--- title: "Web PKI changelog" description: "Release history of Web PKI components (JavaScript library, web extension, native components, mobile app), the latest JavaScript library being 2.19.0 (2026-10-17)." canonical: "https://docs.lacunasoftware.com/en-us/articles/web-pki/changelog" locale: "en" product: "Web PKI" last_updated: "2026-10-18" --- # Web PKI changelog | Component | Latest version | Date | |---|---|---| | [JavaScript library](https://docs.lacunasoftware.com/en-us/articles/web-pki/changelog#javascript-library) | 2.19.0 | 2026-10-17 | | [Web extension](https://docs.lacunasoftware.com/en-us/articles/web-pki/changelog#web-extension) | 2.19.1 | 2026-10-17 | | [Native component for Windows](https://docs.lacunasoftware.com/en-us/articles/web-pki/changelog#native-windows) | 2.16.0 | 2026-07-27 | | [Native component for macOS](https://docs.lacunasoftware.com/en-us/articles/web-pki/changelog#native-macos) | 2.16.0 | 2026-07-27 | | [Native component for Linux](https://docs.lacunasoftware.com/en-us/articles/web-pki/changelog#native-linux) | 2.16.1 | 2026-10-17 | | [Mobile app](https://docs.lacunasoftware.com/en-us/articles/web-pki/changelog#mobile-app) | 5.0.6 | 2026-10-13 | | [IE add-on (legacy)](https://docs.lacunasoftware.com/en-us/articles/web-pki/changelog#ie-addon) | 2.9.2 | 2024-04-05 | ## JavaScript library The Web PKI JavaScript library, distributed on the CDN as `lacuna-web-pki.js` and on npm as the `web-pki` package (same version). ### 2.19.0 (2026-10-17) - Add support for Safari on macOS through the Web PKI Safari extension. - Add API version 1.8.7 (native components 2.15.0 for Windows, macOS and Linux). - \[WPG-70\] Require native components 2.15.0 for Windows, macOS and Linux. - \[WPG-70\] Require web extension 2.16.0. **Older versions** ### 2.18.0 (2026-02-03) - \[WPG-67\] Return the system user name and machine name (`userName`, `machineName`) in the `generateSoftwareRsaKeyPair` and `generateTokenRsaKeyPair` responses. - \[WPG-67\] Add API version 1.8.6 (native components 2.14.0 for Windows, macOS and Linux). - \[WPG-67\] Require native components 2.14.0 for Windows, macOS and Linux. - Add the missing `pkcs11ModuleUsed` field to the `GenerateTokenKeyPairResponse` TypeScript definition. ### 2.17.0 (2026-01-26) - \[WPG-66\] Add the `caCertificates` option to `importCertificate` and `importTokenCertificate` to also import the CA certificate chain into the system CA store and into the token or PFX file (Windows only). - \[WPG-66\] Add API version 1.8.5 (Windows native component 2.13.2). - \[WPG-66\] Require Windows native component 2.13.2. ### 2.16.5 (2025-11-10) - Add API version 1.8.4 (Windows native component 2.12.7). - Require Windows native component 2.12.7. ### 2.16.4 (2025-10-02) - Add API version 1.8.3 (Windows native component 2.12.6, macOS native component 2.13.5). - Require Windows native component 2.12.6 and macOS native component 2.13.5. ## Web extension The Web PKI browser extension for Chrome, Edge, Firefox and Safari. ### 2.19.1 (2026-10-17) - Add Safari support (Safari 14 or later on macOS), distributed as a macOS app on the App Store. - Declare in Firefox that the extension transmits personal information, location information and website content (certificate contents and the data to sign or encrypt), as required by Mozilla. **Older versions** ### 2.18.3 (2026-08-08) - \[WPG-80\] Bundle the popup fonts in the extension instead of loading them from external servers. ### 2.18.2 (2026-08-06) - \[WPG-73\] Reject commands from web pages that the extension does not handle explicitly (error code `command_unknown`) instead of forwarding them to the native component. - Shorten the waiting time after the user denies certificate access: the first denials block new requests for about 2 seconds, later ones up to 5 minutes, and the count resets after 10 minutes without requests. - Disable usage analytics in the popup on all browsers, and in the Edge extension. ### 2.18.0 (2026-07-20) - \[WPG-73\] Ask the user's permission, per website, before a page can list the user's certificates or read a certificate (`listCertificates`, `readCertificate`), with an option to not ask again for that website. Repeated denials are answered automatically for a while, so a page cannot flood the user with dialogs. Older native components without the dialog keep working without asking. - \[WPG-73\] Ignore PKCS#11 module paths supplied by web pages unless they are a library file name or a library under a system or program directory. Modules configured by the user are not affected. - \[WPG-73\] Fix the detection of the website hostname for some URL formats. - \[WPG-70\] Fix commands sent with a different letter case bypassing the extension's own command handling. - \[WPG-71\] Fix an unchecked browser