Release notes, system requirements, & downloads

On this page:

Araxis Merge 2026.1
Araxis Merge 2026.0

Previous releases:

Araxis Merge 2025
Pre-2025: Windows, macOS

Araxis Merge 2026.1 23 September 2026

This release features full support for macOS 27 Golden Gate. Merge for Windows now offers the same discoverable, fluid navigation through every change in every file of a folder comparison as Merge for macOS. The release also provides important security improvements, as well as many other enhancements and fixes. Please read the release notes below for a complete list of changes.

This is the current production-quality release that Araxis recommends for all users. In view of the security fixes present in this release, all users of older versions of Merge are encouraged to upgrade.

This release is available at no extra cost to all customers with upgrade/support entitlement covering the build date indicated in the download box below. This includes everyone who purchased Merge within the year prior to that date.

System requirements

This release is tested and supported on the following platforms:

The following platforms are supported and expected to work, though they are not routinely tested:

Enhancements

Changes

Defects fixed

Security advisories and improvements

Background

Security researcher Kelvin Winborne (grepStrength) responsibly disclosed a credential-storage weakness present in Merge for Windows 2026.0 and earlier versions, described in full below. Our subsequent thorough audit of how Merge stores and uses credentials uncovered several other problems, also described below. We thank grepStrength for his report, which prompted the wider audit.

Merge stored credentials to support the Perforce, Subversion, and Windows-only FTP file-system plugins. Taken together, the reported weakness and the further issues that our audit uncovered showed the credential store itself to be a risk. Few customers use the features that depend on it: the consultation on the removal of the Perforce and FTP plugins, run in the release notes from May 2023 until the plugins were deprecated in 2024, drew very few responses, and we receive almost no support requests about file-system plugins. Weighing the risk of retaining the credential store against the loss of these features, we decided to remove it entirely from Merge 2026.1, together with the three plugins that used it. We have also mitigated the risk to credentials stored by earlier versions. We apologize for the inconvenience caused to users of the removed plugins.

These removals do not affect the use of Merge as an external comparison and merge tool for Perforce and Subversion clients, which remains fully supported. The Git and Mercurial file-system plugins operate only on local repositories and use no stored credentials. They are therefore retained, and Merge-SA-26-05 describes the hardening that they received.

Solution

Rotate credentials and upgrade Araxis Merge:

  1. Immediately rotate any FTP, Perforce, Subversion, or Visual SourceSafe credentials ever used with any version of Araxis Merge.
  2. Upgrade to Merge 2026.1 or later.
  3. Run the newly upgraded version of Merge in each user account that has used Merge.
  4. Exit Merge normally. This completes the removal of credentials stored by earlier versions.

Merge 2026.1 removes stored credentials only in the user accounts in which it runs. It cannot reach backups, system images, or profiles that never run it. Rotation of the credentials is therefore the only certain remedy.

Review the access logs of the servers concerned if you suspect that credentials used with Merge have been compromised. Stored credentials could have been used through Merge, as well as recovered from it.

Workaround

Users unable or not wishing to upgrade should:

  1. Immediately rotate any FTP, Perforce, Subversion, or Visual SourceSafe credentials ever used with any version of Araxis Merge.
  2. Open Araxis Merge.
  3. Windows Remove all credentials configured on the OptionsApplicationCredentials page. On the OptionsApplicationMaintenance page, click Clear history lists.
  4. macOS Remove all credentials configured on the SettingsApplicationCredentials page. Then, in a text, folder, binary, and image comparison in turn, click the Show history button beside an entry field and click Clear History.
  5. Exit Merge normally.
  6. Reopen Merge and confirm that the Credentials page is empty.
  7. Repeat steps 2 to 6 in each user account that has used Merge.
  8. Refrain from using the FTP, Perforce, and Subversion plugins. Do not open a Git or Mercurial URI or revision from an untrusted source. Do not put passwords in URIs.

Vulnerability: Stored credentials could be recovered by other processes running as the user (Merge-SA-26-00)

Affects

Windows Merge 2011.4074–2026.0
Corrected in

Merge 2026.1
Reported by

Kelvin Winborne (grepStrength)
grepStrength Security LLC
CVE ID

CVE-2026-92680
Description

Merge for Windows was able to store server credentials for use by some of its file-system plugins. Merge wrote these credentials as a binary object (blob) to the Windows registry. By design, the blob was protected by the user-scope Windows Data Protection API (DPAPI) using a NULL pOptionalEntropy parameter. Microsoft documents a NULL entropy value as a supported DPAPI mode. Using this mode provides no additional entropy or application-specific boundary, but any entropy constant compiled into Merge would have provided obscurity rather than a security boundary. The NULL entropy value thus shows only which boundary protects the store: the Windows user account. It is not a defect in itself.

