BleachBit 6.0.4

Submitted by andrew on

BleachBit 6.0.4 is a maintenance release with massive security, bug fixes, performance improvements, code cleanup, and four new cleaners. Support for FreeBSD and macOS is maturing for use by a general audience: check back soon for an Apple Disk Image (.dmg) file.

By the way, did you know that BleachBit will soon be 18 years old? Thank you to the community of developers, translators, testers, bug reports, and users!

Upgrade now

Highlights of enhancements and features:

  • Add cleaners for Android Studio, Gradle Cache, fish, Zsh shell, and Python command line
  • Delete top-level log files for Claude
  • Delete dynamic HSTS data to delete supercookies
  • Improve startup speed and scanning speed
  • Shrink the Windows installer and installation footprint
  • Add early support for macOS: new Safari cleaner, compatibility with existing cleaners (such as Google Chrome and Firefox), full CLI support, and early GUI support

Changes since version 6.0.2

Release stats

This release includes 462 commits changing 248 files. Special thanks to XhmikosR, who carried a heavy workload with 249 commits across 229 files, driving security improvements, bug fixes, and code cleanup. Thank you to trhuxtonr for help maturing support for macOS. Thank you for code contributions from NeoCode, ugbotueferhire, Phoenix0531-sudo, Lucas, JokeGbenro, and Balló György.

For brevity, not all 462 commits are covered below, and to accomodate this bulky release, this page introduces a new detail-summary system: click the arrows to show more details.

