> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/enterprise/keeper-secrets-manager/2026/java-sdk-17.4.0.md).

# Java SDK 17.4.0

Released on Aug 25, 2026

### New Features

* **KSM-531:** Added HTTP/HTTPS proxy support. All SDK connections (secret queries, file upload, file download) can now route through a proxy.
  * New `proxyUrl` option on `SecretsManagerOptions`, plus `SecretsManagerOptions.withProxy(storage, proxyUrl)` for Java callers.
  * Precedence: explicit `proxyUrl`, then `https.proxyHost`/`https.proxyPort`, then `HTTPS_PROXY`/`https_proxy`. `NO_PROXY` and `http.nonProxyHosts` exclusions are honored. `HTTP_PROXY` is ignored since all KSM traffic is HTTPS.
  * Authenticated proxies use `http://user:pass@host:port`. A 407 raises a typed `SecretsManagerException` naming the `jdk.http.auth.tunneling.disabledSchemes` JVM flag most applications need to set before making any other HTTP/HTTPS call.
  * New options-taking overloads `downloadFile(options, file)` and `downloadThumbnail(options, file)` honor `proxyUrl`, `allowUnverifiedCertificate`, and the configured timeouts; the single-argument forms are unchanged.
* **KSM-1176:** Added `isEditable` to `KeeperRecord`, forwarded from the server response envelope, so callers can check write permission before calling `updateSecret`.

### Security

* **KSM-1203:** Fixed `generatePassword`'s final character shuffle using Kotlin `Random.Default` instead of a cryptographic source. It now uses `SecureRandom`.
* **KSM-1207:** Fixed `HttpsURLConnection` calls (queries, upload, download) having no timeout, allowing an indefinite hang. Added `connectTimeoutMillis` (5s default) and `readTimeoutMillis` (30s default) to `SecretsManagerOptions`.
* **KSM-1248:** Server-supplied key IDs are now validated against the embedded public key table before being persisted; an unrecognized ID is rejected instead of overwriting stored key state. Key rotation retries are capped at 3.
* **KSM-1262:** Config and cache files are now written via an atomic temp-file swap with 0600 permissions set before data is written, closing the window where another local user could read the file mid-write.

### Bug Fixes

* **KSM-1081:** Fixed `getFolders()` crashing when any folder in the response has a corrupted or missing key. Undecryptable folders are now skipped; the rest are returned normally.
* **KSM-1086:** Fixed `deleteFolder()` returning the wrong response type. It now returns `SecretsManagerDeleteFolderResponse` with per-folder status, matching `deleteSecret()`. Both calls now surface per-item server failures to the caller.
* **KSM-1270:** Fixed `getSharedFolderKey()` looping forever when server folder data contains a parent cycle. The affected folders are now skipped instead.

### Breaking Changes

1. **`deleteFolder()` return type.** Now returns `SecretsManagerDeleteFolderResponse` instead of `SecretsManagerDeleteResponse`. Callers that read `.records` must switch to the new type's `.folders` list. In practice no working code is affected: the old type required a `records` field the backend never sent, so every previous call threw `MissingFieldException` rather than returning a value.
2. **Widened constructors, bytecode-level only.** `KeeperRecord` and `SecretsManagerOptions` gained constructor parameters. Java callers keep every 17.3.0 constructor form via `@JvmOverloads`, but Kotlin code compiled against 17.3.0 throws `NoSuchMethodError` if the 17.4.0 jar is swapped in without recompiling. Rebuild dependents rather than replacing the jar in place.

### Resources

* [Maven Central package](https://central.sonatype.com/artifact/com.keepersecurity.secrets-manager/core/17.4.0)
* See [Java SDK Documentation](/keeperpam/secrets-manager/developer-sdk-library/java-sdk.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.keeper.io/release-notes/enterprise/keeper-secrets-manager/2026/java-sdk-17.4.0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.