2026-05-09 05:21:23 +02:00
199 changed files with 12423 additions and 19799 deletions
--- a/.env.template
+++ b/.env.template
@ -80,16 +80,8 @@
 ## Timeout when acquiring database connection
 # DATABASE_TIMEOUT=30

-## Database idle timeout
-## Timeout in seconds before idle connections to the database are closed.
-# DATABASE_IDLE_TIMEOUT=600
-
-## Database min connections
-## Define the minimum size of the connection pool used for connecting to the database.
-# DATABASE_MIN_CONNS=2
-
 ## Database max connections
-## Define the maximum size of the connection pool used for connecting to the database.
+## Define the size of the connection pool used for connecting to the database.
 # DATABASE_MAX_CONNS=10

 ## Database connection initialization
@ -182,10 +174,6 @@
 ## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
 ## Defaults to every minute. Set blank to disable this job.
 # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
-#
-## Cron schedule of the job that cleans sso auth from incomplete flow
-## Defaults to daily (20 minutes after midnight). Set blank to disable this job.
-# PURGE_INCOMPLETE_SSO_AUTH="0 20 0 * * *"

 ########################
 ### General settings ###
@ -348,7 +336,7 @@
 ## Default: 2592000 (30 days)
 # ICON_CACHE_TTL=2592000
 ## Cache time-to-live for icons which weren't available, in seconds (0 is "forever")
-## Default: 259200 (3 days)
+## Default: 2592000 (3 days)
 # ICON_CACHE_NEGTTL=259200

 ## Icon download timeout
@ -372,22 +360,15 @@
 ## Note that clients cache the /api/config endpoint for about 1 hour and it could take some time before they are enabled or disabled!
 ##
 ## The following flags are available:
-## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
-## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
-## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
-## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
-## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
-## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
-## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
-## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
-## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
-## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
-## - "pm-30529-webauthn-related-origins":
-## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-# EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
+## - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
+## - "inline-menu-totp": Enable the use of inline menu TOTP codes in the browser extension.
+## - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
+## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
+## - "export-attachments": Enable support for exporting attachments (Clients >=2025.4.0)
+## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Needs Android >=2025.3.0, iOS >=2025.4.0)
+## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Needs Android >=2025.3.0, iOS >=2025.4.0)
+## - "mutual-tls": Enable the use of mutual TLS on Android (Client >= 2025.2.0)
+# EXPERIMENTAL_CLIENT_FEATURE_FLAGS=fido2-vault-credentials

 ## Require new device emails. When a user logs in an email is required to be sent.
 ## If sending the email fails the login attempt will fail!!
@ -478,60 +459,6 @@
 ## Setting this to true will enforce the Single Org Policy to be enabled before you can enable the Reset Password policy.
 # ENFORCE_SINGLE_ORG_WITH_RESET_PW_POLICY=false

-## Prefer IPv6 (AAAA) resolving
-## This settings configures the DNS resolver to resolve IPv6 first, and if not available try IPv4
-## This could be useful in IPv6 only environments.
-# DNS_PREFER_IPV6=false
-
-#####################################
-### SSO settings (OpenID Connect) ###
-#####################################
-
-## Controls whether users can login using an OpenID Connect identity provider
-# SSO_ENABLED=false
-
-## Prevent users from logging in directly without going through SSO
-# SSO_ONLY=false
-
-## On SSO Signup if a user with a matching email already exists make the association
-# SSO_SIGNUPS_MATCH_EMAIL=true
-
-## Allow unknown email verification status. Allowing this with `SSO_SIGNUPS_MATCH_EMAIL=true` open potential account takeover.
-# SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=false
-
-## Base URL of the OIDC server (auto-discovery is used)
-##  - Should not include the `/.well-known/openid-configuration` part and no trailing `/`
-##  - ${SSO_AUTHORITY}/.well-known/openid-configuration should return a json document: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
-# SSO_AUTHORITY=https://auth.example.com
-
-## Authorization request scopes. Optional SSO scopes, override if email and profile are not enough (`openid` is implicit).
-# SSO_SCOPES="email profile"
-
-## Additional authorization url parameters (ex: to obtain a `refresh_token` with Google Auth).
-# SSO_AUTHORIZE_EXTRA_PARAMS="access_type=offline&prompt=consent"
-
-## Activate PKCE for the Auth Code flow.
-# SSO_PKCE=true
-
-## Regex for additional trusted Id token audience (by default only the client_id is trusted).
-# SSO_AUDIENCE_TRUSTED='^$'
-
-## Set your Client ID and Client Key
-# SSO_CLIENT_ID=11111
-# SSO_CLIENT_SECRET=AAAAAAAAAAAAAAAAAAAAAAAA
-
-## Optional Master password policy (minComplexity=[0-4]), `enforceOnLogin` is not supported at the moment.
-# SSO_MASTER_PASSWORD_POLICY='{"enforceOnLogin":false,"minComplexity":3,"minLength":12,"requireLower":false,"requireNumbers":false,"requireSpecial":false,"requireUpper":false}'
-
-## Use sso only for authentication not the session lifecycle
-# SSO_AUTH_ONLY_NOT_SESSION=false
-
-## Client cache for discovery endpoint. Duration in seconds (0 to disable).
-# SSO_CLIENT_CACHE_EXPIRATION=0
-
-## Log all the tokens, LOG_LEVEL=debug is required
-# SSO_DEBUG_TOKENS=false
-
 ########################
 ### MFA/2FA settings ###
 ########################
@ -591,7 +518,7 @@
 ##
 ## According to the RFC6238 (https://tools.ietf.org/html/rfc6238),
 ## we allow by default the TOTP code which was valid one step back and one in the future.
-## This can however allow attackers to be a bit more lucky with their attempts because there are 3 valid codes.
+## This can however allow attackers to be a bit more lucky with there attempts because there are 3 valid codes.
 ## You can disable this, so that only the current TOTP Code is allowed.
 ## Keep in mind that when a sever drifts out of time, valid codes could be marked as invalid.
 ## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid.
@ -631,7 +558,7 @@
 # SMTP_AUTH_MECHANISM=

 ## Server name sent during the SMTP HELO
-## By default this value should be the machine's hostname,
+## By default this value should be is on the machine's hostname,
 ## but might need to be changed in case it trips some anti-spam filters
 # HELO_NAME=

--- a/.gitattributes
+++ b/.gitattributes
@ -1,2 +1,3 @@
 # Ignore vendored scripts in GitHub stats
 src/static/scripts/* linguist-vendored
+
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -1,10 +1,6 @@
 name: Build
 permissions: {}

-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 on:
  push:
    paths:
@ -18,7 +14,6 @@ on:
      - "diesel.toml"
      - "docker/Dockerfile.j2"
      - "docker/DockerSettings.yaml"
-      - "macros/**"

  pull_request:
    paths:
@ -32,16 +27,15 @@ on:
      - "diesel.toml"
      - "docker/Dockerfile.j2"
      - "docker/DockerSettings.yaml"
-      - "macros/**"
-
-defaults:
-  run:
-    shell: bash

 jobs:
  build:
    name: Build and Test ${{ matrix.channel }}
-    runs-on: ubuntu-24.04
+    permissions:
+      actions: write
+      contents: read
+    # We use Ubuntu 22.04 here because this matches the library versions used within the Debian docker containers
+    runs-on: ubuntu-22.04
    timeout-minutes: 120
    # Make warnings errors, this is to prevent warnings slipping through.
    # This is done globally to prevent rebuilds when the RUSTFLAGS env variable changes.
@ -62,7 +56,7 @@ jobs:

      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
        with:
          persist-credentials: false
          fetch-depth: 0
@ -71,13 +65,14 @@ jobs:
      # Determine rust-toolchain version
      - name: Init Variables
        id: toolchain
+        shell: bash
        env:
          CHANNEL: ${{ matrix.channel }}
        run: |
          if [[ "${CHANNEL}" == 'rust-toolchain' ]]; then
-            RUST_TOOLCHAIN="$(grep -m1 -oP 'channel.*"(\K.*?)(?=")' rust-toolchain.toml)"
+            RUST_TOOLCHAIN="$(grep -oP 'channel.*"(\K.*?)(?=")' rust-toolchain.toml)"
          elif [[ "${CHANNEL}" == 'msrv' ]]; then
-            RUST_TOOLCHAIN="$(grep -m1 -oP 'rust-version\s.*"(\K.*?)(?=")' Cargo.toml)"
+            RUST_TOOLCHAIN="$(grep -oP 'rust-version.*"(\K.*?)(?=")' Cargo.toml)"
          else
            RUST_TOOLCHAIN="${CHANNEL}"
          fi
@ -85,23 +80,32 @@ jobs:
      # End Determine rust-toolchain version


-      - name: "Install toolchain ${{steps.toolchain.outputs.RUST_TOOLCHAIN}} as default"
+      # Only install the clippy and rustfmt components on the default rust-toolchain
+      - name: "Install rust-toolchain version"
+        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # master @ Apr 29, 2025, 9:22 PM GMT+2
+        if: ${{ matrix.channel == 'rust-toolchain' }}
+        with:
+          toolchain: "${{steps.toolchain.outputs.RUST_TOOLCHAIN}}"
+          components: clippy, rustfmt
+      # End Uses the rust-toolchain file to determine version
+
+
+      # Install the any other channel to be used for which we do not execute clippy and rustfmt
+      - name: "Install MSRV version"
+        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # master @ Apr 29, 2025, 9:22 PM GMT+2
+        if: ${{ matrix.channel != 'rust-toolchain' }}
+        with:
+          toolchain: "${{steps.toolchain.outputs.RUST_TOOLCHAIN}}"
+      # End Install the MSRV channel to be used
+
+      # Set the current matrix toolchain version as default
+      - name: "Set toolchain ${{steps.toolchain.outputs.RUST_TOOLCHAIN}} as default"
        env:
-          CHANNEL: ${{ matrix.channel }}
          RUST_TOOLCHAIN: ${{steps.toolchain.outputs.RUST_TOOLCHAIN}}
        run: |
          # Remove the rust-toolchain.toml
          rm rust-toolchain.toml
-
-          # Install the correct toolchain version
-          rustup toolchain install "${RUST_TOOLCHAIN}" --profile minimal --no-self-update
-
-          # If this matrix is the `rust-toolchain` flow, also install rustfmt and clippy
-          if [[ "${CHANNEL}" == 'rust-toolchain' ]]; then
-            rustup component add --toolchain "${RUST_TOOLCHAIN}" rustfmt clippy
-          fi
-
-          # Set as the default toolchain
+          # Set the default
          rustup default "${RUST_TOOLCHAIN}"

      # Show environment
@ -113,60 +117,60 @@ jobs:

      # Enable Rust Caching
      - name: Rust Caching
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
          # Like changing the build host from Ubuntu 20.04 to 22.04 for example.
          # Only update when really needed! Use a <year>.<month>[.<inc>] format.
-          prefix-key: "v2025.09-rust"
+          prefix-key: "v2023.07-rust"
      # End Enable Rust Caching

      # Run cargo tests
      # First test all features together, afterwards test them separately.
-      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc,s3"
-        id: test_sqlite_mysql_postgresql_mimalloc_s3
+      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc,query_logger"
+        id: test_sqlite_mysql_postgresql_mimalloc_logger
        if: ${{ !cancelled() }}
        run: |
-          cargo test --profile ci --features sqlite,mysql,postgresql,enable_mimalloc,s3
+          cargo test --features sqlite,mysql,postgresql,enable_mimalloc,query_logger

      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc"
        id: test_sqlite_mysql_postgresql_mimalloc
        if: ${{ !cancelled() }}
        run: |
-          cargo test --profile ci --features sqlite,mysql,postgresql,enable_mimalloc
+          cargo test --features sqlite,mysql,postgresql,enable_mimalloc

      - name: "test features: sqlite,mysql,postgresql"
        id: test_sqlite_mysql_postgresql
        if: ${{ !cancelled() }}
        run: |
-          cargo test --profile ci --features sqlite,mysql,postgresql
+          cargo test --features sqlite,mysql,postgresql

      - name: "test features: sqlite"
        id: test_sqlite
        if: ${{ !cancelled() }}
        run: |
-          cargo test --profile ci --features sqlite
+          cargo test --features sqlite

      - name: "test features: mysql"
        id: test_mysql
        if: ${{ !cancelled() }}
        run: |
-          cargo test --profile ci --features mysql
+          cargo test --features mysql

      - name: "test features: postgresql"
        id: test_postgresql
        if: ${{ !cancelled() }}
        run: |
-          cargo test --profile ci --features postgresql
+          cargo test --features postgresql
      # End Run cargo tests


      # Run cargo clippy, and fail on warnings
-      - name: "clippy features: sqlite,mysql,postgresql,enable_mimalloc,s3"
+      - name: "clippy features: sqlite,mysql,postgresql,enable_mimalloc"
        id: clippy
        if: ${{ !cancelled() && matrix.channel == 'rust-toolchain' }}
        run: |
-          cargo clippy --profile ci --features sqlite,mysql,postgresql,enable_mimalloc,s3
+          cargo clippy --features sqlite,mysql,postgresql,enable_mimalloc
      # End Run cargo clippy


@ -184,7 +188,7 @@ jobs:
      - name: "Some checks failed"
        if: ${{ failure() }}
        env:
-          TEST_DB_M_S3: ${{ steps.test_sqlite_mysql_postgresql_mimalloc_s3.outcome }}
+          TEST_DB_M_L: ${{ steps.test_sqlite_mysql_postgresql_mimalloc_logger.outcome }}
          TEST_DB_M: ${{ steps.test_sqlite_mysql_postgresql_mimalloc.outcome }}
          TEST_DB: ${{ steps.test_sqlite_mysql_postgresql.outcome }}
          TEST_SQLITE: ${{ steps.test_sqlite.outcome }}
@ -197,13 +201,13 @@ jobs:
          echo "" >> "${GITHUB_STEP_SUMMARY}"
          echo "|Job|Status|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|---|------|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (sqlite,mysql,postgresql,enable_mimalloc,s3)|${TEST_DB_M_S3}|" >> "${GITHUB_STEP_SUMMARY}"
+          echo "|test (sqlite,mysql,postgresql,enable_mimalloc,query_logger)|${TEST_DB_M_L}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (sqlite,mysql,postgresql,enable_mimalloc)|${TEST_DB_M}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (sqlite,mysql,postgresql)|${TEST_DB}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (sqlite)|${TEST_SQLITE}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (mysql)|${TEST_MYSQL}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (postgresql)|${TEST_POSTGRESQL}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|clippy (sqlite,mysql,postgresql,enable_mimalloc,s3)|${CLIPPY}|" >> "${GITHUB_STEP_SUMMARY}"
+          echo "|clippy (sqlite,mysql,postgresql,enable_mimalloc)|${CLIPPY}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|fmt|${FMT}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "" >> "${GITHUB_STEP_SUMMARY}"
          echo "Please check the failed jobs and fix where needed." >> "${GITHUB_STEP_SUMMARY}"
--- a/.github/workflows/check-templates.yml
+++ b/.github/workflows/check-templates.yml
@ -1,26 +1,20 @@
 name: Check templates
 permissions: {}

-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 on: [ push, pull_request ]

-defaults:
-  run:
-    shell: bash
-
 jobs:
  docker-templates:
    name: Validate docker templates
+    permissions:
+      contents: read
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
        with:
          persist-credentials: false
      # End Checkout the repo
--- a/.github/workflows/hadolint.yml
+++ b/.github/workflows/hadolint.yml
@ -1,26 +1,20 @@
 name: Hadolint
 permissions: {}

-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 on: [ push, pull_request ]

-defaults:
-  run:
-    shell: bash
-
 jobs:
  hadolint:
    name: Validate Dockerfile syntax
+    permissions:
+      contents: read
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@ -32,26 +26,29 @@ jobs:

      # Download hadolint - https://github.com/hadolint/hadolint/releases
      - name: Download hadolint
+        shell: bash
        run: |
          sudo curl -L https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-$(uname -s)-$(uname -m) -o /usr/local/bin/hadolint && \
          sudo chmod +x /usr/local/bin/hadolint
        env:
-          HADOLINT_VERSION: 2.14.0
+          HADOLINT_VERSION: 2.12.0
      # End Download hadolint
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
        with:
          persist-credentials: false
      # End Checkout the repo

      # Test Dockerfiles with hadolint
      - name: Run hadolint
+        shell: bash
        run: hadolint docker/Dockerfile.{debian,alpine}
      # End Test Dockerfiles with hadolint

      # Test Dockerfiles with docker build checks
      - name: Run docker build check
+        shell: bash
        run: |
          echo "Checking docker/Dockerfile.debian"
          docker build --check . -f docker/Dockerfile.debian
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -1,12 +1,6 @@
 name: Release
 permissions: {}

-concurrency:
-  # Apply concurrency control only on the upstream repo
-  group: ${{ github.repository == 'dani-garcia/vaultwarden' && format('{0}-{1}', github.workflow, github.ref) || github.run_id }}
-  # Don't cancel other runs when creating a tag
-  cancel-in-progress: ${{ github.ref_type == 'branch' }}
-
 on:
  push:
    branches:
@ -16,55 +10,73 @@ on:
      # https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
      - '[1-2].[0-9]+.[0-9]+'

