Preserve linked and unknown encrypted fields in Web edits, reject stale and concurrent saves, and support official bulk delete and restore methods while retaining legacy routes.
Add 20 offline compatibility regressions and update undici to 8.10.2. Verified 51 tests, TypeScript checks, locale validation, Web build and Worker deployment dry run. The unpatched braces advisory remains visible.
Resolve bugs in internal authentication handling and improve consistency across supported account flows.
Maintain compatibility with existing accounts while preserving user data and established client behavior.
Validation: TypeScript checks, production build, and Worker packaging checks passed.
* fix(webapp): reflow remote backup table by container width, not viewport
The remote backup list is a four-track grid with a 642px hard minimum plus
gaps and padding, but its detail panel is only as wide as the viewport minus
roughly 858px of app and backup sidebars. Single-column reflow was keyed to
viewport media queries only, so between about 1181px and 1600px no breakpoint
fired while the panel was already too narrow: .backup-browser-list's
overflow:hidden silently clipped Download, Restore and Delete, and because the
list was itself the clipping box the outer scroll container could not recover
them. Common laptop widths were all affected.
Query the panel's own width instead, since that is what actually decides
whether the table fits. Also let the action buttons wrap rather than overflow
their 220px track, and keep a horizontal scroll fallback on the list so a
future overflow degrades to a scrollbar instead of losing content.
The reflow rules were duplicated across two media queries in responsive.css;
they now live only in the container query.
* fix(webapp): keep the vault grid inside the page on narrow viewports
The vault grid required 270px + 400px + 400px, so it needed a 1362px viewport
before the viewport-based fallback at 1180px took over, leaving a horizontal
page scrollbar across those widths.
The list and detail panes already scroll internally, which zeroes their
automatic minimum size, so dropping the track minimums to 0 lets the grid fit
the content area at any width. Wide viewports are unaffected because 36%/1fr
were never binding there.
* docs(readme): add deployment FAQ
Add a FAQ section right after the deploy steps, covering the four most
commonly asked deployment questions:
- GitHub flags the account when the fork reuses this project's name, so
Cloudflare cannot list the repository (404)
- redeploy after deleting the Worker still asks for an invite code,
because D1 / KV were not deleted
- JWT_SECRET set as a build variable instead of a runtime secret
- JWT_SECRET stored as a plain text variable, so it is lost on upgrade
* docs(readme): clarify FAQ and deployment instructions
The duplicate group index was capped with '% 64' to limit color slots, but
the same index is used as the group identity in 'select unique items from
duplicates'. With more than 64 duplicate groups the indices wrap around, so
later groups had every item selected (nothing kept). Drop the modulo so each
group keeps a unique index; colors still differ via the golden-angle hue.
`npx tsc -p webapp/tsconfig.json --noEmit`, one of the checks recommended
in CONTRIBUTING.md, currently fails on main with three errors. All three
are declaration defects with correct runtime behavior; none changes
observable behavior.
- api/backup.ts: downloadAdminBackupAttachmentBlob declared a bare
Uint8Array return. Since TypeScript made typed arrays generic, that
widens to Uint8Array<ArrayBufferLike> and no longer satisfies fflate's
Uint8Array<ArrayBuffer>. The body already returns an ArrayBuffer-backed
value, so this only annotates what it produces.
- backup-center.ts: invalidateRemoteBrowserCacheForDestination declared a
full PersistedRemoteBrowserState but builds four of its five fields.
The sole caller reads .cache only, so the return type is narrowed to
match what the function actually returns.
- password-security-cache.ts: getPasswordSecurityState declared the public
PasswordSecurityState, but startPasswordSecurityScan needs `controller`,
which lives on InternalPasswordSecurityState. An internal accessor keeps
`controller` off the exported type rather than widening the public API.
No change to backup payload shape, archive/import whitelists, or any
persisted format.
