From be95a0c89f64c10e5b3c8019611060add9b1ce02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@cachix.org>
Date: Tue, 20 Oct 2026 17:29:00 +0100
Subject: [PATCH] fix(kdbx): update keepass to correct DeletionTime
 serialization

---
 CHANGELOG.md | 3 +++
 Cargo.lock   | 6 +++---
 Cargo.toml   | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 25a4cbe8..f6b1e976 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- KDBX saves use the correct `DeletionTime` XML element, keeping databases
+  compatible with KeePass clients that strictly validate deletion metadata.
+
 - IPC writes of X.509 identities decode their declared text encoding before
   storage, so protected and unprotected archives round-trip without corruption.
 
diff --git a/Cargo.lock b/Cargo.lock
index 6700ab2c..50f77cf3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4077,12 +4077,12 @@ dependencies = [
 
 [[package]]
 name = "keepass"
-version = "0.13.17"
+version = "0.13.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2765eb6c9966956f5b421f44657140856accd7a769151dd47811d81ff2d8e8df"
+checksum = "f8161ba5159f649a4899e46aa084130263a7af722116ead3faec24e5ee92a7b9"
 dependencies = [
  "aes 0.9.1",
- "base64 0.22.1",
+ "base64 0.23.1",
  "block-modes",
  "byteorder",
  "cbc 0.2.1",
diff --git a/Cargo.toml b/Cargo.toml
index 977abdab..9ee7c579 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -21,7 +21,7 @@ clap_complete = { version = "4.6", features = ["unstable-dynamic"] }
 clap_complete_nushell = "4.6"
 is_executable = "1.0"
 keyring = "4.1.6"
-keepass = { version = "0.13.17", features = ["save_kdbx4"] }
+keepass = { version = "0.13.21", features = ["save_kdbx4"] }
 keeper-secrets-manager-core = { version = "17.3.0", default-features = false, features = ["blocking"] }
 libc = "0.2"
 signal-hook = "0.4"