Misc fixes and updates (#7558)

* Update GHA and pre-commit Signed-off-by: BlackDex <black.dex@gmail.com> * Update admin diagnostics Added a check if the templates are overridden and return which specific folder, `admin`, `email` or `scss`. This way we could more quickly point users to possible outdated templates which they are using. Also updated the Support String to use some emojis so we should be able to quicker see if there is something wrong. Just checking `true` or `false` could be difficult sometimes, and sometimes what we had as `false` wasn't bad either. Also adjusted the eslint comments so it will work with the latest version of eslint. Signed-off-by: BlackDex <black.dex@gmail.com> * Fix updating collections for a cipher The newer clients expect a `cipherDetails` response on the `collections-admin` endpoints. Without it, the client will cause an error and stops handling the update correctly. This will fix this by returning the cipher json. Fixes #7545 Fixes #7546 Signed-off-by: BlackDex <black.dex@gmail.com> * Cache CSS file in a different way Currently we set a cache ttl of 24 hours, and users need to do a force refresh if there is anything changed to the CSS file. In the past we have had several issue reported which were related to a still cached CSS file. This commit will change the caching and also cache the generated CSS file in memory. Instead of letting the browser cache it for 24 hours we generate an ETag, this is just a hash of the contents. This ETag is returned by the browser during a request, and we can match this, and if so, just return a `304` `Not Modified`. If the ETag is not known, we return the new content. This should make simple refreshes by clients get updated settings or a new version of Vaultwarden which has other CSS entries get updated instantly. If a user does a hard refresh, we will not receive the ETag and the content will be served. The same goes if someone has the `reload_templates` feature enabled, since then we should not cache anyway. If someone adjust settings via the `/admin` interface, the cache will be invalidated and a new CSS will be generated. Signed-off-by: BlackDex <black.dex@gmail.com> * Fix showing events for a specific user Signed-off-by: BlackDex <black.dex@gmail.com> * Update crates and adjust code. - Updated opendal and adjusted code where needed. - Updated yubico_ng and adjusted code where needed. This version now supports using an own HttpClient and it pulls in no reqwest dependency anymore. Now it will use our own client which uses custom hickory DNS and other features. Signed-off-by: BlackDex <black.dex@gmail.com> * Update web-vault to v2026.7.0 Signed-off-by: BlackDex <black.dex@gmail.com> * Fix hadolint warnings Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com>
1 week ago · b30cc08562
28 changed files with 432 additions and 281 deletions
--- a/.github/workflows/hadolint.yml
+++ b/.github/workflows/hadolint.yml
@ -41,12 +41,12 @@ jobs:
      # Uses the Docker-based action (hadolint pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian)
      # so no binary is downloaded at runtime. Pinned by commit SHA for supply-chain safety.
      - name: Run hadolint on Dockerfile.debian
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
        with:
          dockerfile: docker/Dockerfile.debian

      - name: Run hadolint on Dockerfile.alpine
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
        with:
          dockerfile: docker/Dockerfile.alpine
      # End Test Dockerfiles with hadolint
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -106,7 +106,7 @@ jobs:

      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@ -121,7 +121,7 @@ jobs:

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@ -137,7 +137,7 @@ jobs:

      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@ -237,7 +237,7 @@ jobs:

      # Upload artifacts to Github Actions and Attest the binaries
      - name: Attest binaries
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: vaultwarden-${{ env.NORMALIZED_ARCH }}

@ -272,7 +272,7 @@ jobs:

      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@ -287,7 +287,7 @@ jobs:

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@ -303,7 +303,7 @@ jobs:

      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@ -365,7 +365,7 @@ jobs:
      # Attest container images
      - name: Attest - docker.io - ${{ matrix.base_image }}
        if: ${{ vars.DOCKERHUB_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ vars.DOCKERHUB_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@ -373,7 +373,7 @@ jobs:

      - name: Attest - ghcr.io - ${{ matrix.base_image }}
        if: ${{ vars.GHCR_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ vars.GHCR_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@ -381,7 +381,7 @@ jobs:

      - name: Attest - quay.io - ${{ matrix.base_image }}
        if: ${{ vars.QUAY_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ vars.QUAY_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          sarif_file: 'trivy-results.sarif'
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@ -23,4 +23,4 @@ jobs:

      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
+        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@ -24,7 +24,7 @@ jobs:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -18,9 +18,10 @@ repos:

  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
  - repo: https://github.com/crate-ci/typos
-    rev: bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
+    rev: 8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
    hooks:
      - id: typos
+        always_run: true

  - repo: local
    hooks:
@ -38,8 +39,7 @@ repos:
        entry: cargo test
        language: system
        args: [ "--features", "sqlite,mysql,postgresql", "--" ]
-        types_or: [ rust, file ]
-        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
+        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
        pass_filenames: false
      - id: cargo-clippy
        name: cargo clippy
@ -47,8 +47,7 @@ repos:
        entry: cargo clippy
        language: system
        args: [ "--features", "sqlite,mysql,postgresql", "--", "-D", "warnings" ]
-        types_or: [ rust, file ]
-        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
+        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
        pass_filenames: false
      - id: check-docker-templates
        name: check docker templates
--- a/Cargo.lock
+++ b/Cargo.lock
@ -22,9 +22,9 @@ dependencies = [

 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
 "memchr",
 ]
@ -52,9 +52,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"

 [[package]]
 name = "android_system_properties"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
 dependencies = [
 "libc",
 ]
@ -150,9 +150,9 @@ dependencies = [

 [[package]]
 name = "async-compression"
-version = "0.4.42"
+version = "0.4.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e79b3f8a79cccc2898f31920fc69f304859b3bd567490f75ebf51ae1c792a9ac"
+checksum = "3976abdc8fe7d1133d43d304afd42abdf5bc3e1319d263d223bde07b5efc4be8"
 dependencies = [
 "compression-codecs",
 "compression-core",
@ -213,7 +213,7 @@ version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
 dependencies = [
- "event-listener 5.4.1",
+ "event-listener 5.4.2",
 "event-listener-strategy",
 "pin-project-lite",
 ]
@ -231,7 +231,7 @@ dependencies = [
 "async-task",
 "blocking",
 "cfg-if",
- "event-listener 5.4.1",
+ "event-listener 5.4.2",
 "futures-lite",
 "rustix",
 ]
@ -349,9 +349,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"

 [[package]]
 name = "aws-config"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "701418aa459dac33e50a0f8e818e5662a16bc018a6ac7423659b70f3799d67a8"
+checksum = "1b180a3c8b55960db3426d8964b8745e652466a1a49fe1a2eda828046d30b5e4"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@ -369,7 +369,7 @@ dependencies = [
 "bytes",
 "fastrand",
 "hex",
- "http 1.4.2",
+ "http 1.5.0",
 "sha1 0.10.7",
 "time",
 "tokio",
@ -392,9 +392,9 @@ dependencies = [