-defaults:
-  run:
-    shell: bash
-
-# A "release" environment must be created in the repository settings
-# (Settings > Environments > New environment) with the following
-# variables and secrets configured as needed.
-#
-# Variables (only set the ones for registries you want to push to):
-#   DOCKERHUB_REPO: 'index.docker.io/<user>/<repo>'
-#   QUAY_REPO: 'quay.io/<user>/<repo>'
-#   GHCR_REPO: 'ghcr.io/<user>/<repo>'
-#
-# Secrets (only required when the corresponding *_REPO variable is set):
-#   DOCKERHUB_REPO => DOCKERHUB_USERNAME, DOCKERHUB_TOKEN
-#   QUAY_REPO      => QUAY_USERNAME, QUAY_TOKEN
-#   GITHUB_TOKEN is provided automatically
-
 jobs:
-  docker-build:
-    name: Build Vaultwarden containers
+  # https://github.com/marketplace/actions/skip-duplicate-actions
+  # Some checks to determine if we need to continue with building a new docker.
+  # We will skip this check if we are creating a tag, because that has the same hash as a previous run already.
+  skip_check:
+    # Only run this in the upstream repo and not on forks
    if: ${{ github.repository == 'dani-garcia/vaultwarden' }}
-    environment: 
-      name: release
-      deployment: false
+    name: Cancel older jobs when running
    permissions:
-      packages: write # Needed to upload packages and artifacts
+      actions: write
+    runs-on: ubuntu-24.04
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+
+    steps:
+      - name: Skip Duplicates Actions
+        id: skip_check
+        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
+        with:
+          cancel_others: 'true'
+        # Only run this when not creating a tag
+        if: ${{ github.ref_type == 'branch' }}
+
+  docker-build:
+    needs: skip_check
+    if: ${{ needs.skip_check.outputs.should_skip != 'true' && github.repository == 'dani-garcia/vaultwarden' }}
+    name: Build Vaultwarden containers
+    permissions:
+      packages: write
      contents: read
-      attestations: write # Needed to generate an artifact attestation for a build
-      id-token: write # Needed to mint the OIDC token necessary to request a Sigstore signing certificate
-    runs-on: ${{ contains(matrix.arch, 'arm') && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+      attestations: write
+      id-token: write
+    runs-on: ubuntu-24.04
    timeout-minutes: 120
+    # Start a local docker registry to extract the compiled binaries to upload as artifacts and attest them
+    services:
+      registry:
+        image: registry@sha256:1fc7de654f2ac1247f0b67e8a459e273b0993be7d2beda1f3f56fbf1001ed3e7 # v3.0.0
+        ports:
+          - 5000:5000
    env:
      SOURCE_COMMIT: ${{ github.sha }}
      SOURCE_REPOSITORY_URL: "https://github.com/${{ github.repository }}"
+      # The *_REPO variables need to be configured as repository variables
+      # Append `/settings/variables/actions` to your repo url
+      # DOCKERHUB_REPO needs to be 'index.docker.io/<user>/<repo>'
+      # Check for Docker hub credentials in secrets
+      HAVE_DOCKERHUB_LOGIN: ${{ vars.DOCKERHUB_REPO != '' && secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}
+      # GHCR_REPO needs to be 'ghcr.io/<user>/<repo>'
+      # Check for Github credentials in secrets
+      HAVE_GHCR_LOGIN: ${{ vars.GHCR_REPO != '' && github.repository_owner != '' && secrets.GITHUB_TOKEN != '' }}
+      # QUAY_REPO needs to be 'quay.io/<user>/<repo>'
+      # Check for Quay.io credentials in secrets
+      HAVE_QUAY_LOGIN: ${{ vars.QUAY_REPO != '' && secrets.QUAY_USERNAME != '' && secrets.QUAY_TOKEN != '' }}
    strategy:
      matrix:
-        arch: ["amd64", "arm64", "arm/v7", "arm/v6"]
        base_image: ["debian","alpine"]

    steps:
      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
        with:
          platforms: "arm64,arm"

      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@ -77,24 +89,25 @@ jobs:

      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
        # We need fetch-depth of 0 so we also get all the tag metadata
        with:
          persist-credentials: false
          fetch-depth: 0

-      # Normalize the architecture string for use in paths and cache keys
-      - name: Normalize architecture string
+      # Determine Base Tags and Source Version
+      - name: Determine Base Tags and Source Version
+        shell: bash
        env:
-          MATRIX_ARCH: ${{ matrix.arch }}
+          REF_TYPE: ${{ github.ref_type }}
        run: |
-          # Replace slashes with nothing to create a safe string for paths/cache keys
-          NORMALIZED_ARCH="${MATRIX_ARCH//\/}"
-          echo "NORMALIZED_ARCH=${NORMALIZED_ARCH}" | tee -a "${GITHUB_ENV}"
+          # Check which main tag we are going to build determined by ref_type
+          if [[ "${REF_TYPE}" == "tag" ]]; then
+            echo "BASE_TAGS=latest,${GITHUB_REF#refs/*/}" | tee -a "${GITHUB_ENV}"
+          elif [[ "${REF_TYPE}" == "branch" ]]; then
+            echo "BASE_TAGS=testing" | tee -a "${GITHUB_ENV}"
+          fi

-      # Determine Source Version
-      - name: Determine Source Version
-        run: |
          # Get the Source Version for this release
          GIT_EXACT_TAG="$(git describe --tags --abbrev=0 --exact-match 2>/dev/null || true)"
          if [[ -n "${GIT_EXACT_TAG}" ]]; then
@ -103,17 +116,19 @@ jobs:
              GIT_LAST_TAG="$(git describe --tags --abbrev=0)"
              echo "SOURCE_VERSION=${GIT_LAST_TAG}-${SOURCE_COMMIT:0:8}" | tee -a "${GITHUB_ENV}"
          fi
+      # End Determine Base Tags

      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
-        if: ${{ vars.DOCKERHUB_REPO != '' }}
+        if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' }}

      - name: Add registry for DockerHub
-        if: ${{ vars.DOCKERHUB_REPO != '' }}
+        if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' }}
+        shell: bash
        env:
          DOCKERHUB_REPO: ${{ vars.DOCKERHUB_REPO }}
        run: |
@ -121,15 +136,16 @@ jobs:

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-        if: ${{ vars.GHCR_REPO != '' }}
+        if: ${{ env.HAVE_GHCR_LOGIN == 'true' }}

      - name: Add registry for ghcr.io
-        if: ${{ vars.GHCR_REPO != '' }}
+        if: ${{ env.HAVE_GHCR_LOGIN == 'true' }}
+        shell: bash
        env:
          GHCR_REPO: ${{ vars.GHCR_REPO }}
        run: |
@ -137,74 +153,64 @@ jobs:

      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_TOKEN }}
-        if: ${{ vars.QUAY_REPO != '' }}
+        if: ${{ env.HAVE_QUAY_LOGIN == 'true' }}

      - name: Add registry for Quay.io
-        if: ${{ vars.QUAY_REPO != '' }}
+        if: ${{ env.HAVE_QUAY_LOGIN == 'true' }}
+        shell: bash
        env:
          QUAY_REPO: ${{ vars.QUAY_REPO }}
        run: |
          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${QUAY_REPO}" | tee -a "${GITHUB_ENV}"

      - name: Configure build cache from/to
+        shell: bash
        env:
          GHCR_REPO: ${{ vars.GHCR_REPO }}
          BASE_IMAGE: ${{ matrix.base_image }}
-          NORMALIZED_ARCH: ${{ env.NORMALIZED_ARCH }}
        run: |
          #
          # Check if there is a GitHub Container Registry Login and use it for caching
-          if [[ -n "${GHCR_REPO}" ]]; then
-            echo "BAKE_CACHE_FROM=type=registry,ref=${GHCR_REPO}-buildcache:${BASE_IMAGE}-${NORMALIZED_ARCH}" | tee -a "${GITHUB_ENV}"
-            echo "BAKE_CACHE_TO=type=registry,ref=${GHCR_REPO}-buildcache:${BASE_IMAGE}-${NORMALIZED_ARCH},compression=zstd,mode=max" | tee -a "${GITHUB_ENV}"
+          if [[ -n "${HAVE_GHCR_LOGIN}" ]]; then
+            echo "BAKE_CACHE_FROM=type=registry,ref=${GHCR_REPO}-buildcache:${BASE_IMAGE}" | tee -a "${GITHUB_ENV}"
+            echo "BAKE_CACHE_TO=type=registry,ref=${GHCR_REPO}-buildcache:${BASE_IMAGE},compression=zstd,mode=max" | tee -a "${GITHUB_ENV}"
          else
            echo "BAKE_CACHE_FROM="
            echo "BAKE_CACHE_TO="
          fi
          #

-      - name: Generate tags
-        id: tags
-        env:
-          CONTAINER_REGISTRIES: "${{ env.CONTAINER_REGISTRIES }}"
+      - name: Add localhost registry
+        shell: bash
        run: |
-          # Convert comma-separated list to newline-separated set commands
-          TAGS=$(echo "${CONTAINER_REGISTRIES}" | tr ',' '\n' | sed "s|.*|*.tags=&|")
-
-          # Output for use in next step
-          {
-            echo "TAGS<<EOF"
-            echo "$TAGS"
-            echo "EOF"
-          } >> "$GITHUB_ENV"
+          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}localhost:5000/vaultwarden/server" | tee -a "${GITHUB_ENV}"

      - name: Bake ${{ matrix.base_image }} containers
        id: bake_vw
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@37816e747588cb137173af99ab33873600c46ea8 # v6.8.0
        env:
-          BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
+          BASE_TAGS: "${{ env.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
          SOURCE_VERSION: "${{ env.SOURCE_VERSION }}"
          SOURCE_REPOSITORY_URL: "${{ env.SOURCE_REPOSITORY_URL }}"
+          CONTAINER_REGISTRIES: "${{ env.CONTAINER_REGISTRIES }}"
        with:
          pull: true
+          push: true
          source: .
          files: docker/docker-bake.hcl
          targets: "${{ matrix.base_image }}-multi"
          set: |
            *.cache-from=${{ env.BAKE_CACHE_FROM }}
            *.cache-to=${{ env.BAKE_CACHE_TO }}
-            *.platform=linux/${{ matrix.arch }}
-            ${{ env.TAGS }}
-            *.output=type=local,dest=./output
-            *.output=type=image,push-by-digest=true,name-canonical=true,push=true

      - name: Extract digest SHA
+        shell: bash
        env:
          BAKE_METADATA: ${{ steps.bake_vw.outputs.metadata }}
          BASE_IMAGE: ${{ matrix.base_image }}
@ -212,177 +218,105 @@ jobs:
          GET_DIGEST_SHA="$(jq -r --arg base "$BASE_IMAGE" '.[$base + "-multi"]."containerimage.digest"' <<< "${BAKE_METADATA}")"
          echo "DIGEST_SHA=${GET_DIGEST_SHA}" | tee -a "${GITHUB_ENV}"

-      - name: Export digest
-        env:
-          DIGEST_SHA: ${{ env.DIGEST_SHA }}
-          RUNNER_TEMP: ${{ runner.temp }}
-        run: |
-          mkdir -p "${RUNNER_TEMP}"/digests
-          digest="${DIGEST_SHA}"
-          touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: digests-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
-          path: ${{ runner.temp }}/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-      - name: Rename binaries to match target platform
-        env:
-          NORMALIZED_ARCH: ${{ env.NORMALIZED_ARCH }}
-        run: |
-          mv ./output/vaultwarden vaultwarden-"${NORMALIZED_ARCH}"
-
-      # Upload artifacts to Github Actions and Attest the binaries
-      - name: Attest binaries
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: vaultwarden-${{ env.NORMALIZED_ARCH }}
-
-      - name: Upload binaries as artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
-          path: vaultwarden-${{ env.NORMALIZED_ARCH }}
-
-  merge-manifests:
-    name: Merge manifests
-    runs-on: ubuntu-latest
-    needs: docker-build
-    environment: 
-      name: release
-      deployment: false
-    permissions:
-      packages: write # Needed to upload packages and artifacts
-      attestations: write # Needed to generate an artifact attestation for a build
-      id-token: write # Needed to mint the OIDC token necessary to request a Sigstore signing certificate
-    strategy:
-      matrix:
-        base_image: ["debian","alpine"]
-
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: ${{ runner.temp }}/digests
-          pattern: digests-*-${{ matrix.base_image }}
-          merge-multiple: true
-
-      # Login to Docker Hub
-      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-        if: ${{ vars.DOCKERHUB_REPO != '' }}
-
-      - name: Add registry for DockerHub
-        if: ${{ vars.DOCKERHUB_REPO != '' }}
-        env:
-          DOCKERHUB_REPO: ${{ vars.DOCKERHUB_REPO }}
-        run: |
-          echo "CONTAINER_REGISTRIES=${DOCKERHUB_REPO}" | tee -a "${GITHUB_ENV}"
-
-      # Login to GitHub Container Registry
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-        if: ${{ vars.GHCR_REPO != '' }}
-
-      - name: Add registry for ghcr.io
-        if: ${{ vars.GHCR_REPO != '' }}
-        env:
-          GHCR_REPO: ${{ vars.GHCR_REPO }}
-        run: |
-          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${GHCR_REPO}" | tee -a "${GITHUB_ENV}"
-
-      # Login to Quay.io
-      - name: Login to Quay.io
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_TOKEN }}
-        if: ${{ vars.QUAY_REPO != '' }}
-
-      - name: Add registry for Quay.io
-        if: ${{ vars.QUAY_REPO != '' }}
-        env:
-          QUAY_REPO: ${{ vars.QUAY_REPO }}
-        run: |
-          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${QUAY_REPO}" | tee -a "${GITHUB_ENV}"
-
-      # Determine Base Tags
-      - name: Determine Base Tags
-        env:
-          BASE_IMAGE_TAG: "${{ matrix.base_image != 'debian' && format('-{0}', matrix.base_image) || '' }}"
-          REF_TYPE: ${{ github.ref_type }}
-        run: |
-          # Check which main tag we are going to build determined by ref_type
-          if [[ "${REF_TYPE}" == "tag" ]]; then
-            echo "BASE_TAGS=latest${BASE_IMAGE_TAG},${GITHUB_REF#refs/*/}${BASE_IMAGE_TAG}${BASE_IMAGE_TAG//-/,}" | tee -a "${GITHUB_ENV}"
-          elif [[ "${REF_TYPE}" == "branch" ]]; then
-            echo "BASE_TAGS=testing${BASE_IMAGE_TAG}" | tee -a "${GITHUB_ENV}"
-          fi
-
-      - name: Create manifest list, push it and extract digest SHA
-        working-directory: ${{ runner.temp }}/digests
-        env:
-          BASE_TAGS: "${{ env.BASE_TAGS }}"
-          CONTAINER_REGISTRIES: "${{ env.CONTAINER_REGISTRIES }}"
-        run: |
-          IFS=',' read -ra IMAGES <<< "${CONTAINER_REGISTRIES}"
-          IFS=',' read -ra TAGS <<< "${BASE_TAGS}"
-
-          TAG_ARGS=()
-          for img in "${IMAGES[@]}"; do
-            for tag in "${TAGS[@]}"; do
-              TAG_ARGS+=("-t" "${img}:${tag}")
-            done
-          done
-
-          echo "Creating manifest"
-          if ! OUTPUT=$(docker buildx imagetools create \
-                          "${TAG_ARGS[@]}" \
-                          $(printf "${IMAGES[0]}@sha256:%s " *) 2>&1); then
-            echo "Manifest creation failed"
-            echo "${OUTPUT}"
-            exit 1
-          fi
-
-          echo "Manifest created successfully"
-          echo "${OUTPUT}"
-
-          # Extract digest SHA for subsequent steps
-          GET_DIGEST_SHA="$(echo "${OUTPUT}" | grep -oE 'sha256:[a-f0-9]{64}' | tail -1)"
-          echo "DIGEST_SHA=${GET_DIGEST_SHA}" | tee -a "${GITHUB_ENV}"
-
      # Attest container images
      - name: Attest - docker.io - ${{ matrix.base_image }}
-        if: ${{ vars.DOCKERHUB_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-name: ${{ vars.DOCKERHUB_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
          push-to-registry: true

      - name: Attest - ghcr.io - ${{ matrix.base_image }}
-        if: ${{ vars.GHCR_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        if: ${{ env.HAVE_GHCR_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-name: ${{ vars.GHCR_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
          push-to-registry: true

      - name: Attest - quay.io - ${{ matrix.base_image }}
-        if: ${{ vars.QUAY_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        if: ${{ env.HAVE_QUAY_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-name: ${{ vars.QUAY_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
          push-to-registry: true
+
+
+      # Extract the Alpine binaries from the containers
+      - name: Extract binaries
+        shell: bash
+        env:
+          REF_TYPE: ${{ github.ref_type }}
+          BASE_IMAGE: ${{ matrix.base_image }}
+        run: |
+          # Check which main tag we are going to build determined by ref_type
+          if [[ "${REF_TYPE}" == "tag" ]]; then
+            EXTRACT_TAG="latest"
+          elif [[ "${REF_TYPE}" == "branch" ]]; then
+            EXTRACT_TAG="testing"
+          fi
+
+          # Check which base_image was used and append -alpine if needed
+          if [[ "${BASE_IMAGE}" == "alpine" ]]; then
+            EXTRACT_TAG="${EXTRACT_TAG}-alpine"
+          fi
+
+          # After each extraction the image is removed.
+          # This is needed because using different platforms doesn't trigger a new pull/download
+
+          # Extract amd64 binary
+          docker create --name amd64 --platform=linux/amd64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker cp amd64:/vaultwarden vaultwarden-amd64-${BASE_IMAGE}
+          docker rm --force amd64
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+
+          # Extract arm64 binary
+          docker create --name arm64 --platform=linux/arm64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker cp arm64:/vaultwarden vaultwarden-arm64-${BASE_IMAGE}
+          docker rm --force arm64
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+
+          # Extract armv7 binary
+          docker create --name armv7 --platform=linux/arm/v7 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker cp armv7:/vaultwarden vaultwarden-armv7-${BASE_IMAGE}
+          docker rm --force armv7
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+
+          # Extract armv6 binary
+          docker create --name armv6 --platform=linux/arm/v6 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker cp armv6:/vaultwarden vaultwarden-armv6-${BASE_IMAGE}
+          docker rm --force armv6
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+
+      # Upload artifacts to Github Actions and Attest the binaries
+      - name: "Upload amd64 artifact ${{ matrix.base_image }}"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-amd64-${{ matrix.base_image }}
+          path: vaultwarden-amd64-${{ matrix.base_image }}
+
+      - name: "Upload arm64 artifact ${{ matrix.base_image }}"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-arm64-${{ matrix.base_image }}
+          path: vaultwarden-arm64-${{ matrix.base_image }}
+
+      - name: "Upload armv7 artifact ${{ matrix.base_image }}"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv7-${{ matrix.base_image }}
+          path: vaultwarden-armv7-${{ matrix.base_image }}
+
+      - name: "Upload armv6 artifact ${{ matrix.base_image }}"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv6-${{ matrix.base_image }}
+          path: vaultwarden-armv6-${{ matrix.base_image }}
+
+      - name: "Attest artifacts ${{ matrix.base_image }}"
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        with:
+          subject-path: vaultwarden-*
+      # End Upload artifacts to Github Actions
--- a/.github/workflows/releasecache-cleanup.yml
+++ b/.github/workflows/releasecache-cleanup.yml
@ -1,10 +1,6 @@
 name: Cleanup
 permissions: {}

-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
 on:
  workflow_dispatch:
    inputs:
@ -20,7 +16,7 @@ jobs:
  releasecache-cleanup:
    name: Releasecache Cleanup
    permissions:
-      packages: write # To be able to cleanup old caches
+      packages: write
    runs-on: ubuntu-24.04
    continue-on-error: true
    timeout-minutes: 30
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@ -1,10 +1,6 @@
 name: Trivy
 permissions: {}

-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 on:
  push:
    branches:
@ -27,18 +23,20 @@ jobs:
    if: ${{ github.repository == 'dani-garcia/vaultwarden' }}
    name: Trivy Scan
    permissions:
-      security-events: write # To write the security report
+      contents: read
+      actions: read
+      security-events: write
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
        with:
          persist-credentials: false