As a consequence of its use of the DPAPI to protect its credential store without employing additional security measures, Merge relied upon the standard Windows user-scope security boundary. This boundary does not prevent other unsandboxed processes running with the same user permissions as Merge from accessing the stored credentials.
Impact

Users who have never stored credentials in Merge for Windows and who have never used the FTP, Perforce, Subversion, or Visual SourceSafe file-system plugins are unaffected.

Ordinary unsandboxed code running as the Windows user who stored the credentials could recover any FTP, Perforce, Subversion, or (in versions before 2014.4531) Visual SourceSafe credentials stored by affected versions of Merge, without administrator rights, user interaction, or any Merge-specific secret material.

Every non-deprecated use of the user-scope Windows DPAPI or of a generic Windows Credential Manager entry to store a reusable secret without additional protection has the same fundamental limitation: neither mechanism provides application-to-application isolation between unsandboxed processes running as the same user. That is the standard security boundary that these Windows generic-secret APIs provide to ordinary unsandboxed desktop software. For example, Git Credential Manager documents that its default Windows store uses Windows Credential Manager entries and that an alternative Windows store uses DPAPI. Its source shows that the default store writes generic (CRED_TYPE_GENERIC) entries. Its source also shows that the DPAPI store passes a null entropy value, as affected versions of Merge did. These two stores thus rest on the user-account boundary that protected the Merge store. The one DPAPI mode that asks the user for consent on each use is deprecated by Microsoft and scheduled for removal in February 2027. We therefore regard the underlying problem as reliance on a user-scope boundary that the product documentation did not describe.
Solution

See above
Workaround

See above
Correction details

The credential store existed on the two platforms, and the changes below apply to both. This vulnerability affected Windows only: on macOS, the keychain protected the stored credentials from other applications. The store was removed on macOS for the reasons given in the Background and in Merge-SA-26-04.

  1. The credential store has been removed. As described above, Merge 2026.1 removes the credential store in its entirety, along with its supporting infrastructure. Merge no longer maintains its own server credential store on either Windows or macOS. Removing the store eliminates the path by which stored credentials could be recovered.
  2. The credential-using file-system plugins have been removed. The Perforce, Subversion, and FTP file-system plugins that relied on the credential store have been removed, as described in the changes section above. The Visual SourceSafe plugin, which also used the store, was removed in Merge for Windows 2014.4531. However, credentials previously stored for it were not removed until now.
  3. Any legacy credential store on Windows is deleted. On every launch, Merge for Windows 2026.1 and later delete the REG_BINARY value Passwords and the Merge7.FTPFS subtree from both HKEY_CURRENT_USER\Software\Araxis\Merge\7.0 and HKEY_CURRENT_USER\Software\Araxis\Merge\7.1, if present, even if the value is corrupt or cannot be decrypted. Repeated cleanup is necessary because a user could run an older, unremediated version of Merge that recreates the credential store.
  4. Any legacy credential store on macOS is deleted. On every launch and before every registration save, Merge for macOS 2026.1 and later remove the passwords member from its keychain item.

Vulnerability: Perforce and Subversion plugins supplied an authentication secret on the child-process command line (Merge-SA-26-01)

Affects

Windows Merge v6.5.1661–2026.0
macOS Merge 2007.3198–2026.0
Corrected in

Merge 2026.1
Reported by

Araxis engineering staff
Description

When the Perforce file-system plugin invoked the Perforce p4 command, it passed a password or Perforce ticket as a command-line argument with p4 -P. Likewise, the Subversion file-system plugin passed a password as a command-line argument to the Subversion svn command with svn --password.
Impact

Users who have never used the Perforce or Subversion file-system plugins are unaffected.

A process permitted by the operating system to read the p4 or svn process command-line arguments could capture secrets while the process ran. Secret-containing command lines could also be recorded by auditing and endpoint-protection tools. A captured Perforce ticket was reusable only while it remained valid and within its server-enforced scope.
Solution

See above
Workaround

See above
Correction details

The Perforce and Subversion file-system plugins have been removed.

Vulnerability: Perforce authentication secrets could be recorded in macOS system logs (Merge-SA-26-02)

Affects

macOS Merge 2014.4581–2026.0
Corrected in

Merge 2026.1
Reported by

Araxis engineering staff
Description

The macOS Perforce file-system plugin logged all its arguments to the macOS system log using NSLog, including the Perforce password or ticket.
Impact

Users who have never used the Perforce file-system plugin are unaffected.

On macOS releases before macOS 26, an administrator, a privileged management agent, or a recipient of a diagnostic log archive could recover the password or ticket from the system logs without keychain approval. From macOS 26 onwards, the system log replaces the variable content of such messages, which includes the password or ticket, with <private> by default. This reduces that exposure. If Merge itself was started from a terminal, or with its standard error redirected, the same text also appeared there, unredacted, on every macOS release. We regard any logging of a credential as a defect.
Solution

See above
Workaround

See above
Correction details

The Perforce file-system plugin has been removed.