 [[package]]
 name = "aws-runtime"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6b50a43f3ccdf331521c6d6c68b7cc9668b6e09d439ebda9569df5722324d76"
+checksum = "c9007227e10b5fed2f3e0a2beff489211e2b5604c400b7a9d5d81ca9d64c24bb"
 dependencies = [
 "aws-credential-types",
 "aws-sigv4",
@ -407,7 +407,7 @@ dependencies = [
 "bytes",
 "bytes-utils",
 "fastrand",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "percent-encoding",
 "pin-project-lite",
@ -417,9 +417,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-sso"
-version = "1.104.0"
+version = "1.105.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b53416d16c278234845392e38d93bd4481d2f09daa0f005a2277f0aa91f59c22"
+checksum = "6ffd0fbe7873cb548a7aa60f9573c268fff94155397fd4f14dc9f1ecaaab8516"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@ -436,16 +436,16 @@ dependencies = [
 "bytes",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "regex-lite",
 "tracing",
 ]

 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.106.0"
+version = "1.107.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc9b706c3305ed0285d5b1b696c747aa34950f830fb03e3e6c76890f99b9f188"
+checksum = "175763eb222a46377df7aa257a3bca980ab3e96703fefc8f4d0b8da6ad2e254c"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@ -462,16 +462,16 @@ dependencies = [
 "bytes",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "regex-lite",
 "tracing",
 ]

 [[package]]
 name = "aws-sdk-sts"
-version = "1.109.0"
+version = "1.110.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32d214cdfa5bbe17f117e76a7643fadf32a5234fb597322ef8b1fb4b2f17dbbd"
+checksum = "dd8b14781dfbff48984017d57167b6ea0b6471c6920ec52b44a2677c7feb3c13"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@ -489,7 +489,7 @@ dependencies = [
 "aws-types",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "regex-lite",
 "tracing",
 ]
@ -509,7 +509,7 @@ dependencies = [
 "hex",
 "hmac 0.13.0",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "percent-encoding",
 "sha2 0.11.0",
 "time",
@ -539,7 +539,7 @@ dependencies = [
 "bytes-utils",
 "futures-core",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "percent-encoding",
@ -596,7 +596,7 @@ dependencies = [
 "bytes",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 0.4.6",
 "http-body 1.1.0",
 "http-body-util",
@ -617,7 +617,7 @@ dependencies = [
 "aws-smithy-types",
 "bytes",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "pin-project-lite",
 "tokio",
 "tracing",
@ -643,7 +643,7 @@ checksum = "7d56e0a4e53127a632224e43633b0fe045fa9e1e3cfc68b9830f1115e103f910"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
- "http 1.4.2",
+ "http 1.5.0",
 ]

 [[package]]
@ -656,7 +656,7 @@ dependencies = [
 "bytes",
 "bytes-utils",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 0.4.6",
 "http-body 1.1.0",
 "http-body-util",
@ -714,6 +714,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"

+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64-simd"
 version = "0.8.0"
@ -1129,12 +1135,13 @@ dependencies = [
 ]

 [[package]]
-name = "crc32c"
-version = "0.6.8"
+name = "crc-fast"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a47af21622d091a8f0fb295b88bc886ac74efcc613efc19f5d0b21de5c89e47"
+checksum = "e75b2483e97a5a7da73ac68a05b629f9c53cff58d8ed1c77866079e18b00dba5"
 dependencies = [
- "rustc_version",
+ "digest 0.10.7",
+ "spin 0.10.1",
 ]

 [[package]]
@ -1154,13 +1161,14 @@ checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"

 [[package]]
 name = "cron"
-version = "0.15.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5877d3fbf742507b66bc2a1945106bd30dd8504019d596901ddd012a4dd01740"
+checksum = "a5dcd6f69605c2956916ce24e8af637b754964c9a83f4662d3a2361654cdba09"
 dependencies = [
 "chrono",
 "once_cell",
- "winnow 0.6.26",
+ "phf 0.11.3",
+ "winnow 0.7.15",
 ]

 [[package]]
@ -1380,9 +1388,9 @@ dependencies = [

 [[package]]
 name = "data-encoding"
-version = "2.11.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"

 [[package]]
 name = "data-url"
@ -1638,13 +1646,13 @@ dependencies = [

 [[package]]
 name = "displaydoc"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]

 [[package]]
@ -1737,9 +1745,9 @@ dependencies = [

 [[package]]
 name = "either"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"

 [[package]]
 name = "elliptic-curve"
@ -1764,11 +1772,11 @@ dependencies = [

 [[package]]
 name = "email-encoding"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9298e6504d9b9e780ed3f7dfd43a61be8cd0e09eb07f7706a945b0072b6670b6"
+checksum = "420b9da095f052ea597503e39073b5b3c522f7db933fbac202d91d24492693fd"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
 "memchr",
 ]

@ -1814,11 +1822,10 @@ checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"

 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
- "concurrent-queue",
 "parking",
 "pin-project-lite",
 ]
@ -1829,7 +1836,7 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
 dependencies = [
- "event-listener 5.4.1",
+ "event-listener 5.4.2",
 "pin-project-lite",
 ]

@ -2179,7 +2186,7 @@ dependencies = [
 "fnv",
 "futures-core",
 "futures-sink",
- "http 1.4.2",
+ "http 1.5.0",
 "indexmap 2.14.0",
 "slab",
 "tokio",
@ -2396,9 +2403,9 @@ dependencies = [

 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
 "bytes",
 "itoa",
@ -2422,7 +2429,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
 "bytes",
- "http 1.4.2",
+ "http 1.5.0",
 ]

 [[package]]
@ -2433,7 +2440,7 @@ checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
 "bytes",
 "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "pin-project-lite",
 ]
@ -2452,9 +2459,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"

 [[package]]
 name = "hybrid-array"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
 dependencies = [
 "typenum",
 ]
@ -2493,7 +2500,7 @@ dependencies = [
 "futures-channel",
 "futures-core",
 "h2",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "httparse",
 "itoa",
@ -2509,10 +2516,10 @@ version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.2",
+ "http 1.5.0",
 "hyper 1.11.0",
 "hyper-util",
- "rustls 0.23.42",
+ "rustls 0.23.43",
 "tokio",
 "tokio-rustls 0.26.4",
 "tower-service",
@ -2528,7 +2535,7 @@ dependencies = [
 "bytes",
 "futures-channel",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "hyper 1.11.0",
 "ipnet",
@ -2720,9 +2727,9 @@ dependencies = [

 [[package]]
 name = "ipnet"
-version = "2.12.0"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
 dependencies = [
 "serde",
 ]
@ -2761,9 +2768,9 @@ checksum = "47f142fe24a9c9944451e8349de0a56af5f3e7226dc46f3ed4d4ecc0b85af75e"

