Merge branch 'main' into PM-24618-CLI-reveal-email-CLI-flag

2026-02-10 05:30:01 +00:00 · 2025-12-30 08:56:12 -07:00
parent 705bc2b730 8a6f9bfaeb
commit 5ea44140f0
127 changed files with 2952 additions and 993 deletions
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -157,6 +157,7 @@
        "html-webpack-injector",
        "html-webpack-plugin",
        "interprocess",
+        "itertools",
        "json5",
        "keytar",
        "libc",
--- a/.github/workflows/alert-ddg-files-modified.yml
+++ b/.github/workflows/alert-ddg-files-modified.yml
@@ -14,7 +14,7 @@ jobs:
      pull-requests: write
    steps:
    - name: Checkout code
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        fetch-depth: 0
        persist-credentials: false
--- a/.github/workflows/auto-branch-updater.yml
+++ b/.github/workflows/auto-branch-updater.yml
@@ -30,7 +30,7 @@ jobs:
        run: echo "branch=${GITHUB_REF#refs/heads/}" >> "$GITHUB_OUTPUT"

      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: 'eu-web-${{ steps.setup.outputs.branch }}'
          fetch-depth: 0
--- a/.github/workflows/build-browser.yml
+++ b/.github/workflows/build-browser.yml
@@ -55,7 +55,7 @@ jobs:
      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -94,7 +94,7 @@ jobs:
        working-directory: apps/browser
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -146,7 +146,7 @@ jobs:
      _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -254,7 +254,7 @@ jobs:
            artifact_name: "dist-opera-MV3"
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -386,7 +386,7 @@ jobs:
      _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -542,7 +542,7 @@ jobs:
      - build-safari
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
--- a/.github/workflows/build-cli.yml
+++ b/.github/workflows/build-cli.yml
@@ -59,7 +59,7 @@ jobs:
      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -114,7 +114,7 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -311,7 +311,7 @@ jobs:
      _WIN_PKG_VERSION: 3.5
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -520,7 +520,7 @@ jobs:
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -55,7 +55,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -88,7 +88,7 @@ jobs:
        working-directory: apps/desktop
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: true
@@ -173,24 +173,14 @@ jobs:
        working-directory: apps/desktop
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 1
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false

-      - name: Free disk space for build
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /usr/share/miniconda
-          sudo rm -rf /usr/share/az_*
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /usr/lib/mono
-          sudo rm -rf /usr/lib/heroku
-          sudo rm -rf /usr/local/aws-cli
-          sudo rm -rf /usr/local/aws-sam-cli
+      - name: Free disk space
+        uses: bitwarden/gh-actions/free-disk-space@main

      - name: Set up Node
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -343,7 +333,7 @@ jobs:
        working-directory: apps/desktop
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -491,7 +481,7 @@ jobs:
      NODE_OPTIONS: --max_old_space_size=4096
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -759,7 +749,7 @@ jobs:
      NODE_OPTIONS: --max_old_space_size=4096
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -1004,7 +994,7 @@ jobs:
        working-directory: apps/desktop
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -1244,7 +1234,7 @@ jobs:
        working-directory: apps/desktop
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -1519,7 +1509,7 @@ jobs:
        working-directory: apps/desktop
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -1860,7 +1850,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          persist-credentials: false
--- a/.github/workflows/build-web.yml
+++ b/.github/workflows/build-web.yml
@@ -64,7 +64,7 @@ jobs:
      has_secrets: ${{ steps.check-secrets.outputs.has_secrets }}
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -144,7 +144,7 @@ jobs:
      _VERSION: ${{ needs.setup.outputs.version }}
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
@@ -174,7 +174,7 @@ jobs:
          echo "server_ref=$SERVER_REF" >> "$GITHUB_OUTPUT"

      - name: Check out Server repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: server
          repository: bitwarden/server
@@ -367,7 +367,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -31,7 +31,7 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{  github.event.pull_request.head.sha }}
          fetch-depth: 0
--- a/.github/workflows/crowdin-pull.yml
+++ b/.github/workflows/crowdin-pull.yml
@@ -58,7 +58,7 @@ jobs:
          permission-pull-requests: write # for generating pull requests

      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          token: ${{ steps.app-token.outputs.token }}
          persist-credentials: false
--- a/.github/workflows/lint-crowdin-config.yml
+++ b/.github/workflows/lint-crowdin-config.yml
@@ -22,7 +22,7 @@ jobs:
        ]
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 1
          persist-credentials: false
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -31,7 +31,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -95,7 +95,7 @@ jobs:

    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/locales-lint.yml
+++ b/.github/workflows/locales-lint.yml
@@ -17,11 +17,11 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - name: Checkout base branch repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          path: base
--- a/.github/workflows/nx.yml
+++ b/.github/workflows/nx.yml
@@ -12,7 +12,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -103,7 +103,7 @@ jobs:
      _PKG_VERSION: ${{ needs.setup.outputs.release_version }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -151,7 +151,7 @@ jobs:
      _PKG_VERSION: ${{ needs.setup.outputs.release_version }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -203,7 +203,7 @@ jobs:
      _PKG_VERSION: ${{ needs.setup.outputs.release_version }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/publish-desktop.yml
+++ b/.github/workflows/publish-desktop.yml
@@ -204,7 +204,7 @@ jobs:
      _RELEASE_TAG: ${{ needs.setup.outputs.tag_name }}
    steps:
      - name: Checkout Repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -258,7 +258,7 @@ jobs:
      _RELEASE_TAG: ${{ needs.setup.outputs.tag_name }}
    steps:
      - name: Checkout Repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -315,7 +315,7 @@ jobs:
      _RELEASE_TAG: ${{ needs.setup.outputs.tag_name }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/publish-web.yml
+++ b/.github/workflows/publish-web.yml
@@ -28,7 +28,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -74,7 +74,7 @@ jobs:
          echo "Github Release Option: $_RELEASE_OPTION"