error when the native component disconnects after the page is closed. - \[WPG-76\] Require Firefox 140 or later, and declare the extension's data collection in Firefox. - Update the Edge extension to Manifest V3. - Return the complete native response from `generateTokenRsaKeyPair` and `importTokenCertificate`. ### 2.17.3 (2025-07-16) - \[WPG-53\] Require Firefox 58 or later. ### 2.17.1 (2024-07-21) - Fix the setup site not being refreshed after the extension is installed from the store. ### 2.17.0 (2024-07-04) - Update the Chrome extension to Manifest V3. - Add the `signHashes` command, which signs several hashes in a single call. - Add support for decrypting with a certificate on a paired mobile device. - Add the `enableUsedPkcs11Module` option to `generateTokenRsaKeyPair` and `importTokenCertificate`, to not save the PKCS#11 module used in the user's settings. - Add support for the new signature options: PDF reason, location, signer name, custom signature field name and metadata; CAdES co-signing from content and signing description; XML signing description; timestamp requester; and returning the encapsulated content when opening a CAdES signature. - Fix the PKI Paraguay "Responsable" field being shown for certificates that are not issued to a legal entity. - Fix the popup staying blocked after removing a mobile device. ## Native component for Windows The Windows application that the Web PKI browser extension uses to access certificates, tokens and local files. ### 2.16.0 (2026-07-27) - \[WPG-73\] Add the consent dialog (Allow, Always allow, Deny) that the web extension shows before a website can list or read the user's certificates. - \[WPG-73\] `importPkcs12` now opens the certificate import wizard only when invoked from the extension popup (or localhost); requests from other websites return `false` without showing it. **Older versions** ### 2.15.0 (2026-06-16) - \[WPG-75\] Fix `downloadToFolder` not saving to the requested folder, a regression in 2.14.2. ### 2.14.2 (2026-05-18) - \[WPG-70\] Require a valid license (outside localhost) for `showFolderBrowser`, `showFileBrowser`, `downloadToFolder`, `openFile`, `openFolder`, `listTokens` and `encrypt`. - \[WPG-70\] Sanitize file names given by websites in `downloadToFolder` and when saving signed files and PKCS#12 (PFX) backups: path traversal, invalid characters, Windows reserved names and overlong names are neutralized. - \[WPG-70\] Save files downloaded with `downloadToFolder` that have an executable, script or installer extension (such as `.exe`, `.bat`, `.ps1`, `.msi`, `.lnk`) with a `.bin` extension instead. ### 2.14.0 (2026-02-03) - \[WPG-67\] Add `userName` and `machineName` to the responses of `generateKeyPair` and `generateTokenKeyPair`. - \[WPG-67\] Fix the PKCS#12 (PFX) password dialog opening behind other windows. ### 2.13.3 (2026-01-27) - Fix the PKCS#12 (PFX) password dialog rejecting an empty password when the website sets no password requirements (regression in 2.13.2). ### 2.13.2 (2026-01-26) - \[WPG-66\] Add the `caCertificates` parameter to `importCertificate` and `importTokenCertificate`: the CA chain is added to the Windows CA store and to the PKCS#12 (PFX) backup or the token. - Improve the PKCS#12 (PFX) password dialog: each password requirement is listed and checked as the user types, and the password can be shown or hidden. ### 2.12.7 (2025-11-10) - \[WPG-65\] Require .NET Framework 4.6 or later (previously 4.0). ### 2.12.6 (2025-10-02) - \[WPG-59\] \[WPG-60\] Treat `*.localhost` domains (RFC 6761) as localhost, so they can use Web PKI without a license. - \[WPG-61\] Fix `importCertificate` failing when an unrelated key container could not be opened while searching for the certificate's private key. - Fix saving the PKCS#12 (PFX) backup in `importCertificate`, and report `imported` as `false` when the certificate could not be added to the Windows store. ## Native component for macOS The native application that the Web PKI extension uses on macOS to access certificates, tokens and local files. ### 2.16.0 (2026-07-27) - \[WPG-73\] Add a consent dialog that asks the user before a website lists or reads their certificates, with a "don't ask again for this website" option. - \[WPG-73\] Restrict importing PKCS#12 files and removing certificates to the Web PKI extension popup. - \[WPG-79\] Improve the look of all dialogs. - \[WPG-79\] Require macOS 10.15 (Catalina) or later on Intel Macs. **Older versions** ### 2.15.0 (2026-06-16) - Add native support for Apple Silicon (arm64) Macs, with a dedicated installer. - \[WPG-72\] Hide the app from the Dock while it runs in the background; it appears only while a dialog is open. - \[WPG-75\] Fix `downloadToFolder` failing for some folder paths (regression in 2.14.2). ### 2.14.2 (2026-05-18) - \[WPG-70\] Require a license for the commands that access local files and folders (file and folder browsers, `downloadToFolder`, `openFile`, `openFolder`), and for `listTokens` and `encrypt`. - \[WPG-70\] Improve the safety of `downloadToFolder`: the file name is sanitized against path traversal and invalid characters, and files with an unsafe extension are saved as `.bin`. ### 2.14.0 (2026-02-03) - \[WPG-67\] Add the user name and machine name to the `generateKeyPair` and `generateTokenKeyPair` responses. - \[WPG-67\] Add support for importing the CA certificates of the chain together with the user certificate in `importCertificate` and `importTokenCertificate`. - Improve the protection of private keys generated by `generateKeyPair` while they wait for the certificate to be imported. ### 2.13.5 (2025-10-02) - \[WPG-59\] \[WPG-60\] Improve the detection of localhost domains, which can use Web PKI without a license. - Fix `listCertificates` failing entirely when a PKCS#11 token cannot be read. - Fix `importCertificate` offering to save the PKCS#12 backup without a password when the user cancels the password dialog. ## Native component for Linux The native application that the Web PKI extension uses on Linux to access certificates, tokens and local files, distributed as .deb and .rpm packages. ### 2.16.1 (2026-10-17) - \[WPG-82\] Fix the package failing to install on Ubuntu 26.04 and Debian 12/13 (newer libicu versions). - \[WPG-85\] Fix the .rpm package not registering the browser integration on systems without `sudo` (such as minimal Fedora, RHEL and Rocky Linux installs), and not removing it on uninstall. **Older versions** ### 2.16.0 (2026-07-27) - \[WPG-73\] Add a consent dialog that asks the user before a website lists or reads their certificates, with a "don't ask again for this website" option. - \[WPG-73\] Restrict importing PKCS#12 files and removing certificates to the Web PKI extension popup. - \[WPG-73\] Fix the app crashing when opening a file or folder dialog on Ubuntu 24.04 and newer. - \[WPG-73\] Fix the .deb package not registering the browser integration on systems without `sudo`. - \[WPG-73\] Declare the required system libraries (ICU, OpenSSL, X11, fontconfig) as dependencies of the .deb and .rpm packages, so they are installed with the package. - \[WPG-79\] Improve the look of all dialogs. ### 2.15.0 (2026-06-16) - \[WPG-75\] Fix `downloadToFolder` failing for some folder paths (regression in 2.14.2). ### 2.14.2 (2026-05-18) - \[WPG-70\] Require a license for the commands that access local files and folders (file and folder browsers, `downloadToFolder`, `openFile`, `openFolder`), and for `listTokens` and `encrypt`. - \[WPG-70\] Improve the safety of `downloadToFolder`: the file name is sanitized against path traversal and invalid characters, and files with an unsafe extension are saved as `.bin`. ### 2.14.0 (2026-02-03) - \[WPG-67\] Add the user name and machine name to the `generateKeyPair` and `generateTokenKeyPair` responses. - \[WPG-67\] Add support for importing the CA certificates of the chain together with the user certificate in `importCertificate` and `importTokenCertificate`. - Improve the protection of private keys generated by `generateKeyPair` while they wait for the certificate to be imported; the key files are now readable only by the user. - \[WPG-59\] \[WPG-60\] Improve the detection of localhost domains, which can use Web PKI without a license. - Fix `listCertificates` failing entirely when a PKCS#11 token cannot be read. - Fix `importCertificate` offering to save the PKCS#12 backup without a password when the user cancels the password dialog. ## Mobile app The Web PKI app for Android and iOS, which lets web pages sign with the certificates on the phone, by QR code, deep link or a paired computer. ### 5.0.6 (2026-10-13) - \[WPG-78\] Rewrite the app in Flutter for Android and iOS, replacing the previous app. Upgrading keeps your certificates, paired computers and favorite signer. - \[WPG-78\] Add dark mode. - \[WPG-78\] Improve biometric authentication: a successful prompt now covers further signatures for 2 minutes only for the same site and paired computer, and only while the app is open on screen. - \[WPG-78\] Ask for notification permission on first launch and on every computer pairing, and offer to open the app settings when it was denied, so signature requests from paired computers are not missed. - \[WPG-78\] Allow unpinning the favorite signer (the star button is now a toggle). - \[WPG-78\] Fix the QR code scanner possibly failing without showing an error. ## IE add-on (legacy) The legacy Web PKI add-on for Internet Explorer on Windows. ### 2.9.2 (2024-04-05) - Maintenance release. Earlier releases are not documented in this changelog.