All Platforms

This release makes BleachBit faster, safer, and more reliable, with new cleaners for Python, Claude Android Studio, and Gradle; improved cleaning for Claude and browser data; and fixes for crashes, data-loss risks, and startup issues.
  • Remember zoom level
  • Fix: when using F11 to toggle full screen, the opposite state was restored on next startup
  • Delete top-level log files in the Claude cleaner
  • Add cleaner for Python command history
  • Delete dynamic HSTS data in six Chromium-based browsers and Zen (Firefox-based) to delete supercookies
  • Add cleaner for Android Studio and Gradle cache
  • Fix cleaners sometimes missing files when the auto-hide feature scanned the same folder at startup
  • Add support for filtering options by operating system in CleanerML files.
  • Improve error handling and error reporting with SQLite operations
  • Improve scanning and startup performance by avoiding redundant directory metadata checks
  • Improve speed during scanning when no keep-list is configured by skipping per-file link checks
  • Improve speed by indexing cleaner actions by option
  • Avoid initializing GTK, which opens a socket, when using CLI, TUI, or wxWidgets
  • Refuse to shred the working directory or its parent directory when shredding arbitrary files, preventing accidental data loss from a path that collapses to the current directory (such as an empty string, `.`, or `..`)
  • Fix dark-background detection misidentifying some GTK themes as dark
  • Fixed the Mozilla Firefox favicons cleaner, which could fail or incorrectly identify favicons to keep.
  • Improve speed of the keep list (whitelist)
  • Fix GTK crash from logging on worker threads
  • Skip junctions and symlinks in deep scan
  • Fix the update dialog opening the wrong version's URL, when two updates (both stable and beta) were available
  • Remove dependency on the chardet package. Reduced the size of library.zip (on Windows) by 161,547 bytes and 48 files. May have slightly improved startup speed on Windows.
  • Shrink Windows builds using advzip recompression
  • Improve scanning speed by combining the keep list (whitelist) into a single match and avoiding repeated work when building commands
  • Improve startup speed by deferring heavy imports
  • Prevent crash in case of deeply nested directory tree
  • Improve robustness in case of permission error while scanning a directory
  • Cache sorted cleaner option keys instead of re-sorting each call
  • Drop redundant path normalization in children_in_directory
  • Improve speed by eliminating redundant compilation of regular expressions
  • Fix race condition where a setting change could be saved to disk in an inconsistent state
  • Skip malformed file URIs that could cause accidental data loss when shredding files from the clipboard
  • Fix crash in desktop notifications caused by importing importlib instead of importlib.util before calling importlib.util.find_spec
  • Warn instead of crashing on an invalid wildcard cleaner, on CLI with foo.*
  • Batch Chrome bookmark id lookups into chunked queries to improve cleaning speed
  • Use a set for mozilla favicon bookmark domain lookup
  • Defer path join past deep-scan filename filters
  • Iterate CleanerML elements without a throwaway list()
  • Use frozensets for Options boolean_keys and int_keys
  • Build cleaner tree without re-sorting options twice
  • Drop redundant comparisons in logical_ranges_to_extents and write_zero_fill
  • Restrict URLs opening in web browser to http/https for security
  • Improve speed by returning cache value the setter just stored
  • Shrink the size of the file bleachbit.png
  • Shrink the sizes of many .png files in the Windows 10 theme
  • Scan the locale directory once per preferences dialog to improve speed
  • Parse update-check XML as bytes so DTD rejection applies to documents with an encoding declaration
  • Update coverage, requests, and certifi dependencies
  • Skip files that vanish between scan and size measurement, instead of aborting
  • Skip cleaner XML files that disappear during startup, avoiding startup abort
  • Fix race condition where a configuration change could be lost if settings were reloaded from disk at the same time
  • Update requests to 2.33.0
  • Add defensive check for GTK typelib directory
  • Fix crash in SQLite error handler (Python 3 exceptions have no .message attribute) and when handling very short file URIs
  • Add defensive checks to prevent crash in csae of two delayed cleanup operations with same priority level
  • Add defensive checks for parsing XMLs with update information
  • Fix parsing of same_user attribute in CleanerML files
  • Fix bug causing some cleaning operations to run twice, causing redundant work
  • Hoist bytes_to_human prefix lists to module constants
  • Drop executable bit from assets and menu.ui
  • Use vanilla RawConfigParser.write in clean_ini: uses less code
  • Close devnull descriptor after redirecting stdout on BrokenPipeError
  • Initialize locals before conditional assignment
  • fnmatch_translate: fix compatibility with Python 3.14
  • Fix crash in the debug log handler when an empty message is written, and append the full buffered text instead of just the last fragment
  • Improve randomness in generating filenames when wiping
  • Narrow the scope of the .angular deepscan cleaner
  • Verify checksum of downloaded chaff models for security
  • Harden SQLite/URI construction in Special.py against injection
  • Do not follow symlinks anywhere in wipe_write()/wipe_contents()
  • Reject DTDs across all XML parsing entry points
  • Reject reparse points when truncating files
  • Block process and winreg actions from untrusted cleaners
  • Improve clarify of message when SQLite3 database cannot be opened, like when blocked by Norton browser data protection
  • Sort bleachbit.ini and write all default preferences
  • Log or narrow exceptions instead of swallowing them
  • Assign the fallback in the handler instead of before the try
  • Support suffix PB for petabytes
  • Do not let an action without a deep scan hide later deep scans