      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/release-browser.yml
+++ b/.github/workflows/release-browser.yml
@@ -28,7 +28,7 @@ jobs:
      release_version: ${{ steps.version.outputs.version }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -61,7 +61,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/release-cli.yml
+++ b/.github/workflows/release-cli.yml
@@ -29,7 +29,7 @@ jobs:
      release_version: ${{ steps.version.outputs.version }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -31,7 +31,7 @@ jobs:
      release_channel: ${{ steps.release_channel.outputs.channel }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/release-web.yml
+++ b/.github/workflows/release-web.yml
@@ -25,7 +25,7 @@ jobs:
      tag_version: ${{ steps.version.outputs.tag }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/repository-management.yml
+++ b/.github/workflows/repository-management.yml
@@ -105,7 +105,7 @@ jobs:
          permission-contents: write # for committing and pushing to current branch

      - name: Check out branch
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.ref }}
          token: ${{ steps.app-token.outputs.token }}
@@ -471,7 +471,7 @@ jobs:
          permission-contents: write # for creating and pushing new branch

      - name: Check out target ref
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ inputs.target_ref }}
          token: ${{ steps.app-token.outputs.token }}
--- a/.github/workflows/sdk-breaking-change-check.yml
+++ b/.github/workflows/sdk-breaking-change-check.yml
@@ -64,7 +64,7 @@ jobs:
        uses: bitwarden/gh-actions/azure-logout@main

      - name: Check out clients repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/test-browser-interactions.yml
+++ b/.github/workflows/test-browser-interactions.yml
@@ -18,7 +18,7 @@ jobs:
      id-token: write
    steps:
    - name: Checkout code
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        fetch-depth: 0
        persist-credentials: false
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,7 +24,7 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -103,7 +103,7 @@ jobs:
          sudo apt-get install -y gnome-keyring dbus-x11

      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -137,7 +137,7 @@ jobs:
    runs-on: macos-14
    steps:
      - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -173,7 +173,7 @@ jobs:
      - rust-coverage
    steps:
      - name: Check out repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/version-auto-bump.yml
+++ b/.github/workflows/version-auto-bump.yml
@@ -39,7 +39,7 @@ jobs:
          permission-contents: write # for committing and pushing to the current branch

      - name: Check out target ref
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: main
          token: ${{ steps.app-token.outputs.token }}
--- a/apps/browser/package.json
+++ b/apps/browser/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@bitwarden/browser",
-  "version": "2025.12.0",
+  "version": "2025.12.1",
  "scripts": {
    "build": "npm run build:chrome",
    "build:bit": "npm run build:bit:chrome",
--- a/apps/browser/src/_locales/az/messages.json
+++ b/apps/browser/src/_locales/az/messages.json
@@ -2498,7 +2498,7 @@
    }
  },
  "topLayerHijackWarning": {
-    "message": "This page is interfering with the Bitwarden experience. The Bitwarden inline menu has been temporarily disabled as a safety measure."
+    "message": "Bu səhifə Bitwarden təcrübəsinə müdaxilə edir. Bitwarden daxili menyusu, təhlükəsizlik tədbiri olaraq müvəqqəti sıradan çıxarılıb."
  },
  "setMasterPassword": {
    "message": "Ana parolu ayarla"
@@ -4124,7 +4124,7 @@
    "message": "Avto-doldurula bilmir"
  },
  "cannotAutofillExactMatch": {
-    "message": "Default matching is set to 'Exact Match'. The current website does not exactly match the saved login details for this item."
+    "message": "İlkin uyuşma 'Tam Uyuşur' olaraq ayarlanıb. Hazırkı veb sayt, bu element üçün saxlanılmış giriş məlumatları ilə tam uyuşmur."
  },
  "okay": {
    "message": "Oldu"
--- a/apps/browser/src/_locales/en/messages.json
+++ b/apps/browser/src/_locales/en/messages.json
@@ -6039,5 +6039,8 @@
  },
  "whyAmISeeingThis": {
    "message": "Why am I seeing this?"
+  },
+  "resizeSideNavigation": {
+    "message": "Resize side navigation"
  }
 }
--- a/apps/browser/src/_locales/zh_CN/messages.json
+++ b/apps/browser/src/_locales/zh_CN/messages.json
@@ -1486,7 +1486,7 @@
    "message": "选择一个文件"
  },
  "itemsTransferred": {
-    "message": "项目已传输"
+    "message": "项目已转移"
  },
  "maxFileSize": {
    "message": "文件最大为 500 MB。"
@@ -3804,7 +3804,7 @@
    "description": "Browser extension/addon"
  },
  "desktop": {
-    "message": "桌面",
+    "message": "桌面端",
    "description": "Desktop app"
  },
  "webVault": {
@@ -5707,7 +5707,7 @@
    "message": "导入现有密码"
  },
  "emptyVaultNudgeBody": {
-    "message": "使用导入器快速将登录传输到 Bitwarden 而无需手动添加。"
+    "message": "使用导入器快速将登录转移到 Bitwarden 而无需手动添加。"
  },
  "emptyVaultNudgeButton": {
    "message": "立即导入"
@@ -6014,7 +6014,7 @@
    "message": "我该如何管理我的密码库？"
  },
  "transferItemsToOrganizationTitle": {
-    "message": "传输项目到 $ORGANIZATION$",
+    "message": "转移项目到 $ORGANIZATION$",
    "placeholders": {
      "organization": {
        "content": "$1",
@@ -6023,7 +6023,7 @@
    }
  },
  "transferItemsToOrganizationContent": {
-    "message": "出于安全和合规考虑，$ORGANIZATION$ 要求所有项目归组织所有。点击「接受」以传输您的项目的所有权。",
+    "message": "出于安全和合规考虑，$ORGANIZATION$ 要求所有项目归组织所有。点击「接受」以转移您的项目的所有权。",
    "placeholders": {
      "organization": {
        "content": "$1",
@@ -6032,7 +6032,7 @@
    }
  },
  "acceptTransfer": {
-    "message": "接受传输"
+    "message": "接受转移"
  },
  "declineAndLeave": {
    "message": "拒绝并退出"
--- a/apps/browser/src/autofill/fido2/content/messaging/messenger.ts
+++ b/apps/browser/src/autofill/fido2/content/messaging/messenger.ts
@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Message, MessageTypes } from "./message";

 const SENDER = "bitwarden-webauthn";
@@ -25,7 +23,7 @@ type Handler = (
 * handling aborts and exceptions across separate execution contexts.
 */
 export class Messenger {
-  private messageEventListener: (event: MessageEvent<MessageWithMetadata>) => void | null = null;
+  private messageEventListener: ((event: MessageEvent<MessageWithMetadata>) => void) | null = null;
  private onDestroy = new EventTarget();