 [[package]]
 name = "jiff"
-version = "0.2.34"
+version = "0.2.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e184d09547b80eb7e20d141ba2fb1fbac843ca53f4cf1b31210adc4c1adc6e16"
+checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
 dependencies = [
 "defmt",
 "jiff-core",
@ -2789,9 +2796,9 @@ dependencies = [

 [[package]]
 name = "jiff-static"
-version = "0.2.34"
+version = "0.2.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "323da076b7a6faf914dc677cb05a4b907742ff7375c8322c9e7f5061e5e0e9de"
+checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
 dependencies = [
 "jiff-core",
 "proc-macro2",
@ -2865,9 +2872,9 @@ dependencies = [

 [[package]]
 name = "job_scheduler_ng"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "217723d58ee473953675d15f11e56898a611aca8ea044d5a34eabeade99ef613"
+checksum = "576b4255ab9de8ce7b81060ec54b1b7f8499dfd6c16a66c4cd4cb1ad4eba27e3"
 dependencies = [
 "chrono",
 "cron",
@ -2943,18 +2950,18 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 dependencies = [
- "spin",
+ "spin 0.9.9",
 ]

 [[package]]
 name = "lettre"
-version = "0.11.22"
+version = "0.11.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0da65617f6cb926332d039cb578aad56178da86e128db6a1b09f4c94fa5b3349"
+checksum = "f2c646bd5cc763b1087b15493e29a64be6147ba8f19342004fa52048ee596eae"
 dependencies = [
 "async-std",
 "async-trait",
- "base64 0.22.1",
+ "base64 0.23.1",
 "email-encoding",
 "email_address",
 "fastrand",
@ -2967,7 +2974,7 @@ dependencies = [
 "nom 8.0.0",
 "percent-encoding",
 "quoted_printable",
- "rustls 0.23.42",
+ "rustls 0.23.43",
 "rustls-native-certs",
 "serde",
 "socket2 0.6.5",
@ -3089,9 +3096,9 @@ dependencies = [

 [[package]]
 name = "mea"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2640d335e7273dacdcf51044026139b2e269c3bb0dfc3f8cb3496b85e3f6a42c"
+checksum = "31fc7d159de0085ab6dd7ff145a9819442cfd3d098f783263120503c3f3e58b0"
 dependencies = [
 "slab",
 ]
@ -3176,7 +3183,7 @@ dependencies = [
 "crossbeam-epoch",
 "crossbeam-utils",
 "equivalent",
- "event-listener 5.4.1",
+ "event-listener 5.4.2",
 "futures-util",
 "parking_lot",
 "portable-atomic",
@ -3194,11 +3201,11 @@ dependencies = [
 "bytes",
 "encoding_rs",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "httparse",
 "memchr",
 "mime",
- "spin",
+ "spin 0.9.9",
 "tokio",
 "tokio-util",
 "version_check",
@ -3370,7 +3377,7 @@ dependencies = [
 "base64 0.22.1",
 "chrono",
 "getrandom 0.2.17",
- "http 1.4.2",
+ "http 1.5.0",
 "rand 0.8.7",
 "serde",
 "serde_json",
@ -3401,9 +3408,9 @@ dependencies = [

 [[package]]
 name = "opendal"
-version = "0.57.0"
+version = "0.58.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96c9c85ce253ff87225e7669979d877a20c98a06604ec9d6dd5f4473e08f1ae1"
+checksum = "4f20562cc7447fcc915fc5c23df305a412ea80a733c9f2fd9e2d267e2815be6d"
 dependencies = [
 "opendal-core",
 "opendal-service-fs",
@ -3412,24 +3419,22 @@ dependencies = [

 [[package]]
 name = "opendal-core"
-version = "0.57.0"
+version = "0.58.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4f8607c90e2c963a91467f50fb49fbc7fb3d573f88cea219ca59ccd3740b309"
+checksum = "ec75551ff4cf3e57da98979f6a937aaa9ddb3915bf68cc17d03df733be6646ed"
 dependencies = [
 "anyhow",
- "base64 0.22.1",
+ "base64 0.23.1",
 "bytes",
 "futures",
- "http 1.4.2",
- "http-body 1.1.0",
+ "http 1.5.0",
 "jiff",
 "log",
 "md-5",
 "mea",
 "percent-encoding",
- "quick-xml 0.39.4",
+ "quick-xml",
 "reqsign-core",
- "reqwest",
 "serde",
 "serde_json",
 "tokio",
@ -3440,9 +3445,9 @@ dependencies = [

 [[package]]
 name = "opendal-service-fs"
-version = "0.57.0"
+version = "0.58.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e89a665fef0e6bd249cf5ea47fc174b7ba892159bee4b9382528b1ca873a2c"
+checksum = "826c4e17a30643b888fe983897f9a4b23b07066e1d069727a923cc8fb419a702"
 dependencies = [
 "bytes",
 "log",
@ -3454,18 +3459,18 @@ dependencies = [

 [[package]]
 name = "opendal-service-s3"
-version = "0.57.0"
+version = "0.58.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "313d46c9f5ae70bca26b7c3e3fbb9b639292625f28af73aa016f47e788af9deb"
+checksum = "58e80cdf192d7eff05feed747894d64f81905ac4eaf132edf7ea270abdd2d663"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
 "bytes",
- "crc32c",
- "http 1.4.2",
+ "crc-fast",
+ "http 1.5.0",
 "log",
 "md-5",
 "opendal-core",
- "quick-xml 0.39.4",
+ "quick-xml",
 "reqsign-aws-v4",
 "reqsign-core",
 "reqsign-file-read-tokio",
@ -3484,7 +3489,7 @@ dependencies = [
 "dyn-clone",
 "ed25519-dalek",
 "hmac 0.12.1",
- "http 1.4.2",
+ "http 1.5.0",
 "itertools",
 "log",
 "oauth2",
@ -4007,16 +4012,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"

-[[package]]
-name = "quick-xml"
-version = "0.39.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e"
-dependencies = [
- "memchr",
- "serde",
-]
-
 [[package]]
 name = "quick-xml"
 version = "0.41.0"
@ -4193,9 +4188,9 @@ dependencies = [

 [[package]]
 name = "regex-automata"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -4226,19 +4221,18 @@ dependencies = [
 ]

 [[package]]
-name = "reqsign-aws-v4"
-version = "3.0.2"
+name = "reqsign-aws-core"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e9e1168fab3883ec6afed1c2e20c25b2a09f366cdb662ac3e0878ae0332d63e"
+checksum = "e4af084e1f3cbf3e67e0c972765399bce54ecec804cceba46b39a8331f3c1bff"
 dependencies = [
- "anyhow",
 "bytes",
 "form_urlencoded",
 "hex",
- "http 1.4.2",
+ "http 1.5.0",
 "log",
 "percent-encoding",
- "quick-xml 0.41.0",
+ "quick-xml",
 "reqsign-core",
 "rust-ini",
 "serde",
@ -4248,19 +4242,33 @@ dependencies = [
 ]

