https://cybertoolchain.io/tools/sops New releases and features in SOPS, tracked by The Cyber Toolchain. en Fri, 08 May 2026 18:10:42 GMT https://github.com/mozilla/sops/releases/tag/v3.13.0 https://github.com/mozilla/sops/releases/tag/v3.13.0 Fri, 08 May 2026 18:10:42 GMT SOPS v3.13.0 adds GCP KMS endpoint/universe env vars, Age multi-key env support, HC Vault URL allowlist, and YAML inline comment preservation. • Adds `SOPS_GCP_KMS_ENDPOINT` and `SOPS_GCP_KMS_UNIVERSE_DOMAIN` environment variables for pointing SOPS at custom or sovereign GCP KMS endpoints. • Allows multiple space-separated Age private keys in the `SOPS_AGE_KEY` environment variable, enabling multi-key Age workflows without key files. • Adds allowlist support for acceptable HashiCorp Vault URLs, restricting which Vault instances SOPS will contact. • Preserves YAML inline comments through encrypt/edit roundtrips, preventing comment loss on re-encryption. • The `--indent` global flag value is now correctly propagated to store configs, giving consistent indentation across output formats. • The `sops exec-file` subcommand now rejects non-local paths in `--filename`, hardening against path traversal misuse. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sops https://github.com/mozilla/sops/releases/tag/v3.11.0 https://github.com/mozilla/sops/releases/tag/v3.11.0 Sun, 28 Sep 2025 18:28:49 GMT SOPS v3.11.0 adds new CLI flags for `sops set`, shell completions, env-var keyservice config, and Azure KMS latest-key support. • Adds `--value-file` option to `sops set` to supply a replacement value from a file instead of inline. • Adds `--value-stdin` option to `sops set` to supply a replacement value from standard input. • Adds shell completion script generation (`sops completion`) to support tab-completion in shells. • Enables configuration of `--enable-local-keyservice` and `--keyservice` via environment variables. • Supports native list syntax for configuring keys in `.sops.yaml`. • Azure Key Vault: omitting a key version now automatically uses the latest key version. • Allows non-complex non-string values (integers, booleans, etc.) in dotenv and exec-env stores. • Introduces `EncryptContext` and `DecryptContext` for AWS, Azure, GCP, PGP, and HashiCorp Vault (library API). • Allows injecting a custom HTTP client for AWS, Azure, GCP, and HashiCorp Vault key providers (library API). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sops https://github.com/mozilla/sops/releases/tag/v3.10.0 https://github.com/mozilla/sops/releases/tag/v3.10.0 Sun, 30 Mar 2025 17:31:26 GMT SOPS v3.10.0 adds age plugin/SSH/passphrase support, stdin encrypt/decrypt, and several new CLI flags • Adds `--input-type` option to the `filestatus` subcommand for specifying file type when checking encryption status • Introduces `SOPS_EDITOR` environment variable, consulted before `EDITOR`, for editor selection • Allows disabling the version check via environment variable • Adds `--same-process` option for `exec-env` subcommand to run commands in the same process • Adds `--idempotent` flag to the `set` subcommand to skip writing the file when no change occurred • Supports encryption and decryption of `time.Time` objects in YAML/JSON files • Adds SSH key support for age encryption • Adds support for age identities protected with a passphrase • Adds age plugin support, enabling external age key management plugins • Supports encrypting and decrypting directly from stdin • Adds `SOPS_AGE_KEY_CMD` option to retrieve the age key via an external command • Adds a way to set the sops config file location via an environment variable • Supports `--config` option in the `publish` subcommand • Adds support for `oauth2.TokenSource` in GCP KMS integration • Supports `GOOGLE_OAUTH_ACCESS_TOKEN` for Google Cloud Platform authentication • Adds duplicate section support to the INI store • Adds a trailing newline at the end of JSON output files • Adds Windows ARM64 binary releases and multiarch Windows release binaries • Warns when a `.sops.yml` file is found while searching for `.sops.yaml` • Adds option to explicitly check for the latest version on demand Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sops https://github.com/mozilla/sops/releases/tag/v3.9.1 https://github.com/mozilla/sops/releases/tag/v3.9.1 Fri, 04 Oct 2024 05:14:58 GMT SOPS v3.9.1 lets `edit` create new files and hardens encryption by rejecting empty key groups. • Enables `sops edit` to create new encrypted files that don't yet exist on disk. • Refuses to encrypt when a key group is empty or no key groups are defined, preventing silently unprotected files. • The `updatekeys` subcommand now displays changes to `shamir_threshold` so operators can audit key-group threshold updates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sops https://github.com/mozilla/sops/releases/tag/v3.9.0 https://github.com/mozilla/sops/releases/tag/v3.9.0 Fri, 28 Jun 2024 06:14:47 GMT SOPS v3.9.0 adds explicit encryption/decryption subcommands, --mac-only-encrypted flag, and exec-env --pristine support. • Add `--mac-only-encrypted` flag to compute MAC only over values that end up encrypted • Introduce `--pristine` flag to `sops exec-env` to clear the environment before injecting secrets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sops https://github.com/getsops/sops/blob/main/CHANGELOG.md https://github.com/getsops/sops/blob/main/CHANGELOG.md Fri, 15 Sep 2023 13:52:37 GMT SOPS 3.8.0 adds --disable-version-check and --input-type for updatekeys. • Adds `--disable-version-check` to allow offline `--version` checks • Adds `--input-type` flag to the `updatekeys` subcommand • Switches `--version` network requests from public DNS to GitHub endpoints Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sops https://github.com/mozilla/sops/releases/tag/v3.7.3 https://github.com/mozilla/sops/releases/tag/v3.7.3 Mon, 09 May 2022 17:37:50 GMT SOPS v3.7.3 adds `GOOGLE_CREDENTIALS` env var support and accepts KeyServiceServer in LocalClient. • Add support for GCP Service Account within `GOOGLE_CREDENTIALS` • keyservice: accept KeyServiceServer in LocalClient Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sops https://github.com/mozilla/sops/releases/tag/v3.7.2 https://github.com/mozilla/sops/releases/tag/v3.7.2 Wed, 09 Mar 2022 19:26:40 GMT SOPS v3.7.2 adds arm64 releases and SOPS_AGE_KEY env var support • Adds `linux` and `darwin` `arm64` platform support for binary releases • Supports the `SOPS_AGE_KEY` environment variable to provide age keys without a file Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sops