Release Announcement

SecureDrop 2.13.0 Released

December 4, 2025

We’re pleased to announce that SecureDrop 2.13.0 has been released. Starting with this release, the securedrop-admin tool — used on Admin and Journalist Workstations to install and manage your SecureDrop instance — is now provided as a Debian package installed on Tails using APT, instead of being run directly from a cloned version of the SecureDrop Git repository.

This removes a deployment dependency on GitHub and improves overall security by using the Tails OS package manager, as well as preparing for future availability of the securedrop-admin utility on Qubes OS.

This release includes some key changes for SecureDrop administrators to be aware of:

  • The securedrop-admin utility is installed in the default path and can be run as securedrop-admin <command> in a terminal window.
  • Configuration and backup files will now be stored in ~/.config/securedrop-admin.
  • The GUI updater is no longer required.

This release also contains initial work toward a second version of the Journalist API, which will be used by a rewritten Qubes-based SecureDrop Client application. For now, the v2 API is disabled by a feature flag.

Other notable changes are highlighted below. For a full list of changes, please refer to the changelog for this release.

What’s new in SecureDrop 2.13.0?

For sources and journalists

  • Add Clear-Site-Data header on logout response for Source Interface (#7660).
  • Use separate prefix for session cookies in Source and Journalist Interface (#7662).
  • Update wordlist to remove offensive term (#7678).
  • Add check for valid tab IDs when creating sources (#7708).

For administrators

  • Update admin tooling to be deployed as a Debian package instead of via Git (#7606).
  • Suppress OSSEC alert caused by non-error Tor log message (#7670).
  • Remove support for Ubuntu 20.04 (Focal) (#7671, #7673, #7674).

For developers

  • Implement v2 Journalist API (#7604, #7622, #7624, #7626, #7629, #7665, #7685, #7691, #7683, #7701, #7681, #7699, #7705, #7706, #7712, #7703, #7713, #7716, #7719).
  • Fix UndefinedError exception on 404 responses for static URLs (#7504).
  • Add test to validate apparmor config (#7702).
  • Update test Firefox and Tor Browser versions to 140 and 15, respectively (#7698).
  • Clean up cargo config following noble migration removal (#7680).
  • Support import of fixd datasets (#7669).
  • Remove safety Makefile target and CI jobs (#7627).
  • Increase functional test startup timeout (#7623).
  • Add optional datastore persistence for the dev environments (#7578).
  • Set Ubuntu Noble as default in devops scripts and dev environments (#7570).
  • Update demo Dockerfile to use Ubuntu Noble by default (#7567).
  • Use a base requirements file and consistently apply constraints (#7551).
  • Updated functional test setup to simplify driver creation (#7439).
  • Update functional tests to use webdriver-supplied locale (#7548).
  • Pin ruamel.yamel.clib at version 0.2.12 in Ubuntu Noble (#7550).
  • Add additional dev-helper Makefile targets (#7278).
  • Update Rust version to 1.90.0 (#7688).
  • Dependency updates:

What administrators need to do

The migration process to package-based deployments is performed via the GUI updater as normal. After the migration is complete, future updates will happen in the background, and the updater will no longer be necessary. The migration will not delete existing server backup or configuration files, but we recommend backing up your Admin Workstation before starting the migration update.

Please follow our upgrade guide and get in touch with us if you require assistance.

Acknowledgments

This release was made possible thanks to volunteer code contributions from Bùi Ngọc Lâm, Emmanuel Ferdman, Giovanni Pellerano, and alberefe.

Thanks to Localization Lab for continued support with our translations. Translations were updated thanks to the work of many volunteers:

  • Catalan: victor dargallo, Ecron
  • Chinese (Traditional Han script): Meng Pang Wang
  • Croatian: Milo Ivir
  • French: AO Localization Lab
  • German: Erik Moeller, Curtis Baltimore
  • Greek: Dimitris Maroulidis
  • Hebrew: Yaron Shahrabani, JonnyShuali
  • Icelandic: Sveinn í Felli, Oktavia
  • Italian: Claudio Arseni
  • Norwegian Bokmål: Øyvind Bye Skille
  • Persian: Maryam Azad, Mehrad Mahmoudian
  • Polish: Adam Rak
  • Romanian: ion ciubara
  • Turkish: tekrei

If you would like to help expand the languages that SecureDrop supports, please see our instructions on contributing translations.

This release incorporates Freedom of the Press Foundation (FPF) contributions by Martin C; Nathan Dyer, communications manager; Micah Lee; Kunal Mehta; Cory Francis Myers, localization manager; Vicki Niu; Kevin O’Gorman, release manager; Ethan Paul; Francisco Rocha; John Skinner; and Rowen S, as well as former FPF staff member Erik Moeller.

Questions and comments

If you have questions or comments regarding this release, please contact us:

We also encourage you to file nonsensitive issues via our GitHub repository.

Thank you for using SecureDrop!

Return to News