  /**
@@ -60,6 +58,12 @@ export class Messenger {
    this.broadcastChannel.addEventListener(this.messageEventListener);
  }

+  private stripMetadata({ SENDER, senderId, ...message }: MessageWithMetadata): Message {
+    void SENDER;
+    void senderId;
+    return message;
+  }
+
  /**
   * Sends a request to the content script and returns the response.
   * AbortController signals will be forwarded to the content script.
@@ -74,7 +78,9 @@ export class Messenger {

    try {
      const promise = new Promise<Message>((resolve) => {
-        localPort.onmessage = (event: MessageEvent<MessageWithMetadata>) => resolve(event.data);
+        localPort.onmessage = (event: MessageEvent<MessageWithMetadata>) => {
+          resolve(this.stripMetadata(event.data));
+        };
      });

      const abortListener = () =>
@@ -129,7 +135,9 @@ export class Messenger {

      try {
        const handlerResponse = await this.handler(message, abortController);
-        port.postMessage({ ...handlerResponse, SENDER });
+        if (handlerResponse !== undefined) {
+          port.postMessage({ ...handlerResponse, SENDER });
+        }
      } catch (error) {
        port.postMessage({
          SENDER,
--- a/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.ts
+++ b/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.ts
@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { EVENTS } from "@bitwarden/common/autofill/constants";
 import { ThemeTypes } from "@bitwarden/common/platform/enums";

@@ -15,14 +13,17 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
  private readonly setElementStyles = setElementStyles;
  private readonly sendExtensionMessage = sendExtensionMessage;
  private port: chrome.runtime.Port | null = null;
-  private portKey: string;
+  private portKey?: string;
  private readonly extensionOrigin: string;
  private iframeMutationObserver: MutationObserver;
-  private iframe: HTMLIFrameElement;
-  private ariaAlertElement: HTMLDivElement;
-  private ariaAlertTimeout: number | NodeJS.Timeout;
-  private delayedCloseTimeout: number | NodeJS.Timeout;
-  private fadeInTimeout: number | NodeJS.Timeout;
+  /**
+   *  Initialized in initMenuIframe which makes it safe to assert non null by lifecycle.
+   */
+  private iframe!: HTMLIFrameElement;
+  private ariaAlertElement?: HTMLDivElement;
+  private ariaAlertTimeout: number | NodeJS.Timeout | null = null;
+  private delayedCloseTimeout: number | NodeJS.Timeout | null = null;
+  private fadeInTimeout: number | NodeJS.Timeout | null = null;
  private readonly fadeInOpacityTransition = "opacity 125ms ease-out 0s";
  private readonly fadeOutOpacityTransition = "opacity 65ms ease-out 0s";
  private iframeStyles: Partial<CSSStyleDeclaration> = {
@@ -50,7 +51,7 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
  };
  private foreignMutationsCount = 0;
  private mutationObserverIterations = 0;
-  private mutationObserverIterationsResetTimeout: number | NodeJS.Timeout;
+  private mutationObserverIterationsResetTimeout: number | NodeJS.Timeout | null = null;
  private readonly backgroundPortMessageHandlers: BackgroundPortMessageHandlers = {
    initAutofillInlineMenuButton: ({ message }) => this.initAutofillInlineMenu(message),
    initAutofillInlineMenuList: ({ message }) => this.initAutofillInlineMenu(message),
@@ -134,7 +135,9 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
    this.port.onDisconnect.addListener(this.handlePortDisconnect);
    this.port.onMessage.addListener(this.handlePortMessage);

-    this.announceAriaAlert(this.ariaAlert, 2000);
+    if (this.ariaAlert) {
+      this.announceAriaAlert(this.ariaAlert, 2000);
+    }
  };

  /**
@@ -155,7 +158,7 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe

    this.ariaAlertTimeout = globalThis.setTimeout(async () => {
      const isFieldFocused = await this.sendExtensionMessage("checkIsFieldCurrentlyFocused");
-      if (isFieldFocused || triggeredByUser) {
+      if ((isFieldFocused || triggeredByUser) && this.ariaAlertElement) {
        this.shadow.appendChild(this.ariaAlertElement);
      }
      this.ariaAlertTimeout = null;
@@ -242,7 +245,7 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
   */
  private initAutofillInlineMenuList(message: AutofillInlineMenuIframeExtensionMessage) {
    const { theme } = message;
-    let borderColor: string;
+    let borderColor: string | undefined;
    let verifiedTheme = theme;
    if (verifiedTheme === ThemeTypes.System) {
      verifiedTheme = globalThis.matchMedia("(prefers-color-scheme: dark)").matches
@@ -274,8 +277,8 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
   *
   * @param position - The position styles to apply to the iframe
   */
-  private updateIframePosition(position: Partial<CSSStyleDeclaration>) {
-    if (!globalThis.document.hasFocus()) {
+  private updateIframePosition(position?: Partial<CSSStyleDeclaration>) {
+    if (!position || !globalThis.document.hasFocus()) {
      return;
    }

@@ -295,7 +298,9 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
      this.handleFadeInInlineMenuIframe();
    }

-    this.announceAriaAlert(this.ariaAlert, 2000);
+    if (this.ariaAlert) {
+      this.announceAriaAlert(this.ariaAlert, 2000);
+    }
  }