Vulnerability: Credentials provided in file and folder URIs could be stored insecurely (Merge-SA-26-03)

Affects

Windows Merge v6.5.1491–2026.0
macOS Merge 2007.3160–2026.0
Corrected in

Merge 2026.1
Reported by

Araxis engineering staff
Description

Merge accepted passwords embedded in file and folder URIs used by its file-system plugins. For example, the Perforce file-system plugin accepted URIs such as p4://user:password@host:1666/depot/notepad/notepad.cpp, where password is a secret authentication credential.

File, folder, binary, and image comparison histories stored such URIs verbatim. The same URIs could enter saved comparisons or diagnostic material on both platforms, and, on Windows, saved workspaces and options files. All of these stores recorded the unredacted URIs in plain form.

On macOS, if execution failed, the compare command-line tool also used NSLog to log the complete generated AppleScript with which it invoked the Merge application.
Impact

Users who have never used a credential-bearing URI with Merge are unaffected. Many potential uses of such URIs were better served by the use of stored credentials or the placeholder scheme://user:*@server/path syntax that caused Merge to prompt for a password. Consequently, few users are likely to have been affected by this vulnerability.

A password or access token provided to Merge in a file or folder scheme://user:password@server/path URI could be stored or displayed in unredacted, unsecured form in comparison histories, user-created files, error messages, or, on macOS, the diagnostic output of the compare command-line tool. Anyone with access to the stored data could extract the credentials.

On macOS releases before macOS 26, an administrator, a privileged management agent, or a recipient of a diagnostic log archive could recover a password or token from the entries that the compare command-line tool wrote to the system log when a comparison failed. From macOS 26 onwards, the system log replaces the variable content of such messages, which includes the URI, with <private> by default. This reduces that exposure. On all macOS releases, NSLog also writes the same text, unredacted, to standard error when the tool runs in a terminal or its output is captured. We regard any logging of a credential as a defect.
Solution

See above
Workaround

See above
Correction details
  1. At every entry point, Merge replaces the user-information part of a URI – the user:password@ or user@ before the host – with ***. The URI then fails to load, because the remaining file-system plugins do not accept credentials in URIs.
  2. On macOS, the compare command-line tool no longer logs its AppleScript when execution fails.
  3. Every time Merge starts, it applies the same replacement to the file, folder, binary, and image comparison histories.
  4. Merge applies the same replacement to the paths in saved comparisons and, on Windows, workspaces when it loads them. Comparison histories are no longer included in saved comparisons, workspaces, or options files, and Merge ignores any history in an options file from an earlier version.

Vulnerability: Code running as the user could use Merge as a proxy to access remote servers (Merge-SA-26-04)

Affects

Windows Merge 2011.4074–2026.0
macOS Merge 2011.4026–2026.0
Corrected in

Merge 2026.1
Reported by

Araxis engineering staff
Description

Merge was able to store server credentials for use by some of its file-system plugins. Those credentials were protected by the Windows DPAPI on Windows and by the keychain on macOS. However, any application able to control Merge (through the command line, the Windows Automation API, AppleScript, or accessibility features that simulate user input) could use Merge as a proxy to access files on remote servers using those stored credentials. On macOS, each of these paths needs a permission that the user grants once. On Windows, no such permission is needed.
Impact

Users who have never stored credentials in Merge are unaffected.

An attacker able to run code as the user could gain read access to whatever the stored credentials could read, and, on Windows, write access through FTP saves. This did not require recovering the credentials themselves, which is why it applied on macOS as well.
Solution

See above
Workaround

See above
Correction details
  1. The credential store has been removed entirely. Merge thus holds no credentials of its own that an attacker could use to reach remote servers.
  2. The Perforce, FTP, and Subversion file-system plugins that could access remote servers have been removed.

Vulnerability: Potential argument injection for commands invoked by file-system plugins (Merge-SA-26-05)

Affects

Windows macOS Potentially all versions before Merge 2026.1. No exploit has been demonstrated.
Corrected in

Merge 2026.1
Reported by

Araxis engineering staff
Description

On Windows, the Perforce, Subversion, Git, and Mercurial file-system plugins built a single command-line string to invoke the native p4, svn, git, and hg tools. A quotation mark " inside a file or folder path was not escaped in that string. Although a Windows filename cannot contain that character, a manually entered, restored, or script-supplied URI or revision value could contain one.

