Description
This is a patch release with an important security update, a rework of how premium database backups are made, and many fixes since 1.44.1.
Security. rotki now ships updated certificate trust lists after the eMudhra certificate authority key compromise announced on 20 October 2026, so certificates issued with the compromised keys are no longer trusted.
New premium backup format (#13401). Backups now use stronger encryption (Argon2id key derivation with AES-256-GCM) and a faster compression algorithm. That makes them quicker to create and smaller, so more databases fit within your plan’s limit. The format can also hold more than the database, so it can grow in future releases. A database that is too large for your plan is now caught before upload, and failed uploads and downloads now say why they failed.
Please make sure to update every device that uses premium sync:
- rotki 1.44.1 and earlier can’t read backups made by 1.44.2.
- A device that has synced a new-format backup won’t accept an old-format backup from the server.
- Existing backups in the old format can still be restored with 1.44.2.
Build pipeline. We updated Node.js, which rotki is built with, to pick up its latest security fixes, and we tightened the security of our build and release process.
It contains 67 commits from 7 different committers. For more information check the detailed changelog below 👇
Our Sponsors
This release is sponsored by:
🥇 Gold Sponsors
- Ambire Wallet (
0xa07D75aacEFd11b425AF7181958F0F85c312f143)
🥉 Bronze Sponsors
- soxpert.eth (
0xEf6FE9C9B351824c96e5C7a478C1e52BAdCBAEe0)
Downloads
Upgrade is highly recommended. Download the binary for your OS from below:
- Linux
- AppImage
- Tar with executable
- deb package
- Standalone Backend
- OSX
- arm64
- x86_64
- Standalone Backend
- Windows
- Windows executable
- Standalone Backend
Optionally, you can also verify the integrity of the aforementioned binaries using the following checksums:
- Linux
- AppImage checksum
- Tar with executable checksum
- deb package
- Standalone Backend
- OSX
- arm64
- x86_64
- Standalone Backend
- Windows
- Windows executable checksum
- Standalone Backend
New Features
- Calendar reminders are now created for SafeNet staking withdrawals that have been initiated but not claimed yet, set to the moment they can be claimed. The reminder is removed once the withdrawal is claimed.
- Initiating a withdrawal from SafeNet staking is now decoded as an informational event. Before, the transaction only showed the gas spend. Redecode your SafeNet transactions to pick up the withdrawals you already initiated.
- Bonds, ETFs and Collectibles are now available as locations, for manual balances, balance snapshots and manually added history events.
Bug Fixes
- rotki now uses updated certificate trust lists that no longer trust the eMudhra certificate authorities affected by the key compromise announced on 20 October 2026, so certificates issued with those keys are no longer accepted.
- When restoring the premium database backup fails while creating an account, for example because of a wrong password, this device is no longer left registered to your premium account, where it took up one of the devices your plan allows. The error now says that the password cannot unlock the backup, instead of pointing at the API keys.
- The folders rotki sets aside after a failed login or account creation are no longer listed as profiles on the login screen. New profile names cannot start with
auto_backup_. - [#13288] The asset picker of the statistics graph now opens on the assets you own, largest holdings first, and filters them as you type. Before, it stayed empty until you typed, and an asset you own, such as USDC, could be missing from the results.
- Re-pulling Hyperliquid Core history now says how many events were re-pulled. Before, it said that no transactions were re-pulled even when events were found.
- Balance queries no longer ask the price oracles for the same token several times at once, and no longer spend Alchemy requests on NFT prices that Alchemy cannot provide, so balances load faster and hit rate limits less often.
- Refreshing transactions now needs about half as many block lookups through the indexers, so rate limits are hit less often.
- ENS avatars are now looked up through your connected nodes first. Before, every lookup went through Etherscan, using up its rate limit.
- A failed manual upload or download of the premium database backup now says why it failed, for example that the database is bigger than your plan allows, that your plan does not include backups or that there is no backup on the server. Before, an empty error dialog was shown. A database that is too big for your plan is now detected while it is compressed, instead of after uploading it.
- [#13399] Fixed NFTs appearing twice in balances or remaining after being sold or transferred.
- [#13340] After you disable the NFT module, the NFTs that token detection found for your accounts show up in balances and snapshots again, and an NFT you gave a manual price in the module keeps that price. Before, disabling the module hid them until it was turned back on.
- The date format help now says that
%Ishows the 12-hour clock hour with a leading zero and%-Iwithout one. Before, the two descriptions were swapped. - [#13345] ZKSync Lite transaction history is now fully fetched for every tracked address. Before, an address could be skipped when another tracked address had a newer transaction, leaving its older transactions and events missing.
- [#13295] NFTs that the NFT module does not report now show up in balances and snapshots when another NFT of the same collection is reported.
- Spot sends between Hyperliquid accounts are now included in the history, together with the fee paid by the sender. A send between two of your tracked accounts is shown as a transfer.
- Account detection now also checks Hyperliquid Core, both in the daily autodetection and when adding an address to all EVM chains. Before, only HyperEVM activity was checked, so accounts active only on Hyperliquid Core were not detected.
- When checking an address for activity on a chain fails due to a temporary error such as a rate limit or a timeout, only the failed checks are retried after an hour. Before, they were only checked again in the next daily detection.
- [#13329] Jupiter swaps from native SOL that fund the temporary wrapped SOL account in a single transfer no longer count the swapped SOL twice. Before, the funding transfer was kept as an extra SOL spend next to the swap.
- Forcing a download of the premium database backup no longer leaves a corrupted database that fails to open at the next login. Once a download starts it always ends by logging you out, also when it fails before the local database was replaced, for example when there is no backup on the server or it was made with a different password.
- Loading Ethereum withdrawals through Blockscout works again with Blockscout v12 instances. Before, the changed pagination of v12 made the withdrawals query fail.
- [#13285] Token transfers seen while the nodes could not be reached are no longer lost. Their transactions are left undecoded and decoded again automatically once the token details can be queried. Tokens that were saved with their identifier as name, because their details could not be queried, now get their details fetched again in the background. If the decimals turn out to be different, you are asked to redecode the token's transactions.
- Hyperliquid Core history is no longer cut off after the first page of entries, and all funding payments are now saved instead of just one. History is refetched once after upgrading to recover what was missing.
- NFTs of a collection with no floor price on OpenSea now show up in the NFT gallery and NFT balances. Before, every NFT of such a collection was skipped, and an account that only held such NFTs did not appear at all.
- Leveraged Curve crvUSD loans on markets with WETH collateral no longer fail to decode.
- [#13393] Premium backups now use stronger encryption. Upgrade every device that syncs: older versions cannot restore backups made by this version.
- [#13356] Redecoding Monerium or Gnosis Pay transactions while signed out now asks you to sign in, or to sign in again if your session expired, instead of showing a misleading missing API key warning. It is only shown when there are events that signing in would add details to.
- [#13278] Choosing Email in the Report an Issue dialog now opens your mail client in the desktop app. Before, the dialog closed without opening anything and the title and description you typed were lost. If an option cannot be opened, the dialog now stays open with your report and says so.