      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
        env:
          TRIVY_DB_REPOSITORY: docker.io/aquasec/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2
          TRIVY_JAVA_DB_REPOSITORY: docker.io/aquasec/trivy-java-db:1,public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1
@ -50,6 +48,6 @@ jobs:
          severity: CRITICAL,HIGH

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
        with:
          sarif_file: 'trivy-results.sarif'
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@ -1,26 +0,0 @@
-name: Code Spell Checking
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-on: [ push, pull_request ]
-
-jobs:
-  typos:
-    name: Run typos spell checking
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-
-    steps:
-      # Checkout the repo
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      # End Checkout the repo
-
-      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
-      - name: Spell Check Repo
-        uses: crate-ci/typos@7c572958218557a3272c2d6719629443b5cc26fd # v1.45.2
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@ -1,9 +1,4 @@
 name: Security Analysis with zizmor
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true

 on:
  push:
@ -11,20 +6,22 @@ on:
  pull_request:
    branches: ["**"]

+permissions: {}
+
 jobs:
  zizmor:
    name: Run zizmor
    runs-on: ubuntu-latest
    permissions:
-      security-events: write # To write the security report
+      security-events: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -1,60 +1,52 @@
 ---
 repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
    hooks:
-      - id: check-yaml
-      - id: check-json
-      - id: check-toml
-      - id: mixed-line-ending
-        args: [ "--fix=no" ]
-      - id: end-of-file-fixer
-        exclude: "(.*js$|.*css$)"
-      - id: check-case-conflict
-      - id: check-merge-conflict
-      - id: detect-private-key
-      - id: check-symlinks
-      - id: forbid-submodules
-
-  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
-  - repo: https://github.com/crate-ci/typos
-    rev: 7c572958218557a3272c2d6719629443b5cc26fd # v1.45.2
+    - id: check-yaml
+    - id: check-json
+    - id: check-toml
+    - id: mixed-line-ending
+      args: ["--fix=no"]
+    - id: end-of-file-fixer
+      exclude: "(.*js$|.*css$)"
+    - id: check-case-conflict
+    - id: check-merge-conflict
+    - id: detect-private-key
+    - id: check-symlinks
+    - id: forbid-submodules
+-   repo: local
    hooks:
-      - id: typos
-
-  - repo: local
-    hooks:
-      - id: fmt
-        name: fmt
-        description: Format files with cargo fmt.
-        entry: cargo fmt
-        language: system
-        always_run: true
-        pass_filenames: false
-        args: [ "--", "--check" ]
-      - id: cargo-test
-        name: cargo test
-        description: Test the package for errors.
-        entry: cargo test
-        language: system
-        args: [ "--features", "sqlite,mysql,postgresql", "--" ]
-        types_or: [ rust, file ]
-        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
-        pass_filenames: false
-      - id: cargo-clippy
-        name: cargo clippy
-        description: Lint Rust sources
-        entry: cargo clippy
-        language: system
-        args: [ "--features", "sqlite,mysql,postgresql", "--", "-D", "warnings" ]
-        types_or: [ rust, file ]
-        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
-        pass_filenames: false
-      - id: check-docker-templates
-        name: check docker templates
-        description: Check if the Docker templates are updated
-        language: system
-        entry: sh
-        args:
-          - "-c"
-          - "cd docker && make"
+    - id: fmt
+      name: fmt
+      description: Format files with cargo fmt.
+      entry: cargo fmt
+      language: system
+      types: [rust]
+      args: ["--", "--check"]
+    - id: cargo-test
+      name: cargo test
+      description: Test the package for errors.
+      entry: cargo test
+      language: system
+      args: ["--features", "sqlite,mysql,postgresql,enable_mimalloc", "--"]
+      types_or: [rust, file]
+      files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
+      pass_filenames: false
+    - id: cargo-clippy
+      name: cargo clippy
+      description: Lint Rust sources
+      entry: cargo clippy
+      language: system
+      args: ["--features", "sqlite,mysql,postgresql,enable_mimalloc", "--", "-D", "warnings"]
+      types_or: [rust, file]
+      files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
+      pass_filenames: false
+    - id: check-docker-templates
+      name: check docker templates
+      description: Check if the Docker templates are updated
+      language: system
+      entry: sh
+      args:
+        - "-c"
+        - "cd docker && make"
--- a/.typos.toml
+++ b/.typos.toml
@ -1,28 +0,0 @@
-[files]
-extend-exclude = [
-    ".git/",
-    "playwright/",
-    "*.js", # Ignore all JavaScript files
-    "!admin*.js", # Except our own JavaScript files
-]
-ignore-hidden = false
-
-[default]
-extend-ignore-re = [
-    # We use this in place of the reserved type identifier at some places
-    "typ",
-    # In SMTP it's called HELO, so ignore it
-    "(?i)helo_name",
-    "Server name sent during.+HELO",
-    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
-    "COSEKey",
-    "COSEAlgorithm",
-    # Ignore this specific string as it's valid
-    "Ensure they are valid OTPs",
-    # This word is misspelled upstream
-    # https://github.com/bitwarden/server/blob/dff9f1cf538198819911cf2c20f8cda3307701c5/src/Notifications/HubHelpers.cs#L86
-    # https://github.com/bitwarden/clients/blob/9612a4ac45063e372a6fbe87eb253c7cb3c588fb/libs/common/src/auth/services/anonymous-hub.service.ts#L45
-    "AuthRequestResponseRecieved",
-    # Ignore Punycode/IDN tests
-    "xn--.+"
-]
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@ -1,10 +1,3 @@
-[workspace.package]
-edition = "2021"
-rust-version = "1.93.0"
-license = "AGPL-3.0-only"
-repository = "https://github.com/dani-garcia/vaultwarden"
-publish = false
-
 [workspace]
 members = ["macros"]

@ -12,39 +5,35 @@ members = ["macros"]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
-readme = "README.md"
-build = "build.rs"
+edition = "2021"
+rust-version = "1.86.0"
 resolver = "2"
-repository.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-license.workspace = true
-publish.workspace = true
+
+repository = "https://github.com/dani-garcia/vaultwarden"
+readme = "README.md"
+license = "AGPL-3.0-only"
+publish = false
+build = "build.rs"

 [features]
-default = [
-    # "sqlite" or "sqlite_system",
-    # "mysql",
-    # "postgresql",
-]
+# default = ["sqlite"]
 # Empty to keep compatibility, prefer to set USE_SYSLOG=true
 enable_syslog = []
-# Please enable at least one of these DB backends.
 mysql = ["diesel/mysql", "diesel_migrations/mysql"]
 postgresql = ["diesel/postgres", "diesel_migrations/postgres"]
-sqlite_system = ["diesel/sqlite", "diesel_migrations/sqlite"]
-sqlite = ["sqlite_system", "libsqlite3-sys/bundled"] # Alternative to the above, statically linked SQLite into the binary instead of dynamically.
+sqlite = ["diesel/sqlite", "diesel_migrations/sqlite", "dep:libsqlite3-sys"]
 # Enable to use a vendored and statically linked openssl
 vendored_openssl = ["openssl/vendored"]
 # Enable MiMalloc memory allocator to replace the default malloc
 # This can improve performance for Alpine builds
 enable_mimalloc = ["dep:mimalloc"]
+# This is a development dependency, and should only be used during development!
+# It enables the usage of the diesel_logger crate, which is able to output the generated queries.
+# You also need to set an env variable `QUERY_LOGGER=1` to fully activate this so you do not have to re-compile
+# if you want to turn off the logging for a specific run.
+query_logger = ["dep:diesel_logger"]
 s3 = ["opendal/services-s3", "dep:aws-config", "dep:aws-credential-types", "dep:aws-smithy-runtime-api", "dep:anyhow", "dep:http", "dep:reqsign"]

-# OIDC specific features
-oidc-accept-rfc3339-timestamps = ["openidconnect/accept-rfc3339-timestamps"]
-oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]
-
 # Enable unstable features, requires nightly
 # Currently only used to enable rusts official ip support
 unstable = []
@ -57,153 +46,148 @@ syslog = "7.0.0"
 macros = { path = "./macros" }

 # Logging
-log = "0.4.29"
+log = "0.4.27"
 fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
-tracing = { version = "0.1.44", features = ["log"] } # Needed to have lettre and webauthn-rs trace logging to work
+tracing = { version = "0.1.41", features = ["log"] } # Needed to have lettre and webauthn-rs trace logging to work

 # A `dotenv` implementation for Rust
 dotenvy = { version = "0.15.7", default-features = false }

+# Lazy initialization
+once_cell = "1.21.3"
+
 # Numerical libraries
 num-traits = "0.2.19"
 num-derive = "0.4.2"
-bigdecimal = "0.4.10"
+bigdecimal = "0.4.8"

 # Web framework
 rocket = { version = "0.5.1", features = ["tls", "json"], default-features = false }
 rocket_ws = { version ="0.1.1" }

 # WebSockets libraries
-rmpv = "1.3.1" # MessagePack library
+rmpv = "1.3.0" # MessagePack library

 # Concurrent HashMap used for WebSocket messaging and favicons
 dashmap = "6.1.0"

 # Async futures
-futures = "0.3.32"
-tokio = { version = "1.52.1", features = ["rt-multi-thread", "fs", "io-util", "parking_lot", "time", "signal", "net"] }
-tokio-util = { version = "0.7.18", features = ["compat"]}
+futures = "0.3.31"
+tokio = { version = "1.47.0", features = ["rt-multi-thread", "fs", "io-util", "parking_lot", "time", "signal", "net"] }
+tokio-util = { version = "0.7.15", features = ["compat"]}

 # A generic serialization/deserialization framework
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.149"
+serde = { version = "1.0.219", features = ["derive"] }
+serde_json = "1.0.141"

 # A safe, extensible ORM and Query builder
-# Currently pinned diesel to v2.3.3 as newer version break MySQL/MariaDB compatibility
-diesel = { version = "2.3.9", features = ["chrono", "r2d2", "numeric"] }
-diesel_migrations = "2.3.2"
+diesel = { version = "2.2.12", features = ["chrono", "r2d2", "numeric"] }
+diesel_migrations = "2.2.0"
+diesel_logger = { version = "0.4.0", optional = true }

-derive_more = { version = "2.1.1", features = ["from", "into", "as_ref", "deref", "display"] }
+derive_more = { version = "2.0.1", features = ["from", "into", "as_ref", "deref", "display"] }
 diesel-derive-newtype = "2.1.2"

-# SQLite, statically bundled unless the `sqlite_system` feature is enabled
-libsqlite3-sys = { version = "0.37.0", optional = true }
+# Bundled/Static SQLite
+libsqlite3-sys = { version = "0.35.0", features = ["bundled"], optional = true }

 # Crypto-related libraries
-rand = "0.10.1"
+rand = "0.9.2"
 ring = "0.17.14"
 subtle = "2.6.1"

 # UUID generation
-uuid = { version = "1.23.1", features = ["v4"] }
+uuid = { version = "1.17.0", features = ["v4"] }

 # Date and time libraries
-chrono = { version = "0.4.44", features = ["clock", "serde"], default-features = false }
+chrono = { version = "0.4.41", features = ["clock", "serde"], default-features = false }
 chrono-tz = "0.10.4"
-time = "0.3.47"
+time = "0.3.41"

 # Job scheduler
-job_scheduler_ng = "2.4.0"
+job_scheduler_ng = "2.2.0"

 # Data encoding library Hex/Base32/Base64
-data-encoding = "2.11.0"
+data-encoding = "2.9.0"

 # JWT library
-jsonwebtoken = { version = "10.3.0", features = ["use_pem", "rust_crypto"], default-features = false }
+jsonwebtoken = "9.3.1"

 # TOTP library
 totp-lite = "2.0.1"

 # Yubico Library
-yubico = { package = "yubico_ng", version = "0.14.1", features = ["online-tokio"], default-features = false }
+yubico = { package = "yubico_ng", version = "0.13.0", features = ["online-tokio"], default-features = false }

 # WebAuthn libraries
-# danger-allow-state-serialisation is needed to save the state in the db
-# danger-credential-internals is needed to support U2F to Webauthn migration
-webauthn-rs = { version = "0.5.5", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
-webauthn-rs-proto = "0.5.5"
-webauthn-rs-core = "0.5.5"
+webauthn-rs = "0.3.2"

 # Handling of URL's for WebAuthn and favicons
-url = "2.5.8"
+url = "2.5.4"

 # Email libraries
-lettre = { version = "0.11.21", features = ["smtp-transport", "sendmail-transport", "builder", "serde", "hostname", "tracing", "tokio1-rustls", "ring", "rustls-native-certs"], default-features = false }
-percent-encoding = "2.3.2" # URL encoding library used for URL's in the emails
+lettre = { version = "0.11.18", features = ["smtp-transport", "sendmail-transport", "builder", "serde", "hostname", "tracing", "tokio1-rustls", "ring", "rustls-native-certs"], default-features = false }
+percent-encoding = "2.3.1" # URL encoding library used for URL's in the emails
 email_address = "0.2.9"

 # HTML Template library
-handlebars = { version = "6.4.0", features = ["dir_source"] }
+handlebars = { version = "6.3.2", features = ["dir_source"] }

 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.12.28", features = ["rustls-tls", "rustls-tls-native-roots", "stream", "json", "deflate", "gzip", "brotli", "zstd", "socks", "cookies", "charset", "http2", "system-proxy"], default-features = false}
-hickory-resolver = "0.26.1"
+reqwest = { version = "0.12.22", features = ["rustls-tls", "rustls-tls-native-roots", "stream", "json", "deflate", "gzip", "brotli", "zstd", "socks", "cookies", "charset", "http2", "system-proxy"], default-features = false}
+hickory-resolver = "0.25.2"

 # Favicon extraction libraries
-html5gum = "0.8.3"
-regex = { version = "1.12.3", features = ["std", "perf", "unicode-perl"], default-features = false }
-data-url = "0.3.2"
-bytes = "1.11.1"
-svg-hush = "0.9.6"
+html5gum = "0.7.0"
+regex = { version = "1.11.1", features = ["std", "perf", "unicode-perl"], default-features = false }
+data-url = "0.3.1"
+bytes = "1.10.1"
+svg-hush = "0.9.5"

 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "0.59.0", features = ["async"] }
+cached = { version = "0.56.0", features = ["async"] }

 # Used for custom short lived cookie jar during favicon extraction
 cookie = "0.18.1"
-cookie_store = "0.22.1"
+cookie_store = "0.21.1"

 # Used by U2F, JWT and PostgreSQL
-openssl = "0.10.78"
+openssl = "0.10.73"

 # CLI argument parsing
 pico-args = "0.5.0"

 # Macro ident concatenation
-pastey = "0.2.2"
-governor = "0.10.4"
-
-# OIDC for SSO
-openidconnect = { version = "4.0.1", features = ["reqwest", "rustls-tls"] }
-moka = { version = "0.12.15", features = ["future"] }
+pastey = "0.1.0"
+governor = "0.10.0"

 # Check client versions for specific features.
-semver = "1.0.28"
+semver = "1.0.26"

 # Allow overriding the default memory allocator
 # Mainly used for the musl builds, since the default musl malloc is very slow
-mimalloc = { version = "0.1.50", features = ["secure"], default-features = false, optional = true }
+mimalloc = { version = "0.1.47", features = ["secure"], default-features = false, optional = true }

-which = "8.0.2"
+which = "8.0.0"

 # Argon2 library with support for the PHC format
 argon2 = "0.5.3"

 # Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
-rpassword = "7.5.1"
+rpassword = "7.4.0"

 # Loading a dynamic CSS Stylesheet
 grass_compiler = { version = "0.13.4", default-features = false }

 # File are accessed through Apache OpenDAL
-opendal = { version = "0.55.0", features = ["services-fs"], default-features = false }
+opendal = { version = "0.54.0", features = ["services-fs"], default-features = false }

 # For retrieving AWS credentials, including temporary SSO credentials
-anyhow = { version = "1.0.102", optional = true }
-aws-config = { version = "1.8.16", features = ["behavior-version-latest", "rt-tokio", "credentials-process", "sso"], default-features = false, optional = true }
-aws-credential-types = { version = "1.2.14", optional = true }
-aws-smithy-runtime-api = { version = "1.12.0", optional = true }
-http = { version = "1.4.0", optional = true }
+anyhow = { version = "1.0.98", optional = true }
+aws-config = { version = "1.8.3", features = ["behavior-version-latest", "rt-tokio", "credentials-process", "sso"], default-features = false, optional = true }
+aws-credential-types = { version = "1.2.4", optional = true }
+aws-smithy-runtime-api = { version = "1.8.5", optional = true }
+http = { version = "1.3.1", optional = true }
 reqsign = { version = "0.16.5", optional = true }

 # Strip debuginfo from the release builds
@ -213,13 +197,23 @@ reqsign = { version = "0.16.5", optional = true }
 strip = "debuginfo"
 lto = "fat"
 codegen-units = 1
-debug = false
+
+# A little bit of a speedup
+[profile.dev]
+split-debuginfo = "unpacked"
+
+# Always build argon2 using opt-level 3
+# This is a huge speed improvement during testing
+[profile.dev.package.argon2]
+opt-level = 3

 # Optimize for size
 [profile.release-micro]
 inherits = "release"
-strip = "symbols"
 opt-level = "z"
+strip = "symbols"
+lto = "fat"
+codegen-units = 1
 panic = "abort"

 # Profile for systems with low resources
@ -230,32 +224,6 @@ strip = "symbols"
 lto = "thin"
 codegen-units = 16

-# Used for profiling and debugging like valgrind or heaptrack
-# Inherits release to be sure all optimizations have been done
-[profile.dbg]
-inherits = "release"
-strip = "none"
-split-debuginfo = "off"
-debug = "full"
-
-# A little bit of a speedup for generic building
-[profile.dev]
-split-debuginfo = "unpacked"
-debug = "line-tables-only"
-
-# Used for CI builds to improve compile time
-[profile.ci]
-inherits = "dev"
-debug = false
-debug-assertions = false
-strip = "symbols"
-panic = "abort"
-
-# Always build argon2 using opt-level 3
-# This is a huge speed improvement during testing
-[profile.dev.package.argon2]
-opt-level = 3
-
 # Linting config
 # https://doc.rust-lang.org/rustc/lints/groups.html
 [workspace.lints.rust]
@ -265,16 +233,15 @@ non_ascii_idents = "forbid"

