We are pleased to announce that SecureDrop 2.15.0 is now available. This version enables an updated API, which is required for the new Inbox application that will be released soon.

A full list of changes can be found below.

What’s new in SecureDrop 2.15.0?

For administrators and journalists

• v2 Journalist API:
  • Enable v2 API by default (#7789)
  • Add source_converation_seen event (#7784)
  • Let client request arbitrary metadata shards (#7770)
• Update terms used in English wordlist (#7785)

For developers

• Improve v2 API documentation (#7793)
• Use uv to manage admin requirements (#7773)
• Set 7-day cooldown for dependabot alerts (#7787)
• Update demo base container image to used fully qualified name (#7794)
• Dependency updates:
  • cffi to 2.0.0 (#7773)
  • cryptography to 46.0.6 (#7797)
• GitHub Actions download-artifact to 8 (#7782)
• GitHub Actions upload-artifact to 7 (#7782)

Acknowledgments

Thanks to Localization Lab for continued support with our translations. Translations were updated thanks to the work of many volunteers:

• Soufiane Hti
• AO yahoe.001
• Øyvind Bye Skille
• aaloo
• Jonas Waga
• tekrei

If you would like to help expand the languages that SecureDrop supports, please see our instructions on contributing translations.

This release incorporates Freedom of the Press Foundation (FPF) contributions by Martin C; Nathan Dyer, communications manager; Micah Lee; Kunal Mehta; Cory Francis Myers, release manager; Vicki Niu, translations manager; Kevin O’Gorman; Francisco Rocha; John Skinner; and Rowen S.

Questions and comments

If you have questions or comments regarding this release, please contact us:

• Via Signal, either in your dedicated SecureDrop support group, or by contacting the support account listed at securedrop.org/help/.
• Via securedrop@freedom.press (PGP encrypted) for sensitive security issues (please use judiciously), or submit a report via Bugcrowd.

We also encourage you to file nonsensitive issues via our GitHub repository.

Thank you for using SecureDrop!