Notepad++ v8.8.3 Release Candidate

donho

There were - and still are - many false positives reported in the v8.8.2 binaries by the antivirus software. To prevent this issue from recurring in future releases, this version is signed with a certificate issued by a self-signed Certificate Authority (CA). The root certificate (i.e., the CA in question) will be published on the Notepad++ website & GitHub repository, allowing antivirus vendors and users to verify the authencity of each release.

There should be no regressions in this release. It will be published as soon as I finish writting the release notes, explaining the new self-signed certificate and creating a guide on installation the Notepad++ root certificate. The process may take arround 2 days.

For those who want to install Notepad++ root certificate in his PC, here is the certificate:
http://download.notepad-plus-plus.org/repository/MISC/xca/Notepad_plus_plus_Root_Certificat.crt
It will be great If you can also provide the guide ;)

Notepad++ 8.8.3 RC is available here:
~~http://download.notepad-plus-plus.org/repository/8.x/8.8.3.RC/~~
http://download.notepad-plus-plus.org/repository/8.x/8.8.3.RC2/

Notepad++ v8.8.3 security-fixes & new enhancement:

Use self-signed certificate to sign new release binaries. (Implement commit)
Fix uninstaller security issue (CVE-2025-49144). (Fix #16787)
Enhance security for DLL loading. (Fix #13964)

Notepad++ v8.8.2 regression-fixes, bug-fixes & new features:

Fix regression of folding state not being remembered through sessions. (Fix #16597, #16670)
Fix “Go To Settings” links in Style Configurator regression (from v8.8). (Fix #16592)
Fix small regression of tab background (hovered) highlighting issue after drag&drop. (Fix #16559)
Fix an unresponsive (hang) issue due to hide lines. (Fix #16316)
Fix installer security issue by using the absolute path instead of an unspecified path (CVE-2025-49144). (commit, fix report on GitHub, fix #16744)
Installer component “WinGUp”: update cURL to 8.13.0 for fixing cURL’s security issue CVE-2025-0167. (Fix #16531, #16515)
Update to scintilla 5.5.7 & Lexilla 5.4.5. (Implement #16649)
Add feature to update Notepad++ on exit. (Fix #16601, #13749, #10317, #8495, #8457, #3755)
Add “/relaunchNppAfterSilentInstall” command argument for installer. (Fix #issue)
Add feature to set read-only attribute on file so user can toggle (set/remove) read-only attribute of a file. (Fix #326, #4594, #6216, #7841, #12520, #15571, #16603)
Add new plugin API: NPPM_GETTOOLBARICONSETMODE & NPPN_TOOLBARICONSETCHANGED to get toolbar icon set choice. (Fix #16547, #16646)
Deprecate 3 APIs: Deprecate NPPM_GETOPENFILENAMES, NPPM_GETOPENFILENAMESPRIMARY & NPPM_GETOPENFILENAMESSECOND. (Fix #15997)
Add new feature of using first line of untitled document for its tab name. (Fix #3994, #16584)
Enhance NPPM_DARKMODESUBCLASSANDTHEME: Enable darkmode progress bar for plugins. (Fix #16675)
Various dark mode enhancements. (Fix #16668, #16674, #16560, #16537, #issue)
Fix right click on caption bar unhidding main menu. (Fix #16652)
Fix rename tab error message when tab name is unchanged. (Fix #16661)
Fix Python FunctionList absorbing next function issue if space after colon. (Fix #16636)
Remove .log from errorlist lexer’s default extensions. (Fix #16627)
Make raw string syntax highlighting work for Golang. (Fix #16609)
Fix Notepad++ tray icon lost after Windows Taskbar crashing & being relaunched. (Fix #16588)
Fix changing toolbar icon set not updating to matching panel icon set. (Fix #16595)
Fix Windows dialog file list not react with keystroke (character match). (Fix #2239)
Add “*” mark on modified file entries in “Windows” dropdown menu. (Fix #16542)

PeterJones

@donho said in Notepad++ v8.8.3 Release Candidate:

this version is signed with a certificate issued by a self-signed Certificate Authority (CA).

Hmm… I am not seeing the installer or executable be signed.

I downloaded the http://download.notepad-plus-plus.org/repository/8.x/8.8.3.RC/npp.8.8.3.Installer.x64.exe
- right click, Properties, Digital Signatures, and it’s showing none. (Whereas when I look at the npp.8.8.1.Installer.x64.exe, I see the digital signature on that one)
- try running the installer, and Windows complains about unknown publisher (just like it did for the npp.8.8.2.Installer.x64.exe, which was unsigned)
I downloaded the portable http://download.notepad-plus-plus.org/repository/8.x/8.8.3.RC/npp.8.8.3.portable.x64.zip
- unzip the notepad++.exe from there
- right click, Properties, Digital Signatures, and it’s showing no signatures as well.

I thought maybe it was because I didn’t have your CA certificate yet, so I installed that, then tried the above again: both of those still show as unsigned.