 # Deny
 deprecated_in_future = "deny"
-deprecated_safe = { level = "deny", priority = -1 }
 future_incompatible = { level = "deny", priority = -1 }
 keyword_idents = { level = "deny", priority = -1 }
 let_underscore = { level = "deny", priority = -1 }
-nonstandard_style = { level = "deny", priority = -1 }
 noop_method_call = "deny"
 refining_impl_trait = { level = "deny", priority = -1 }
 rust_2018_idioms = { level = "deny", priority = -1 }
 rust_2021_compatibility = { level = "deny", priority = -1 }
 rust_2024_compatibility = { level = "deny", priority = -1 }
+edition_2024_expr_fragment_specifier = "allow" # Once changed to Rust 2024 this should be removed and macro's should be validated again
 single_use_lifetimes = "deny"
 trivial_casts = "deny"
 trivial_numeric_casts = "deny"
@ -284,8 +251,7 @@ unused_lifetimes = "deny"
 unused_qualifications = "deny"
 variant_size_differences = "deny"
 # Allow the following lints since these cause issues with Rust v1.84.0 or newer
-# Building Vaultwarden with Rust v1.85.0 with edition 2024 also works without issues
-edition_2024_expr_fragment_specifier = "allow" # Once changed to Rust 2024 this should be removed and macro's should be validated again
+# Building Vaultwarden with Rust v1.85.0 and edition 2024 also works without issues
 if_let_rescope = "allow"
 tail_expr_drop_order = "allow"

@ -299,16 +265,12 @@ todo = "warn"
 result_large_err = "allow"

 # Deny
-branches_sharing_code = "deny"
 case_sensitive_file_extension_comparisons = "deny"
 cast_lossless = "deny"
 clone_on_ref_ptr = "deny"
-duration_suboptimal_units = "deny"
 equatable_if_let = "deny"
-excessive_precision = "deny"
 filter_map_next = "deny"
 float_cmp_const = "deny"
-implicit_clone = "deny"
 inefficient_to_string = "deny"
 iter_on_empty_collections = "deny"
 iter_on_single_items = "deny"
@ -319,20 +281,16 @@ manual_instant_elapsed = "deny"
 manual_string_new = "deny"
 match_wildcard_for_single_variants = "deny"
 mem_forget = "deny"
-needless_borrow = "deny"
-needless_collect = "deny"
 needless_continue = "deny"
 needless_lifetimes = "deny"
 option_option = "deny"
-redundant_clone = "deny"
-ref_option = "deny"
 string_add_assign = "deny"
+string_to_string = "deny"
 unnecessary_join = "deny"
 unnecessary_self_imports = "deny"
 unnested_or_patterns = "deny"
 unused_async = "deny"
 unused_self = "deny"
-useless_let_if_seq = "deny"
 verbose_file_reads = "deny"
 zero_sized_map_values = "deny"

--- a/README.md
+++ b/README.md
@ -59,9 +59,8 @@ A nearly complete implementation of the Bitwarden Client API is provided, includ
 ## Usage

 > [!IMPORTANT]
-> The web-vault requires the use of HTTPS and a secure context for the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API). <br>
-> That means it will only work if you [enable HTTPS](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS). <br>
-> We also suggest to use a [reverse proxy](https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples).
+> The web-vault requires the use a secure context for the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API).
+> That means it will only work via `http://localhost:8000` (using the port from the example below) or if you [enable HTTPS](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS).

 The recommended way to install and use Vaultwarden is via our container images which are published to [ghcr.io](https://github.com/dani-garcia/vaultwarden/pkgs/container/vaultwarden), [docker.io](https://hub.docker.com/r/vaultwarden/server) and [quay.io](https://quay.io/repository/vaultwarden/server).
 See [which container image to use](https://github.com/dani-garcia/vaultwarden/wiki/Which-container-image-to-use) for an explanation of the provided tags.
--- a/build.rs
+++ b/build.rs
@ -2,26 +2,29 @@ use std::env;
 use std::process::Command;

 fn main() {
-    // These allow using e.g. #[cfg(mysql)] instead of #[cfg(feature = "mysql")], which helps when trying to add them through macros
-    #[cfg(feature = "sqlite_system")] // The `sqlite` feature implies this one.
+    // This allow using #[cfg(sqlite)] instead of #[cfg(feature = "sqlite")], which helps when trying to add them through macros
+    #[cfg(feature = "sqlite")]
    println!("cargo:rustc-cfg=sqlite");
    #[cfg(feature = "mysql")]
    println!("cargo:rustc-cfg=mysql");
    #[cfg(feature = "postgresql")]
    println!("cargo:rustc-cfg=postgresql");
-    #[cfg(not(any(feature = "sqlite_system", feature = "mysql", feature = "postgresql")))]
+    #[cfg(feature = "query_logger")]
+    println!("cargo:rustc-cfg=query_logger");
+    #[cfg(feature = "s3")]
+    println!("cargo:rustc-cfg=s3");
+
+    #[cfg(not(any(feature = "sqlite", feature = "mysql", feature = "postgresql")))]
    compile_error!(
        "You need to enable one DB backend. To build with previous defaults do: cargo build --features sqlite"
    );

-    #[cfg(feature = "s3")]
-    println!("cargo:rustc-cfg=s3");
-
    // Use check-cfg to let cargo know which cfg's we define,
    // and avoid warnings when they are used in the code.
    println!("cargo::rustc-check-cfg=cfg(sqlite)");
    println!("cargo::rustc-check-cfg=cfg(mysql)");
    println!("cargo::rustc-check-cfg=cfg(postgresql)");
+    println!("cargo::rustc-check-cfg=cfg(query_logger)");
    println!("cargo::rustc-check-cfg=cfg(s3)");

    // Rerun when these paths are changed.
@ -31,6 +34,9 @@ fn main() {
    println!("cargo:rerun-if-changed=.git/index");
    println!("cargo:rerun-if-changed=.git/refs/tags");

+    #[cfg(all(not(debug_assertions), feature = "query_logger"))]
+    compile_error!("Query Logging is only allowed during development, it is not intended for production usage!");
+
    // Support $BWRS_VERSION for legacy compatibility, but default to $VW_VERSION.
    // If neither exist, read from git.
    let maybe_vaultwarden_version =
--- a/diesel.toml
+++ b/diesel.toml
@ -2,4 +2,4 @@
 # see diesel.rs/guides/configuring-diesel-cli

 [print_schema]
-file = "src/db/schema.rs"
+file = "src/db/schema.rs"
--- a/docker/DockerSettings.yaml
+++ b/docker/DockerSettings.yaml
@ -1,13 +1,13 @@
 ---
-vault_version: "v2026.4.1"
-vault_image_digest: "sha256:ca2a4251c4e63c9ad428262b4dd452789a1b9f6fce71da351e93dceed0d2edbe"
-# Cross Compile Docker Helper Scripts v1.9.0
+vault_version: "v2025.7.0"
+vault_image_digest: "sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e"
+# Cross Compile Docker Helper Scripts v1.6.1
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
-xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
-rust_version: 1.95.0 # Rust version to be used
-debian_version: trixie # Debian release name to be used
-alpine_version: "3.23" # Alpine version to be used
+xx_image_digest: "sha256:9c207bead753dda9430bdd15425c6518fc7a03d866103c516a2c6889188f5894"
+rust_version: 1.88.0 # Rust version to be used
+debian_version: bookworm # Debian release name to be used
+alpine_version: "3.22" # Alpine version to be used
 # For which platforms/architectures will we try to build images
 platforms: ["linux/amd64", "linux/arm64", "linux/arm/v7", "linux/arm/v6"]
 # Determine the build images per OS/Arch
@ -17,6 +17,7 @@ build_stage_image:
    platform: "$BUILDPLATFORM"
  alpine:
    image: "build_${TARGETARCH}${TARGETVARIANT}"
+    platform: "linux/amd64" # The Alpine build images only have linux/amd64 images
    arch_image:
      amd64: "ghcr.io/blackdex/rust-musl:x86_64-musl-stable-{{rust_version}}"
      arm64: "ghcr.io/blackdex/rust-musl:aarch64-musl-stable-{{rust_version}}"
--- a/docker/Dockerfile.alpine
+++ b/docker/Dockerfile.alpine
@ -19,27 +19,27 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.4.1
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.4.1
-#     [docker.io/vaultwarden/web-vault@sha256:ca2a4251c4e63c9ad428262b4dd452789a1b9f6fce71da351e93dceed0d2edbe]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2025.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2025.7.0
+#     [docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ca2a4251c4e63c9ad428262b4dd452789a1b9f6fce71da351e93dceed0d2edbe
-#     [docker.io/vaultwarden/web-vault:v2026.4.1]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e
+#     [docker.io/vaultwarden/web-vault:v2025.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ca2a4251c4e63c9ad428262b4dd452789a1b9f6fce71da351e93dceed0d2edbe AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e AS vault

 ########################## ALPINE BUILD IMAGES ##########################
-## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
+## NOTE: The Alpine Base Images do not support other platforms then linux/amd64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.95.0 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.95.0 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.95.0 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.95.0 AS build_armv6
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.88.0 AS build_amd64
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.88.0 AS build_arm64
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.88.0 AS build_armv7
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.88.0 AS build_armv6

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM build_${TARGETARCH}${TARGETVARIANT} AS build
+FROM --platform=linux/amd64 build_${TARGETARCH}${TARGETVARIANT} AS build
 ARG TARGETARCH
 ARG TARGETVARIANT
 ARG TARGETPLATFORM
@ -53,9 +53,9 @@ ENV DEBIAN_FRONTEND=noninteractive \
    TERM=xterm-256color \
    CARGO_HOME="/root/.cargo" \
    USER="root" \
-    # Use PostgreSQL v17 during Alpine/MUSL builds instead of the default v16
-    # Debian Trixie uses libpq v17
-    PQ_LIB_DIR="/usr/local/musl/pq17/lib"
+    # Use PostgreSQL v15 during Alpine/MUSL builds instead of the default v11
+    # Debian Bookworm already contains libpq v15
+    PQ_LIB_DIR="/usr/local/musl/pq15/lib"


 # Create CARGO_HOME folder and don't download rust docs
@ -127,7 +127,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
-FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.23
+FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.22

 ENV ROCKET_PROFILE="release" \
    ROCKET_ADDRESS=0.0.0.0 \
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@ -19,24 +19,24 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.4.1
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.4.1
-#     [docker.io/vaultwarden/web-vault@sha256:ca2a4251c4e63c9ad428262b4dd452789a1b9f6fce71da351e93dceed0d2edbe]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2025.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2025.7.0
+#     [docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ca2a4251c4e63c9ad428262b4dd452789a1b9f6fce71da351e93dceed0d2edbe
-#     [docker.io/vaultwarden/web-vault:v2026.4.1]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e
+#     [docker.io/vaultwarden/web-vault:v2025.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ca2a4251c4e63c9ad428262b4dd452789a1b9f6fce71da351e93dceed0d2edbe AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e AS vault

 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
 ## And these bash scripts do not have any significant difference if at all
-FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
+FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:9c207bead753dda9430bdd15425c6518fc7a03d866103c516a2c6889188f5894 AS xx

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.95.0-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.88.0-slim-bookworm AS build
 COPY --from=xx / /
 ARG TARGETARCH
 ARG TARGETVARIANT
@ -51,6 +51,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
    TERM=xterm-256color \
    CARGO_HOME="/root/.cargo" \
    USER="root"
+
 # Install clang to get `xx-cargo` working
 # Install pkg-config to allow amd64 builds to find all libraries
 # Install git so build.rs can determine the correct version
@ -67,11 +68,15 @@ RUN apt-get update && \
    xx-apt-get install -y \
        --no-install-recommends \
        gcc \
+        libmariadb3 \
        libpq-dev \
        libpq5 \
        libssl-dev \
-        libmariadb-dev \
        zlib1g-dev && \
+    # Force install arch dependend mariadb dev packages
+    # Installing them the normal way breaks several other packages (again)
+    apt-get download "libmariadb-dev-compat:$(xx-info debian-arch)" "libmariadb-dev:$(xx-info debian-arch)" && \
+    dpkg --force-all -i ./libmariadb-dev*.deb && \
    # Run xx-cargo early, since it sometimes seems to break when run at a later stage
    echo "export CARGO_TARGET=$(xx-cargo --print-target-triple)" >> /env-cargo

@ -161,7 +166,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
-FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim
+FROM --platform=$TARGETPLATFORM docker.io/library/debian:bookworm-slim

 ENV ROCKET_PROFILE="release" \
    ROCKET_ADDRESS=0.0.0.0 \
@ -174,7 +179,7 @@ RUN mkdir /data && \
        --no-install-recommends \
        ca-certificates \
        curl \
-        libmariadb3 \
+        libmariadb-dev-compat \
        libpq5 \
        openssl && \
    apt-get clean && \
--- a/docker/Dockerfile.j2
+++ b/docker/Dockerfile.j2
@ -19,13 +19,13 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:{{ vault_version | replace('+', '_') }}
-#     $ docker image inspect --format "{{ '{{' }}.RepoDigests}}" docker.io/vaultwarden/web-vault:{{ vault_version | replace('+', '_') }}
+#     $ docker pull docker.io/vaultwarden/web-vault:{{ vault_version }}
+#     $ docker image inspect --format "{{ '{{' }}.RepoDigests}}" docker.io/vaultwarden/web-vault:{{ vault_version }}
 #     [docker.io/vaultwarden/web-vault@{{ vault_image_digest }}]
 #
 # - Conversely, to get the tag name from the digest:
 #     $ docker image inspect --format "{{ '{{' }}.RepoTags}}" docker.io/vaultwarden/web-vault@{{ vault_image_digest }}
-#     [docker.io/vaultwarden/web-vault:{{ vault_version | replace('+', '_') }}]
+#     [docker.io/vaultwarden/web-vault:{{ vault_version }}]
 #
 FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault

@ -36,16 +36,16 @@ FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_diges
 FROM --platform=linux/amd64 docker.io/tonistiigi/xx@{{ xx_image_digest }} AS xx
 {% elif base == "alpine" %}
 ########################## ALPINE BUILD IMAGES ##########################
-## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
+## NOTE: The Alpine Base Images do not support other platforms then linux/amd64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
 {% for arch in build_stage_image[base].arch_image %}
-FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].arch_image[arch] }} AS build_{{ arch }}
+FROM --platform={{ build_stage_image[base].platform }} {{ build_stage_image[base].arch_image[arch] }} AS build_{{ arch }}
 {% endfor %}
 {% endif %}

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].image }} AS build
+FROM --platform={{ build_stage_image[base].platform }} {{ build_stage_image[base].image }} AS build
 {% if base == "debian" %}
 COPY --from=xx / /
 {% endif %}
@ -63,12 +63,13 @@ ENV DEBIAN_FRONTEND=noninteractive \
    CARGO_HOME="/root/.cargo" \
    USER="root"
 {%- if base == "alpine" %} \
-    # Use PostgreSQL v17 during Alpine/MUSL builds instead of the default v16
-    # Debian Trixie uses libpq v17
-    PQ_LIB_DIR="/usr/local/musl/pq17/lib"
+    # Use PostgreSQL v15 during Alpine/MUSL builds instead of the default v11
+    # Debian Bookworm already contains libpq v15
+    PQ_LIB_DIR="/usr/local/musl/pq15/lib"
 {% endif %}

 {% if base == "debian" %}
+
 # Install clang to get `xx-cargo` working
 # Install pkg-config to allow amd64 builds to find all libraries
 # Install git so build.rs can determine the correct version
@ -85,11 +86,15 @@ RUN apt-get update && \
    xx-apt-get install -y \
        --no-install-recommends \
        gcc \
+        libmariadb3 \
        libpq-dev \
        libpq5 \
        libssl-dev \
-        libmariadb-dev \
        zlib1g-dev && \
+    # Force install arch dependend mariadb dev packages
+    # Installing them the normal way breaks several other packages (again)
+    apt-get download "libmariadb-dev-compat:$(xx-info debian-arch)" "libmariadb-dev:$(xx-info debian-arch)" && \
+    dpkg --force-all -i ./libmariadb-dev*.deb && \
    # Run xx-cargo early, since it sometimes seems to break when run at a later stage
    echo "export CARGO_TARGET=$(xx-cargo --print-target-triple)" >> /env-cargo
 {% endif %}
@ -211,7 +216,7 @@ RUN mkdir /data && \
        --no-install-recommends \
        ca-certificates \
        curl \
-        libmariadb3 \
+        libmariadb-dev-compat \
        libpq5 \
        openssl && \
    apt-get clean && \
--- a/docker/README.md
+++ b/docker/README.md
@ -116,7 +116,7 @@ docker/bake.sh
 ```

 You can append both `alpine` and `debian` with `-amd64`, `-arm64`, `-armv7` or `-armv6`, which will trigger a build for that specific platform.<br>
-This will also append those values to the tag so you can see the built container when running `docker images`.
+This will also append those values to the tag so you can see the builded container when running `docker images`.

 You can also append extra arguments after the target if you want. This can be useful for example to print what bake will use.
 ```bash
@ -162,7 +162,7 @@ You can append extra arguments after the target if you want. This can be useful

 For the podman builds you can, just like the `bake.sh` script, also append the architecture to build for that specific platform.<br>

-### Testing podman built images
+### Testing podman builded images

 The command to start a podman built container is almost the same as for the docker/bake built containers. The images start with `localhost/`, so you need to prepend that.

