[stas-schaller]

Summary

Release branch for v1.1.0: raises the Python floor to 3.9.2 and bundles 13 bug fixes addressing thread safety, crypto hygiene, silent errors, atomic writes, and config-loading edge cases across all encrypted storage backends.

Changes

Bug Fixes

• Thread safety (KSM-959): added threading.RLock to all 5 backends — prevents data corruption under concurrent use
• Crypto hygiene (KSM-960): MD5 → SHA-256 for change-detection hashing; Azure AES-GCM nonce fixed 16 → 12 bytes (NIST SP 800-38D compliance)
• Silent encrypt/decrypt errors (KSM-961, Critical): failures in __encrypt_buffer/__decrypt_buffer now raise instead of silently corrupting storage state
• delete_all() leaving empty blob (KSM-962): now calls os.remove() on the config file instead of writing an empty encrypted blob
• State divergence on write failure (KSM-963): __save_config writes to disk before updating self.config — prevents in-memory/on-disk divergence
• decrypt_config() autosave default (KSM-964): changed from autosave=True to autosave=False — stray calls no longer silently overwrite the encrypted file with plaintext
• Empty-JSON bootstrap (KSM-965): __load_config check changed from if config: to if config is not None: — a plaintext {} config is now correctly re-encrypted on first load instead of falling into the binary decrypt path
• AWS Secrets provider silent failures (KSM-966): _get_instance_region raises when all IMDS detection methods fail; read_config raises with the actual AWS error instead of returning an empty string
• AwsSecretStorage eager load (KSM-967): __init__ now calls __load_config() on construction, matching all peer backends; accepts any valid JSON dict (removed privateKey gate)
• Non-UTF8 corrupt config (KSM-972): non-UTF8 bytes that are not the \xff\xff blob header now raise "<path> is not a valid encrypted config file" across all three encrypted backends (nfast, AWS KMS, Azure KeyVault) — replaces misleading encoding error messages and bare UnicodeDecodeError/JSONDecodeError escapes
• __load_config swallows AWS errors (KSM-977, Merges KSM-977: fix AwsSecretStorage.__load_config() silently swallowing AWS errors #1025): the except Exception block now populates err before logging, so construction raises when read_config raises — fixes the KSM-966 × KSM-967 interaction where the exception was logged but never reached the caller
• Decrypt-path parity (KSM-978, Merges KSM-978: raise on empty __decrypt_buffer result in HsmNfast and AwsKms #1026): HsmNfast and AwsKms now raise "<path> is not a valid encrypted config file" when __decrypt_buffer returns empty — matches Azure's existing behavior; HsmNfast no longer leaks a bare JSONDecodeError, AwsKms no longer silently logs without raising
• Atomic saves (KSM-979, Merges KSM-979: atomic write for __save_config and create_config_file_if_missing #1027): __save_config and create_config_file_if_missing now write to <path>.tmp then os.replace across all three encrypted file backends — a write failure no longer truncates the existing config to 0 bytes, and an encrypt failure in create_config_file_if_missing no longer leaves a 0-byte stub on disk

Maintenance

• Raise minimum Python version from 3.6 to 3.9.2
• Update keeper-secrets-manager-core dependency floor to >=17.2.0
• Add Python 3.13 classifier; remove 3.6, 3.7, 3.8 classifiers
• 51 regression tests added across 12 test files

Breaking Changes

Python 3.6, 3.7, and 3.8 are no longer supported. Users on those versions must remain on v1.0.2.

Related Issues

• KSM-959, KSM-960, KSM-961, KSM-962, KSM-963, KSM-964, KSM-965, KSM-966, KSM-967, KSM-972, KSM-977, KSM-978, KSM-979

[claude]

⚠️ Code review skipped — your organization has reached its monthly code review spending cap.

An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.

Once the cap resets or is raised, push a new commit or reopen this pull request to trigger a review.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​certifi@​2026.5.20
	pypi/​urllib3@​2.6.3
	pypi/​pycparser@​2.23
	pypi/​cffi@​2.0.0
	pypi/​charset-normalizer@​3.4.7
	pypi/​requests@​2.32.5
	pypi/​typing-extensions@​4.15.0
	pypi/​pycparser@​3.0
	pypi/​idna@​3.15

View full report