Windows

Access to the application menu moved from the application icon on left side to hamburger menu on right side. Windows users get faster and more reliable cleaning, corrected secure wiping, improved network-path and notification support, stronger security protections, a smaller installer, and a smaller installed footprint.
  • Move the menu from application icon on left side to hamburger on right side (now consistent with Linux)
  • Use absolute paths for ipconfig and taskkill to prevent binary-planting attack via executable search path
  • Fix secure file wiping skipping some clusters that should have been overwritten
  • Fix secure file wiping not fully overwriting fragmented files
  • Migrate Windows CI builds from ci.bleachbit.org to download.bleachbit.org/ci/ to consolidate on one subdomain. The new Windows CI download page has many enhancements such as filtering by branch and one-click to copy checksums.
  • Fix failure to start application from UNC (network) paths
  • Preserve the root of folders for temporary files
  • Fix: toast notification was broken
  • Fix cleaning of folder shortcuts (junctions) and directory symlinks being skipped when the target folder contained files
  • Fix pathnames in amule, Adobe Flash, Vuze, VLC, so they clean more files
  • Fix: crash reports were not found in Pale Moon on Windows
  • Fixed winapp2.ini ExcludeKey with the *.* pattern, which should exclude the whole folder but was not working. The normal Winapp2.ini file does not contain this pattern, so the bug does not normally affect users.
  • Update framework, including new versions of Python and GTK. Reduce the size of GTK by disabling unused code.
  • When cleaning system.tmp, preserve new GLib D-Bus nonce files to not allow multiple instances of the application to be open.
  • Improve speed of importing Winapp2.ini cleaners
  • Speed up the keep list (whitelist) by avoiding repeated lookups of the Windows temporary directory
  • Call match directly on precompiled winapp2 regexes
  • Remember the Windows version to avoid repeated lookups
  • Hoist loop invariants in winapp2.ini parsing
  • Skip the unused world-writable stat on Windows
  • Improve efficiency in detecting file encoding
  • Handle interrupted console output
  • Refuse wiping a file through symlink for security
  • Remove 89 icon and theme files, reducing the size of the Windows installer by 56 KB.
  • Shrink .svg files using SVGO
  • Clean Windows clipboard in TUI or wx GUI without requiring GTK
  • Write the GTK error report to a unique temporary file
  • Skip unknown winapp2 options instead of aborting the section
  • Ensure that file wiping releases system resources in case of error
  • Cap the wildcard count in winapp2.ini glob patterns for ReDoS (regex denial-of-service) defense
  • Use subprocess.list2cmdline for UAC argument encoding
  • Reject all insecure winapp2 and update-check URLs
  • Harden Windows DLL search path against preloading attacks
  • Fix missing icon in preferences dialog
  • Use Python's native isjunction function
  • Detect encoding for Winapp2.ini (not needed for automatic downloads)
  • Soften the error about potential permission issue with configuration file
  • Fix: do not shown an error message when the SID owning the configuration file cannot be resolved to an account name

POSIX

POSIX users get new Fish and Zsh cleaners, more reliable clipboard shredding, better handling of missing files and tools, and stronger protections for symlinks, permissions, subprocesses, and downloaded data.
  • Add cleaner for fish shell
  • Add cleaner for Zsh shell
  • Gracefully handle missing sqlite3: show message instead of crashing on startup
  • Fix UnicodeDecodeError reading clipboard target names when shredding files from clipboard
  • Fix shredding files from the clipboard, which failed to detect files in some cases
  • Handle spaces in process names, like for Google Chrome, from /proc and ps aux on POSIX systems without psutil installed
  • Improve performance of open-files cache
  • Refuse writing LibreOffice/OpenOffice configuration file through a symlink for security
  • Create download directories with 0o700 permissions for security
  • Warn when the shred drive is world-writable because wiping there is unsafe
  • Refuse to delete system-critical POSIX paths (/, /proc, /sys, /run) even with an empty keep list
  • Drop LD_LIBRARY_PATH from the environment kept for external commands for security
  • Fix error when file disappears when cleaning system temporary files
  • Suppress asyncio deprecation warnings with Python 3.14
  • Add defensive check to prevent crash when the LOGNAME environment variable contains digit-like Unicode characters that are not valid decimal numbers
  • Fall back to PATH when a POSIX tool is not in a standard directory
  • Do not delete locale contents through a symlinked locale directory
  • Create the debug log file with 0600 permissions for security
  • Do not load cleaner files in world-writable files or directories for security
  • Sanitize PATH and drop code-loading env vars for subprocesses when root
  • Use absolute path for POSIX tools for security
  • Harden chownself() against symlinks and non-canonical /root paths
  • Validate SUDO_UID before use
  • Escape the home directory in the keep list regexes

Linux

Linux users get new cleaner and system-detection improvements, more accurate package-manager and memory reports, better Firefox and Chromium support, and fixes for process, swap, and file-handling issues.
  • Report disk usage covered by DNF4 (instead of 0B). Improve accuracy of disk usage recovered by DNF autoremove (instead of estimation).
  • Use XDG_CONFIG_HOME to find Firefox profile folders
  • Fix memory wiping on Linux with systemd
  • Improve detection of size reported by pacman
  • Do not count SwapCached as free memory
  • Fix crash when enumerating running processes on Linux caused by non-numeric /proc entries such as /proc/self and /proc/thread-self
  • Handle vanishing file while checking open files
  • Escape literal dots in the keep-list (whitelist) regexes to improve precision of pattern matching
  • Relay error from DNF5 (package manager on Fedora, RHEL, and similar distributions)
  • Fix DNF4 freed space parsing to use IEC units
  • Improve detection of space saved reportde by APT autoclean
  • Fix apt_autoclean and locale encoding regexes
  • Fix incorrect debug message during swap cleaning
  • Fix file descriptor leaks when an error occurs while reading /proc/swaps or wiping file contents
  • Fix DNF clean without root permission
  • Fix overcleaning Chromium if installed from snap