--- a/macros/Cargo.toml
+++ b/macros/Cargo.toml
@ -1,11 +1,7 @@
 [package]
 name = "macros"
 version = "0.1.0"
-repository.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-license.workspace = true
-publish.workspace = true
+edition = "2021"

 [lib]
 name = "macros"
@ -13,8 +9,8 @@ path = "src/lib.rs"
 proc-macro = true

 [dependencies]
-quote = "1.0.45"
-syn = "2.0.117"
+quote = "1.0.40"
+syn = "2.0.104"

 [lints]
 workspace = true
--- a/migrations/mysql/2023-09-10-133000_add_sso/down.sql
+++ b/migrations/mysql/2023-09-10-133000_add_sso/down.sql
@ -1 +0,0 @@
-DROP TABLE sso_nonce;
--- a/migrations/mysql/2023-09-10-133000_add_sso/up.sql
+++ b/migrations/mysql/2023-09-10-133000_add_sso/up.sql
@ -1,4 +0,0 @@
-CREATE TABLE sso_nonce (
-  nonce               CHAR(36) NOT NULL PRIMARY KEY,
-  created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/mysql/2023-09-14-133000_add_users_organizations_invited_by_email/down.sql
+++ b/migrations/mysql/2023-09-14-133000_add_users_organizations_invited_by_email/down.sql
@ -1 +0,0 @@
-ALTER TABLE users_organizations DROP COLUMN invited_by_email;
--- a/migrations/mysql/2023-09-14-133000_add_users_organizations_invited_by_email/up.sql
+++ b/migrations/mysql/2023-09-14-133000_add_users_organizations_invited_by_email/up.sql
@ -1 +0,0 @@
-ALTER TABLE users_organizations ADD COLUMN invited_by_email TEXT DEFAULT NULL;
--- a/migrations/mysql/2024-02-14-170000_add_state_to_sso_nonce/down.sql
+++ b/migrations/mysql/2024-02-14-170000_add_state_to_sso_nonce/down.sql
@ -1,6 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_nonce (
-  nonce               CHAR(36) NOT NULL PRIMARY KEY,
-  created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/mysql/2024-02-14-170000_add_state_to_sso_nonce/up.sql
+++ b/migrations/mysql/2024-02-14-170000_add_state_to_sso_nonce/up.sql
@ -1,8 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_nonce (
-	state               VARCHAR(512) NOT NULL PRIMARY KEY,
-  	nonce               TEXT NOT NULL,
-  	redirect_uri 		TEXT NOT NULL,
-  	created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/mysql/2024-02-26-170000_add_pkce_to_sso_nonce/down.sql
+++ b/migrations/mysql/2024-02-26-170000_add_pkce_to_sso_nonce/down.sql
@ -1,8 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_nonce (
-    state               VARCHAR(512) NOT NULL PRIMARY KEY,
-    nonce               TEXT NOT NULL,
-    redirect_uri        TEXT NOT NULL,
-    created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/mysql/2024-02-26-170000_add_pkce_to_sso_nonce/up.sql
+++ b/migrations/mysql/2024-02-26-170000_add_pkce_to_sso_nonce/up.sql
@ -1,9 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_nonce (
-    state               VARCHAR(512) NOT NULL PRIMARY KEY,
-  	nonce               TEXT NOT NULL,
-    verifier            TEXT,
-  	redirect_uri 		TEXT NOT NULL,
-  	created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/mysql/2024-03-06-170000_add_sso_users/down.sql
+++ b/migrations/mysql/2024-03-06-170000_add_sso_users/down.sql
@ -1 +0,0 @@
-DROP TABLE IF EXISTS sso_users;
--- a/migrations/mysql/2024-03-06-170000_add_sso_users/up.sql
+++ b/migrations/mysql/2024-03-06-170000_add_sso_users/up.sql
@ -1,7 +0,0 @@
-CREATE TABLE sso_users (
-  user_uuid           CHAR(36) NOT NULL PRIMARY KEY,
-  identifier          VARCHAR(768) NOT NULL UNIQUE,
-  created_at          TIMESTAMP NOT NULL DEFAULT now(),
-
-  FOREIGN KEY(user_uuid) REFERENCES users(uuid)
-);
--- a/migrations/mysql/2024-03-13-170000_sso_users_cascade/down.sql
+++ b/migrations/mysql/2024-03-13-170000_sso_users_cascade/down.sql
--- a/migrations/mysql/2024-03-13-170000_sso_users_cascade/up.sql
+++ b/migrations/mysql/2024-03-13-170000_sso_users_cascade/up.sql
@ -1,15 +0,0 @@
-- Dynamically create DROP FOREIGN KEY
-- Some versions of MySQL or MariaDB might fail if the key doesn't exists
-- This checks if the key exists, and if so, will drop it.
-SET @drop_sso_fk = IF((SELECT true FROM information_schema.TABLE_CONSTRAINTS WHERE
-    CONSTRAINT_SCHEMA = DATABASE() AND
-    TABLE_NAME = 'sso_users' AND
-    CONSTRAINT_NAME = 'sso_users_ibfk_1' AND
-    CONSTRAINT_TYPE = 'FOREIGN KEY') = true,
-    'ALTER TABLE sso_users DROP FOREIGN KEY sso_users_ibfk_1',
-    'SELECT 1');
-PREPARE stmt FROM @drop_sso_fk;
-EXECUTE stmt;
-DEALLOCATE PREPARE stmt;
-
-ALTER TABLE sso_users ADD FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE;
--- a/migrations/mysql/2025-08-20-120000_sso_nonce_to_auth/down.sql
+++ b/migrations/mysql/2025-08-20-120000_sso_nonce_to_auth/down.sql
@ -1,9 +0,0 @@
-DROP TABLE IF EXISTS sso_auth;
-
-CREATE TABLE sso_nonce (
-    state               VARCHAR(512) NOT NULL PRIMARY KEY,
-    nonce               TEXT NOT NULL,
-    verifier            TEXT,
-    redirect_uri        TEXT NOT NULL,
-    created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/mysql/2025-08-20-120000_sso_nonce_to_auth/up.sql
+++ b/migrations/mysql/2025-08-20-120000_sso_nonce_to_auth/up.sql
@ -1,12 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_auth (
-    state               VARCHAR(512) NOT NULL PRIMARY KEY,
-    client_challenge    TEXT NOT NULL,
-    nonce               TEXT NOT NULL,
-    redirect_uri        TEXT NOT NULL,
-    code_response       TEXT,
-    auth_response       TEXT,
-    created_at          TIMESTAMP NOT NULL DEFAULT now(),
-    updated_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/mysql/2026-03-09-005927_add_archives/down.sql
+++ b/migrations/mysql/2026-03-09-005927_add_archives/down.sql
@ -1 +0,0 @@
-DROP TABLE IF EXISTS archives;
--- a/migrations/mysql/2026-03-09-005927_add_archives/up.sql
+++ b/migrations/mysql/2026-03-09-005927_add_archives/up.sql
@ -1,10 +0,0 @@
-DROP TABLE IF EXISTS archives;
-
-CREATE TABLE archives (
-    user_uuid   CHAR(36) NOT NULL,
-    cipher_uuid CHAR(36) NOT NULL,
-    archived_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    PRIMARY KEY (user_uuid, cipher_uuid),
-    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE,
-    FOREIGN KEY (cipher_uuid) REFERENCES ciphers (uuid) ON DELETE CASCADE
-);
--- a/migrations/mysql/2026-04-25-120000_sso_auth_binding/down.sql
+++ b/migrations/mysql/2026-04-25-120000_sso_auth_binding/down.sql
@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN binding_hash;
--- a/migrations/mysql/2026-04-25-120000_sso_auth_binding/up.sql
+++ b/migrations/mysql/2026-04-25-120000_sso_auth_binding/up.sql
@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
--- a/migrations/postgresql/2023-09-10-133000_add_sso/down.sql
+++ b/migrations/postgresql/2023-09-10-133000_add_sso/down.sql
@ -1 +0,0 @@
-DROP TABLE sso_nonce;
--- a/migrations/postgresql/2023-09-10-133000_add_sso/up.sql
+++ b/migrations/postgresql/2023-09-10-133000_add_sso/up.sql
@ -1,4 +0,0 @@
-CREATE TABLE sso_nonce (
-  nonce               CHAR(36) NOT NULL PRIMARY KEY,
-  created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/postgresql/2023-09-14-133000_add_users_organizations_invited_by_email/down.sql
+++ b/migrations/postgresql/2023-09-14-133000_add_users_organizations_invited_by_email/down.sql
@ -1 +0,0 @@
-ALTER TABLE users_organizations DROP COLUMN invited_by_email;
--- a/migrations/postgresql/2023-09-14-133000_add_users_organizations_invited_by_email/up.sql
+++ b/migrations/postgresql/2023-09-14-133000_add_users_organizations_invited_by_email/up.sql
@ -1 +0,0 @@
-ALTER TABLE users_organizations ADD COLUMN invited_by_email TEXT DEFAULT NULL;
--- a/migrations/postgresql/2024-02-14-170000_add_state_to_sso_nonce/down.sql
+++ b/migrations/postgresql/2024-02-14-170000_add_state_to_sso_nonce/down.sql
@ -1,6 +0,0 @@
-DROP TABLE sso_nonce;
-
-CREATE TABLE sso_nonce (
-  nonce               CHAR(36) NOT NULL PRIMARY KEY,
-  created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/postgresql/2024-02-14-170000_add_state_to_sso_nonce/up.sql
+++ b/migrations/postgresql/2024-02-14-170000_add_state_to_sso_nonce/up.sql
@ -1,8 +0,0 @@
-DROP TABLE sso_nonce;
-
-CREATE TABLE sso_nonce (
-	state               TEXT NOT NULL PRIMARY KEY,
-  	nonce               TEXT NOT NULL,
-  	redirect_uri 		TEXT NOT NULL,
-  	created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/postgresql/2024-02-26-170000_add_pkce_to_sso_nonce/down.sql
+++ b/migrations/postgresql/2024-02-26-170000_add_pkce_to_sso_nonce/down.sql
@ -1,8 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_nonce (
-    state               TEXT NOT NULL PRIMARY KEY,
-    nonce               TEXT NOT NULL,
-    redirect_uri        TEXT NOT NULL,
-    created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/postgresql/2024-02-26-170000_add_pkce_to_sso_nonce/up.sql
+++ b/migrations/postgresql/2024-02-26-170000_add_pkce_to_sso_nonce/up.sql
@ -1,9 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_nonce (
-    state               TEXT NOT NULL PRIMARY KEY,
-    nonce               TEXT NOT NULL,
-    verifier            TEXT,
-    redirect_uri        TEXT NOT NULL,
-    created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/postgresql/2024-03-06-170000_add_sso_users/down.sql
+++ b/migrations/postgresql/2024-03-06-170000_add_sso_users/down.sql
@ -1 +0,0 @@
-DROP TABLE IF EXISTS sso_users;
--- a/migrations/postgresql/2024-03-06-170000_add_sso_users/up.sql
+++ b/migrations/postgresql/2024-03-06-170000_add_sso_users/up.sql
@ -1,7 +0,0 @@
-CREATE TABLE sso_users (
-  user_uuid           CHAR(36) NOT NULL PRIMARY KEY,
-  identifier          TEXT NOT NULL UNIQUE,
-  created_at          TIMESTAMP NOT NULL DEFAULT now(),
-
-  FOREIGN KEY(user_uuid) REFERENCES users(uuid)
-);
--- a/migrations/postgresql/2024-03-13-170000_sso_users_cascade/down.sql
+++ b/migrations/postgresql/2024-03-13-170000_sso_users_cascade/down.sql
--- a/migrations/postgresql/2024-03-13-170000_sso_users_cascade/up.sql
+++ b/migrations/postgresql/2024-03-13-170000_sso_users_cascade/up.sql
@ -1,3 +0,0 @@
-ALTER TABLE sso_users
-  DROP CONSTRAINT "sso_users_user_uuid_fkey",
-  ADD CONSTRAINT "sso_users_user_uuid_fkey" FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE;
--- a/migrations/postgresql/2025-08-20-120000_sso_nonce_to_auth/down.sql
+++ b/migrations/postgresql/2025-08-20-120000_sso_nonce_to_auth/down.sql
@ -1,9 +0,0 @@
-DROP TABLE IF EXISTS sso_auth;
-
-CREATE TABLE sso_nonce (
-    state               TEXT NOT NULL PRIMARY KEY,
-    nonce               TEXT NOT NULL,
-    verifier            TEXT,
-    redirect_uri        TEXT NOT NULL,
-    created_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/postgresql/2025-08-20-120000_sso_nonce_to_auth/up.sql
+++ b/migrations/postgresql/2025-08-20-120000_sso_nonce_to_auth/up.sql
@ -1,12 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_auth (
-    state               TEXT NOT NULL PRIMARY KEY,
-    client_challenge    TEXT NOT NULL,
-    nonce               TEXT NOT NULL,
-    redirect_uri        TEXT NOT NULL,
-    code_response       TEXT,
-    auth_response       TEXT,
-    created_at          TIMESTAMP NOT NULL DEFAULT now(),
-    updated_at          TIMESTAMP NOT NULL DEFAULT now()
-);
--- a/migrations/postgresql/2026-03-09-005927_add_archives/down.sql
+++ b/migrations/postgresql/2026-03-09-005927_add_archives/down.sql
@ -1 +0,0 @@
-DROP TABLE IF EXISTS archives;
--- a/migrations/postgresql/2026-03-09-005927_add_archives/up.sql
+++ b/migrations/postgresql/2026-03-09-005927_add_archives/up.sql
@ -1,8 +0,0 @@
-DROP TABLE IF EXISTS archives;
-
-CREATE TABLE archives (
-    user_uuid   CHAR(36) NOT NULL REFERENCES users (uuid) ON DELETE CASCADE,
-    cipher_uuid CHAR(36) NOT NULL REFERENCES ciphers (uuid) ON DELETE CASCADE,
-    archived_at TIMESTAMP NOT NULL DEFAULT now(),
-    PRIMARY KEY (user_uuid, cipher_uuid)
-);
--- a/migrations/postgresql/2026-04-25-120000_sso_auth_binding/down.sql
+++ b/migrations/postgresql/2026-04-25-120000_sso_auth_binding/down.sql
@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN binding_hash;
--- a/migrations/postgresql/2026-04-25-120000_sso_auth_binding/up.sql
+++ b/migrations/postgresql/2026-04-25-120000_sso_auth_binding/up.sql
@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
--- a/migrations/sqlite/2023-09-10-133000_add_sso/down.sql
+++ b/migrations/sqlite/2023-09-10-133000_add_sso/down.sql
@ -1 +0,0 @@
-DROP TABLE sso_nonce;
--- a/migrations/sqlite/2023-09-10-133000_add_sso/up.sql
+++ b/migrations/sqlite/2023-09-10-133000_add_sso/up.sql
@ -1,4 +0,0 @@
-CREATE TABLE sso_nonce (
-  nonce               CHAR(36) NOT NULL PRIMARY KEY,
-  created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/sqlite/2023-09-14-133000_add_users_organizations_invited_by_email/down.sql
+++ b/migrations/sqlite/2023-09-14-133000_add_users_organizations_invited_by_email/down.sql
@ -1 +0,0 @@
-ALTER TABLE users_organizations DROP COLUMN invited_by_email;
--- a/migrations/sqlite/2023-09-14-133000_add_users_organizations_invited_by_email/up.sql
+++ b/migrations/sqlite/2023-09-14-133000_add_users_organizations_invited_by_email/up.sql
@ -1 +0,0 @@
-ALTER TABLE users_organizations ADD COLUMN invited_by_email TEXT DEFAULT NULL;
--- a/migrations/sqlite/2024-02-14-170000_add_state_to_sso_nonce/down.sql
+++ b/migrations/sqlite/2024-02-14-170000_add_state_to_sso_nonce/down.sql
@ -1,6 +0,0 @@
-DROP TABLE sso_nonce;
-
-CREATE TABLE sso_nonce (
-  nonce               CHAR(36) NOT NULL PRIMARY KEY,
-  created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/sqlite/2024-02-14-170000_add_state_to_sso_nonce/up.sql
+++ b/migrations/sqlite/2024-02-14-170000_add_state_to_sso_nonce/up.sql
@ -1,8 +0,0 @@
-DROP TABLE sso_nonce;
-
-CREATE TABLE sso_nonce (
-  state               TEXT NOT NULL PRIMARY KEY,
-  nonce               TEXT NOT NULL,
-  redirect_uri        TEXT NOT NULL,
-  created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/sqlite/2024-02-26-170000_add_pkce_to_sso_nonce/down.sql
+++ b/migrations/sqlite/2024-02-26-170000_add_pkce_to_sso_nonce/down.sql
@ -1,8 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_nonce (
-  state               TEXT NOT NULL PRIMARY KEY,
-  nonce               TEXT NOT NULL,
-  redirect_uri        TEXT NOT NULL,
-  created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/sqlite/2024-02-26-170000_add_pkce_to_sso_nonce/up.sql
+++ b/migrations/sqlite/2024-02-26-170000_add_pkce_to_sso_nonce/up.sql
@ -1,9 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_nonce (
-  state               TEXT NOT NULL PRIMARY KEY,
-  nonce               TEXT NOT NULL,
-  verifier            TEXT,
-  redirect_uri        TEXT NOT NULL,
-  created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/sqlite/2024-03-06-170000_add_sso_users/down.sql
+++ b/migrations/sqlite/2024-03-06-170000_add_sso_users/down.sql
@ -1 +0,0 @@
-DROP TABLE IF EXISTS sso_users;
--- a/migrations/sqlite/2024-03-06-170000_add_sso_users/up.sql
+++ b/migrations/sqlite/2024-03-06-170000_add_sso_users/up.sql
@ -1,7 +0,0 @@
-CREATE TABLE sso_users (
-  user_uuid           CHAR(36) NOT NULL PRIMARY KEY,
-  identifier          TEXT NOT NULL UNIQUE,
-  created_at          TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-  FOREIGN KEY(user_uuid) REFERENCES users(uuid)
-);
--- a/migrations/sqlite/2024-03-13_170000_sso_userscascade/down.sql
+++ b/migrations/sqlite/2024-03-13_170000_sso_userscascade/down.sql
--- a/migrations/sqlite/2024-03-13_170000_sso_userscascade/up.sql
+++ b/migrations/sqlite/2024-03-13_170000_sso_userscascade/up.sql
@ -1,9 +0,0 @@
-DROP TABLE IF EXISTS sso_users;
-
-CREATE TABLE sso_users (
-  user_uuid           CHAR(36) NOT NULL PRIMARY KEY,
-  identifier          TEXT NOT NULL UNIQUE,
-  created_at          TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-  FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE
-);
--- a/migrations/sqlite/2025-08-20-120000_sso_nonce_to_auth/down.sql
+++ b/migrations/sqlite/2025-08-20-120000_sso_nonce_to_auth/down.sql
@ -1,9 +0,0 @@
-DROP TABLE IF EXISTS sso_auth;
-
-CREATE TABLE sso_nonce (
-  state               TEXT NOT NULL PRIMARY KEY,
-  nonce               TEXT NOT NULL,
-  verifier            TEXT,
-  redirect_uri        TEXT NOT NULL,
-  created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/sqlite/2025-08-20-120000_sso_nonce_to_auth/up.sql
+++ b/migrations/sqlite/2025-08-20-120000_sso_nonce_to_auth/up.sql
@ -1,12 +0,0 @@
-DROP TABLE IF EXISTS sso_nonce;
-
-CREATE TABLE sso_auth (
-    state               TEXT NOT NULL PRIMARY KEY,
-    client_challenge    TEXT NOT NULL,
-    nonce               TEXT NOT NULL,
-    redirect_uri        TEXT NOT NULL,
-    code_response       TEXT,
-    auth_response       TEXT,
-    created_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
--- a/migrations/sqlite/2026-03-09-005927_add_archives/down.sql
+++ b/migrations/sqlite/2026-03-09-005927_add_archives/down.sql
@ -1 +0,0 @@
-DROP TABLE IF EXISTS archives;
--- a/migrations/sqlite/2026-03-09-005927_add_archives/up.sql
+++ b/migrations/sqlite/2026-03-09-005927_add_archives/up.sql
@ -1,8 +0,0 @@
-DROP TABLE IF EXISTS archives;
-
-CREATE TABLE archives (
-    user_uuid   CHAR(36) NOT NULL REFERENCES users (uuid) ON DELETE CASCADE,
-    cipher_uuid CHAR(36) NOT NULL REFERENCES ciphers (uuid) ON DELETE CASCADE,
-    archived_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    PRIMARY KEY (user_uuid, cipher_uuid)
-);
--- a/migrations/sqlite/2026-04-25-120000_sso_auth_binding/down.sql
+++ b/migrations/sqlite/2026-04-25-120000_sso_auth_binding/down.sql
@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN binding_hash;
--- a/migrations/sqlite/2026-04-25-120000_sso_auth_binding/up.sql
+++ b/migrations/sqlite/2026-04-25-120000_sso_auth_binding/up.sql
@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
--- a/playwright/.env.template
+++ b/playwright/.env.template
@ -1,64 +0,0 @@
-#################################
-### Conf to run dev instances ###
-#################################
-ENV=dev
-DC_ENV_FILE=.env
-COMPOSE_IGNORE_ORPHANS=True
-DOCKER_BUILDKIT=1
-
-################
-# Users Config #
-################
-TEST_USER=test
-TEST_USER_PASSWORD=${TEST_USER}
