Product
Changelog
latest v2.10.0 · October 30, 2026
What changed in each release of Montara Pass, newest first. Every entry links to its commit on GitHub.
On this page
Features
3Features
5- appreset the account password by email95ec7e0
- extensionlink sign-in to the web app's password reset64ed980
- mobileadd the Expo app with routes mirroring the web appd618299
- mobileimplement the vault design on the home, vaults and create screens53c5087
- mobilesign in, verify TOTP and list the real vault7faf393
Bug fixes
7- depsoverride @expo/cli's zod v3 to patched 4.6.7bcae29b
- depspatch vulnerable next, zod, dompurify, undici and fast-urif0590da
- mobileguard the web theme hook and move stack options into group layouts32a5192
- serverbump Go to 1.27.3 for crypto/x509 vulnerabilitycd23048
- update claude skills30d0872
- update github workflows91a450d
- update license3653f9d
Bug fixes
1- extensionrefuse a billing overview in an unexpected form8a6df67
Features
1- vaultadd card item type for payment cardsb2ddb95
Features
1- serverfilter subscriptions and purchases by store mode2f975f2
Features
5Bug fixes
7- authrequire the account password to change the email and a code to turn TOTP offdde3dfc
- billingopen a checkout again without a refused discount code35ca602
- depspatch Go, golang.org/x/net, amqp091-go and katex advisories5e792ea
- extensionsign out of the old server when switching, and require httpsde54b98
- price small discounts and match yearly plans by family and mode88935b5
- serverrecord what Lemon Squeezy settled a payment at274298c
- serverrefuse unidentified account changes and retry checkout only for a refused code0a1302b
Features
3Features
2Features
1- extensionadd an Update button for a downloaded version8ff5268
Features
2Features
11- appredesign billing page plans as priced cards with yearly markeda149ebc
- appsearch the vault by name, username or URL9facd44
- extensionput search, sort, refresh and new item on one bar in full screen48dd5ce
- extensionredesign billing page plans as priced cards with yearly markedba89f06
- webread pricing plans through an API layer and TanStack Querybb95fc1
- webredesign contact page channels, form and office cards61b4511
- webredesign home hero with a top glow and single-tone heading4d2e48c
- webredesign home pricing section as self-hosted and cloud cardsc66ca34
- webredesign pricing page plans as a table with yearly as best value77b44e0
- webredesign self-host section as stack layers and deploy stepsf4ed9cf
- webredesign the sections below the pricing plans624672d
Breaking changes
4- server/api/v1/categories is removed and its table dropped. cmd/migrate no longer takes --seed, and the migrate:up:seed script is gone; SEED_ON_BOOT now only creates the SUPER_USER account.
- servercmd/migrate takes --cloud instead of --ee to force or create a Cloud Edition migration.
- serverMIDTRANS_SERVER_KEY and MIDTRANS_PRODUCTION are gone; set LEMONSQUEEZY_API_KEY, LEMONSQUEEZY_STORE_ID and LEMONSQUEEZY_WEBHOOK_SECRET instead, all three or none. The webhook moves to /api/v1/billing/lemonsqueezy/webhook, and /api/v1/billing/midtrans/notification is removed. A plan is sold only once it names its Lemon Squeezy variant_id, and amounts are cents in every currency, so a plan stored in whole rupiah must be repriced.
- serverPOST /api/v1/plans and PUT /api/v1/plans/:id are removed; plans are changed in the Lemon Squeezy store, then synced. Checkouts no longer send custom_price, so a plan costs what its variant costs there.
Features
12- appmanage the subscription in Lemon Squeezy's customer portal5bd73a6
- appshow the plan refusal where sharing was attempted7e4ce1c
- extensionmask email usernames in lists, with a reveal in the detail7bff3ad
- extensionmask every username in lists, not only email addresses986c8b2
- extensionshow plans and the subscription in the full tab0742738
- servergate paid sharing on REQUIRE_PAID_SHARINGdf6ce30
- servergate sharing out on a paid plan53356b5
- serverlet the community edition run without emaila159052
- serversync the plans from the Lemon Squeezy catalog and save customers14aa8e7
- servertake payments through Lemon Squeezy instead of Midtransb5a0105
- webadd a pricing page and the site's design system5c9bca4
- webname Lemon Squeezy as the merchant on the pricing pagesb9f56bf
Bug fixes
4Breaking changes
1- EDITION=ee and EDITION=ce are no longer accepted; use EDITION=cloud or EDITION=community. The montara-pass-ee, -ce and -docs images stop receiving releases.
