Preserve linked and unknown encrypted fields in Web edits, reject stale and concurrent saves, and support official bulk delete and restore methods while retaining legacy routes.
Add 20 offline compatibility regressions and update undici to 8.10.2. Verified 51 tests, TypeScript checks, locale validation, Web build and Worker deployment dry run. The unpatched braces advisory remains visible.
`npx tsc -p webapp/tsconfig.json --noEmit`, one of the checks recommended
in CONTRIBUTING.md, currently fails on main with three errors. All three
are declaration defects with correct runtime behavior; none changes
observable behavior.
- api/backup.ts: downloadAdminBackupAttachmentBlob declared a bare
Uint8Array return. Since TypeScript made typed arrays generic, that
widens to Uint8Array<ArrayBufferLike> and no longer satisfies fflate's
Uint8Array<ArrayBuffer>. The body already returns an ArrayBuffer-backed
value, so this only annotates what it produces.
- backup-center.ts: invalidateRemoteBrowserCacheForDestination declared a
full PersistedRemoteBrowserState but builds four of its five fields.
The sole caller reads .cache only, so the return type is narrowed to
match what the function actually returns.
- password-security-cache.ts: getPasswordSecurityState declared the public
PasswordSecurityState, but startPasswordSecurityScan needs `controller`,
which lives on InternalPasswordSecurityState. An internal accessor keeps
`controller` off the exported type rather than widening the public API.
No change to backup payload shape, archive/import whitelists, or any
persisted format.
Verified with tsc 5.9.3, 6.0.3, and 7.0.2 (all exit 0 for both
webapp/tsconfig.json and tsconfig.json), plus npm run build and
npm run i18n:validate.
Detect insecure or unsupported browser contexts before account registration and show localized HTTPS guidance instead of leaking a SubtleCrypto runtime error.
Fixes#320
When entering the cloud backup page, the remote backup directory list only showed cached data and required a manual click of the refresh button to see new backup files. This change adds a TTL-based auto-refresh that fetches fresh data when the cache is older than 5 minutes.
Changes:
- Added refreshedAt tracking per cache key in persisted state
- Added REMOTE_BROWSER_REFRESH_TTL_MS (5 min) constant
- Added useEffect that triggers auto-refresh when destination is selected and cached data is stale
- Stamped refresh timestamps after successful API responses
- Cleaned up timestamps on destination delete and settings save
Gate invite management, user ban/delete, and delete-all-devices behind
masterPasswordHash verification, matching backup step-up auth. The web UI
prompts for the master password in the shared confirm dialog.
- Add password and authType fields to Send type
- Show lock icon in send list for password-protected sends
- Display masked dots in password field when editing a send that has a password set
- Add Remove button to clear existing password
- Implemented YubiKey OTP settings management in useAccountSecurityActions hook.
- Added API functions for retrieving, saving, and bootstrapping YubiKey OTP credentials.
- Enhanced authentication flow to support multiple two-factor providers, including YubiKey.
- Updated localization files to include new YubiKey-related strings in English, Spanish, Russian, and Chinese.
- Introduced new styles for YubiKey management UI components.
- Created utility functions for YubiKey OTP validation and credential handling.
style: adjust grid layout for app main and add responsive styles for settings category
style: enhance management styles with new settings category layout and tabs
style: improve responsive design for settings modules and submodules
parseBitwardenCsvFieldLines previously discarded any field line that did not
contain the ': ' delimiter, truncating multiline values like OpenSSH private
keys to only their first line.
Replace the map+filter pipeline with a reduce that accumulates continuation
lines (lines without ': ') into the previous entry's value, joined by '\n'.
This preserves the full private key content through a CSV round-trip.
Fixes: CSV export to import of SSH key items where the private key body was
silently dropped.
- Updated English, Spanish, Russian, Simplified Chinese, and Traditional Chinese locale files to include new error messages related to backup and restore processes.
- Added prefix and suffix strings for the "cached empty" message to enhance clarity in user prompts.
- Enhanced the management CSS with new styles for the backup browser refresh prompt to improve layout and user experience.
shuaiplus
Cordero Core
EnvyBackyard
ph4nt0mer
Domainmasteri