-TEST_USER_MAIL=${TEST_USER}@yopmail.com
-
-TEST_USER2=test2
-TEST_USER2_PASSWORD=${TEST_USER2}
-TEST_USER2_MAIL=${TEST_USER2}@yopmail.com
-
-TEST_USER3=test3
-TEST_USER3_PASSWORD=${TEST_USER3}
-TEST_USER3_MAIL=${TEST_USER3}@yopmail.com
-
-###################
-# Keycloak Config #
-###################
-KEYCLOAK_ADMIN=admin
-KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
-KC_HTTP_HOST=127.0.0.1
-KC_HTTP_PORT=8080
-
-# Script parameters (use Keycloak and Vaultwarden config too)
-TEST_REALM=test
-DUMMY_REALM=dummy
-DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
-
-######################
-# Vaultwarden Config #
-######################
-ROCKET_ADDRESS=0.0.0.0
-ROCKET_PORT=8000
-DOMAIN=http://localhost:${ROCKET_PORT}
-LOG_LEVEL=info,oidcwarden::sso=debug
-I_REALLY_WANT_VOLATILE_STORAGE=true
-
-SSO_ENABLED=true
-SSO_ONLY=false
-SSO_CLIENT_ID=warden
-SSO_CLIENT_SECRET=warden
-SSO_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${TEST_REALM}
-
-SMTP_HOST=127.0.0.1
-SMTP_PORT=1025
-SMTP_SECURITY=off
-SMTP_TIMEOUT=5
-SMTP_FROM=vaultwarden@test
-SMTP_FROM_NAME=Vaultwarden
-
-########################################################
-# DUMMY values for docker-compose to stop bothering us #
-########################################################
-MARIADB_PORT=3305
-MYSQL_PORT=3307
-POSTGRES_PORT=5432
--- a/playwright/.gitignore
+++ b/playwright/.gitignore
@ -1,6 +0,0 @@
-logs
-node_modules/
-/test-results/
-/playwright-report/
-/playwright/.cache/
-temp
--- a/playwright/README.md
+++ b/playwright/README.md
@ -1,179 +0,0 @@
-# Integration tests
-
-This allows running integration tests using [Playwright](https://playwright.dev/).
-
-It uses its own `test.env` with different ports to not collide with a running dev instance.
-
-## Install
-
-This relies on `docker` and the `compose` [plugin](https://docs.docker.com/compose/install/).
-Databases (`Mariadb`, `Mysql` and `Postgres`) and `Playwright` will run in containers.
-
-### Running Playwright outside docker
-
-It is possible to run `Playwright` outside of the container, this removes the need to rebuild the image for each change.
-You will additionally need `nodejs` then run:
-
-```bash
-npm ci --ignore-scripts
-npx playwright install-deps
-npx playwright install firefox
-```
-
-## Usage
-
-To run all the tests:
-
-```bash
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright
-```
-
-To force a rebuild of the Playwright image:
-```bash
-DOCKER_BUILDKIT=1 docker compose --env-file test.env build Playwright
-```
-
-To access the UI to easily run test individually and debug if needed (this will not work in docker):
-
-```bash
-npx playwright test --ui
-```
-
-### DB
-
-Projects are configured to allow to run tests only on specific database.
-
-You can use:
-
-```bash
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=mariadb
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=mysql
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=postgres
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite
-```
-
-### SSO
-
-To run the SSO tests:
-
-```bash
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project sso-sqlite
-```
-
-### Keep services running
-
-If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
-
-```bash
-PW_KEEP_SERVICE_RUNNNING=true npx playwright test
-```
-
-### Running specific tests
-
-To run a whole file you can :
-
-```bash
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite tests/login.spec.ts
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite login
-```
-
-To run only a specifc test (It might fail if it has dependency):
-
-```bash
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite -g "Account creation"
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite tests/login.spec.ts:16
-```
-
-## Writing scenario
-
-When creating new scenario use the recorder to more easily identify elements
-(in general try to rely on visible hint to identify elements and not hidden IDs).
-This does not start the server, you will need to start it manually.
-
-```bash
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
-npx playwright codegen "http://127.0.0.1:8003"
-```
-
-## Override web-vault
-
-It is possible to change the `web-vault` used by referencing a different `vw_web_builds` commit.
-
-Simplest is to set and uncomment `PW_VW_REPO_URL` and `PW_VW_COMMIT_HASH` in the `test.env`.
-Ensure that the image is built with:
-
-```bash
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env build Vaultwarden
-```
-
-You can check the result running:
-
-```bash
-DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
-```
-
-Then check `http://127.0.0.1:8003/admin/diagnostics` with `admin`.
-
-# OpenID Connect test setup
-
-Additionally this `docker-compose` template allows to run locally Vaultwarden,
-[Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.
-
-## Setup
-
-This rely on `docker` and the `compose` [plugin](https://docs.docker.com/compose/install/).
-First create a copy of `.env.template` as `.env` (This is done to prevent committing your custom settings, Ex `SMTP_`).
-
-## Usage
-
-Then start the stack (the `profile` is required to run `Vaultwarden`) :
-
-```bash
-> docker compose --profile vaultwarden --env-file .env up
-....
-keycloakSetup_1  | Logging into http://127.0.0.1:8080 as user admin of realm master
-keycloakSetup_1  | Created new realm with id 'test'
-keycloakSetup_1  | 74af4933-e386-4e64-ba15-a7b61212c45e
-oidc_keycloakSetup_1 exited with code 0
-```
-
-Wait until `oidc_keycloakSetup_1 exited with code 0` which indicates the correct setup of the Keycloak realm, client and user
-(It is normal for this container to stop once the configuration is done).
-
-Then you can access :
-
- `Vaultwarden` on http://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
- `Keycloak` on http://0.0.0.0:8080/admin/master/console/ with the default user `admin/admin`
- `Maildev` on http://0.0.0.0:1080
-
-To proceed with an SSO login after you enter the email, on the screen prompting for `Master Password` the SSO button should be visible.
-To use your computer external ip (for example when testing with a phone) you will have to configure `KC_HTTP_HOST` and `DOMAIN`.
-
-## Running only Keycloak
-
-You can run just `Keycloak` with `--profile keycloak`:
-
-```bash
-> docker compose --profile keycloak --env-file .env up
-```
-When running with a local Vaultwarden, you can use a front-end build from [dani-garcia/bw_web_builds](https://github.com/dani-garcia/bw_web_builds/releases).
-
-## Rebuilding the Vaultwarden
-
-To force rebuilding the Vaultwarden image you can run
-
-```bash
-docker compose --profile vaultwarden --env-file .env build VaultwardenPrebuild Vaultwarden
-```
-
-## Configuration
-
-All configuration for `keycloak` / `Vaultwarden` / `keycloak_setup.sh` can be found in [.env](.env.template).
-The content of the file will be loaded as environment variables in all containers.
-
- `keycloak` [configuration](https://www.keycloak.org/server/all-config) includes `KEYCLOAK_ADMIN` / `KEYCLOAK_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
- All `Vaultwarden` configuration can be set (EX: `SMTP_*`)
-
-## Cleanup
-
-Use `docker compose --profile vaultwarden down`.
--- a/playwright/compose/keycloak/Dockerfile
+++ b/playwright/compose/keycloak/Dockerfile
@ -1,19 +0,0 @@
-FROM docker.io/library/debian:trixie-slim
-
-ARG KEYCLOAK_VERSION
-
-ENV DEBIAN_FRONTEND=noninteractive
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-
-RUN apt-get update && apt-get install -y ca-certificates curl jq openjdk-21-jdk-headless wget
-
-WORKDIR /
-
-RUN wget -c https://github.com/keycloak/keycloak/releases/download/${KEYCLOAK_VERSION}/keycloak-${KEYCLOAK_VERSION}.tar.gz -O - | tar -xz \
-    && mkdir -p /opt/keycloak \
-    && mv /keycloak-${KEYCLOAK_VERSION}/bin /opt/keycloak/bin \
-    && rm -rf /keycloak-${KEYCLOAK_VERSION}
-
-COPY setup.sh /setup.sh
-
-CMD "/setup.sh"
--- a/playwright/compose/keycloak/setup.sh
+++ b/playwright/compose/keycloak/setup.sh
@ -1,44 +0,0 @@
-#!/bin/bash
-
-export PATH=/opt/keycloak/bin:$PATH
-
-STATUS_CODE=0
-while [[ "$STATUS_CODE" != "404" ]] ; do
-    echo "Will retry in 2 seconds"
-    sleep 2
-
-    STATUS_CODE=$(curl -s -o /dev/null -w "%{http_code}"  "$DUMMY_AUTHORITY")
-
-    if [[ "$STATUS_CODE" = "200" ]]; then
-        echo "Setup should already be done. Will not run."
-        exit 0
-    fi
-done
-
-set -e
-
-kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
-
-kcadm.sh create realms -s realm="$TEST_REALM" -s enabled=true -s "accessTokenLifespan=600"
-kcadm.sh create clients -r test -s "clientId=$SSO_CLIENT_ID" -s "secret=$SSO_CLIENT_SECRET" -s "redirectUris=[\"$DOMAIN/*\"]" -i
-
-TEST_USER_ID=$(kcadm.sh create users -r "$TEST_REALM" -s "username=$TEST_USER" -s "firstName=$TEST_USER" -s "lastName=$TEST_USER" -s "email=$TEST_USER_MAIL"  -s emailVerified=true -s enabled=true -i)
-kcadm.sh update users/$TEST_USER_ID/reset-password -r "$TEST_REALM" -s type=password -s "value=$TEST_USER_PASSWORD" -n
-
-TEST_USER2_ID=$(kcadm.sh create users -r "$TEST_REALM" -s "username=$TEST_USER2" -s "firstName=$TEST_USER2" -s "lastName=$TEST_USER2" -s "email=$TEST_USER2_MAIL"  -s emailVerified=true -s enabled=true -i)
-kcadm.sh update users/$TEST_USER2_ID/reset-password -r "$TEST_REALM" -s type=password -s "value=$TEST_USER2_PASSWORD" -n
-
-TEST_USER3_ID=$(kcadm.sh create users -r "$TEST_REALM" -s "username=$TEST_USER3" -s "firstName=$TEST_USER3" -s "lastName=$TEST_USER3" -s "email=$TEST_USER3_MAIL"  -s emailVerified=true -s enabled=true -i)
-kcadm.sh update users/$TEST_USER3_ID/reset-password -r "$TEST_REALM" -s type=password -s "value=$TEST_USER3_PASSWORD" -n
-
-# Dummy realm to mark end of setup
-kcadm.sh create realms -s realm="$DUMMY_REALM" -s enabled=true -s "accessTokenLifespan=600"
-
-# TO DEBUG uncomment the following line to keep the setup container running
-# sleep 3600
-# THEN in another terminal:
-# docker exec -it keycloakSetup-dev /bin/bash
-# export PATH=$PATH:/opt/keycloak/bin
-# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
-# ENJOY
-# Doc: https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/admin-cli.html
--- a/playwright/compose/playwright/Dockerfile
+++ b/playwright/compose/playwright/Dockerfile
@ -1,40 +0,0 @@
-FROM docker.io/library/debian:trixie-slim
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update \
-    && apt-get install -y ca-certificates curl \
-    && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
-    && chmod a+r /etc/apt/keyrings/docker.asc \
-    && echo "deb [signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian trixie stable" | tee /etc/apt/sources.list.d/docker.list \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends \
-        containerd.io \
-        docker-buildx-plugin \
-        docker-ce \
-        docker-ce-cli \
-        docker-compose-plugin \
-        git \
-        libmariadb-dev-compat \
-        libpq5 \
-        nodejs \
-        npm \
-        openssl \
-    && rm -rf /var/lib/apt/lists/*
-
-RUN mkdir /playwright
-WORKDIR /playwright
-
-COPY package.json package-lock.json .
-RUN npm ci --ignore-scripts && npx playwright install-deps && npx playwright install firefox
-
-COPY docker-compose.yml test.env ./
-COPY compose ./compose
-
-COPY *.ts test.env ./
-COPY tests ./tests
-
-ENTRYPOINT ["/usr/bin/npx", "playwright"]
-CMD ["test"]
--- a/playwright/compose/warden/Dockerfile
+++ b/playwright/compose/warden/Dockerfile
@ -1,40 +0,0 @@
-FROM playwright_oidc_vaultwarden_prebuilt AS prebuilt
-
-FROM node:22-trixie AS build
-
-ARG REPO_URL
-ARG COMMIT_HASH
-
-ENV REPO_URL=$REPO_URL
-ENV COMMIT_HASH=$COMMIT_HASH
-
-COPY --from=prebuilt /web-vault /web-vault
-
-COPY build.sh /build.sh
-RUN /build.sh
-
-######################## RUNTIME IMAGE  ########################
-FROM docker.io/library/debian:trixie-slim
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-# Create data folder and Install needed libraries
-RUN mkdir /data && \
-    apt-get update && apt-get install -y \
-        --no-install-recommends \
-        ca-certificates \
-        curl \
-        libmariadb-dev \
-        libpq5 \
-        openssl && \
-    rm -rf /var/lib/apt/lists/*
-
-# Copies the files from the context (Rocket.toml file and web-vault)
-# and the binary from the "build" stage to the current stage
-WORKDIR /
-
-COPY --from=prebuilt /start.sh .
-COPY --from=prebuilt /vaultwarden .
-COPY --from=build /web-vault ./web-vault
-
-ENTRYPOINT ["/start.sh"]
--- a/playwright/compose/warden/build.sh
+++ b/playwright/compose/warden/build.sh
@ -1,24 +0,0 @@
-#!/bin/bash
-
-echo $REPO_URL
-echo $COMMIT_HASH
-
-if [[ ! -z "$REPO_URL" ]] && [[ ! -z "$COMMIT_HASH" ]] ; then
-    rm -rf /web-vault
-
-    mkdir -p vw_web_builds;
-    cd vw_web_builds;
-
-    git -c init.defaultBranch=main init
-    git remote add origin "$REPO_URL"
-    git fetch --depth 1 origin "$COMMIT_HASH"
-    git -c advice.detachedHead=false checkout FETCH_HEAD
-
-    npm ci --ignore-scripts
-
-    cd apps/web
-    npm run dist:oss:selfhost
-    printf '{"version":"%s"}' "$COMMIT_HASH" > build/vw-version.json
-
-    mv build /web-vault
-fi
--- a/playwright/docker-compose.yml
+++ b/playwright/docker-compose.yml
@ -1,124 +0,0 @@
-services:
-  VaultwardenPrebuild:
-    profiles: ["playwright", "vaultwarden"]
-    container_name: playwright_oidc_vaultwarden_prebuilt
-    image: playwright_oidc_vaultwarden_prebuilt
-    build:
-      context: ..
-      dockerfile: Dockerfile
-    entrypoint: /bin/bash
-    restart: "no"
-
-  Vaultwarden:
-    profiles: ["playwright", "vaultwarden"]
-    container_name: playwright_oidc_vaultwarden-${ENV:-dev}
-    image: playwright_oidc_vaultwarden-${ENV:-dev}
-    network_mode: "host"
-    build:
-      context: compose/warden
-      dockerfile: Dockerfile
-      args:
-        REPO_URL: ${PW_VW_REPO_URL:-}
-        COMMIT_HASH: ${PW_VW_COMMIT_HASH:-}
-    env_file: ${DC_ENV_FILE:-.env}
-    environment:
-      - ADMIN_TOKEN
-      - DATABASE_URL
-      - I_REALLY_WANT_VOLATILE_STORAGE
-      - LOG_LEVEL
-      - LOGIN_RATELIMIT_MAX_BURST
-      - SMTP_HOST
-      - SMTP_FROM
-      - SMTP_DEBUG
-      - SSO_DEBUG_TOKENS
-      - SSO_ENABLED
-      - SSO_FRONTEND
-      - SSO_ONLY
-      - SSO_SCOPES
-    restart: "no"
-    depends_on:
-      - VaultwardenPrebuild
-
-  Playwright:
-    profiles: ["playwright"]
-    container_name: playwright_oidc_playwright
-    image: playwright_oidc_playwright
-    network_mode: "host"
-    build:
-      context: .
-      dockerfile: compose/playwright/Dockerfile
-    environment:
-      - PW_WV_REPO_URL
-      - PW_WV_COMMIT_HASH
-    restart: "no"
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ..:/project
-
-  Mariadb:
-    profiles: ["playwright"]
-    container_name: playwright_mariadb
-    image: mariadb:11.2.4
-    env_file: test.env
-    healthcheck:
-      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
-      start_period: 10s
-      interval: 10s
-    ports:
-      - ${MARIADB_PORT}:3306
-
-  Mysql:
-    profiles: ["playwright"]
-    container_name: playwright_mysql
-    image: mysql:8.4.1
-    env_file: test.env
-    healthcheck:
-      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
-      start_period: 10s
-      interval: 10s
-    ports:
-      - ${MYSQL_PORT}:3306
-
-  Postgres:
-    profiles: ["playwright"]
-    container_name: playwright_postgres
-    image: postgres:16.3
-    env_file: test.env
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
-      start_period: 20s
-      interval: 30s
-    ports:
-      - ${POSTGRES_PORT}:5432
-
-  Maildev:
-    profiles: ["vaultwarden", "maildev"]
-    container_name: maildev
-    image: timshel/maildev:3.0.4
-    ports:
-      - ${SMTP_PORT}:1025
-      - 1080:1080
-
-  Keycloak:
-    profiles: ["keycloak", "vaultwarden"]
-    container_name: keycloak-${ENV:-dev}
-    image: quay.io/keycloak/keycloak:26.3.4
-    network_mode: "host"
-    command:
-      - start-dev
-    env_file: ${DC_ENV_FILE:-.env}
-
-  KeycloakSetup:
-    profiles: ["keycloak", "vaultwarden"]
-    container_name: keycloakSetup-${ENV:-dev}
-    image: keycloak_setup-${ENV:-dev}
-    build:
-      context: compose/keycloak
-      dockerfile: Dockerfile
-      args:
-        KEYCLOAK_VERSION: 26.3.4
-    network_mode: "host"
-    depends_on:
-      - Keycloak
-    restart: "no"
-    env_file: ${DC_ENV_FILE:-.env}
--- a/playwright/global-setup.ts
+++ b/playwright/global-setup.ts
@ -1,22 +0,0 @@
-import { firefox, type FullConfig } from '@playwright/test';
-import { execSync } from 'node:child_process';
-import fs from 'fs';
-
-const utils = require('./global-utils');
-
-utils.loadEnv();
-
-async function globalSetup(config: FullConfig) {
-    // Are we running in docker and the project is mounted ?
-    const path = (fs.existsSync("/project/playwright/playwright.config.ts") ? "/project/playwright" : ".");
-    execSync(`docker compose --project-directory ${path} --profile playwright --env-file test.env build VaultwardenPrebuild`, {
-        env: { ...process.env },
-        stdio: "inherit"
-    });
-    execSync(`docker compose --project-directory ${path} --profile playwright --env-file test.env build Vaultwarden`, {
-        env: { ...process.env },
-        stdio: "inherit"
-    });
-}
-
-export default globalSetup;
--- a/playwright/global-utils.ts
+++ b/playwright/global-utils.ts
@ -1,262 +0,0 @@
-import { expect, type Browser, type TestInfo } from '@playwright/test';
-import { EventEmitter } from "events";
-import { type Mail, MailServer } from 'maildev';
-import { execSync } from 'node:child_process';
-
-import dotenv from 'dotenv';
-import dotenvExpand from 'dotenv-expand';
-
-const fs = require("fs");
-const { spawn } = require('node:child_process');
-
-export function loadEnv(){
-    var myEnv = dotenv.config({ path: 'test.env', quiet: true });
-    dotenvExpand.expand(myEnv);
-
-    return {
-        user1: {
-            email: process.env.TEST_USER_MAIL,
-            name: process.env.TEST_USER,
-            password: process.env.TEST_USER_PASSWORD,