So I don’t know if I’ve done something wrong, or if you accidentally uploaded the unsigned copies…

here is the certificate: http://download.notepad-plus-plus.org …

Word of warning: that’s a non-HTTPS URL. It would really behoove you to publish the certificate on a site where HTTPS is available – maybe on your main https://notepad-plus-plus.org site instead. Without that, there can be no confidence that there isn’t a man-in-the-middle attack, injecting a false certificate; without an https URL, it is doubtful whether antivirus vendors would ever trust your CA certificate, or any signing-certificate generated from that CA.

It will be great If you can also provide the guide ;)

This much, I got working:

Caveat emptor: Only follow these instructions if you trust the download path between the server and your computer, and if you trust software or certificates that @donho has signed

Download the .crt file
- If I click on the link, it just opens the about:blank tab – I think my browser might be trying to protect me from unexpected certificates
- Instead, right click on the link and Save As. Your browser may protect you: if it pops up something saying it’s unsafe, you can click Keep (that’s what Chrome says, anyway; use whatever your browser’s nomenclature is). (I think that an https:// URL might have avoided that extra rigmarole)
Open the certificate: double-click, or right-click > Open
- if Windows is confused on your machine, you might have to Open With and choose “Crypto Shell Extensions”
Once it’s open
- The Certification Path tab will say it’s untrusted at this point
- On the main General tab, click Install Certificate
- ick “Current User”, NEXT
- don’t pick “Automatically select…” because it will default to “Intermediate Certification Authorities”, which isn’t sufficient for a self-signed
- pick “Place all certificates in the following store”, and Browse to Trusted Root Certification Authorities, NEXT
- FINISH
- There will be a warning, because you are putting it in Trusted Root CA. Make sure you understand the implications of moving forward with YES.
- “The import was successful”: OK
If you close the Certificate, then open it again, the General tab shows the certificate’s purpose, and the Certification Path will show it’s trusted.
If you ever want to remove that Trusted Root CA certificate (for example, if you stop trusting Don’s signature, or he is able to get a public CA to behave reasonably toward open source developers)
- Win+R to bring up Run dialog, and run certmgr.msc
- Navigate to Trusted Root Certification Authorities > Certificates
- Scroll down until you find “Notepad++ Root Certificate”, and right click on it, then Delete and Yes

donho

@PeterJones said in Notepad++ v8.8.3 Release Candidate:

Hmm… I am not seeing the installer or executable be signed.

Sorry about that - I have disabled code signing for the build package while testing PR #16787 and verify the functionality of the unstaller. I forgot to re-enabke signing after merging PR #16787.
After building RC1, instead of checking for the certificate in the binaries (which I have already done several times), I focused only 2 commands: “Update Notepad++” & “Plugins Admin…” - since without signature on gup.exe & nppPluginList.dll, these command don’t work. However, both of these files were signed before the latest RC1 build.
Not trying to make excuses, just clarify the context.

RC2 is available here: http://download.notepad-plus-plus.org/repository/8.x/8.8.3.RC2/

Word of warning: that’s a non-HTTPS URL. It would really behoove you to publish the certificate on a site where HTTPS is available – maybe on your main https://notepad-plus-plus.org site instead. Without that, there can be no confidence that there isn’t a man-in-the-middle attack, injecting a false certificate; without an https URL, it is doubtful whether antivirus vendors would ever trust your CA certificate, or any signing-certificate generated from that CA.

X509 Notepad++ Root Certificate will be published here:
https://notepad-plus-plus.org/notepadroot.crt

BTW, I should make https work, I know - it’s on my TODO list.

This much, I got working:

Thank you! It deserves also in npp-user-manual.org - what do you think?

PeterJones

BTW, I should make https work, I know - it’s on my TODO list.

Good idea. :-)

Thank you! It deserves also in npp-user-manual.org - what do you think?

Yes, makes sense. I am adding those instructions (cleaned up) to the Getting Started page.

X509 Notepad++ Root Certificate will be published here:
https://notepad-plus-plus.org/notepadroot.crt

Let me know once it’s available at that URL, and I’ll push the new instructions to the Manual website.

mkupper

@PeterJones and others - Is the self-signed root cert going to be the permanent fix? It seems a lot of work being put into this by you and others.

I have hoped that Notepad++ will soon get signed again via a normal CA.

Related to that is will the https certificate for https://download.notepad-plus-plus.org/ will get renewed? It expired five years ago on Sat, 22 Feb 2020 19:46:00 GMT.

PeterJones

Related to that is will the https certificate for https://download.notepad-plus-plus.org/ will get renewed? It expired five years ago on Sat, 22 Feb 2020 19:46:00 GMT.

Considering @donho said above, “BTW, I should make https work, I know - it’s on my TODO list.”, I can confidentally conclude that the goal is to get it renewed. ;-)

Is the self-signed root cert going to be the permanent fix?

My guess is that’s currently unknowable. It presumably depends on how long beaurocracy fights Don vs how much effort he is willing to expend.

Given the number of complaints since v8.8.2, I think it’s worth the effort (at least, my tiny side of the effort) until such time as a different CA can be used: even if it’s only 1 version down the road (so a month later), saving that month of signed-installer posts will be worth it to me. :-)