Features

New option write_flash --flash-size keep will keep whatever flash size is set in the bootloader header, matching the behaviour of --flash-mode keep and --flash-speed keep. The default is still --flash-size detect but may be changed to keep in a future major update, to be consistent with the other two options.
write_flash no longer updates the flash header if the file being written to the bootloader offset isn't a valid image file for the chip. This is useful for flashing pre-encrypted data to ESP32s, where the image file contains ciphertext.
esptool now always prints the detected crystal frequency (26MHz or 40MHz) as part of general chip information, and will warn if the detected frequency deviates by an unexpected amount.
Passing arguments to main() from Python is now documented in the README (#408)

Bug Fixes/Changes

elf2image --sha256-offset will now only write the ELF SHA-256 to this offset if the existing data is all zeroes. Otherwise a warning is printed.
Improved the error message if esptool searches all serial ports and finds nothing. (#401)

New write_flash --encrypt option that works with the new Development Mode flash encryption that will be the default flash encryption development workflow in ESP-IDF V4.0.
espefuse.py summary --format json will print a JSON dictionary of efuse summary data (#436)
espefuse.py burn commands now set the efuse timing before burning, in line with recent ESP32 TRM update.
espsecure.py key operations now support --keylen argument, allowing 192-bit keys for ESP32s with 3/4 Coding Scheme set.
espsecure.py encryption and decryption speed substantially improved. (#416)

FLASH_CRYPT_CNT efuse is now defined as 7 bits wide, as eight bit is not used by flash encryption hardware.