age v1.3.2 released on 29-08-2026
age v1.3.2 is out now. It tightens input validation and rejects oversized headers and recipient lists to close parsing and resource‑exhaustion and encoding edge cases, improving robustness and security.
See the project’s GitHub release page for downloads and release archives, which include the new pre-built binaries and bundled compatibility plugins.
What’s in this release
- Stricter input validation: message headers larger than 2 MiB and recipient lists over 1024 entries are now rejected; malformed SSH keys in recipients files are refused; non‑UTF‑8 plaintext will not be written to an interactive terminal unless explicitly forced with -o -.
- Expanded official pre-built binaries: release assets now include windows/arm64 and darwin/amd64 builds.
- Release archives now bundle compatibility plugins (age-plugin-pq, age-plugin-tag, age-plugin-tagpq) alongside the main age binaries.
Upgrade notes
- Some inputs that previously succeeded will now be refused — audit recipient lists and trim or split any exceeding 1024 entries, ensure headers stay below 2 MiB, validate SSH recipient key files before use, and explicitly force output (-o -) or redirect to a file if you must write non‑UTF‑8 plaintext. Test upgrades for scripts and CI that feed large or legacy inputs.
- If the stricter checks cause breakage for your workflows, continue using the prior release until you can make the required changes and retest.
Share comments on your experience with the upgrade, especially if you encounter unexpected rejections or migration friction.
