SFTPPlus Release 6.0.0

SFTPPlus version 6.0.0 is now available. This major release introduces modernized clustering configurations, Web Manager interface enhancements, and critical security updates, alongside a streamlined architecture that removes obsolete legacy components.

Security Updates ​

• Core Libraries: The embedded Python version has been updated to 3.14.7, and the OpenSSL library has been updated to 4.0.1.
• Cryptography Modernization: SSL v3 is no longer supported. Additionally, generating Certificate Signing Requests (CSRs) or self-signed certificates using the obsolete SHA-1 algorithm has been disabled.
• Vault Permissions: The Web Manager API now strictly enforces vault-item read permissions when including an existing vault item's content during a pinned-key import.

New Features & Enhancements ​

• Cluster Pools: Cluster nodes are now configured in pools that share a name, password, and configuration. The Web Manager utilizes these pool names for cluster access. Existing cluster-nodes configurations are automatically migrated to cluster-pools.
• UI Themes: The Web Manager now includes light and dark theme controls, with the browser retaining your selected preference across sessions.

Important Deprecations, Changes, and Removals ​

As a major version release, version 6.0.0 includes structural changes and removes legacy support:

• Authentication Changes: The anonymous authentication method has been removed; an application account with a password is now required for file transfer access. The deny-username and ip-time-ban authentication methods are also removed, with their settings automatically migrated to the default security policy.
• Custom LDAP Extensions Removed: The Python API for extending LDAP authentication (including the bundled TOTP validation extension) is no longer supported. Authentication checks provided by these extensions must be replaced before upgrading.
• Linux Connectors Split: For Linux environments, the IBM MQ C client and Microsoft Purview SDK libraries are now distributed in a separate extra-connectors archive. Windows packages continue to bundle both connectors natively.
• API Structure Flattened: Service configurations returned by the Web Manager JSON-RPC API are now flat. Integrations must interact with protocol options directly on the service, without using the nested configuration object. Existing INI files remain unaffected.
• HTTP Endpoint Simplification: HTTP authentication methods and HTTP event handlers now accept only a single URL. Fallback URL support has been removed, and existing lists will be automatically migrated to use only their primary value.
• Event Handling Updates: The groups configuration option for event handlers has been renamed to event_groups to prevent confusion with account groups, and auto-migrates without impacting filtering behavior. The obsolete legacy-webadmin HTTP event format has been entirely removed.
• Internet Explorer 11: The Web Manager service no longer supports IE11. Users attempting to access the modern interface with IE11 will receive a warning directing them to SFTPPlus version 5 if the legacy browser is strictly required.

Upgrade Information ​

SFTPPlus 6.0.0 is available for download today.

For a complete list of changes, see the release notes here.