 [[package]]
-name = "reqsign-core"
+name = "reqsign-aws-v4"
 version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "514a1e0b4aa288652a3fdbda4f0a610f379cdf5374e55a37c9edd03d57ed856b"
+checksum = "4ac5b3b7cefa28933792b439186459f77f19f9b6edbeab41b8b187150361a206"
+dependencies = [
+ "bytes",
+ "http 1.5.0",
+ "log",
+ "quick-xml",
+ "reqsign-aws-core",
+ "reqsign-core",
+ "serde",
+]
+
+[[package]]
+name = "reqsign-core"
+version = "3.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c07dd510b1e1b9b241883e483358147fb2ed2d497a7b39b065ba61eb93deceb0"
 dependencies = [
 "anyhow",
- "base64 0.22.1",
+ "base64 0.23.1",
 "bytes",
- "form_urlencoded",
 "futures",
 "hex",
 "hmac 0.13.0",
- "http 1.4.2",
+ "http 1.5.0",
 "jiff",
 "log",
 "percent-encoding",
@ -4271,9 +4279,9 @@ dependencies = [

 [[package]]
 name = "reqsign-file-read-tokio"
-version = "3.0.2"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b472a8d1f2e5a4be8ce13bb7bdf4b59e9bee613ce124aca23959ddb42176b39"
+checksum = "663d9d55abd0df0830ef0ae43708297cc1371cf4e8ca91f3ac813c309cca8c98"
 dependencies = [
 "anyhow",
 "reqsign-core",
@ -4291,11 +4299,10 @@ dependencies = [
 "cookie",
 "cookie_store",
 "encoding_rs",
- "futures-channel",
 "futures-core",
 "futures-util",
 "h2",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "hyper 1.11.0",
@ -4306,7 +4313,7 @@ dependencies = [
 "mime",
 "percent-encoding",
 "pin-project-lite",
- "rustls 0.23.42",
+ "rustls 0.23.43",
 "rustls-pki-types",
 "rustls-platform-verifier",
 "serde",
@ -4575,9 +4582,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.42"
+version = "0.23.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
 "log",
 "once_cell",
@ -4629,7 +4636,7 @@ dependencies = [
 "jni",
 "log",
 "once_cell",
- "rustls 0.23.42",
+ "rustls 0.23.43",
 "rustls-native-certs",
 "rustls-platform-verifier-android",
 "rustls-webpki 0.103.13",
@ -4719,9 +4726,9 @@ dependencies = [

 [[package]]
 name = "schemars"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
 dependencies = [
 "dyn-clone",
 "ref-cast",
@ -4921,7 +4928,7 @@ dependencies = [
 "indexmap 1.9.3",
 "indexmap 2.14.0",
 "schemars 0.9.0",
- "schemars 1.2.1",
+ "schemars 1.2.2",
 "serde_core",
 "serde_json",
 "serde_with_macros",
@ -5107,6 +5114,12 @@ version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"

+[[package]]
+name = "spin"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
+
 [[package]]
 name = "spinning_top"
 version = "0.3.0"
@ -5330,20 +5343,11 @@ dependencies = [
 "cfg-if",
 ]

-[[package]]
-name = "threadpool"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
-dependencies = [
- "num_cpus",
-]
-
 [[package]]
 name = "time"
-version = "0.3.54"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
 "deranged",
 "libc",
@ -5424,13 +5428,13 @@ dependencies = [

 [[package]]
 name = "tokio-macros"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]

 [[package]]
@ -5449,7 +5453,7 @@ version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.42",
+ "rustls 0.23.43",
 "tokio",
 ]

@ -5550,9 +5554,9 @@ dependencies = [

 [[package]]
 name = "toml_parser"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
 "winnow 1.0.4",
 ]
@ -5601,7 +5605,7 @@ dependencies = [
 "bytes",
 "futures-core",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "pin-project-lite",
@ -5702,7 +5706,7 @@ dependencies = [
 "byteorder",
 "bytes",
 "data-encoding",
- "http 1.4.2",
+ "http 1.5.0",
 "httparse",
 "log",
 "rand 0.8.7",
@ -5818,9 +5822,9 @@ checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"

 [[package]]
 name = "value-bag"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef73bfbaf3216cb59c205d7176bee1194e0d84348979da31f4a71fefe3c2054e"
+checksum = "068e763e8279de7ab94b6afebded2cb701678af094feb1c12ccb061b4783c1be"

 [[package]]
 name = "vaultwarden"
@ -5853,7 +5857,7 @@ dependencies = [
 "handlebars",
 "hickory-resolver",
 "html5gum",
- "http 1.4.2",
+ "http 1.5.0",
 "ipnet",
 "job_scheduler_ng",
 "jsonwebtoken",
@ -5881,7 +5885,7 @@ dependencies = [
 "rocket",
 "rocket_ws",
 "rpassword",
- "rustls 0.23.42",
+ "rustls 0.23.43",
 "semver",
 "serde",
 "serde_json",
@ -6392,15 +6396,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

-[[package]]
-name = "winnow"
-version = "0.6.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e90edd2ac1aa278a5c4599b1d89cf03074b610800f866d4026dc199d7929a28"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "winnow"
 version = "0.7.15"
@ -6501,18 +6496,15 @@ dependencies = [

 [[package]]
 name = "yubico_ng"
-version = "0.15.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "228e2862e3c66f3224102d9a00d9d3646b271a05cc6c4819fea195fa8b5c00e0"
+checksum = "563eb0ab41031e758446e3737231541bb4556d6af1e893e94faa09c989f794af"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
 "form_urlencoded",
- "futures",
- "hmac 0.12.1",
- "rand 0.9.5",
- "reqwest",
- "sha1 0.10.7",
- "threadpool",
+ "getrandom 0.4.3",
+ "hmac 0.13.0",
+ "sha1 0.11.0",
 ]

 [[package]]
--- a/Cargo.toml
+++ b/Cargo.toml
@ -124,7 +124,7 @@ libsqlite3-sys = { version = "0.37.0", optional = true }
 # Crypto-related libraries
 rand = "0.10.2"
 ring = "0.17.14"
-rustls = { version = "0.23.42", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.43", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"

 # UUID generation
@ -133,13 +133,13 @@ uuid = { version = "1.24.0", features = ["v4"] }
 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
 chrono-tz = "0.10.4"
-time = "0.3.54"
+time = "0.3.55"

