SecureDrop 1.1.0 is now available! This update will automatically be installed as part of your regular preflight updates. No further action is needed.

This release addresses a number of small issues that weren’t ready in time for our 1.0.0 release. In case you missed it, the SecureDrop Inbox is our new journalist experience for triaging and working with sources.

If you encounter any bugs or issues, please contact SecureDrop support via Signal, so we can make sure to address them. As a reminder, the legacy Client will only be available as a fallback option for three more weeks. It can be opened by going to Qubes menu ▸ Gear icon ▸ Other ▸ SecureDrop Client (legacy).

We will continue to keep you updated on specific dates and other details through your Signal group.

Changelog

• Correctly set the SecureDrop logo as the Inbox menu bar icon (#3330)
• Fix typo in username placeholder text (#3331)
• Remove empty string translation (#3334)
• Harden liquidjs usage to mitigate CVE-2026-35525, CVE-2026-39859, and CVE-2026-39412 (#3204)
• Improve deletion counting performance with a single SQL query instead of per-source queries (#3329)
• Dependency updates:
  • Bump openssl from 0.10.72 to 0.10.78 (#3284)
  • Bump protobufjs to 7.5.5 (#3283)
  • Update Poetry to 2.3.3 (#3228)
• Internal and development:
  • Remove unused PendingEventType event types (#3341)

Acknowledgments

This release incorporates Freedom of the Press Foundation (FPF) contributions by Giulio B; Martin C; Nathan Dyer, communications manager; Micah Lee; Kunal Mehta, deputy release manager; Cory Francis Myers; Vicki Niu, release manager; Kevin O’Gorman; Francisco Rocha; Conor Schaefer; John Skinner; and Rowen S.

Questions and comments

If you have questions or comments regarding this release, please contact us:

• Via Signal, either in your dedicated SecureDrop Support group, or by contacting the support account listed at securedrop.org/help/.
• Via securedrop@freedom.press (PGP encrypted) for sensitive security issues (please use judiciously), or submit a report via Bugcrowd.

We also encourage you to file nonsensitive issues via our GitHub repository.

Thank you for using SecureDrop!