  /**
@@ -359,8 +364,8 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
   * @param customElement - The element to update the styles for
   * @param styles - The styles to apply to the element
   */
-  private updateElementStyles(customElement: HTMLElement, styles: Partial<CSSStyleDeclaration>) {
-    if (!customElement) {
+  private updateElementStyles(customElement: HTMLElement, styles?: Partial<CSSStyleDeclaration>) {
+    if (!customElement || !styles) {
      return;
    }

--- a/apps/browser/src/autofill/overlay/notifications/content/overlay-notifications-content.service.ts
+++ b/apps/browser/src/autofill/overlay/notifications/content/overlay-notifications-content.service.ts
@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { EVENTS } from "@bitwarden/common/autofill/constants";

 import { BrowserApi } from "../../../../platform/browser/browser-api";
@@ -84,11 +82,15 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
    }
    const { type, typeData, params } = message.data;

+    if (!typeData) {
+      return;
+    }
+
    if (this.currentNotificationBarType && type !== this.currentNotificationBarType) {
      this.closeNotificationBar();
    }

-    const initData = {
+    const initData: NotificationBarIframeInitData = {
      type: type as NotificationType,
      isVaultLocked: typeData.isVaultLocked,
      theme: typeData.theme,
@@ -116,7 +118,9 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
    const closedByUser =
      typeof message.data?.closedByUser === "boolean" ? message.data.closedByUser : true;
    if (message.data?.fadeOutNotification) {
-      setElementStyles(this.notificationBarIframeElement, { opacity: "0" }, true);
+      if (this.notificationBarIframeElement) {
+        setElementStyles(this.notificationBarIframeElement, { opacity: "0" }, true);
+      }
      globalThis.setTimeout(() => this.closeNotificationBar(closedByUser), 150);
      return;
    }
@@ -166,7 +170,9 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
      this.createNotificationBarElement();

      this.setupInitNotificationBarMessageListener(initData);
-      globalThis.document.body.appendChild(this.notificationBarRootElement);
+      if (this.notificationBarRootElement) {
+        globalThis.document.body.appendChild(this.notificationBarRootElement);
+      }
    }
  }

@@ -179,7 +185,7 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
    const isNotificationFresh =
      initData.launchTimestamp && Date.now() - initData.launchTimestamp < 250;

-    this.currentNotificationBarType = initData.type;
+    this.currentNotificationBarType = initData.type ?? null;
    this.notificationBarIframeElement = globalThis.document.createElement("iframe");
    this.notificationBarIframeElement.id = "bit-notification-bar-iframe";
    const parentOrigin = globalThis.location.origin;
@@ -206,11 +212,13 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
   * This will animate the notification bar into view.
   */
  private handleNotificationBarIframeOnLoad = () => {
-    setElementStyles(
-      this.notificationBarIframeElement,
-      { transform: "translateX(0)", opacity: "1" },
-      true,
-    );
+    if (this.notificationBarIframeElement) {
+      setElementStyles(
+        this.notificationBarIframeElement,
+        { transform: "translateX(0)", opacity: "1" },
+        true,
+      );
+    }

    this.notificationBarIframeElement?.removeEventListener(
      EVENTS.LOAD,
@@ -252,6 +260,7 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
    const handleInitNotificationBarMessage = (event: MessageEvent) => {
      const { source, data } = event;
      if (
+        !this.notificationBarIframeElement?.contentWindow ||
        source !== this.notificationBarIframeElement.contentWindow ||
        data?.command !== "initNotificationBar"
      ) {
@@ -282,13 +291,14 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
      return;
    }

-    this.notificationBarIframeElement.remove();
+    this.notificationBarIframeElement?.remove();
    this.notificationBarIframeElement = null;

-    this.notificationBarElement.remove();
+    this.notificationBarElement?.remove();
    this.notificationBarElement = null;
    this.notificationBarShadowRoot = null;
-    this.notificationBarRootElement.remove();
+
+    this.notificationBarRootElement?.remove();
    this.notificationBarRootElement = null;

    const removableNotificationTypes = new Set([
@@ -297,7 +307,11 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
      NotificationTypes.AtRiskPassword,
    ] as NotificationType[]);

-    if (closedByUserAction && removableNotificationTypes.has(this.currentNotificationBarType)) {
+    if (
+      closedByUserAction &&
+      this.currentNotificationBarType &&
+      removableNotificationTypes.has(this.currentNotificationBarType)
+    ) {
      void sendExtensionMessage("bgRemoveTabFromNotificationQueue");
    }

@@ -310,7 +324,7 @@ export class OverlayNotificationsContentService implements OverlayNotificationsC
   * @param message - The message to send to the notification bar iframe.
   */
  private sendMessageToNotificationBarIframe(message: Record<string, any>) {
-    if (this.notificationBarIframeElement) {
+    if (this.notificationBarIframeElement?.contentWindow) {
      this.notificationBarIframeElement.contentWindow.postMessage(message, this.extensionOrigin);
    }
  }
--- a/apps/browser/src/autofill/popup/settings/autofill.component.html
+++ b/apps/browser/src/autofill/popup/settings/autofill.component.html
@@ -6,16 +6,18 @@
  </popup-header>

