 26
 
+permissions:
+  contents: read
+
 jobs:
   determine-version:
     name: 'Determines the version following semver'

.github/workflows/linux-flatpak.yml

@@ -23,6 +23,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/linux-makepkg.yml

@@ -23,6 +23,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/mac-dmg-x64.yml

@@ -62,6 +62,9 @@ env:
   VERSION_SUFFIX: ${{ inputs.semVerSuffix || ''}}
 
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}
@@ -192,7 +195,6 @@ jobs:
           -Dlicense.includedScopes=compile
           -Dlicense.excludedGroups=^org\.cryptomator
           -Dlicense.failOnMissing=true
-          -Dlicense.licenseMergesUrl=file://${{ github.workspace }}/license/merges
       - name: Install codesign certificate
         run: |
           # create variables

.github/workflows/mac-dmg.yml

@@ -60,6 +60,9 @@ env:
   VERSION_SUFFIX: ${{ inputs.semVerSuffix || ''}}
 
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}
@@ -191,7 +194,6 @@ jobs:
           -Dlicense.includedScopes=compile
           -Dlicense.excludedGroups=^org\.cryptomator
           -Dlicense.failOnMissing=true
-          -Dlicense.licenseMergesUrl=file://${{ github.workspace }}/license/merges
       - name: Install codesign certificate
         run: |
           # create variables

.github/workflows/post-publish.yml

@@ -4,6 +4,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   notify:
     runs-on: ubuntu-latest
@@ -142,4 +144,3 @@ jobs:
           token: ${{ secrets.CRYPTOBOT_WORKFLOW_DISPATCH_TOKEN }}
           repository: cryptomator/docs
           client-payload: '{ "version": "${{ github.event.release.tag_name }}", "release": ${{ toJson(github.event.release.assets) }} }'
-

.github/workflows/pullrequest.yml

@@ -11,6 +11,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs: 
   test:
     name: Compile and Test

.github/workflows/release-check.yml

@@ -14,6 +14,9 @@ env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: 26
 
+permissions:
+  contents: read
+
 jobs:
   check-preconditions:
     name: Validate commits pushed to release/hotfix branch to fulfill release requirements

.github/workflows/win-exe.yml

@@ -71,6 +71,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   build-msi:
     name: Build .msi Installer
@@ -269,7 +272,6 @@ jobs:
           "-Dlicense.includedScopes=compile"
           "-Dlicense.excludedGroups=^org\.cryptomator"
           "-Dlicense.failOnMissing=true"
-          "-Dlicense.licenseMergesUrl=file:///${{ github.workspace }}/license/merges"
         shell: pwsh
       - name: Create file association file from template
         working-directory: dist/win
@@ -384,7 +386,6 @@ jobs:
           "-Dlicense.includedScopes=compile"
           "-Dlicense.excludedGroups=^org\.cryptomator"
           "-Dlicense.failOnMissing=true"
-          "-Dlicense.licenseMergesUrl=file:///${{ github.workspace }}/license/merges"
         shell: pwsh
       - name: Download WinFsp
         run: |

.github/workflows/winget.yml

@@ -7,6 +7,8 @@ on:
         description: 'Release tag'
         required: true
 
+permissions: {}
+
 jobs:
   winget:
     name: Publish winget package

CHANGELOG.md

@@ -9,8 +9,17 @@ Changes to prior versions can be found on the [Github release page](https://gith
 
 
 ## [Unreleased](https://github.com/cryptomator/cryptomator/compare/1.19.3...HEAD)
+### Fixed
+* Fixed "Locate encrypted file" opening the file instead of revealing it in the file manager on Linux ([#4272](https://github.com/cryptomator/cryptomator/issues/4272))
+
 ### Changed
-* Updated Jackson to 2.21.6
+* Improved usability of the trust on first use dialog ([#4295](https://github.com/cryptomator/cryptomator/pull/4295))
+* Migrated code to common JDK 25 APIs and constructs
+* Added Maven profile to run the app from the command line ([#4317](https://github.com/cryptomator/cryptomator/pull/4317))
+* Updated dependencies:
+  - `org.cryptomator:integrations-linux` from 1.7.0 to 1.8.0-beta1
+  - `com.fasterxml.jackson.core:jackson-databind` from 2.21.4 to 2.21.6
+  - `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.21.4 to 2.21.6
 
 
 ## [1.19.3](https://github.com/cryptomator/cryptomator/releases/1.19.3) - 2026-06-29
@@ -19,7 +28,8 @@ Changes to prior versions can be found on the [Github release page](https://gith
 