 # Job scheduler
-job_scheduler_ng = "2.4.0"
+job_scheduler_ng = "2.5.0"

 # Data encoding library Hex/Base32/Base64
-data-encoding = "2.11.0"
+data-encoding = "2.11.1"

 # JWT library
 jsonwebtoken = { version = "11.0.0", default-features = false, features = ["rust_crypto", "use_pem"] }
@ -148,7 +148,7 @@ jsonwebtoken = { version = "11.0.0", default-features = false, features = ["rust
 totp-lite = "2.0.1"

 # Yubico Library
-yubico = { package = "yubico_ng", version = "0.15.0", default-features = false, features = ["online-tokio"] }
+yubico_ng = { version = "1.0.0", default-features = false }

 # WebAuthn libraries
 # danger-allow-state-serialisation is needed to save the state in the db
@ -161,7 +161,7 @@ webauthn-rs-core = "0.5.5"
 url = "2.5.8"

 # Email libraries
-lettre = { version = "0.11.22", default-features = false, features = [
+lettre = { version = "0.11.23", default-features = false, features = [
    # Misc
    "tracing",
    "serde",
@ -231,7 +231,7 @@ pastey = "0.2.3"
 governor = "0.10.4"

 # CIDR parsing for the trusted proxies of the client IP header
-ipnet = "2.12.0"
+ipnet = "2.12.1"

 # OIDC for SSO
 openidconnect = { version = "4.0.1", default-features = false }
@ -256,10 +256,10 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }

 # File are accessed through Apache OpenDAL
-opendal = { version = "0.57.0", default-features = false, features = ["services-fs"] }
+opendal = { version = "0.58.1", default-features = false, features = ["services-fs"] }

 # For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.10.0", optional = true, default-features = false, features = [
+aws-config = { version = "1.10.1", optional = true, default-features = false, features = [
    "behavior-version-latest",
    "credentials-process",
    "rt-tokio",
@ -267,9 +267,9 @@ aws-config = { version = "1.10.0", optional = true, default-features = false, fe
 ] }
 aws-credential-types = { version = "1.3.0", optional = true }
 aws-smithy-runtime-api = { version = "1.14.0", optional = true }
-http = { version = "1.4.2", optional = true }
-reqsign-aws-v4 = { version = "3.0.2", optional = true }
-reqsign-core = { version = "3.1.0", optional = true }
+http = { version = "1.5.0", optional = true }
+reqsign-aws-v4 = { version = "3.1.0", optional = true }
+reqsign-core = { version = "3.2.1", optional = true }

 # Strip debuginfo from the release builds
 # The debug symbols are to provide better panic traces
--- a/docker/DockerSettings.yaml
+++ b/docker/DockerSettings.yaml
@ -1,6 +1,6 @@
 ---
-vault_version: "v2026.6.4"
-vault_image_digest: "sha256:e7d3b31ec6a991a6bf447721ea341b4192ce5d3b920929211672fd4f3f891427"
+vault_version: "v2026.7.0"
+vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c"
 # Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
--- a/docker/Dockerfile.alpine
+++ b/docker/Dockerfile.alpine
@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.6.4
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.6.4
-#     [docker.io/vaultwarden/web-vault@sha256:e7d3b31ec6a991a6bf447721ea341b4192ce5d3b920929211672fd4f3f891427]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:e7d3b31ec6a991a6bf447721ea341b4192ce5d3b920929211672fd4f3f891427
-#     [docker.io/vaultwarden/web-vault:v2026.6.4]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+#     [docker.io/vaultwarden/web-vault:v2026.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:e7d3b31ec6a991a6bf447721ea341b4192ce5d3b920929211672fd4f3f891427 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault

 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
@ -70,7 +70,7 @@ RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo

-RUN source /env-cargo && \
+RUN . /env-cargo && \
    rustup target add "${CARGO_TARGET}"

 # Copies over *only* your manifests and build files
@ -86,7 +86,7 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
    find . -not -path "./target*" -delete

@ -97,13 +97,13 @@ COPY . .
 ARG VW_VERSION

 # Builds again, this time it will be the actual source files being build
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
-    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
+    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@ -126,6 +126,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
+# hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.24

 ENV ROCKET_PROFILE="release" \
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.6.4
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.6.4
-#     [docker.io/vaultwarden/web-vault@sha256:e7d3b31ec6a991a6bf447721ea341b4192ce5d3b920929211672fd4f3f891427]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:e7d3b31ec6a991a6bf447721ea341b4192ce5d3b920929211672fd4f3f891427
-#     [docker.io/vaultwarden/web-vault:v2026.6.4]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+#     [docker.io/vaultwarden/web-vault:v2026.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:e7d3b31ec6a991a6bf447721ea341b4192ce5d3b920929211672fd4f3f891427 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault

 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
@ -37,6 +37,7 @@ FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
 FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.97.1-slim-trixie AS build
+# hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH
 ARG TARGETVARIANT
@ -80,7 +81,7 @@ RUN mkdir -pv "${CARGO_HOME}" && \
 RUN USER=root cargo new --bin /app
 WORKDIR /app

-RUN source /env-cargo && \
+RUN . /env-cargo && \
    rustup target add "${CARGO_TARGET}"

 # Copies over *only* your manifests and build files
@ -95,7 +96,7 @@ ARG DB=sqlite,mysql,postgresql
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
@ -113,7 +114,7 @@ COPY . .
 ARG VW_VERSION

 # Builds again, this time it will be the actual source files being build
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
@ -126,7 +127,7 @@ RUN source /env-cargo && \
        export XX_RUSTFLAGS; \
    fi && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
-    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
+    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@ -149,6 +150,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
+# hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim

 ENV ROCKET_PROFILE="release" \
--- a/docker/Dockerfile.j2
+++ b/docker/Dockerfile.j2
@ -57,6 +57,7 @@ FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].arch_image[arch] }} AS
 # hadolint ignore=DL3006
 FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].image }} AS build
 {% if base == "debian" %}
+# hadolint ignore=DL3067
 COPY --from=xx / /
 {% endif %}
 ARG TARGETARCH
@ -116,7 +117,7 @@ RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
    cat /env-cargo

 {% endif %}
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    rustup target add "${CARGO_TARGET}"

 # Copies over *only* your manifests and build files
@ -136,7 +137,7 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN source /env-cargo && \
+RUN . /env-cargo && \
 {% if base == "debian" %}
    {{ xx_cargo_config() }} && \
 {% elif base == "alpine" %}
@ -151,7 +152,7 @@ COPY . .
 ARG VW_VERSION

 # Builds again, this time it will be the actual source files being build
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
@ -161,7 +162,7 @@ RUN source /env-cargo && \
 {% elif base == "alpine" %}
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
 {% endif %}
-    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
+    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@ -184,6 +185,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
+# hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM {{ runtime_stage_image[base] }}

