- Verify the chunk id of every chunk before upload: 54f9752
- Added an option to store metadata chunks separately from file chunks: 0c0392d
- B2: switched to API v4 to support multi-bucket keys: 4645cc0
- Upgraded dependencies with known vulnerabilities: 5debf42
- Upgraded Go to version 1.26.9 (requires macOS 12 or later)
Security note: 3.3.0 is built with Go 1.26.9 and updates golang.org/x/crypto, golang.org/x/net and the SMB library, which fixes a number of known vulnerabilities in earlier versions. Duplicacy only acts as a client, and backups are protected by chunk hash verification (and encryption, if enabled), so none of these vulnerabilities allows an attacker to read, modify or delete backups. The realistic worst case is a malicious or compromised storage server (SFTP and SMB in particular) causing a backup to hang or crash. Upgrading is recommended but not urgent.