Secrets Manager CLI 1.5.0

Released on Aug 14, 2026

Security

• KSM-1168: Fixed an authorization gap in ksm sync --type aws where a Keeper user with add access to a synced folder could craft a record title to target arbitrary secrets in the operator's AWS account. Secret names written to AWS are now confined to a caller-supplied namespace prefix (--prefix). Dry-run output no longer includes the live destination secret value for any cloud backend (AWS, Azure, GCP).

Improvements

• KSM-1114: Removed the unmaintained colorama dependency; terminal coloring now uses click.style(), already present via click-help-colors, with no new dependency added
• When KSM_CONFIG is set and a keyring profile would otherwise take precedence, the CLI now warns on stderr naming the active config source. The warning is suppressed when the keyring is unavailable or empty, so CI and container environments using KSM_CONFIG exclusively see no output.

Bug Fixes

• KSM-929: Fixed locked OS keyring (e.g. gnome-keyring over SSH) silently returning no profiles; CLI now raises an actionable error pointing at --ini-file / KSM_CONFIG as a fallback
• KSM-1113: Fixed config path search on Windows (%APPDIR% → %APPDATA%) and on Linux (/etc entries now resolve as absolute paths instead of relative to the current directory)
• KSM-1107: ksm secret add clone now exits non-zero when the source UID does not exist, instead of silently exiting 0
• KSM-1118: Fixed ksm secret add clone crashing with "list index out of range" when the source record contained an unpopulated complex field (name, address, host, etc.)
• KSM-1126: Fixed ksm secret add file and ksm secret add editor crashing with the same "list index out of range" error when the record contained an unpopulated complex field
• KSM-1135: Fixed ksm secret download crashing with MissingSchema: Invalid URL 'None' when called immediately after ksm secret upload; the vault propagates the file's download URL asynchronously and the CLI now raises a clear retry message
• KSM-1155: Fixed fatal keyring storage errors swallowing the underlying error message; the original error is now surfaced directly
• KSM-1156: Fixed ksm shell crashing at startup with UnicodeEncodeError when stdout could not represent the Unicode box-drawing banner (cp1252 on piped/redirected Windows output, C-locale pipes on Linux); the shell now falls back to a plain-text banner
• KSM-1157: Fixed ksm shell ignoring session global options (--ini-file, --profile-name, --output, --color, --cache, --log-level) for commands run inside the shell; all session options now propagate to inner commands
• KSM-1162: Fixed ksm shell on Windows corrupting file paths containing backslashes; C:\dir\file.ini was silently converted to C:dirfile.ini
• KSM-1165: Fixed ksm shell truncating command arguments at # characters; UIDs and paths containing # are now passed through intact
• KSM-1163: Fixed two keeper.ini discovery bugs on all platforms: KSM_INI_DIR was silently overridden by a keeper.ini in the current directory without any warning, and unset environment variables in the search path were probed as literal directory names
• KSM-1018: Fixed macOS installer crashing on every ksm invocation; bundled libssl updated to OpenSSL >=3.2.0 (x64 and arm64)
• KSM-1105: Fixed Windows installer's post-install launch of ksm.exe being blocked by endpoint security (EDR/AV)
• KSM-1106: Fixed macOS PKG installer ignoring Keyring and Cloud Sync component checkboxes in GUI mode; the installer now respects the user's component selection
• KSM-1116: Fixed Windows installer placing the 64-bit binary in Program Files (x86) instead of Program Files on 64-bit systems
• KSM-1159: Fixed Windows installer appending a duplicate PATH entry on every install or upgrade
• KSM-1164: Fixed Windows uninstall and upgrade corrupting the system PATH by writing it as REG_SZ instead of REG_EXPAND_SZ; %SystemRoot% and %WINDIR% expansion was broken in all subsequent processes after the uninstaller ran
• KSM-1117: Fixed the Docker Alpine image shipping a musl 1.2.4 base image while the bundled binary required musl >= 1.2.5; the /cli/musl/ksm init-container binary failed to load in its own image
• KSM-1120: Fixed the Docker /cli/glibc/ksm and /cli/musl/ksm init-container binaries shipping as amd64 ELF on all platforms; arm64 init-containers have never had a functional binary
• KSM-1160: Fixed install.sh producing a cryptic PyInstaller crash on Alpine 3.19 (musl 1.2.4) or systems with glibc < 2.28; the script now checks platform compatibility before installing
• KSM-1169: ksm sync dry-run output no longer includes the live destination value for Azure Key Vault or GCP Secret Manager; behavior now matches AWS. Destination names supplied via --map are validated against Azure and GCP naming rules before any write is attempted.
• KSM-1170: ksm sync --record and --folder now warn on stderr when a token resolves by record title or folder name rather than by UID, since those identifiers are mutable. Resolution behavior is unchanged; UIDs are recommended for scheduled syncs.
• KSM-1171: ksm init k8s now uses a YAML serializer to build the Kubernetes Secret manifest, so --name and --namespace values are always properly encoded and cannot inject content into the manifest.

Breaking Changes

• KSM-1168: ksm sync --type aws with --record, --folder, or --folder-recursive now requires a --prefix argument. Existing sync commands must add --prefix <value> (e.g. --prefix keeper/).
• KSM-1120: Linux GitHub release tarballs now include the architecture in the filename. The previous single Linux tarball is replaced by keeper-secrets-manager-cli-linux-amd64-1.5.0.tar.gz and keeper-secrets-manager-cli-linux-arm64-1.5.0.tar.gz; the Alpine tarball is split the same way, into keeper-secrets-manager-cli-alpine-linux-amd64-1.5.0.tar.gz and keeper-secrets-manager-cli-alpine-linux-arm64-1.5.0.tar.gz. Scripts that reference the old unsuffixed tarball names need to be updated.

Resources

• PyPI Package
• Docker Hub
• GitHub Releases
• CLI Documentation