  <div class="tw-bg-background-alt">
-    <div *ngIf="!defaultBrowserAutofillDisabled && (showSpotlightNudge$ | async)" class="tw-mb-6">
-      <bit-spotlight
-        [title]="'autofillSpotlightTitle' | i18n"
-        [subtitle]="'autofillSpotlightDesc' | i18n"
-        [buttonText]="spotlightButtonText"
-        (onDismiss)="dismissSpotlight()"
-        (onButtonClick)="disableBrowserAutofillSettingsFromNudge($event)"
-        [buttonIcon]="spotlightButtonIcon"
-      ></bit-spotlight>
-    </div>
+    @if (showSpotlightNudge$ | async) {
+      <div class="tw-mb-6">
+        <bit-spotlight
+          [title]="'autofillSpotlightTitle' | i18n"
+          [subtitle]="'autofillSpotlightDesc' | i18n"
+          [buttonText]="spotlightButtonText"
+          (onDismiss)="dismissSpotlight()"
+          (onButtonClick)="disableBrowserAutofillSettingsFromNudge($event)"
+          [buttonIcon]="spotlightButtonIcon"
+        ></bit-spotlight>
+      </div>
+    }
    <bit-section>
      <bit-section-header>
        <h2 bitTypography="h6">{{ "autofillSuggestionsSectionTitle" | i18n }}</h2>
--- a/apps/browser/src/autofill/popup/settings/autofill.component.ts
+++ b/apps/browser/src/autofill/popup/settings/autofill.component.ts
@@ -611,6 +611,10 @@ export class AutofillComponent implements OnInit {
    if (this.canOverrideBrowserAutofillSetting) {
      this.defaultBrowserAutofillDisabled = true;
      await this.updateDefaultBrowserAutofillDisabled();
+      await this.nudgesService.dismissNudge(
+        NudgeType.AutofillNudge,
+        await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId)),
+      );
    } else {
      await this.openURI(event, this.disablePasswordManagerURI);
    }
--- a/apps/browser/src/manifest.json
+++ b/apps/browser/src/manifest.json
@@ -2,7 +2,7 @@
  "manifest_version": 2,
  "name": "__MSG_extName__",
  "short_name": "Bitwarden",
-  "version": "2025.12.0",
+  "version": "2025.12.1",
  "description": "__MSG_extDesc__",
  "default_locale": "en",
  "author": "Bitwarden Inc.",
--- a/apps/browser/src/manifest.v3.json
+++ b/apps/browser/src/manifest.v3.json
@@ -3,7 +3,7 @@
  "minimum_chrome_version": "102.0",
  "name": "__MSG_extName__",
  "short_name": "Bitwarden",
-  "version": "2025.12.0",
+  "version": "2025.12.1",
  "description": "__MSG_extDesc__",
  "default_locale": "en",
  "author": "Bitwarden Inc.",
--- a/apps/browser/src/popup/services/services.module.ts
+++ b/apps/browser/src/popup/services/services.module.ts
@@ -23,6 +23,8 @@ import {
  WINDOW,
 } from "@bitwarden/angular/services/injection-tokens";
 import { JslibServicesModule } from "@bitwarden/angular/services/jslib-services.module";
+import { AUTOFILL_NUDGE_SERVICE } from "@bitwarden/angular/vault";
+import { SingleNudgeService } from "@bitwarden/angular/vault/services/default-single-nudge.service";
 import {
  LoginComponentService,
  TwoFactorAuthComponentService,
@@ -208,6 +210,7 @@ import {
 } from "../../platform/system-notifications/browser-system-notification.service";
 import { fromChromeRuntimeMessaging } from "../../platform/utils/from-chrome-runtime-messaging";
 import { FilePopoutUtilsService } from "../../tools/popup/services/file-popout-utils.service";
+import { BrowserAutofillNudgeService } from "../../vault/popup/services/browser-autofill-nudge.service";
 import { Fido2UserVerificationService } from "../../vault/services/fido2-user-verification.service";
 import { ExtensionAnonLayoutWrapperDataService } from "../components/extension-anon-layout-wrapper/extension-anon-layout-wrapper-data.service";

@@ -756,6 +759,11 @@ const safeProviders: SafeProvider[] = [
      MessagingServiceAbstraction,
    ],
  }),
+  safeProvider({
+    provide: AUTOFILL_NUDGE_SERVICE as SafeInjectionToken<SingleNudgeService>,
+    useClass: BrowserAutofillNudgeService,
+    deps: [],
+  }),
 ];

@NgModule({
--- a/apps/browser/src/safari/desktop/Info.plist
+++ b/apps/browser/src/safari/desktop/Info.plist
@@ -25,7 +25,7 @@
 		<key>LSMinimumSystemVersion</key>
 		<string>$(MACOSX_DEPLOYMENT_TARGET)</string>
 		<key>NSHumanReadableCopyright</key>
-		<string>Copyright © 2015-2025 Bitwarden Inc. All rights reserved.</string>
+		<string>Copyright © 2015-2026 Bitwarden Inc. All rights reserved.</string>
 		<key>NSMainStoryboardFile</key>
 		<string>Main</string>
 		<key>NSPrincipalClass</key>
--- a/apps/browser/src/safari/safari/Info.plist
+++ b/apps/browser/src/safari/safari/Info.plist
@@ -30,7 +30,7 @@
 			<string>$(PRODUCT_MODULE_NAME).SafariWebExtensionHandler</string>
 		</dict>
 		<key>NSHumanReadableCopyright</key>
-		<string>Copyright © 2015-2025 Bitwarden Inc. All rights reserved.</string>
+		<string>Copyright © 2015-2026 Bitwarden Inc. All rights reserved.</string>
 		<key>NSHumanReadableDescription</key>
 		<string>A secure and free password manager for all of your devices.</string>
 		<key>SFSafariAppExtensionBundleIdentifiersToReplace</key>
--- a/apps/browser/src/tools/popup/settings/settings-v2.component.html
+++ b/apps/browser/src/tools/popup/settings/settings-v2.component.html
@@ -34,13 +34,11 @@
        <i slot="start" class="bwi bwi-check-circle" aria-hidden="true"></i>
        <div class="tw-flex tw-items-center tw-justify-center">
          <p class="tw-pr-2">{{ "autofill" | i18n }}</p>
-          <span
-            *ngIf="!(isBrowserAutofillSettingOverridden$ | async) && (showAutofillBadge$ | async)"
-            bitBadge
-            variant="notification"
-            [attr.aria-label]="'nudgeBadgeAria' | i18n"
-            >1</span
-          >
+          @if (showAutofillBadge$ | async) {
+            <span bitBadge variant="notification" [attr.aria-label]="'nudgeBadgeAria' | i18n"
+              >1</span
+            >
+          }
        </div>
        <i slot="end" class="bwi bwi-angle-right" aria-hidden="true"></i>
      </a>
--- a/apps/browser/src/tools/popup/settings/settings-v2.component.spec.ts
+++ b/apps/browser/src/tools/popup/settings/settings-v2.component.spec.ts
@@ -148,31 +148,7 @@ describe("SettingsV2Component", () => {
    expect(openSpy).toHaveBeenCalledWith(dialogService);
  });