 ENV ROCKET_PROFILE="release" \
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@ -716,6 +716,36 @@ fn web_vault_compare(active: &str, latest: &str) -> i8 {
    }
 }

+fn check_template_overrides() -> Vec<&'static str> {
+    let template_folder = std::path::PathBuf::from(CONFIG.templates_folder());
+    let mut overrides = Vec::new();
+    for folder in ["admin", "email", "scss"] {
+        if folder_has_hbs_files(&template_folder.join(folder)) {
+            overrides.push(folder);
+        }
+    }
+
+    if folder_has_hbs_files(&template_folder) {
+        overrides.push("other");
+    }
+
+    overrides
+}
+
+fn folder_has_hbs_files(dir: &std::path::Path) -> bool {
+    let Ok(files) = std::fs::read_dir(dir) else {
+        // No files in this directory at all, so we can return false
+        return false;
+    };
+
+    files.flatten().any(|f| {
+        // Validate if it is a file and if it has the `.hbs` extension and starts with a-z or 0-9
+        f.file_type().is_ok_and(|t| t.is_file())
+            && f.path().extension().is_some_and(|e| e.eq_ignore_ascii_case("hbs"))
+            && f.file_name().to_str().is_some_and(|n| n.starts_with(|c: char| c.is_ascii_alphanumeric()))
+    })
+}
+
 #[get("/diagnostics")]
 async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> ApiResult<Html<String>> {
    use chrono::prelude::*;
@ -770,6 +800,7 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
        "db_version": get_sql_server_version(&conn).await,
        "admin_url": format!("{}/diagnostics", admin_url()),
        "overrides": &CONFIG.get_overrides().join(", "),
+        "template_overrides": check_template_overrides().join(", "),
        "invalid_feature_flags": invalid_feature_flags,
        "host_arch": env::consts::ARCH,
        "host_os":  env::consts::OS,
--- a/src/api/core/ciphers.rs
+++ b/src/api/core/ciphers.rs
@ -870,7 +870,7 @@ async fn put_collections_admin(
    headers: Headers,
    conn: DbConn,
    nt: Notify<'_>,
-) -> EmptyResult {
+) -> JsonResult {
    post_collections_admin(cipher_id, data, headers, conn, nt).await
 }

@ -881,7 +881,7 @@ async fn post_collections_admin(
    headers: Headers,
    conn: DbConn,
    nt: Notify<'_>,
-) -> EmptyResult {
+) -> JsonResult {
    let data: CollectionsAdminData = data.into_inner();

    let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
@ -940,7 +940,7 @@ async fn post_collections_admin(
    )
    .await;

-    Ok(())
+    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::Organization, &conn).await?))
 }

 #[derive(Deserialize)]
--- a/src/api/core/two_factor/yubikey.rs
+++ b/src/api/core/two_factor/yubikey.rs
@ -1,6 +1,10 @@
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
-use yubico::{config::Config, verify_async};
+use yubico_ng::{
+    Verifier, YubicoError,
+    config::Config,
+    transport::{AsyncTransport, Response},
+};

 use crate::{
    CONFIG,
@ -14,12 +18,39 @@ use crate::{
        models::{EventType, TwoFactor, TwoFactorType},
    },
    error::{Error, MapResult},
+    http_client,
 };

 pub fn routes() -> Vec<Route> {
    routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
 }

+struct HttpClientTransport {
+    client: reqwest::Client,
+}
+
+impl HttpClientTransport {
+    fn new() -> Result<Self, reqwest::Error> {
+        http_client::get_reqwest_client_builder(false).redirect(reqwest::redirect::Policy::none()).build().map(
+            |client| Self {
+                client,
+            },
+        )
+    }
+}
+
+impl AsyncTransport for HttpClientTransport {
+    type Error = YubicoError;
+
+    async fn yubico_get(&self, url: &str) -> Result<Response, Self::Error> {
+        let response = self.client.get(url).send().await.map_err(YubicoError::transport)?;
+        Ok(Response {
+            status: response.status().as_u16(),
+            body: response.text().await.map_err(YubicoError::transport)?,
+        })
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EnableYubikeyData {
@ -44,8 +75,7 @@ pub struct YubikeyMetadata {

 fn parse_yubikeys(data: &EnableYubikeyData) -> Vec<String> {
    let data_keys = [&data.key1, &data.key2, &data.key3, &data.key4, &data.key5];
-
-    data_keys.into_iter().flatten().cloned().collect()
+    data_keys.into_iter().flatten().filter(|e| !e.is_empty()).cloned().collect()
 }

 fn jsonify_yubikeys(yubikeys: Vec<String>) -> Value {
@ -73,13 +103,15 @@ fn get_yubico_credentials() -> Result<(String, String), Error> {
 async fn verify_yubikey_otp(otp: String) -> EmptyResult {
    let (yubico_id, yubico_secret) = get_yubico_credentials()?;

-    let config = Config::default().set_client_id(yubico_id).set_key(yubico_secret);
-
-    match CONFIG.yubico_server() {
-        Some(server) => verify_async(otp, config.set_api_hosts(vec![server])).await,
-        None => verify_async(otp, config).await,
+    let mut config = Config::default().set_client_id(yubico_id).set_key(yubico_secret)?;
+    if let Some(yubico_server) = CONFIG.yubico_server() {
+        config = config.set_api_host(yubico_server);
    }
-    .map_res("Failed to verify OTP")
+
+    let client = HttpClientTransport::new()?;
+    let verifier = Verifier::with_client(config, client)?;
+
+    verifier.verify(otp).await.map_res("Failed to verify OTP")
 }

 #[post("/two-factor/get-yubikey", data = "<data>")]
@ -137,10 +169,9 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
    let yubikeys = parse_yubikeys(&data);

    if yubikeys.is_empty() {
-        return Ok(Json(json!({
-            "enabled": false,
-            "object": "twoFactorU2f",
-        })));
+        // Return an error to prevent saving empty keys which would cause users not being able to login anymore.
+        // To remove all keys users should click the `Deactivate all keys` button
+        err!("A key is required.");
    }

    // Ensure they are valid OTPs
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@ -30,7 +30,7 @@ pub use crate::api::{
    },
    web::catchers as web_catchers,
    web::routes as web_routes,
-    web::static_files,
+    web::{invalidate_css_cache, static_files},
 };
 use crate::{
    CONFIG,
--- a/src/api/web.rs
+++ b/src/api/web.rs
@ -1,4 +1,7 @@
-use std::path::{Path, PathBuf};
+use std::{
+    path::{Path, PathBuf},
+    sync::{Arc, RwLock},
+};

 use rocket::{
    Catcher, Route,
@ -13,12 +16,13 @@ use crate::{
    CONFIG,
    api::{ApiResult, EmptyResult, core::now},
    auth::decode_file_download,
+    crypto::sha256_hex,
    db::{
        DbConn,
        models::{AttachmentId, CipherId},
    },
    error::Error,
-    util::Cached,
+    util::{Cached, EtagCached},
 };

 pub fn routes() -> Vec<Route> {
@ -63,8 +67,27 @@ fn not_found() -> ApiResult<Html<String>> {
    Ok(Html(text))
 }