-        },
-        user2: {
-            email: process.env.TEST_USER2_MAIL,
-            name: process.env.TEST_USER2,
-            password: process.env.TEST_USER2_PASSWORD,
-        },
-        user3: {
-            email: process.env.TEST_USER3_MAIL,
-            name: process.env.TEST_USER3,
-            password: process.env.TEST_USER3_PASSWORD,
-        },
-    }
-}
-
-export async function waitFor(url: String, browser: Browser) {
-    var ready = false;
-    var context;
-
-    do {
-        try {
-            context = await browser.newContext();
-            const page = await context.newPage();
-            await page.waitForTimeout(500);
-            const result = await page.goto(url);
-            ready = result.status() === 200;
-        } catch(e) {
-            if( !e.message.includes("CONNECTION_REFUSED") ){
-                throw e;
-            }
-        } finally {
-            await context.close();
-        }
-    } while(!ready);
-}
-
-export function startComposeService(serviceName: String){
-    console.log(`Starting ${serviceName}`);
-    execSync(`docker compose --profile playwright --env-file test.env  up -d ${serviceName}`);
-}
-
-export function stopComposeService(serviceName: String){
-    console.log(`Stopping ${serviceName}`);
-    execSync(`docker compose --profile playwright --env-file test.env  stop ${serviceName}`);
-}
-
-function wipeSqlite(){
-    console.log(`Delete Vaultwarden container to wipe sqlite`);
-    execSync(`docker compose --env-file test.env stop Vaultwarden`);
-    execSync(`docker compose --env-file test.env rm -f Vaultwarden`);
-}
-
-async function wipeMariaDB(){
-    var mysql = require('mysql2/promise');
-    var ready = false;
-    var connection;
-
-    do {
-        try {
-            connection = await mysql.createConnection({
-                user: process.env.MARIADB_USER,
-                host: "127.0.0.1",
-                database: process.env.MARIADB_DATABASE,
-                password: process.env.MARIADB_PASSWORD,
-                port: process.env.MARIADB_PORT,
-            });
-
-            await connection.execute(`DROP DATABASE ${process.env.MARIADB_DATABASE}`);
-            await connection.execute(`CREATE DATABASE ${process.env.MARIADB_DATABASE}`);
-            console.log('Successfully wiped mariadb');
-            ready = true;
-        } catch (err) {
-            console.log(`Error when wiping mariadb: ${err}`);
-        } finally {
-            if( connection ){
-                connection.end();
-            }
-        }
-        await new Promise(r => setTimeout(r, 1000));
-    } while(!ready);
-}
-
-async function wipeMysqlDB(){
-    var mysql = require('mysql2/promise');
-    var ready = false;
-    var connection;
-
-    do{
-        try {
-            connection = await mysql.createConnection({
-                user: process.env.MYSQL_USER,
-                host: "127.0.0.1",
-                database: process.env.MYSQL_DATABASE,
-                password: process.env.MYSQL_PASSWORD,
-                port: process.env.MYSQL_PORT,
-            });
-
-            await connection.execute(`DROP DATABASE ${process.env.MYSQL_DATABASE}`);
-            await connection.execute(`CREATE DATABASE ${process.env.MYSQL_DATABASE}`);
-            console.log('Successfully wiped mysql');
-            ready = true;
-        } catch (err) {
-            console.log(`Error when wiping mysql: ${err}`);
-        } finally {
-            if( connection ){
-                connection.end();
-            }
-        }
-        await new Promise(r => setTimeout(r, 1000));
-    } while(!ready);
-}
-
-async function wipePostgres(){
-    const { Client } = require('pg');
-
-    const client = new Client({
-        user: process.env.POSTGRES_USER,
-        host: "127.0.0.1",
-        database: "postgres",
-        password: process.env.POSTGRES_PASSWORD,
-        port: process.env.POSTGRES_PORT,
-    });
-
-    try {
-        await client.connect();
-        await client.query(`DROP DATABASE ${process.env.POSTGRES_DB}`);
-        await client.query(`CREATE DATABASE ${process.env.POSTGRES_DB}`);
-        console.log('Successfully wiped postgres');
-    } catch (err) {
-        console.log(`Error when wiping postgres: ${err}`);
-    } finally {
-        client.end();
-    }
-}
-
-function dbConfig(testInfo: TestInfo){
-    switch(testInfo.project.name) {
-        case "postgres":
-        case "sso-postgres":
-            return { DATABASE_URL: `postgresql://${process.env.POSTGRES_USER}:${process.env.POSTGRES_PASSWORD}@127.0.0.1:${process.env.POSTGRES_PORT}/${process.env.POSTGRES_DB}` };
-        case "mariadb":
-        case "sso-mariadb":
-            return { DATABASE_URL: `mysql://${process.env.MARIADB_USER}:${process.env.MARIADB_PASSWORD}@127.0.0.1:${process.env.MARIADB_PORT}/${process.env.MARIADB_DATABASE}` };
-        case "mysql":
-        case "sso-mysql":
-            return { DATABASE_URL: `mysql://${process.env.MYSQL_USER}:${process.env.MYSQL_PASSWORD}@127.0.0.1:${process.env.MYSQL_PORT}/${process.env.MYSQL_DATABASE}`};
-        case "sqlite":
-        case "sso-sqlite":
-            return { I_REALLY_WANT_VOLATILE_STORAGE: true };
-        default:
-            throw new Error(`Unknow database name: ${testInfo.project.name}`);
-    }
-}
-
-/**
- *  All parameters passed in `env` need to be added to the docker-compose.yml
- **/
-export async function startVault(browser: Browser, testInfo: TestInfo, env = {}, resetDB: Boolean = true) {
-    if( resetDB ){
-        switch(testInfo.project.name) {
-            case "postgres":
-            case "sso-postgres":
-                await wipePostgres();
-                break;
-            case "mariadb":
-            case "sso-mariadb":
-                await wipeMariaDB();
-                break;
-            case "mysql":
-            case "sso-mysql":
-                await wipeMysqlDB();
-                break;
-            case "sqlite":
-            case "sso-sqlite":
-                wipeSqlite();
-                break;
-            default:
-                throw new Error(`Unknow database name: ${testInfo.project.name}`);
-        }
-    }
-
-    console.log(`Starting Vaultwarden`);
-    execSync(`docker compose --profile playwright --env-file test.env up -d Vaultwarden`, {
-        env: { ...env, ...dbConfig(testInfo) },
-    });
-    await waitFor("/", browser);
-    console.log(`Vaultwarden running on: ${process.env.DOMAIN}`);
-}
-
-export async function stopVault(force: boolean = false) {
-    if( force === false && process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
-        console.log(`Keep vaultwarden running on: ${process.env.DOMAIN}`);
-    } else {
-        console.log(`Vaultwarden stopping`);
-        execSync(`docker compose --profile playwright --env-file test.env stop Vaultwarden`);
-    }
-}
-
-export async function restartVault(page: Page, testInfo: TestInfo, env, resetDB: Boolean = true) {
-    stopVault(true);
-    return startVault(page.context().browser(), testInfo, env, resetDB);
-}
-
-export async function checkNotification(page: Page, hasText: string) {
-    await expect(page.locator('bit-toast', { hasText })).toBeVisible();
-    try {
-        await page.locator('bit-toast', { hasText }).getByRole('button', { name: 'Close' }).click({force: true, timeout: 10_000});
-    } catch (error) {
-        console.log(`Closing notification failed but it should now be invisible (${error})`);
-    }
-    await expect(page.locator('bit-toast', { hasText })).toHaveCount(0);
-}
-
-export async function cleanLanding(page: Page) {
-    await page.goto('/', { waitUntil: 'domcontentloaded' });
-    await expect(page.getByRole('button').nth(0)).toBeVisible();
-
-    const logged = await page.getByRole('button', { name: 'Log out' }).count();
-    if( logged > 0 ){
-        await page.getByRole('button', { name: 'Log out' }).click();
-        await page.getByRole('button', { name: 'Log out' }).click();
-    }
-}
-
-export async function logout(test: Test, page: Page, user: { name: string }) {
-    await test.step('logout', async () => {
-        await page.getByRole('button', { name: user.name, exact: true }).click();
-        await page.getByRole('menuitem', { name: 'Log out' }).click();
-        await expect(page.getByRole('heading', { name: 'Log in' })).toBeVisible();
-    });
-}
-
-export async function ignoreExtension(page: Page) {
-    await page.waitForLoadState('domcontentloaded');
-
-    try {
-        await page.getByRole('button', { name: 'Add it later' }).click({timeout: 5_000});
-        await page.getByRole('link', { name: 'Skip to web app' }).click();
-    } catch (error) {
-        console.log('Extension setup not visible. Continuing');
-    }
-
-}
--- a/playwright/package-lock.json
+++ b/playwright/package-lock.json
--- a/playwright/package.json
+++ b/playwright/package.json
@ -1,21 +0,0 @@
-{
-    "name": "scenarios",
-    "version": "1.0.0",
-    "description": "",
-    "main": "index.js",
-    "scripts": {},
-    "keywords": [],
-    "author": "",
-    "license": "ISC",
-    "devDependencies": {
-        "@playwright/test": "1.56.1",
-        "dotenv": "17.2.3",
-        "dotenv-expand": "12.0.3",
-        "maildev": "npm:@timshel_npm/maildev@3.2.5"
-    },
-    "dependencies": {
-        "mysql2": "3.15.3",
-        "otpauth": "9.4.1",
-        "pg": "8.16.3"
-    }
-}
--- a/playwright/playwright.config.ts
+++ b/playwright/playwright.config.ts
@ -1,143 +0,0 @@
-import { defineConfig, devices } from '@playwright/test';
-import { exec } from 'node:child_process';
-
-const utils = require('./global-utils');
-
-utils.loadEnv();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-    testDir: './.',
-    /* Run tests in files in parallel */
-    fullyParallel: false,
-
-    /* Fail the build on CI if you accidentally left test.only in the source code. */
-    forbidOnly: !!process.env.CI,
-
-    retries: 0,
-    workers: 1,
-
-    /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-    reporter: 'html',
-
-    /* Long global timeout for complex tests
-     * But short action/nav/expect timeouts to fail on specific step (raise locally if not enough).
-     */
-    timeout: 120 * 1000,
-    actionTimeout: 20 * 1000,
-    navigationTimeout: 20 * 1000,
-    expect: { timeout: 20 * 1000 },
-
-    /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-    use: {
-        /* Base URL to use in actions like `await page.goto('/')`. */
-        baseURL: process.env.DOMAIN,
-        browserName: 'firefox',
-        locale: 'en-GB',
-        timezoneId: 'Europe/London',
-
-        /* Always collect trace (other values add random test failures) See https://playwright.dev/docs/trace-viewer */
-        trace: 'on',
-        viewport: {
-            width: 1080,
-            height: 720,
-        },
-        video: "on",
-    },
-
-    /* Configure projects for major browsers */
-    projects: [
-        {
-            name: 'mariadb-setup',
-            testMatch: 'tests/setups/db-setup.ts',
-            use: { serviceName: "Mariadb" },
-            teardown: 'mariadb-teardown',
-        },
-        {
-            name: 'mysql-setup',
-            testMatch: 'tests/setups/db-setup.ts',
-            use: { serviceName: "Mysql" },
-            teardown: 'mysql-teardown',
-        },
-        {
-            name: 'postgres-setup',
-            testMatch: 'tests/setups/db-setup.ts',
-            use: { serviceName: "Postgres" },
-            teardown: 'postgres-teardown',
-        },
-        {
-            name: 'sso-setup',
-            testMatch: 'tests/setups/sso-setup.ts',
-            teardown: 'sso-teardown',
-        },
-
-        {
-            name: 'mariadb',
-            testMatch: 'tests/*.spec.ts',
-            testIgnore: 'tests/sso_*.spec.ts',
-            dependencies: ['mariadb-setup'],
-        },
-        {
-            name: 'mysql',
-            testMatch: 'tests/*.spec.ts',
-            testIgnore: 'tests/sso_*.spec.ts',
-            dependencies: ['mysql-setup'],
-        },
-        {
-            name: 'postgres',
-            testMatch: 'tests/*.spec.ts',
-            testIgnore: 'tests/sso_*.spec.ts',
-            dependencies: ['postgres-setup'],
-        },
-        {
-            name: 'sqlite',
-            testMatch: 'tests/*.spec.ts',
-            testIgnore: 'tests/sso_*.spec.ts',
-        },
-
-        {
-            name: 'sso-mariadb',
-            testMatch: 'tests/sso_*.spec.ts',
-            dependencies: ['sso-setup', 'mariadb-setup'],
-        },
-        {
-            name: 'sso-mysql',
-            testMatch: 'tests/sso_*.spec.ts',
-            dependencies: ['sso-setup', 'mysql-setup'],
-        },
-        {
-            name: 'sso-postgres',
-            testMatch: 'tests/sso_*.spec.ts',
-            dependencies: ['sso-setup', 'postgres-setup'],
-        },
-        {
-            name: 'sso-sqlite',
-            testMatch: 'tests/sso_*.spec.ts',
-            dependencies: ['sso-setup'],
-        },
-
-        {
-            name: 'mariadb-teardown',
-            testMatch: 'tests/setups/db-teardown.ts',
-            use: { serviceName: "Mariadb" },
-        },
-        {
-            name: 'mysql-teardown',
-            testMatch: 'tests/setups/db-teardown.ts',
-            use: { serviceName: "Mysql" },
-        },
-        {
-            name: 'postgres-teardown',
-            testMatch: 'tests/setups/db-teardown.ts',
-            use: { serviceName: "Postgres" },
-        },
-        {
-            name: 'sso-teardown',
-            testMatch: 'tests/setups/sso-teardown.ts',
-        },
-    ],
-
-    globalSetup: require.resolve('./global-setup'),
-});
--- a/playwright/test.env
+++ b/playwright/test.env
@ -1,98 +0,0 @@
-##################################################################
-### Shared Playwright conf test file Vaultwarden and Databases ###
-##################################################################
-
-ENV=test
-DC_ENV_FILE=test.env
-COMPOSE_IGNORE_ORPHANS=True
-DOCKER_BUILDKIT=1
-
-#####################
-# Playwright Config #
-#####################
-PW_KEEP_SERVICE_RUNNNING=${PW_KEEP_SERVICE_RUNNNING:-false}
-PW_SMTP_FROM=vaultwarden@playwright.test
-
-#####################
-# Maildev Config 	#
-#####################
-MAILDEV_HTTP_PORT=1081
-MAILDEV_SMTP_PORT=1026
-MAILDEV_HOST=127.0.0.1
-
-################
-# Users Config #
-################
-TEST_USER=test
-TEST_USER_PASSWORD=Master Password
-TEST_USER_MAIL=${TEST_USER}@example.com
-
-TEST_USER2=test2
-TEST_USER2_PASSWORD=Master Password
-TEST_USER2_MAIL=${TEST_USER2}@example.com
-
-TEST_USER3=test3
-TEST_USER3_PASSWORD=Master Password
-TEST_USER3_MAIL=${TEST_USER3}@example.com
-
-###################
-# Keycloak Config #
-###################
-KEYCLOAK_ADMIN=admin
-KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
-KC_HTTP_HOST=127.0.0.1
-KC_HTTP_PORT=8081
-
-# Script parameters (use Keycloak and Vaultwarden config too)
-TEST_REALM=test
-DUMMY_REALM=dummy
-DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
-
-######################
-# Vaultwarden Config #
-######################
-ROCKET_PORT=8003
-DOMAIN=http://localhost:${ROCKET_PORT}
-LOG_LEVEL=info,oidcwarden::sso=debug
-LOGIN_RATELIMIT_MAX_BURST=100
-ADMIN_TOKEN=admin
-
-SMTP_SECURITY=off
-SMTP_PORT=${MAILDEV_SMTP_PORT}
-SMTP_FROM_NAME=Vaultwarden
-SMTP_TIMEOUT=5
-
-SSO_CLIENT_ID=warden
-SSO_CLIENT_SECRET=warden
-SSO_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${TEST_REALM}
-SSO_DEBUG_TOKENS=true
-
-# Custom web-vault build
-# PW_VW_REPO_URL=https://github.com/vaultwarden/vw_web_builds.git
-# PW_VW_COMMIT_HASH=b5f5b2157b9b64b5813bc334a75a277d0377b5d3
-
-###########################
-# Docker MariaDb container#
-###########################
-MARIADB_PORT=3307
-MARIADB_ROOT_PASSWORD=warden
-MARIADB_USER=warden
-MARIADB_PASSWORD=warden
-MARIADB_DATABASE=warden
-
-###########################
-# Docker Mysql container#
-###########################
-MYSQL_PORT=3309
-MYSQL_ROOT_PASSWORD=warden
-MYSQL_USER=warden
-MYSQL_PASSWORD=warden
-MYSQL_DATABASE=warden
-
-############################
-# Docker Postgres container#
-############################
-POSTGRES_PORT=5433
-POSTGRES_USER=warden
-POSTGRES_PASSWORD=warden
-POSTGRES_DB=warden
--- a/playwright/tests/collection.spec.ts
+++ b/playwright/tests/collection.spec.ts
@ -1,37 +0,0 @@
-import { test, expect, type TestInfo } from '@playwright/test';
-
-import * as utils from "../global-utils";
-import { createAccount } from './setups/user';
-
-let users = utils.loadEnv();
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    await utils.startVault(browser, testInfo);
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-});
-
-test('Create', async ({ page }) => {
-    await createAccount(test, page, users.user1);
-
-    await test.step('Create Org', async () => {
-        await page.getByRole('link', { name: 'New organisation' }).click();
-        await page.getByLabel('Organisation name (required)').fill('Test');
-        await page.getByRole('button', { name: 'Submit' }).click();
-        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
-
-        await utils.checkNotification(page, 'Organisation created');
-    });
-
-    await test.step('Create Collection', async () => {
-        await page.getByRole('link', { name: 'Collections' }).click();
-        await page.getByRole('button', { name: 'New' }).click();
-        await page.getByRole('menuitem', { name: 'Collection' }).click();
-        await page.getByLabel('Name (required)').fill('RandomCollec');
-        await page.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page, 'Created collection RandomCollec');
-        await expect(page.getByRole('button', { name: 'RandomCollec' })).toBeVisible();
-    });
-});
--- a/playwright/tests/login.smtp.spec.ts
+++ b/playwright/tests/login.smtp.spec.ts
@ -1,103 +0,0 @@
-import { test, expect, type TestInfo } from '@playwright/test';
-import { MailDev } from 'maildev';
-