-  it("isBrowserAutofillSettingOverridden$ emits the value from the AutofillBrowserSettingsService", async () => {
-    pushActiveAccount();
-
-    mockAutofillSettings.isBrowserAutofillSettingOverridden.mockResolvedValue(true);
-
-    const fixture = TestBed.createComponent(SettingsV2Component);
-    const component = fixture.componentInstance;
-    fixture.detectChanges();
-    await fixture.whenStable();
-
-    const value = await firstValueFrom(component["isBrowserAutofillSettingOverridden$"]);
-    expect(value).toBe(true);
-
-    mockAutofillSettings.isBrowserAutofillSettingOverridden.mockResolvedValue(false);
-
-    const fixture2 = TestBed.createComponent(SettingsV2Component);
-    const component2 = fixture2.componentInstance;
-    fixture2.detectChanges();
-    await fixture2.whenStable();
-
-    const value2 = await firstValueFrom(component2["isBrowserAutofillSettingOverridden$"]);
-    expect(value2).toBe(false);
-  });
-
-  it("showAutofillBadge$ emits true when default autofill is NOT disabled and nudge is true", async () => {
+  it("showAutofillBadge$ emits true when showNudgeBadge is true", async () => {
    pushActiveAccount();

    mockNudges.showNudgeBadge$.mockImplementation((type: NudgeType) =>
@@ -184,30 +160,10 @@ describe("SettingsV2Component", () => {
    fixture.detectChanges();
    await fixture.whenStable();

-    mockAutofillSettings.defaultBrowserAutofillDisabled$.next(false);
-
    const value = await firstValueFrom(component.showAutofillBadge$);
    expect(value).toBe(true);
  });

-  it("showAutofillBadge$ emits false when default autofill IS disabled even if nudge is true", async () => {
-    pushActiveAccount();
-
-    mockNudges.showNudgeBadge$.mockImplementation((type: NudgeType) =>
-      of(type === NudgeType.AutofillNudge),
-    );
-
-    const fixture = TestBed.createComponent(SettingsV2Component);
-    const component = fixture.componentInstance;
-    fixture.detectChanges();
-    await fixture.whenStable();
-
-    mockAutofillSettings.defaultBrowserAutofillDisabled$.next(true);
-
-    const value = await firstValueFrom(component.showAutofillBadge$);
-    expect(value).toBe(false);
-  });
-
  it("dismissBadge dismisses when showVaultBadge$ emits true", async () => {
    const acct = pushActiveAccount();

--- a/apps/browser/src/tools/popup/settings/settings-v2.component.ts
+++ b/apps/browser/src/tools/popup/settings/settings-v2.component.ts
@@ -1,16 +1,7 @@
 import { CommonModule } from "@angular/common";
 import { ChangeDetectionStrategy, Component } from "@angular/core";
 import { RouterModule } from "@angular/router";
-import {
-  combineLatest,
-  filter,
-  firstValueFrom,
-  from,
-  map,
-  Observable,
-  shareReplay,
-  switchMap,
-} from "rxjs";
+import { filter, firstValueFrom, Observable, shareReplay, switchMap } from "rxjs";

 import { PremiumUpgradeDialogComponent } from "@bitwarden/angular/billing/components";
 import { JslibModule } from "@bitwarden/angular/jslib.module";
@@ -28,8 +19,6 @@ import {
 } from "@bitwarden/components";

 import { CurrentAccountComponent } from "../../../auth/popup/account-switching/current-account.component";
-import { AutofillBrowserSettingsService } from "../../../autofill/services/autofill-browser-settings.service";
-import { BrowserApi } from "../../../platform/browser/browser-api";
 import { PopOutComponent } from "../../../platform/popup/components/pop-out.component";
 import { PopupHeaderComponent } from "../../../platform/popup/layout/popup-header.component";
 import { PopupPageComponent } from "../../../platform/popup/layout/popup-page.component";
@@ -55,12 +44,6 @@ import { PopupPageComponent } from "../../../platform/popup/layout/popup-page.co
 export class SettingsV2Component {
  NudgeType = NudgeType;

-  protected isBrowserAutofillSettingOverridden$ = from(
-    this.autofillBrowserSettingsService.isBrowserAutofillSettingOverridden(
-      BrowserApi.getBrowserClientVendor(window),
-    ),
-  );
-
  private authenticatedAccount$: Observable<Account> = this.accountService.activeAccount$.pipe(
    filter((account): account is Account => account !== null),
    shareReplay({ bufferSize: 1, refCount: true }),
@@ -82,23 +65,13 @@ export class SettingsV2Component {
    ),
  );

-  showAutofillBadge$: Observable<boolean> = combineLatest([
-    this.autofillBrowserSettingsService.defaultBrowserAutofillDisabled$,
-    this.authenticatedAccount$,
-  ]).pipe(
-    switchMap(([defaultBrowserAutofillDisabled, account]) =>
-      this.nudgesService.showNudgeBadge$(NudgeType.AutofillNudge, account.id).pipe(
-        map((badgeStatus) => {
-          return !defaultBrowserAutofillDisabled && badgeStatus;
-        }),
-      ),
-    ),
+  showAutofillBadge$: Observable<boolean> = this.authenticatedAccount$.pipe(
+    switchMap((account) => this.nudgesService.showNudgeBadge$(NudgeType.AutofillNudge, account.id)),
  );