Verified with tsc 5.9.3, 6.0.3, and 7.0.2 (all exit 0 for both
webapp/tsconfig.json and tsconfig.json), plus npm run build and
npm run i18n:validate.
.list-head is a single-line flex row whose buttons are nowrap and
cannot shrink below their labels. The duplicates view adds a detection
mode select and a Select-duplicates button to the standard
search/sort/sync set, exceeding the list column (capped at 540px on
desktop), so the shrinkable controls crush to slivers and the fixed
buttons overlap and spill out of the column. Allow wrapping: views
that fit stay on one line; crowded toolbars flow to a second row.
Mobile is unaffected (it switches .list-head to its own grid).
.authorized-devices-actions forced its four buttons (Untrust, Trust
permanently, Device note, Delete) onto one non-wrapping, non-shrinking
line inside the fixed 26% actions column. At common desktop widths the
row overflows the column and table-layout: fixed clips it at the panel
edge, cutting off Device note and hiding Delete entirely. Let the
buttons wrap to a second line instead.
The .kv-row grid sized its actions column with auto, letting it claim
content width before the minmax(0, 1fr) value column. Once the
Check breach button joined Reveal and Copy, label + actions could
exceed the row width, resolving the value column to 0px; combined
with overflow-wrap: anywhere this rendered masked passwords as a
vertical column of one asterisk per line at common desktop widths.
Give the value column a floor of min(35%, 140px) so the actions
column shrinks and wraps its buttons (kv-actions already has
flex-wrap) before the value collapses.
Replace hardcoded #1d4ed8 / #2563eb / #bfdbfe values with their exact
design-token equivalents (--primary, --primary-hover, --primary-strong)
in 17 declarations across auth, dark, management, and vault styles.
Light theme is pixel-identical: every replaced hex equals the token's
light value. In dark theme this fixes spots that dark.css never
overrode and that kept light-theme blues on dark backgrounds:
standalone footer links and version badge, JWT warning inline link,
restore-progress active dot, TOTP countdown ring, and the
authorized-device checkbox accent.
Intentionally left alone: .btn-primary gradients (would lighten dark
buttons under white text), card brand colors (Amex/Maestro/RuPay blues
are brand constants, not theme colors), and light-pill pairings whose
backgrounds have no token (.log-mode-option.active, .log-category-auth,
.log-level-info, .folder-edit-btn:hover, #93c5fd borders).
Return Bitwarden's desktop-ui-settings-dialog feature state so supported desktop clients use the official settings dialog with browser integration controls.
Fixes#315
Detect insecure or unsupported browser contexts before account registration and show localized HTTPS guidance instead of leaking a SubtleCrypto runtime error.
Fixes#320
Add official-compatible mobile and desktop connector flows, preserve exact .html asset paths, and cover the protocol and framing behavior with regression tests.
Fixes#326
When entering the cloud backup page, the remote backup directory list only showed cached data and required a manual click of the refresh button to see new backup files. This change adds a TTL-based auto-refresh that fetches fresh data when the cache is older than 5 minutes.
Changes:
- Added refreshedAt tracking per cache key in persisted state
- Added REMOTE_BROWSER_REFRESH_TTL_MS (5 min) constant
- Added useEffect that triggers auto-refresh when destination is selected and cached data is stale
- Stamped refresh timestamps after successful API responses
- Cleaned up timestamps on destination delete and settings save
Gate invite management, user ban/delete, and delete-all-devices behind
masterPasswordHash verification, matching backup step-up auth. The web UI
prompts for the master password in the shared confirm dialog.
Expand compressed IPv6 hostnames before the private-address allowlist so
forms like ::1 cannot bypass SSRF protection for WebDAV/S3 backup endpoints.
Also reject IPv4-mapped addresses written as ::ffff:hex:hex.
Tenghui Zhong
shuaiplus
DAVID TB
dependabot[bot]
github-actions[bot]
EggRoll
Cerarin
KiritoXDone
Chius
ph4nt0mer
Cordero Core
EnvyBackyard
zu1k