Features
2Bug fixes
2Code refactoring
1- rename the editions to cloud and community078d7b3
Features
12- appadd a billing page to the enterprise editiona2a898b
- appdrop sign-up and sharing from the community editione862628
- appreplace the sidebar with shadcn's inset sidebareeb1ae3
- extensionbuild a community edition without sign-up or sharing00221a1
- extensionshow a lock icon on the settings' lock button0d7f6b0
- extensionshow the user's plan in the settings3850390
- extensionuse the web app's sidebar in the full tab85fd1e1
- serveradd a community edition without sign-up or sharing5fa517f
- serveradd an overview of counts and revenue for a super user6971694
- serveradd billing with Midtrans to the enterprise edition3b5b519
- serverlist every customer's subscriptions and purchases for a super user93300c4
- webshow the hosted service's plans in the pricing sectione36acd5
Bug fixes
5Features
9- appgive an empty page a shape5781a27
- applet a page arrive, and show a skeleton while it loadse42da3e
- applet a secure note be kept hiddenb3b449c
- appmake a password from the item form3ede577
- apprebuild the web app on the extension's design system7782cdf
- extensiondraw in a regenerated passwordcea7c2c
- extensionfold the full-tab sidebar down to its icons43661ae
- extensiongive a first-time user a way to an accountd942b44
- extensionmatch the item detail's actions to the web appcf3d6bd
Bug fixes
6- appgive the parts of the vault list room and a rule1adb2a6
- extensioncentre the generator and the health reportd264b0e
- extensionfinish the password generator's options and slider9bd7311
- extensiongroup the password health report into cards60c1adf
- extensionput the share view in orderade6cff
- give the generator and the health report more room8f50f1a
Features
1- extensionoffer a site's logins in the corner of its sign-in pagecd7b1f1
Bug fixes
1- extensiontie a sign-in field's error to its input617dbe6
Features
3Bug fixes
5- appshow a dash for a date that cannot be reada5060b6
- extensiondo not offer a passkey-only login for filling3eb45f5
- extensionhear only the frames the content script made1d89fe8
- extensionkeep www apart on a shared suffix, and say shared aloudd383223
- extensionoffer sign out in settings after a failed start40099ed
Features
5- app,extensionsend an idempotency key with every write98ff599
- extensionoffer to save a login as it is submitted949ea5e
- extensionsuggest a generated password on sign-up forms929ed2d
- serverrun a write once when it carries an Idempotency-Key1ce0cfb
- servershare rate limits and idempotency keys through Redisb43e623
Bug fixes
7- applock the vault after 15 idle minutes and refuse short public keys22f0a42
- applock the vault when a click arrives after the deadlinec60d88b
- extensionexpire a pending login under an open save prompt2766278
- extensionignore synthetic key events and plain http pages6078aa8
- extensionopen the inline menu when a login field is entered73fe601
- serverkeep one idempotency lock token per holder6874496
- serverrefuse unverified emails and harden rate limits and headersf4bf6e7
Features
14- appadd a password generator and a password health checkdefc552
- appbalance the password generator and split out the Markdown editor9ec8df2
- appedit a login's notes as Markdown too5c863fc
- appedit secure notes as rich text with Milkdownae2f984
- applet a secure note be marked not visiblede5477a
- extensionadd password tools, list columns and sharing to the full-screen viewda71e3c
- extensionblur a secure note that is not visible until it is shown0695bd6
- extensionedit and render a login's notes as Markdown75f44a4
- extensionkeep a login's site icon inside the encrypted itemef66b6e
- extensionrender a secure note's Markdown in the item detail71e4be3
- extensionshow site icons and when a login was last usedee13304
- extensionturn the inline menu on for everyone and offer one server URLeac1d59
- extensionwrite secure notes in the Markdown editor and balance the generator218306d
- serverrecord when a member last used an itemec6bcb4
Features
3Bug fixes
1- extensionclear the add-on linter warnings for Firefoxb9fafd6
Features
1- deployadd a Docker Compose stack for Dokploydce72b4
Breaking changes
1- API paths move from /v1 and /health to /api/v1 and /api/health, including the Google OAuth callback. The separate app image is no longer published; the server image contains the web app.
Features
1- serve the web app from the API and move every endpoint under /apid5c8022
Bug fixes
1- update domain web4f5fbbf
v1.0.0
Breaking changes
1- serverDATABASE_URL is replaced by DB_DSN, and APP_SECRET, FROM_ADDRESS and RESEND_API_KEY are now required. The migrations are replaced (PostgreSQL 18 for uuidv7()), so a database that applied the old 000001_create_users_table must be recreated.
migrate downnow rolls back every migration instead of one step.
Features
17- add skillse758f24
- appadd the end-to-end encrypted vault UId34858a
- appuse the new logo and the brand palettebd54cbc
- docsadd the documentation sitecc6f561
- extensionadd the browser extension for Chrome and Firefoxb00f008
- extensionrestyle the popup and add a full-screen vault view4f17949
- extensionrework sign-in, the item form and the palette34ddea8
- extensionuse the new logo and restyle the form selects687524d
- initial projectdca56dd
- serveradd end-to-end encrypted password vaulte911731
- serveradopt gofi structure with embedded Authula auth75c4efd
- webcontact page with validated forma87dbf8
- weblegal pages with sticky table of contents388f2ba
- weblight mode with theme toggleede0bf3
- webprofessional polish for the home page7a93d87
- webshared layout and site chromef6cbb27
- webuse the new logo and the brand palette9f7207d