+struct CssCache {
+    css: String,
+    etag: String,
+}
+
+static CSS_CACHE: RwLock<Option<Arc<CssCache>>> = RwLock::new(None);
+
+pub fn invalidate_css_cache() {
+    *CSS_CACHE.write().unwrap() = None;
+}
+
 #[get("/css/vaultwarden.css")]
-fn vaultwarden_css() -> Cached<Css<String>> {
+fn vaultwarden_css() -> EtagCached<Css<String>> {
+    // If reload_templates is false, and we already have the CSS Cached, return this
+    if !CONFIG.reload_templates()
+        && let Some(cached) = CSS_CACHE.read().unwrap().as_ref()
+    {
+        return EtagCached::new(Css(cached.css.clone()), &cached.etag);
+    }
+
+    // Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS
    let css_options = json!({
        "emergency_access_allowed": CONFIG.emergency_access_allowed(),
        "load_user_scss": true,
@ -112,8 +135,18 @@ fn vaultwarden_css() -> Cached<Css<String>> {
        }
    };

-    // Cache for one day should be enough and not too much
-    Cached::ttl(Css(css), 86_400, false)
+    let etag = sha256_hex(css.as_bytes());
+    let cached = Arc::new(CssCache {
+        css,
+        etag,
+    });
+
+    if !CONFIG.reload_templates() {
+        *CSS_CACHE.write().unwrap() = Some(Arc::clone(&cached));
+    }
+
+    // Etag Caching will let the browser send us an etag to verify and send new content if needed
+    EtagCached::new(Css(cached.css.clone()), &cached.etag)
 }

 #[get("/")]
--- a/src/config.rs
+++ b/src/config.rs
@ -1506,6 +1506,9 @@ impl Config {
        let operator = storage::operator_for_path(&CONFIG_FILE_PARENT_DIR)?;
        operator.write(&CONFIG_FILENAME, config_str).await?;

+        // Invalidate CSS Cache because several config items might have impact on the rendered CSS
+        crate::api::invalidate_css_cache();
+
        Ok(())
    }

@ -1588,6 +1591,9 @@ impl Config {
            writer._overrides = Vec::new();
        }

+        // Invalidate CSS Cache because several config items might have impact on the rendered CSS
+        crate::api::invalidate_css_cache();
+
        Ok(())
    }

--- a/src/db/models/event.rs
+++ b/src/db/models/event.rs
@ -298,12 +298,16 @@ impl Event {
    ) -> Vec<Self> {
        conn.run(move |conn| {
            event::table
-                .inner_join(users_organizations::table.on(users_organizations::uuid.eq(member_uuid)))
+                .inner_join(
+                    users_organizations::table
+                        .on(users_organizations::uuid.eq(member_uuid).and(users_organizations::org_uuid.eq(org_uuid))),
+                )
                .filter(event::org_uuid.eq(org_uuid))
                .filter(event::event_date.between(start, end))
                .filter(
-                    event::user_uuid
-                        .eq(users_organizations::user_uuid.nullable())
+                    event::org_user_uuid
+                        .eq(member_uuid)
+                        .or(event::user_uuid.eq(users_organizations::user_uuid.nullable()))
                        .or(event::act_user_uuid.eq(users_organizations::user_uuid.nullable())),
                )
                .select(event::all_columns)
--- a/src/error.rs
+++ b/src/error.rs
@ -58,7 +58,7 @@ use serde_json::{Error as SerdeErr, Value};
 use std::io::Error as IoErr;
 use std::time::SystemTimeError as TimeErr;
 use webauthn_rs::prelude::WebauthnError as WebauthnErr;
-use yubico::yubicoerror::YubicoError as YubiErr;
+use yubico_ng::error::YubicoError as YubiErr;

 #[derive(Serialize)]
 pub struct Empty {}
--- a/src/static/scripts/admin.js
+++ b/src/static/scripts/admin.js
@ -1,6 +1,5 @@
 "use strict";
-/* eslint-env es2017, browser */
-/* exported BASE_URL, _post _delete */
+/* exported BASE_URL, _post, _delete */

 function getBaseUrl() {
    // If the base URL is `https://vaultwarden.example.com/base/path/admin/`,
--- a/src/static/scripts/admin_diagnostics.js
+++ b/src/static/scripts/admin_diagnostics.js
@ -1,5 +1,4 @@
 "use strict";
-/* eslint-env es2017, browser */
 /* global BASE_URL:readable, bootstrap:readable */

 var dnsCheck = false;
@ -80,37 +79,44 @@ async function generateSupportString(event, dj) {
    event.preventDefault();
    event.stopPropagation();

+    // Health check Markdown emoji, if something is a failure or not
+    const chk = v => v ? "true :white_check_mark:" : "false :x:";
+    // Yes/No Markdown emoji, if something is not a failure, but just yes or no
+    const yn = v => v ? "yes :heavy_plus_sign:" : "no :heavy_minus_sign:";
+
+    const template_overrides = dj.template_overrides !== "" ? ` (${dj.template_overrides})` : "";
    let supportString = "### Your environment (Generated via diagnostics page)\n\n";