  constructor(
    private readonly nudgesService: NudgesService,
    private readonly accountService: AccountService,
-    private readonly autofillBrowserSettingsService: AutofillBrowserSettingsService,
    private readonly accountProfileStateService: BillingAccountProfileStateService,
    private readonly dialogService: DialogService,
  ) {}
--- a/apps/browser/src/vault/popup/services/browser-autofill-nudge.service.spec.ts
+++ b/apps/browser/src/vault/popup/services/browser-autofill-nudge.service.spec.ts
@@ -0,0 +1,157 @@
+import { TestBed } from "@angular/core/testing";
+import { mock, MockProxy } from "jest-mock-extended";
+import { firstValueFrom } from "rxjs";
+
+import { NudgeStatus, NudgeType } from "@bitwarden/angular/vault";
+import { VaultProfileService } from "@bitwarden/angular/vault/services/vault-profile.service";
+import { BrowserClientVendors } from "@bitwarden/common/autofill/constants";
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { StateProvider } from "@bitwarden/common/platform/state";
+import { UserId } from "@bitwarden/common/types/guid";
+
+import { FakeStateProvider, mockAccountServiceWith } from "../../../../../../libs/common/spec";
+import { BrowserApi } from "../../../platform/browser/browser-api";
+
+import { BrowserAutofillNudgeService } from "./browser-autofill-nudge.service";
+
+describe("BrowserAutofillNudgeService", () => {
+  let service: BrowserAutofillNudgeService;
+  let vaultProfileService: MockProxy<VaultProfileService>;
+  let fakeStateProvider: FakeStateProvider;
+
+  const userId = "test-user-id" as UserId;
+  const nudgeType = NudgeType.AutofillNudge;
+
+  const notDismissedStatus: NudgeStatus = {
+    hasBadgeDismissed: false,
+    hasSpotlightDismissed: false,
+  };
+
+  const dismissedStatus: NudgeStatus = {
+    hasBadgeDismissed: true,
+    hasSpotlightDismissed: true,
+  };
+
+  // Set profile creation date to now (new account, within 30 days)
+  const recentProfileDate = new Date();
+
+  beforeEach(() => {
+    vaultProfileService = mock<VaultProfileService>();
+    vaultProfileService.getProfileCreationDate.mockResolvedValue(recentProfileDate);
+
+    fakeStateProvider = new FakeStateProvider(mockAccountServiceWith(userId));
+
+    TestBed.configureTestingModule({
+      providers: [
+        BrowserAutofillNudgeService,
+        {
+          provide: VaultProfileService,
+          useValue: vaultProfileService,
+        },
+        {
+          provide: StateProvider,
+          useValue: fakeStateProvider,
+        },
+        {
+          provide: LogService,
+          useValue: mock<LogService>(),
+        },
+      ],
+    });
+
+    service = TestBed.inject(BrowserAutofillNudgeService);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("nudgeStatus$", () => {
+    it("returns parent status when browser client is Unknown", async () => {
+      jest
+        .spyOn(BrowserApi, "getBrowserClientVendor")
+        .mockReturnValue(BrowserClientVendors.Unknown);
+      jest.spyOn(BrowserApi, "browserAutofillSettingsOverridden").mockResolvedValue(true);
+
+      const result = await firstValueFrom(service.nudgeStatus$(nudgeType, userId));
+
+      expect(result).toEqual(notDismissedStatus);
+    });
+
+    it("returns parent status when browser autofill is not overridden", async () => {
+      jest.spyOn(BrowserApi, "getBrowserClientVendor").mockReturnValue(BrowserClientVendors.Chrome);
+      jest.spyOn(BrowserApi, "browserAutofillSettingsOverridden").mockResolvedValue(false);
+
+      const result = await firstValueFrom(service.nudgeStatus$(nudgeType, userId));
+
+      expect(result).toEqual(notDismissedStatus);
+    });
+
+    it("returns dismissed status when browser autofill is overridden", async () => {
+      jest.spyOn(BrowserApi, "getBrowserClientVendor").mockReturnValue(BrowserClientVendors.Chrome);
+      jest.spyOn(BrowserApi, "browserAutofillSettingsOverridden").mockResolvedValue(true);
+
+      const result = await firstValueFrom(service.nudgeStatus$(nudgeType, userId));
+
+      expect(result).toEqual(dismissedStatus);
+    });
+
+    it("preserves parent dismissed status when account is older than 30 days", async () => {
+      // Set profile creation date to more than 30 days ago
+      const oldProfileDate = new Date(Date.now() - 31 * 24 * 60 * 60 * 1000);
+      vaultProfileService.getProfileCreationDate.mockResolvedValue(oldProfileDate);
+
+      jest.spyOn(BrowserApi, "getBrowserClientVendor").mockReturnValue(BrowserClientVendors.Chrome);
+      jest.spyOn(BrowserApi, "browserAutofillSettingsOverridden").mockResolvedValue(false);
+
+      const result = await firstValueFrom(service.nudgeStatus$(nudgeType, userId));
+
+      expect(result).toEqual(dismissedStatus);
+    });
+
+    it("combines parent dismissed and browser autofill overridden status", async () => {
+      // Set profile creation date to more than 30 days ago (parent dismisses)
+      const oldProfileDate = new Date(Date.now() - 31 * 24 * 60 * 60 * 1000);
+      vaultProfileService.getProfileCreationDate.mockResolvedValue(oldProfileDate);
+
+      jest.spyOn(BrowserApi, "getBrowserClientVendor").mockReturnValue(BrowserClientVendors.Chrome);
+      jest.spyOn(BrowserApi, "browserAutofillSettingsOverridden").mockResolvedValue(true);
+
+      const result = await firstValueFrom(service.nudgeStatus$(nudgeType, userId));
+
+      expect(result).toEqual(dismissedStatus);
+    });
