Age of Empires III: The Asian Dynasties full changelog

v1.3.1 is a minor release to restore version injection from downstream package build processes.

Post-quantum recipients:
age now has native post-quantum recipients based on HPKE with a hybrid ML-KEM-768 KEM. The recipients start with age1pq1..., and the identities start with AGE-SECRET-KEY-PQ-1
New I/O APIs:
The new DecryptReaderAt API implements seeking decryption, which can be used with zip.NewReader.
The new EncryptReader API implements pull-based encryption by wrapping an io.Reader, as opposed to wrapping an io.Writer like Encrypt.
age-inspect:
The new age-inspect(1) tool presents the metadata of an age file without decrypting it.
Built-in recipients compatible with hardware plugins:
age(1) now supports encrypting to age1tag1... and age1tagpq1... recipients, which are compatible with hardware plugins. The latest or upcoming versions of age-plugin-yubikey, age-plugin-tpm, and age-plugin-se will support producing these recipients for existing and new keys, and decrypting files encrypted to them.
The filippo.io/age/tag package provides an implementation, including a Recipient.Tag method useful to plugin implementations.
C2SP has the specification for these recipient types.
(For users that are using older age clients, there are compatiblity plugins that can be shipped along with the hardware plugins.)
Non-interactive passphrase input:
We have long resisted implementing non-interactive CLI passphrase input, because most use cases are more securely and/or efficiently served by native keys or passphrase-encrypted identities. However, there are some residual use cases.
This is now available through the batchpass plugin, but we invite everyone to read the warning in the man page and help text.
Go framework for implementing plugins:
The filippo.io/age/plugin package now provides a framework for exposing age.Recipient and age.Identity implementations as standalone CLI plugins.
Armor fixes:
The CLI now allows some leading whitespace before the armor header, as the API always did. The API and CLI now reject empty lines in armored data, as required by the spec.
Detached