    supportString += `* Vaultwarden version: v${dj.current_release}\n`;
    supportString += `* Web-vault version: v${dj.active_web_release}\n`;
    supportString += `* OS/Arch: ${dj.host_os}/${dj.host_arch}\n`;
-    supportString += `* Running within a container: ${dj.running_within_container} (Base: ${dj.container_base_image})\n`;
+    supportString += `* Running within a container: ${yn(dj.running_within_container)} (Base: ${dj.container_base_image})\n`;
    supportString += `* Database type: ${dj.db_type}\n`;
    supportString += `* Database version: ${dj.db_version}\n`;
-    supportString += `* Uses config.json: ${dj.overrides !== ""}\n`;
-    supportString += `* Uses a reverse proxy: ${dj.ip_header_exists}\n`;
+    supportString += `* Uses config.json: ${yn(dj.overrides !== "")}\n`;
+    supportString += `* Uses custom templates: ${yn(dj.template_overrides !== "")}${template_overrides}\n`;
+    supportString += `* Uses a reverse proxy: ${yn(dj.ip_header_exists)}\n`;
    if (dj.ip_header_exists) {
-        supportString += `* IP Header check: ${dj.ip_header_match} (${dj.ip_header_name})\n`;
+        supportString += `* IP Header check: ${chk(dj.ip_header_match)} (${dj.ip_header_name})\n`;
    }
-    supportString += `* Internet access: ${dj.has_http_access}\n`;
-    supportString += `* Internet access via a proxy: ${dj.uses_proxy}\n`;
-    supportString += `* DNS Check: ${dnsCheck}\n`;
+    supportString += `* Internet access: ${chk(dj.has_http_access)}\n`;
+    supportString += `* Internet access via a proxy: ${yn(dj.uses_proxy)}\n`;
+    supportString += `* DNS Check: ${chk(dnsCheck)}\n`;
    if (dj.tz_env !== "") {
        supportString += `* TZ environment: ${dj.tz_env}\n`;
    }
-    supportString += `* Browser/Server Time Check: ${timeCheck}\n`;
-    supportString += `* Server/NTP Time Check: ${ntpTimeCheck}\n`;
-    supportString += `* Domain Configuration Check: ${domainCheck}\n`;
-    supportString += `* HTTPS Check: ${httpsCheck}\n`;
+    supportString += `* Browser/Server Time Check: ${chk(timeCheck)}\n`;
+    supportString += `* Server/NTP Time Check: ${chk(ntpTimeCheck)}\n`;
+    supportString += `* Domain Configuration Check: ${chk(domainCheck)}\n`;
+    supportString += `* HTTPS Check: ${chk(httpsCheck)}\n`;
    if (dj.enable_websocket) {
-        supportString += `* Websocket Check: ${websocketCheck}\n`;
+        supportString += `* Websocket Check: ${chk(websocketCheck)}\n`;
    } else {
        supportString += "* Websocket Check: disabled\n";
    }
-    supportString += `* HTTP Response Checks: ${httpResponseCheck}\n`;
+    supportString += `* HTTP Response Checks: ${chk(httpResponseCheck)}\n`;
    if (dj.invalid_feature_flags != "") {
-        supportString += `* Invalid feature flags: true\n`;
+        supportString += "* Invalid feature flags: true\n";
    }

    const jsonResponse = await fetch(`${BASE_URL}/admin/diagnostics/config`, {
--- a/src/static/scripts/admin_organizations.js
+++ b/src/static/scripts/admin_organizations.js
@ -1,6 +1,5 @@
 "use strict";
-/* eslint-env es2017, browser, jquery */
-/* global _post:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
+/* global jQuery, _post:readable, BASE_URL:readable, reload:readable, jdenticon:readable */

 function deleteOrganization(event) {
    event.preventDefault();
--- a/src/static/scripts/admin_settings.js
+++ b/src/static/scripts/admin_settings.js
@ -1,5 +1,4 @@
 "use strict";
-/* eslint-env es2017, browser */
 /* global _post:readable, BASE_URL:readable */

 function smtpTest(event) {
--- a/src/static/scripts/admin_users.js
+++ b/src/static/scripts/admin_users.js
@ -1,6 +1,5 @@
 "use strict";
-/* eslint-env es2017, browser, jquery */
-/* global _post:readable, _delete:readable BASE_URL:readable, reload:readable, jdenticon:readable */
+/* global jQuery, _post:readable, _delete:readable, BASE_URL:readable, reload:readable, jdenticon:readable */

 function deleteUser(event) {
    event.preventDefault();
--- a/src/static/templates/admin/diagnostics.hbs
+++ b/src/static/templates/admin/diagnostics.hbs
@ -77,6 +77,16 @@
                        <span class="d-block"><b>No</b></span>
                    {{/unless}}
                    </dd>
+                    <dt class="col-sm-5">Uses custom templates</dt>
+                    <dd class="col-sm-7">
+                    {{#if page_data.template_overrides}}
+                        <span class="d-inline"><b>Yes</b></span>
+                        <span class="badge bg-info text-dark abbr-badge" title="Custom template files are used.&#013;&#010;{{page_data.template_overrides}}">Details</span>
+                    {{/if}}
+                    {{#unless page_data.template_overrides}}
+                        <span class="d-block"><b>No</b></span>
+                    {{/unless}}
+                    </dd>
                    <dt class="col-sm-5">Uses a reverse proxy</dt>
                    <dd class="col-sm-7">
                    {{#if page_data.ip_header_exists}}
--- a/src/storage.rs
+++ b/src/storage.rs
@ -67,7 +67,7 @@ pub(crate) fn operator_for_path(path: &str) -> Result<opendal::Operator, crate::
        s3::operator_for_path(path)?
    } else {
        let builder = opendal::services::Fs::default().root(path);
-        opendal::Operator::new(builder)?.finish()
+        opendal::Operator::new(builder)?
    };

    OPERATORS_BY_PATH.insert(path.to_owned(), operator.clone());
@ -236,7 +236,7 @@ mod s3 {
                builder.credential_provider_chain(ProvideCredentialChain::new().push(OpenDALS3CredentialProvider));
        }

-        Ok(opendal::Operator::new(builder)?.finish())
+        Ok(opendal::Operator::new(builder)?)
    }

    fn uri_has_option(uri: &opendal::OperatorUri, names: &[&str]) -> bool {
--- a/src/util.rs
+++ b/src/util.rs
@ -257,6 +257,44 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for Cache
    }
 }

+pub struct EtagCached<R> {
+    response: R,
+    etag: String,
+}
+
+impl<R> EtagCached<R> {
+    /// An `etag` response should always be quoted
+    pub fn new(response: R, etag: &str) -> Self {
+        Self {
+            response,
+            etag: format!("\"{etag}\""),
+        }
+    }
+}
+
+impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for EtagCached<R> {
+    fn respond_to(self, request: &'r Request<'_>) -> response::Result<'static> {
+        // Check and validate a `If-None-Match` ETag header
+        // Multiple tags could be returned for the same URI if the browser has multiple versions cached
+        // Also, weak tags are prefixed with `W/`, but ETags are always weak, so just strip it too before comparing
+        let etag_matches = request
+            .headers()
+            .get_one("If-None-Match")
+            .is_some_and(|v| v.split(',').any(|t| t.trim().trim_start_matches("W/") == self.etag));
+
+        let mut res = if etag_matches {
+            Response::build().status(Status::NotModified).ok()?
+        } else {
+            self.response.respond_to(request)?
+        };
+
+        // Both 200 (OK) and 304 (Not Modified) need to return the etag and cache-control
+        res.set_raw_header("Etag", self.etag);
+        res.set_raw_header("Cache-Control", "public, no-cache");
+        Ok(res)
+    }
+}
+
 // Log all the routes from the main paths list, and the attachments endpoint
 // Effectively ignores, any static file route, and the alive endpoint
 const LOGGED_ROUTES: [&str; 7] = ["/api", "/admin", "/identity", "/icons", "/attachments", "/events", "/notifications"];