 ### Fixed
 * Fixed Cryptomator file extensions were not registered on Windows ([#4219](https://github.com/cryptomator/cryptomator/issues/4219))
-* Fixed warning was displayed when accessing update tab in settings even though an update check did not ran ([#4199](https://github.com/cryptomator/cryptomator/pull/4199))
+* Fixed warning was displayed when accessing update tab in settings even though an update check did not ran ([#4194](https://github.com/cryptomator/cryptomator/pull/4194))
+* Fixed the same vault could be added several times to the vault list ([#4243](https://github.com/cryptomator/cryptomator/pull/4243))
 * Fixed several Decrypt Name dialogs could be opened on the same vault ([#4164](https://github.com/cryptomator/cryptomator/pull/4164))
 * Fixed not all mount options in vault specific settings could be displayed ([#4227](https://github.com/cryptomator/cryptomator/pull/4227))
 * Fixed localhost alias on Windows was not removed on uninstall ([#3993](https://github.com/cryptomator/cryptomator/issues/3993))
@@ -31,6 +41,9 @@ Changes to prior versions can be found on the [Github release page](https://gith
 * Drop signing with Actalis issued certificate ([#4169](https://github.com/cryptomator/cryptomator/pull/4169), [#4262](https://github.com/cryptomator/cryptomator/pull/4262))
 * Fix dagger binding graph issues ([#4147](https://github.com/cryptomator/cryptomator/pull/4147))
 * Added flatpak build to CI ([#4199](https://github.com/cryptomator/cryptomator/pull/4199))
+* Added monthly distribution builds to CI ([#4187](https://github.com/cryptomator/cryptomator/pull/4187))
+* Replaced Guava cache with Caffeine
+* Updated translations ([#4223](https://github.com/cryptomator/cryptomator/pull/4223))
 * Updated dependencies:
   - `org.cryptomator:webdav-nio-adapter` from 3.0.1 to 3.0.2
   - `org.cryptomator:integrations-api` from 1.8.0 to 1.9.0

dist/mac/dmg/build.sh

@@ -143,8 +143,7 @@ cp ../embedded.provisionprofile ${APP_NAME}.app/Contents/
     -Dlicense.fileTemplate=resources/licenseTemplate.ftl \
     -Dlicense.includedScopes=compile \
     -Dlicense.excludedGroups=^org\.cryptomator \
-    -Dlicense.failOnMissing=true \
+    -Dlicense.failOnMissing=true
-    -Dlicense.licenseMergesUrl=file://$(pwd)/../../../license/merges
 
 # codesign
 if [ -n "${CODESIGN_IDENTITY}" ] && [ -n "${TEAM_IDENTIFIER}" ]; then

dist/win/build.ps1

@@ -213,8 +213,7 @@ Invoke-CommandWithExitCheck -Command `
     "-Dlicense.outputDirectory=$buildDir\resources\", `
     "-Dlicense.includedScopes=compile", `
     "-Dlicense.excludedGroups=^org\.cryptomator", `
-    "-Dlicense.failOnMissing=true", `
+    "-Dlicense.failOnMissing=true")
-    "-Dlicense.licenseMergesUrl=file:///$buildDir/../../license/merges")
 
 # patch app dir
 Copy-Item "contrib\*" -Destination "$AppName"
@@ -260,8 +259,7 @@ Invoke-CommandWithExitCheck -Command `
 	"-Dlicense.outputDirectory=$buildDir\bundle\resources\", `
 	"-Dlicense.includedScopes=compile", `
 	"-Dlicense.excludedGroups=^org\.cryptomator", `
-	"-Dlicense.failOnMissing=true", `
+	"-Dlicense.failOnMissing=true")
-	"-Dlicense.licenseMergesUrl=file:///$buildDir/../../license/merges")
 
 # download Winfsp
 $winfspMsiUrl= 'https://github.com/winfsp/winfsp/releases/download/v2.1/winfsp-2.1.25156.msi'

license/merges

@@ -1,7 +1,7 @@
 Apache License v2.0|Apache License, Version 2.0|The Apache License, Version 2.0|The Apache Software License, Version 2.0|Apache 2.0|Apache Software License - Version 2.0|Apache-2.0
 MIT License|MIT|The MIT License (MIT)|The MIT License|MIT license
-LGPL 2.1|LGPL, version 2.1|GNU Lesser/Library General Public License version 2|GNU Lesser General Public License Version 2.1|GNU Lesser General Public License
+LGPL 2.1|LGPL, version 2.1|GNU Lesser/Library General Public License version 2|GNU Lesser General Public License Version 2.1|GNU Lesser General Public License|LGPL-2.1-only
 GPLv2|GNU General Public License Version 2
 GPLv2+CE|CDDL + GPLv2 with classpath exception
 Eclipse Public License - Version 1.0|Eclipse Public License - v 1.0
-Eclipse Public License - Version 2.0|Eclipse Public License - v 2.0
+Eclipse Public License - Version 2.0|Eclipse Public License - v 2.0|EPL-2.0

pom.xml

@@ -426,6 +426,9 @@
 			<plugin>
 				<groupId>org.codehaus.mojo</groupId>
 				<artifactId>license-maven-plugin</artifactId>
+				<configuration>
+					<licenseMergesUrl>${project.baseUri}license/merges</licenseMergesUrl>
+				</configuration>
 				<executions>
 					<execution>
 						<id>add-third-party</id>
@@ -437,7 +440,6 @@
 							<thirdPartyFilename>THIRD-PARTY.txt</thirdPartyFilename>
 							<includedScopes>compile</includedScopes>
 							<excludedGroups>org\.cryptomator</excludedGroups>
-							<licenseMergesUrl>file:///${project.basedir}/license/merges</licenseMergesUrl>
 							<fileTemplate>${project.basedir}/src/main/resources/license/template.ftl</fileTemplate>
 						</configuration>
 					</execution>