macOS

macOS users get a new Safari cleaner and broader early macOS support, including Full Disk Access guidance, native notifications, improved shortcuts, language detection, clipboard handling, and Trash cleaning. Check back soon for an Apple Disk Image (.dmg).
  • Add cleaner for Safari on macOS
  • Add early support for macOS-specific cleaners
  • Warn user if macOS Full Disk Access is disabled
  • Switch macOS path protection to case-insensitive
  • Fix get_real_username() on macOS
  • Fix sed call in Makefile for BSD
  • Add GitHub Actions workflow for macOS
  • Filter urllib3 warning about OpenSSL vs LibreSSL
  • Fix sync() for macOS
  • Fix low-level code to run on macOS
  • Delete empty folders when cleaning trash on macOS
  • Make many fixes for macOS: automatic language detection, Cmd+Q shortcut key, clipboard crash, add native notification in macOS notification Center, etc.

BSD

BSD users get improved FreeBSD support, including dependency installation, portable build scripts, SQL compatibility, and automated FreeBSD testing.
  • Add script to test FreeBSD 15 in VM from Linux
  • Use portable shell detection in Makefiles
  • Add support for FreeBSD in script that installs dependencies
  • Use single quotes for string literals in SQL

Developers

This update modernizes the CI/CD pipeline by migrating Windows builds and testing from AppVeyor to GitHub Actions (where we already tested Linux). This release adds security scanning. It also improves code security and maintainability through refactoring, cleanup, stronger tests, and removal of legacy code.
  • CI: switch from AppVeyor to GitHub Actions for Windows
  • Test also Ubuntu 26.04, swap Python 3.12 for 3.13
  • Add zimzor workflow for CI/CD security static analysis
  • Set PYTHONWARNINGS in local Docker with Python 3.14 environment: catch more warnings during testing
  • Fix DeprecationWarning in GTK GUI when PYTHONWARNINGS=error is set
  • Use fast build mode for Windows builds, which disables English-only installer and size optimizations for CI builds found on download.bleachbit.org/ci/
  • Windows build: run UPX compression as parallel batches
  • CI: parallelize windows-test admin suite with pytest-xdist
  • Skip building English-only installer to upload to https://download.bleachbit.org/ci/ except for tags (releases)
  • Streamline usage of "IS_*" system constants across the codebase
  • Fix potential code injection in CI during translation update
  • Code cleanup: use guard clauses to reduce nesting
  • Optimize Windows pip caching and suppress version check
  • Remove Python 2 coding declarations and __future__ import
  • Use zero-arg super() and drop redundant object base class
  • Drop unused local variable assignments
  • Refactor callers to use PathUtils helpers
  • Refactor some functions from FileUtilities and ProtectedPath to PathUtils
  • Improve security of GitHub workflows
  • Add CodeQL workflow for finding bugs
  • Add macOS support to script for installing dependencies
  • Add translation (.po) tests
  • Add pytest-rerunfailures to retry flaky clipboard test
  • Makefile: run pyflake and pylint in parallel
  • Add Makefile targets tests-pytest and tests-nsis
  • Remove unused code
  • Return a list of updates instead of a variable-length tuple
  • Return a list of candidate paths from winapp_expand_vars
  • Remove unused dll_excludes in setup.py
  • zizmor fixes
  • List of commits
  • List of 113 closed issues

Translations

  • 60 languages were updated with 790 changes.
  • The most active languages were Català (145), Svenska (105), and Қазақ тілі (24).
  • This release drops 12 translations that were stale and nearly empty

Website and Documentation

  • Download pages on download.bleachbit.org show the sha256, sha1, and md5 checksums with buttons to copy them to the clipboard
  • Compress PNG images
  • Add Docker support for documentation repository
  • Add GitHub Actions for documentation repository
  • List of commits in bleachbit-docs

Upgrade now

Blog tags: 
release