Merge branch 'release/1.19.3'

Signed-off-by: Armin Schrenk <armin.schrenk@skymatic.de>

.github/workflows/av-whitelist.yml

@@ -78,7 +78,7 @@ jobs:
           local-dir: ./upload/
   allowlist-avast:
     name: Anti Virus Allowlisting Avast
-    runs-on: ubuntu-slim
+    runs-on: ubuntu
     needs: download-file
     if: inputs.avast
     steps:

.github/workflows/post-publish.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   notify:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu
     steps:
       - name: Notify about DEB build
         uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0
@@ -102,7 +102,7 @@ jobs:
     name: Notify for winget-release
     if: needs.get-asset-urls.outputs.is-windows-release == 'true' && needs.check-release.outputs.release-kind == 'stable'
     needs: [check-release, get-asset-urls]
-    runs-on: ubuntu-slim
+    runs-on: ubuntu
     steps:
       - name: Slack Notification
         uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0

.github/workflows/release-check.yml

@@ -48,19 +48,4 @@ jobs:
           if ! grep -q "<release date=\".*\" version=\"${{ steps.validate-pom-version.outputs.semVerStr }}\">" dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml; then
             echo "Release not set in dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml"
             exit 1
-          fi
+          fi
-      - name: Cache NVD DB
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ~/.m2/repository/org/owasp/dependency-check-data/
-          key: dependency-check-${{ github.run_id }}
-          restore-keys: |
-            dependency-check
-        env:
-          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 5
-      - name: Run org.owasp:dependency-check plugin
-        id: dependency-check
-        continue-on-error: true
-        run: ./mvnw -B verify -Pdependency-check -DskipTests
-        env:
-          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}

.github/workflows/win-exe.yml

@@ -82,7 +82,7 @@ jobs:
         include:
           - arch: x64
             os: windows-latest
-            java-dist: 'zulu' #cannot use temurin, see https://github.com/cryptomator/cryptomator/issues/3824#issuecomment-2829827427
+            java-dist: 'temurin'
             java-version: '26.0.1+8'
             java-package: 'jdk'
     steps:
@@ -229,22 +229,23 @@ jobs:
         uses: ./.github/actions/win-sign-action
         with:
           base-dir: ${{ github.workspace }}\appdir
+          file-extensions: 'exe,dll'
           recursive: true
           append-signature: true
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - name: Sign DLLs with Actalis CodeSigner
+      - name: Sign Scripts with Azure Trusted Signing
-        if: inputs.sign || github.event_name == 'release'
+        if: inputs.sign || github.event_name == 'schedule'
-        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
+        uses: ./.github/actions/win-sign-action
         with:
-          base-dir: 'appdir'
+          base-dir: ${{ github.workspace }}\appdir\Cryptomator
-          file-extensions: 'dll,exe,ps1'
+          file-extensions: 'ps1'
-          recursive: true
+          recursive: false
-          sign-description: 'Cryptomator'
+          append-signature: false  # Powershell scripts cannot be signed in append mode, see #4260
-          sign-url: 'https://cryptomator.org'
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          username: ${{ secrets.WIN_CODESIGN_USERNAME }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          password: ${{ secrets.WIN_CODESIGN_PW }}
+          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
       - name: Replace DLLs inside jars with signed ones
         shell: pwsh
         run: |
@@ -347,7 +348,7 @@ jobs:
           - arch: x64
             os: windows-latest
             executable-suffix: x64
-            java-dist: 'zulu'
+            java-dist: 'temurin'
             java-version: '26.0.1+8'
             java-package: 'jdk'
     steps:
@@ -429,16 +430,6 @@ jobs:
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - name: Sign burn engine with Actalis CodeSigner
-        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
-        with:
-          base-dir: 'tmp'
-          file-extensions: 'exe'
-          sign-description: 'Cryptomator Bundle Installer'
-          sign-url: 'https://cryptomator.org'
-          username: ${{ secrets.WIN_CODESIGN_USERNAME }}
-          password: ${{ secrets.WIN_CODESIGN_PW }}
       - name: Reattach signed burn engine to installer
         if: inputs.sign || github.event_name == 'schedule'
         shell: pwsh
@@ -456,16 +447,6 @@ jobs:
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - name: Sign installer with Actalis CodeSigner
-        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
-        with:
-          base-dir: 'installer'
-          file-extensions: 'exe'
-          sign-description: 'Cryptomator Bundle Installer'
-          sign-url: 'https://cryptomator.org'
-          username: ${{ secrets.WIN_CODESIGN_USERNAME }}
-          password: ${{ secrets.WIN_CODESIGN_PW }}
       - id: sha256sum
         run: |
           read -ra CMD_OUTPUT < <(sha256sum installer/Cryptomator-*.exe)

CHANGELOG.md

@@ -8,8 +8,7 @@ The changelog starts with version 1.19.0.
 Changes to prior versions can be found on the [Github release page](https://github.com/cryptomator/cryptomator/releases).
 
 
-## [Unreleased](https://github.com/cryptomator/cryptomator/compare/1.19.2...HEAD)
+## [1.19.3](https://github.com/cryptomator/cryptomator/releases/1.19.3) - 2026-06-29
-
 ### Added
 * New error dialog if importing a vault fails ([#4243](https://github.com/cryptomator/cryptomator/pull/4243))
 
@@ -24,6 +23,9 @@ Changes to prior versions can be found on the [Github release page](https://gith
 * Refactored release pipeline to allow immutable releases ([#4205](https://github.com/cryptomator/cryptomator/pull/4205))
 * Updated to JDK 26.0.1 ([#4244](https://github.com/cryptomator/cryptomator/pull/4244))
 * Updated to JavaFX 25.0.3 ([#4255](https://github.com/cryptomator/cryptomator/pull/4255))
+* Drop signing with Actalis issued certificate ([#4169](https://github.com/cryptomator/cryptomator/pull/4169), [#4262](https://github.com/cryptomator/cryptomator/pull/4262))
+* Fix dagger binding graph issues ([#4147](https://github.com/cryptomator/cryptomator/pull/4147))
+* Added flatpak build to CI ([#4199](https://github.com/cryptomator/cryptomator/pull/4199))
 * Updated dependencies:
   - `org.cryptomator:webdav-nio-adapter` from 3.0.1 to 3.0.2
   - `org.cryptomator:integrations-api` from 1.8.0 to 1.9.0

dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml

@@ -84,6 +84,9 @@
 	</content_rating>
 
 	<releases>
+		<release date="2026-06-29" version="1.19.3">
+			<url type="details">https://github.com/cryptomator/cryptomator/releases/1.19.3</url>
+		</release>
 		<release date="2026-03-20" version="1.19.2">
 			<url type="details">https://github.com/cryptomator/cryptomator/releases/1.19.2</url>
 		</release>

pom.xml

@@ -3,7 +3,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>org.cryptomator</groupId>
 	<artifactId>cryptomator</artifactId>
-	<version>1.20.0-SNAPSHOT</version>
+	<version>1.19.3</version>
 	<name>Cryptomator Desktop App</name>
 
 	<organization>