-const utils = require('../global-utils');
-import { createAccount, logUser } from './setups/user';
-import { activateEmail, retrieveEmailCode, disableEmail } from './setups/2fa';
-
-let users = utils.loadEnv();
-
-let mailserver;
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    mailserver = new MailDev({
-        port: process.env.MAILDEV_SMTP_PORT,
-        web: { port: process.env.MAILDEV_HTTP_PORT },
-    })
-
-    await mailserver.listen();
-
-    await utils.startVault(browser, testInfo, {
-        SMTP_HOST: process.env.MAILDEV_HOST,
-        SMTP_FROM: process.env.PW_SMTP_FROM,
-    });
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-    if( mailserver ){
-        await mailserver.close();
-    }
-});
-
-test('Account creation', async ({ page }) => {
-    const mailBuffer = mailserver.buffer(users.user1.email);
-
-    await createAccount(test, page, users.user1, mailBuffer);
-
-    mailBuffer.close();
-});
-
-test('Login', async ({ context, page }) => {
-    const mailBuffer = mailserver.buffer(users.user1.email);
-
-    await logUser(test, page, users.user1, mailBuffer);
-
-    await test.step('verify email', async () => {
-        await page.getByText('Verify your account\'s email').click();
-        await expect(page.getByText('Verify your account\'s email')).toBeVisible();
-        await page.getByRole('button', { name: 'Send email' }).click();
-
-        await utils.checkNotification(page, 'Check your email inbox for a verification link');
-
-        const verify = await mailBuffer.expect((m) => m.subject === "Verify Your Email");
-        expect(verify.from[0]?.address).toBe(process.env.PW_SMTP_FROM);
-
-        const page2 = await context.newPage();
-        await page2.setContent(verify.html);
-        const link = await page2.getByTestId("verify").getAttribute("href");
-        await page2.close();
-
-        await page.goto(link);
-        await utils.checkNotification(page, 'Account email verified');
-    });
-
-    mailBuffer.close();
-});
-
-test('Activate 2fa', async ({ page }) => {
-    const emails = mailserver.buffer(users.user1.email);
-
-    await logUser(test, page, users.user1);
-
-    await activateEmail(test, page, users.user1, emails);
-
-    emails.close();
-});
-
-test('2fa', async ({ page }) => {
-    const emails = mailserver.buffer(users.user1.email);
-
-    await test.step('login', async () => {
-        await page.goto('/');
-
-        await page.getByLabel(/Email address/).fill(users.user1.email);
-        await page.getByRole('button', { name: 'Continue' }).click();
-        await page.getByLabel('Master password').fill(users.user1.password);
-        await page.getByRole('button', { name: 'Log in with master password' }).click();
-
-        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-        const code = await retrieveEmailCode(test, page, emails);
-        await page.getByLabel(/Verification code/).fill(code);
-        await page.getByRole('button', { name: 'Continue' }).click();
-
-        await page.getByRole('button', { name: 'Add it later' }).click();
-        await page.getByRole('link', { name: 'Skip to web app' }).click();
-
-        await expect(page).toHaveTitle(/Vaults/);
-    })
-
-    await disableEmail(test, page, users.user1);
-
-    emails.close();
-});
--- a/playwright/tests/login.spec.ts
+++ b/playwright/tests/login.spec.ts
@ -1,51 +0,0 @@
-import { test, expect, type Page, type TestInfo } from '@playwright/test';
-import * as OTPAuth from "otpauth";
-
-import * as utils from "../global-utils";
-import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP } from './setups/2fa';
-
-let users = utils.loadEnv();
-let totp;
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    await utils.startVault(browser, testInfo, {});
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-});
-
-test('Account creation', async ({ page }) => {
-    await createAccount(test, page, users.user1);
-});
-
-test('Master password login', async ({ page }) => {
-    await logUser(test, page, users.user1);
-});
-
-test('Authenticator 2fa', async ({ page }) => {
-    await logUser(test, page, users.user1);
-
-    let totp = await activateTOTP(test, page, users.user1);
-
-    await utils.logout(test, page, users.user1);
-
-    await test.step('login', async () => {
-        let timestamp = Date.now(); // Needed to use the next token
-        timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
-
-        await page.getByLabel(/Email address/).fill(users.user1.email);
-        await page.getByRole('button', { name: 'Continue' }).click();
-        await page.getByLabel('Master password').fill(users.user1.password);
-        await page.getByRole('button', { name: 'Log in with master password' }).click();
-
-        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
-        await page.getByRole('button', { name: 'Continue' }).click();
-
-        await expect(page).toHaveTitle(/Vaultwarden Web/);
-    });
-
-    await disableTOTP(test, page, users.user1);
-});
--- a/playwright/tests/organization.smtp.spec.ts
+++ b/playwright/tests/organization.smtp.spec.ts
@ -1,119 +0,0 @@
-import { test, expect, type TestInfo } from '@playwright/test';
-import { MailDev } from 'maildev';
-
-import * as utils from '../global-utils';
-import * as orgs from './setups/orgs';
-import { createAccount, logUser } from './setups/user';
-
-let users = utils.loadEnv();
-
-let mailServer, mail1Buffer, mail2Buffer, mail3Buffer;
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    mailServer = new MailDev({
-        port: process.env.MAILDEV_SMTP_PORT,
-        web: { port: process.env.MAILDEV_HTTP_PORT },
-    })
-
-    await mailServer.listen();
-
-    await utils.startVault(browser, testInfo, {
-        SMTP_HOST: process.env.MAILDEV_HOST,
-        SMTP_FROM: process.env.PW_SMTP_FROM,
-    });
-
-    mail1Buffer = mailServer.buffer(users.user1.email);
-    mail2Buffer = mailServer.buffer(users.user2.email);
-    mail3Buffer = mailServer.buffer(users.user3.email);
-});
-
-test.afterAll('Teardown', async ({}, testInfo: TestInfo) => {
-    utils.stopVault(testInfo);
-    [mail1Buffer, mail2Buffer, mail3Buffer, mailServer].map((m) => m?.close());
-});
-
-test('Create user3', async ({ page }) => {
-    await createAccount(test, page, users.user3, mail3Buffer);
-});
-
-test('Invite users', async ({ page }) => {
-    await createAccount(test, page, users.user1, mail1Buffer);
-
-    await orgs.create(test, page, 'Test');
-    await orgs.members(test, page, 'Test');
-    await orgs.invite(test, page, 'Test', users.user2.email);
-    await orgs.invite(test, page, 'Test', users.user3.email, {
-        navigate: false,
-    });
-});
-
-test('invited with new account', async ({ page }) => {
-    const invited = await mail2Buffer.expect((mail) => mail.subject === 'Join Test');
-
-    await test.step('Create account', async () => {
-        await page.setContent(invited.html);
-        const link = await page.getByTestId('invite').getAttribute('href');
-        await page.goto(link);
-        await expect(page).toHaveTitle(/Create account | Vaultwarden Web/);
-
-        //await page.getByLabel('Name').fill(users.user2.name);
-        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
-        await page.getByLabel('Confirm master password (').fill(users.user2.password);
-        await page.getByRole('button', { name: 'Create account' }).click();
-        await utils.checkNotification(page, 'Your new account has been created');
-
-        await utils.checkNotification(page, 'Invitation accepted');
-        await utils.ignoreExtension(page);
-
-        // Redirected to the vault
-        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
-        // await utils.checkNotification(page, 'You have been logged in!');
-    });
-
-    await test.step('Check mails', async () => {
-        await mail2Buffer.expect((m) => m.subject === 'Welcome');
-        await mail2Buffer.expect((m) => m.subject === 'New Device Logged In From Firefox');
-        await mail1Buffer.expect((m) => m.subject.includes('Invitation to Test accepted'));
-    });
-});
-
-test('invited with existing account', async ({ page }) => {
-    const invited = await mail3Buffer.expect((mail) => mail.subject === 'Join Test');
-
-    await page.setContent(invited.html);
-    const link = await page.getByTestId('invite').getAttribute('href');
-
-    await page.goto(link);
-
-    // We should be on login page with email prefilled
-    await expect(page).toHaveTitle(/Vaultwarden Web/);
-    await page.getByRole('button', { name: 'Continue' }).click();
-
-    // Unlock page
-    await page.getByLabel('Master password').fill(users.user3.password);
-    await page.getByRole('button', { name: 'Log in with master password' }).click();
-
-    await utils.checkNotification(page, 'Invitation accepted');
-    await utils.ignoreExtension(page);
-
-    // We are now in the default vault page
-    await expect(page).toHaveTitle(/Vaultwarden Web/);
-
-    await mail3Buffer.expect((m) => m.subject === 'New Device Logged In From Firefox');
-    await mail1Buffer.expect((m) => m.subject.includes('Invitation to Test accepted'));
-});
-
-test('Confirm invited user', async ({ page }) => {
-    await logUser(test, page, users.user1, mail1Buffer);
-
-    await orgs.members(test, page, 'Test');
-    await orgs.confirm(test, page, 'Test', users.user2.email);
-
-    await mail2Buffer.expect((m) => m.subject.includes('Invitation to Test confirmed'));
-});
-
-test('Organization is visible', async ({ page }) => {
-    await logUser(test, page, users.user2, mail2Buffer);
-    await page.getByRole('button', { name: 'vault: Test', exact: true }).click();
-    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
-});
--- a/playwright/tests/organization.spec.ts
+++ b/playwright/tests/organization.spec.ts
@ -1,54 +0,0 @@
-import { test, expect, type TestInfo } from '@playwright/test';
-import { MailDev } from 'maildev';
-
-import * as utils from "../global-utils";
-import * as orgs from './setups/orgs';
-import { createAccount, logUser } from './setups/user';
-
-let users = utils.loadEnv();
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    await utils.startVault(browser, testInfo);
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-});
-
-test('Invite', async ({ page }) => {
-    await createAccount(test, page, users.user3);
-    await createAccount(test, page, users.user1);
-
-    await orgs.create(test, page, 'New organisation');
-    await orgs.members(test, page, 'New organisation');
-
-    await test.step('missing user2', async () => {
-        await orgs.invite(test, page, 'New organisation', users.user2.email);
-        await expect(page.getByRole('row', { name: users.user2.email })).toHaveText(/Invited/);
-    });
-
-    await test.step('existing user3', async () => {
-        await orgs.invite(test, page, 'New organisation', users.user3.email);
-        await expect(page.getByRole('row', { name: users.user3.email })).toHaveText(/Needs confirmation/);
-        await orgs.confirm(test, page, 'New organisation', users.user3.email);
-    });
-
-    await test.step('confirm user2', async () => {
-        await createAccount(test, page, users.user2);
-        await logUser(test, page, users.user1);
-        await orgs.members(test, page, 'New organisation');
-        await orgs.confirm(test, page, 'New organisation', users.user2.email);
-    });
-
-    await test.step('Org visible user2  ', async () => {
-        await logUser(test, page, users.user2);
-        await page.getByRole('button', { name: 'vault: New organisation', exact: true }).click();
-        await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
-    });
-
-    await test.step('Org visible user3  ', async () => {
-        await logUser(test, page, users.user3);
-        await page.getByRole('button', { name: 'vault: New organisation', exact: true }).click();
-        await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
-    });
-});
--- a/playwright/tests/setups/2fa.ts
+++ b/playwright/tests/setups/2fa.ts
@ -1,92 +0,0 @@
-import { expect, type Page, Test } from '@playwright/test';
-import { type MailBuffer } from 'maildev';
-import * as OTPAuth from "otpauth";
-
-import * as utils from '../../global-utils';
-
-export async function activateTOTP(test: Test, page: Page, user: { name: string, password: string }): OTPAuth.TOTP {
-    return await test.step('Activate TOTP 2FA', async () => {
-        await page.getByRole('button', { name: user.name }).click();
-        await page.getByRole('menuitem', { name: 'Account settings' }).click();
-        await page.getByRole('link', { name: 'Security' }).click();
-        await page.getByRole('link', { name: 'Two-step login' }).click();
-        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByLabel('Master password (required)').fill(user.password);
-        await page.getByRole('button', { name: 'Continue' }).click();
-
-        const secret = await page.getByLabel('Key').innerText();
-        let totp = new OTPAuth.TOTP({ secret, period: 30 });
-
-        await page.getByLabel(/Verification code/).fill(totp.generate());
-        await page.getByRole('button', { name: 'Turn on' }).click();
-        await page.getByRole('heading', { name: 'Turned on', exact: true });
-        await page.getByLabel('Close').click();
-
-        return totp;
-    })
-}
-
-export async function disableTOTP(test: Test, page: Page, user: { password: string }) {
-    await test.step('Disable TOTP 2FA', async () => {
-        await page.getByRole('button', { name: 'Test' }).click();
-        await page.getByRole('menuitem', { name: 'Account settings' }).click();
-        await page.getByRole('link', { name: 'Security' }).click();
-        await page.getByRole('link', { name: 'Two-step login' }).click();
-        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByLabel('Master password (required)').click();
-        await page.getByLabel('Master password (required)').fill(user.password);
-        await page.getByRole('button', { name: 'Continue' }).click();
-        await page.getByRole('button', { name: 'Turn off' }).click();
-        await page.getByRole('button', { name: 'Yes' }).click();
-        await utils.checkNotification(page, 'Two-step login provider turned off');
-    });
-}
-
-export async function activateEmail(test: Test, page: Page, user: { name: string, password: string }, mailBuffer: MailBuffer) {
-    await test.step('Activate Email 2FA', async () => {
-        await page.getByRole('button', { name: user.name }).click();
-        await page.getByRole('menuitem', { name: 'Account settings' }).click();
-        await page.getByRole('link', { name: 'Security' }).click();
-        await page.getByRole('link', { name: 'Two-step login' }).click();
-        await page.locator('bit-item').filter({ hasText: 'Enter a code sent to your email' }).getByRole('button').click();
-        await page.getByLabel('Master password (required)').fill(user.password);
-        await page.getByRole('button', { name: 'Continue' }).click();
-        await page.getByRole('button', { name: 'Send email' }).click();
-    });
-
-    let code = await retrieveEmailCode(test, page, mailBuffer);
-
-    await test.step('input code', async () => {
-        await page.getByLabel('2. Enter the resulting 6').fill(code);
-        await page.getByRole('button', { name: 'Turn on' }).click();
-        await page.getByRole('heading', { name: 'Turned on', exact: true });
-    });
-}
-
-export async function retrieveEmailCode(test: Test, page: Page, mailBuffer: MailBuffer): string {
-    return await test.step('retrieve code', async () => {
-        const codeMail = await mailBuffer.expect((mail) => mail.subject.includes("Login Verification Code"));
-        const page2 = await page.context().newPage();
-        await page2.setContent(codeMail.html);
-        const code = await page2.getByTestId("2fa").innerText();
-        await page2.close();
-        return code;
-    });
-}
-
-export async function disableEmail(test: Test, page: Page, user: { password: string }) {
-    await test.step('Disable Email 2FA', async () => {
-        await page.getByRole('button', { name: 'Test' }).click();
-        await page.getByRole('menuitem', { name: 'Account settings' }).click();
-        await page.getByRole('link', { name: 'Security' }).click();
-        await page.getByRole('link', { name: 'Two-step login' }).click();
-        await page.locator('bit-item').filter({ hasText: 'Email' }).getByRole('button').click();
-        await page.getByLabel('Master password (required)').click();
-        await page.getByLabel('Master password (required)').fill(user.password);
-        await page.getByRole('button', { name: 'Continue' }).click();
-        await page.getByRole('button', { name: 'Turn off' }).click();
-        await page.getByRole('button', { name: 'Yes' }).click();
-
-        await utils.checkNotification(page, 'Two-step login provider turned off');
-    });
-}
--- a/playwright/tests/setups/db-setup.ts
+++ b/playwright/tests/setups/db-setup.ts
@ -1,7 +0,0 @@
-import { test } from './db-test';
-
-const utils = require('../../global-utils');
-
-test('DB start', async ({ serviceName }) => {
-	utils.startComposeService(serviceName);
-});
--- a/playwright/tests/setups/db-teardown.ts
+++ b/playwright/tests/setups/db-teardown.ts
@ -1,11 +0,0 @@
-import { test } from './db-test';
-
-const utils = require('../../global-utils');
-
-utils.loadEnv();
-
-test('DB teardown ?', async ({ serviceName }) => {
-    if( process.env.PW_KEEP_SERVICE_RUNNNING !== "true" ) {
-        utils.stopComposeService(serviceName);
-    }
-});
--- a/Show more
+++ b/Show more
				`@ -1 +0,0 @@`
				`ALTER TABLE users_organizations DROP COLUMN invited_by_email;`
				`@ -1 +0,0 @@`
				`ALTER TABLE users_organizations ADD COLUMN invited_by_email TEXT DEFAULT NULL;`
				`@ -1 +0,0 @@`
				`ALTER TABLE sso_auth DROP COLUMN binding_hash;`
				`@ -1 +0,0 @@`
				`ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;`