The duplicate group index was capped with '% 64' to limit color slots, but
the same index is used as the group identity in 'select unique items from
duplicates'. With more than 64 duplicate groups the indices wrap around, so
later groups had every item selected (nothing kept). Drop the modulo so each
group keeps a unique index; colors still differ via the golden-angle hue.
`npx tsc -p webapp/tsconfig.json --noEmit`, one of the checks recommended
in CONTRIBUTING.md, currently fails on main with three errors. All three
are declaration defects with correct runtime behavior; none changes
observable behavior.
- api/backup.ts: downloadAdminBackupAttachmentBlob declared a bare
Uint8Array return. Since TypeScript made typed arrays generic, that
widens to Uint8Array<ArrayBufferLike> and no longer satisfies fflate's
Uint8Array<ArrayBuffer>. The body already returns an ArrayBuffer-backed
value, so this only annotates what it produces.
- backup-center.ts: invalidateRemoteBrowserCacheForDestination declared a
full PersistedRemoteBrowserState but builds four of its five fields.
The sole caller reads .cache only, so the return type is narrowed to
match what the function actually returns.
- password-security-cache.ts: getPasswordSecurityState declared the public
PasswordSecurityState, but startPasswordSecurityScan needs `controller`,
which lives on InternalPasswordSecurityState. An internal accessor keeps
`controller` off the exported type rather than widening the public API.
No change to backup payload shape, archive/import whitelists, or any
persisted format.
Verified with tsc 5.9.3, 6.0.3, and 7.0.2 (all exit 0 for both
webapp/tsconfig.json and tsconfig.json), plus npm run build and
npm run i18n:validate.
.list-head is a single-line flex row whose buttons are nowrap and
cannot shrink below their labels. The duplicates view adds a detection
mode select and a Select-duplicates button to the standard
search/sort/sync set, exceeding the list column (capped at 540px on
desktop), so the shrinkable controls crush to slivers and the fixed
buttons overlap and spill out of the column. Allow wrapping: views
that fit stay on one line; crowded toolbars flow to a second row.
Mobile is unaffected (it switches .list-head to its own grid).
.authorized-devices-actions forced its four buttons (Untrust, Trust
permanently, Device note, Delete) onto one non-wrapping, non-shrinking
line inside the fixed 26% actions column. At common desktop widths the
row overflows the column and table-layout: fixed clips it at the panel
edge, cutting off Device note and hiding Delete entirely. Let the
buttons wrap to a second line instead.
The .kv-row grid sized its actions column with auto, letting it claim
content width before the minmax(0, 1fr) value column. Once the
Check breach button joined Reveal and Copy, label + actions could
exceed the row width, resolving the value column to 0px; combined
with overflow-wrap: anywhere this rendered masked passwords as a
vertical column of one asterisk per line at common desktop widths.
Give the value column a floor of min(35%, 140px) so the actions
column shrinks and wraps its buttons (kv-actions already has
flex-wrap) before the value collapses.
Replace hardcoded #1d4ed8 / #2563eb / #bfdbfe values with their exact
design-token equivalents (--primary, --primary-hover, --primary-strong)
in 17 declarations across auth, dark, management, and vault styles.
Light theme is pixel-identical: every replaced hex equals the token's
light value. In dark theme this fixes spots that dark.css never
overrode and that kept light-theme blues on dark backgrounds:
standalone footer links and version badge, JWT warning inline link,
restore-progress active dot, TOTP countdown ring, and the
authorized-device checkbox accent.
Intentionally left alone: .btn-primary gradients (would lighten dark
buttons under white text), card brand colors (Amex/Maestro/RuPay blues
are brand constants, not theme colors), and light-pill pairings whose
backgrounds have no token (.log-mode-option.active, .log-category-auth,
.log-level-info, .folder-edit-btn:hover, #93c5fd borders).
Return Bitwarden's desktop-ui-settings-dialog feature state so supported desktop clients use the official settings dialog with browser integration controls.
Fixes#315
Detect insecure or unsupported browser contexts before account registration and show localized HTTPS guidance instead of leaking a SubtleCrypto runtime error.
Fixes#320
Add official-compatible mobile and desktop connector flows, preserve exact .html asset paths, and cover the protocol and framing behavior with regression tests.
Fixes#326
When entering the cloud backup page, the remote backup directory list only showed cached data and required a manual click of the refresh button to see new backup files. This change adds a TTL-based auto-refresh that fetches fresh data when the cache is older than 5 minutes.
Changes:
- Added refreshedAt tracking per cache key in persisted state
- Added REMOTE_BROWSER_REFRESH_TTL_MS (5 min) constant
- Added useEffect that triggers auto-refresh when destination is selected and cached data is stale
- Stamped refresh timestamps after successful API responses
- Cleaned up timestamps on destination delete and settings save
Gate invite management, user ban/delete, and delete-all-devices behind
masterPasswordHash verification, matching backup step-up auth. The web UI
prompts for the master password in the shared confirm dialog.
Expand compressed IPv6 hostnames before the private-address allowlist so
forms like ::1 cannot bypass SSRF protection for WebDAV/S3 backup endpoints.
Also reject IPv4-mapped addresses written as ::ffff:hex:hex.
dependabot[bot]
KiritoXDone
Chius
ph4nt0mer
shuaiplus
Cordero Core
EnvyBackyard
zu1k
Domainmasteri