Two months. That’s how long GnuPG 2.4 users have left before official support expires. Werner Koch announced the release of GnuPG 2.5.19 last Friday, and the message is clear: upgrade while you still can.

The headline: post-quantum cryptography arrives

The jump from 2.4 to 2.5 isn’t just window dressing. The most significant addition to the entire series is support for ML-KEM as a post-quantum encryption algorithm. ML-KEM, also known as Kyber, was standardized by the US NIST (FIPS-203) and is designed to withstand the computational power of quantum computers, which could theoretically render today’s encryption methods obsolete down the line. It’s not an immediate threat, but anyone handling sensitive long-term communications has solid reasons to care.

The developers note that the upcoming 2.6 series won’t differ much from 2.4 in terms of visible features. Most of the changes are internal, involving updated support libraries.

What’s actually in 2.5.19

Compared to the previous version, this release adds a few new options for GPG and improves pinentry behavior when working with smartcards. Among the bug fixes, one addresses RSA padding handling in SSH signatures, and another resolves an issue importing certificates from Deutsche Telekom. Nothing groundbreaking, but for encryption software, routine maintenance matters.

Source code and Windows packages are available at gnupg.org. Debian packages are in preparation and should arrive within a few days.