On both Windows and macOS, the Perforce, Subversion, Git, and Mercurial commands invoked by their respective file-system plugins were passed path arguments without specifically marking the end of native options to those commands. For Perforce and Subversion this had little practical consequence, because every path argument began with // or a URI scheme. Mercurial was also passed the revision as a separate value after -r, so a revision value that began with a hyphen could have been read as an option.
Impact

Users who have never used the Perforce, Subversion, Git, or Mercurial file-system plugins are unaffected.

On Windows, it is conceivable that a specially crafted path might terminate a quoted argument and add options to the invocation of the native tools used by the file-system plugins. On either platform, a path or revision beginning with - might be interpreted as an option by the native tool.

These are unconfirmed, potential vulnerabilities, and we have not proven the feasibility of an exploit.
Solution

Upgrade to Merge 2026.1 or later.
Workaround

Turn off Show file versions from SCM systems (Windows) or Include versions from SCM systems (macOS), and do not open a Git or Mercurial URI or revision from an untrusted source.
Correction details
  1. The Perforce and Subversion file-system plugins have been removed.
  2. The retained Git and Mercurial file-system plugins have been hardened. On Windows, they no longer build a single command-line string. They pass an argument list that a tested encoder serializes at the process boundary, so a quotation mark in a path reaches the native tool as part of one literal argument. On both platforms, before any process starts, they reject a revision that begins with - (Git) or that contains a control character, and a git:// or hg:// URI whose path is not an absolute local path. They also explicitly signal the end of native options when invoking the native git and hg commands, and they run hg in plain mode with strict flag parsing.
  3. When the Show file versions from SCM systems (Windows) or Include versions from SCM systems (macOS) setting is on, Merge now looks up the available versions of the path in an entry field only when the path is committed: when the user presses Enter, selects an item from the history or the versions list, or moves the keyboard focus out of the field. Earlier versions of Merge queried on every text change. This ensures that no partial URI ever reaches the git or hg commands.

Vulnerability: Potential AppleScript source injection in the macOS command-line tool and Merge extension for Finder (Merge-SA-26-06)

Affects

macOS Potentially all versions before Merge 2026.1. No exploit has been demonstrated.
Corrected in

Merge 2026.1
Reported by

Araxis engineering staff
Description

The compare command-line tool and the deprecated Merge extension for Finder built AppleScript source text and executed it to control Merge. Each input or output URI or path was placed into the AppleScript as a quoted string, without escaping " or \ characters. A carefully crafted path or URI could be constructed so that attacker-controlled text is executed as AppleScript source.
Impact

A crafted file or folder path or URI in, for example, a checkout, an archive, or a shared folder, could cause the compare command-line tool or the Merge extension for Finder to run arbitrary AppleScript, including do shell script. The AppleScript would run when the user compared such an item with that tool or extension, before Merge itself was involved. The AppleScript would be run with the user’s own permissions.

The command-line tool is unsandboxed. The Merge extension for Finder runs in the macOS App Sandbox, which constrains what an injected script could do from there.

A successful injection attack remains unconfirmed.
Solution

Upgrade to Merge 2026.1 or later.
Workaround
  1. Use the Merge services for macOS instead of the Merge extension for Finder.
  2. The compare command-line tool is often invoked by third-party tools, so its paths are not always under your control. The only precaution is to avoid comparing files or folders from untrusted sources whose paths contain a quotation mark or a backslash.
Correction details
  1. The Merge extension for Finder has been removed. It was already deprecated in favour of the Merge services for macOS.
  2. On macOS, the compare command-line tool escapes every path or URI that it places in AppleScript source.

Software bill of materials

Download

Version Build date
2026.1 22 September 2026

Araxis Merge 2026.0 19 June 2026

This release features a beautiful UI redesign for macOS and first-class support for macOS 26 Tahoe. The macOS 27 Golden Gate Developer Beta 1 also receives preliminary support. The presentation of comparison results on macOS is significantly enhanced, making it easier than ever to see and understand changes in their full context. Various other improvements and fixes for Windows and macOS are also included. Please read the release notes below for a complete list of changes.

We plan to bring many of the macOS UI refinements from this release to Merge for Windows in future versions.

This is no longer the current release. All users are encouraged to upgrade to the most recent release for the latest enhancements, bug fixes, and security improvements.

This release is available at no extra cost to all customers with upgrade/support entitlement covering the build date indicated in the download box below. This includes everyone who purchased Merge within the year prior to that date.

System requirements

Merge 2026.0 appears to be fully functional on macOS 27 Golden Gate Developer Beta 1, though macOS Golden Gate is not yet a fully supported platform. We are working to provide complete support for macOS Golden Gate following its general availability.

This release is tested and supported on the following platforms:

The following platforms are supported and expected to work, though they are not routinely tested:

Enhancements

Changes

Defects fixed

Software bill of materials

Download

Version Build date
2026.0 19 June 2026