QtPass changelog

Name: QtPass
Author: IJHack

v1.8.1

Security and bug-fix release: the fixes from the 2.0 branch that matter for 1.8 users, backported. Qt 5.15 and Qt 6 are both still supported.

Windows/WSL: commands run through wsl --exec instead of the distribution's login shell, so paths, recipients and commit messages are no longer word-split or expanded by a shell
Every gpg encrypt call passes --no-encrypt-to, so an encrypt-to in your gpg.conf can no longer add a recipient the .gpg-id never listed
Only http(s) URLs become clickable links; other schemes and URLs with embedded credentials are shown as text
The key-generation dialog no longer shows the passphrase in the batch template, and an expert-mode template cannot produce an unprotected key by accident
The re-encryption backup commit stages tracked files only, so stray plaintext in the store is never committed and pushed
Single-instance IPC: a stale socket no longer disables it, the socket is restricted to the owning user, and a failed forward opens a window instead of exiting silently
An out-of-range character-set setting is clamped instead of read out of bounds

"New folder" no longer writes an empty .gpg-id that broke every insert in that folder; it inherits the parent's recipients
A configured GPG home that no longer exists is ignored with a status message instead of failing every gpg call with "No secret key"
Ctrl-drag copying an entry onto a folder works again in the native (gpg2/git) backend
"Use Git" without a Git executable no longer wedges the command queue
Edits typed in the password dialog before the decrypt finished are no longer discarded; a failed decrypt shows the gpg error
The password pane and the open-in-browser tooltip no longer show &, " for values with & and "
.gpg-id entries gpg accepts (v6 fingerprints, user IDs) are no longer dropped and erased on the next save
Cancelling the first-run wizard quits instead of showing a half-configured window

Built-in TOTP (RFC 6238, incl. Steam Guard): one-time passwords are generated by QtPass itself; the pass-otp extension is no longer needed. OTP is on by default after the upgrade; turn it off in Settings if you do not want it.
Share submenu (re-encrypt, export your public key, add recipients) and an Import key dialog in the Users dialog
Process output panel, "Open in browser" for URL fields, content search, multiple templates with Ctrl+T, per-profile Git options
Automatic SSH_AUTH_SOCK detection with a manual override
14 new languages (64 in total), most locales complete for the new strings pending Weblate review

Settings no longer silently corrupted by the configuration dialog
Executor could stall on a command that failed to start; crashed subprocesses no longer hang the UI
The window, its content pane and the toolbar follow light/dark theme switches at runtime
WSL path translation, clipboard autoclear tracking, key-generation start failures, tray close behaviour

macOS: the .dmg is not notarized and the Homebrew cask is disabled; see the macOS page.
Windows: the installer is unsigned; SmartScreen asks once.