+
+    it.each([
+      BrowserClientVendors.Chrome,
+      BrowserClientVendors.Edge,
+      BrowserClientVendors.Opera,
+      BrowserClientVendors.Vivaldi,
+    ])("checks browser autofill settings for %s browser", async (browserVendor) => {
+      const getBrowserClientVendorSpy = jest
+        .spyOn(BrowserApi, "getBrowserClientVendor")
+        .mockReturnValue(browserVendor);
+      const browserAutofillSettingsOverriddenSpy = jest
+        .spyOn(BrowserApi, "browserAutofillSettingsOverridden")
+        .mockResolvedValue(true);
+
+      await firstValueFrom(service.nudgeStatus$(nudgeType, userId));
+
+      expect(getBrowserClientVendorSpy).toHaveBeenCalledWith(window);
+      expect(browserAutofillSettingsOverriddenSpy).toHaveBeenCalled();
+    });
+
+    it("does not check browser autofill settings for Unknown browser", async () => {
+      jest
+        .spyOn(BrowserApi, "getBrowserClientVendor")
+        .mockReturnValue(BrowserClientVendors.Unknown);
+      const browserAutofillSettingsOverriddenSpy = jest
+        .spyOn(BrowserApi, "browserAutofillSettingsOverridden")
+        .mockResolvedValue(true);
+
+      await firstValueFrom(service.nudgeStatus$(nudgeType, userId));
+
+      expect(browserAutofillSettingsOverriddenSpy).not.toHaveBeenCalled();
+    });
+  });
+});
--- a/apps/browser/src/vault/popup/services/browser-autofill-nudge.service.ts
+++ b/apps/browser/src/vault/popup/services/browser-autofill-nudge.service.ts
@@ -0,0 +1,37 @@
+import { Injectable } from "@angular/core";
+import { Observable, switchMap } from "rxjs";
+
+import { NudgeStatus, NudgeType } from "@bitwarden/angular/vault";
+import { NewAccountNudgeService } from "@bitwarden/angular/vault/services/custom-nudges-services/new-account-nudge.service";
+import { BrowserClientVendors } from "@bitwarden/common/autofill/constants";
+import { UserId } from "@bitwarden/common/types/guid";
+
+import { BrowserApi } from "../../../platform/browser/browser-api";
+
+/**
+ * Browser-specific autofill nudge service.
+ * Extends NewAccountNudgeService (30-day account age check) and adds
+ * browser autofill setting detection.
+ *
+ * Nudge is dismissed if:
+ * - Account is older than 30 days (inherited from NewAccountNudgeService)
+ * - Browser's built-in password manager is already disabled via privacy settings
+ */
+@Injectable()
+export class BrowserAutofillNudgeService extends NewAccountNudgeService {
+  override nudgeStatus$(nudgeType: NudgeType, userId: UserId): Observable<NudgeStatus> {
+    return super.nudgeStatus$(nudgeType, userId).pipe(
+      switchMap(async (status) => {
+        const browserClient = BrowserApi.getBrowserClientVendor(window);
+        const browserAutofillOverridden =
+          browserClient !== BrowserClientVendors.Unknown &&
+          (await BrowserApi.browserAutofillSettingsOverridden());
+
+        return {
+          hasBadgeDismissed: status.hasBadgeDismissed || browserAutofillOverridden,
+          hasSpotlightDismissed: status.hasSpotlightDismissed || browserAutofillOverridden,
+        };
+      }),
+    );
+  }
+}
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -1,7 +1,7 @@
 {
  "name": "@bitwarden/cli",
  "description": "A secure and free password manager for all of your devices.",
-  "version": "2025.12.0",
+  "version": "2025.12.1",
  "keywords": [
    "bitwarden",
    "password",
--- a/apps/cli/stores/chocolatey/bitwarden-cli.nuspec
+++ b/apps/cli/stores/chocolatey/bitwarden-cli.nuspec
@@ -10,7 +10,7 @@
    <authors>Bitwarden Inc.</authors>
    <projectUrl>https://bitwarden.com/</projectUrl>
    <iconUrl>https://raw.githubusercontent.com/bitwarden/brand/master/icons/256x256.png</iconUrl>
-    <copyright>Copyright © 2015-2025 Bitwarden Inc.</copyright>
+    <copyright>Copyright © 2015-2026 Bitwarden Inc.</copyright>
    <projectSourceUrl>https://github.com/bitwarden/clients/</projectSourceUrl>
    <docsUrl>https://help.bitwarden.com/article/cli/</docsUrl>
    <bugTrackerUrl>https://github.com/bitwarden/clients/issues</bugTrackerUrl>
--- a/apps/desktop/desktop_native/Cargo.lock
+++ b/apps/desktop/desktop_native/Cargo.lock
@@ -329,6 +329,7 @@ name = "autotype"
 version = "0.0.0"
 dependencies = [
 "anyhow",
+ "itertools",
 "mockall",
 "serial_test",
 "tracing",
@@ -1026,6 +1027,12 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
 [[package]]
 name = "elliptic-curve"
 version = "0.13.8"
@@ -1617,6 +1624,15 @@ version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"

+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.15"
--- a/apps/desktop/desktop_native/Cargo.toml
+++ b/apps/desktop/desktop_native/Cargo.toml
@@ -39,6 +39,7 @@ futures = "=0.3.31"
 hex = "=0.4.3"
 homedir = "=0.3.6"
 interprocess = "=2.2.1"
+itertools = "=0.14.0"
 libc = "=0.2.178"
 linux-keyutils = "=0.2.4"
 memsec = "=0.7.0"
--- a/apps/desktop/desktop_native/autotype/Cargo.toml
+++ b/apps/desktop/desktop_native/autotype/Cargo.toml
@@ -9,6 +9,7 @@ publish.workspace = true
 anyhow = { workspace = true }

 [target.'cfg(windows)'.dependencies]
+itertools.workspace = true
 mockall = "=0.14.0"
 serial_test = "=3.2.0"
 tracing.workspace = true
--- a/apps/desktop/desktop_native/autotype/src/lib.rs
+++ b/apps/desktop/desktop_native/autotype/src/lib.rs
@@ -28,6 +28,6 @@ pub fn get_foreground_window_title() -> Result<String> {
 /// This function returns an `anyhow::Error` if there is any
 /// issue in typing the input. Detailed reasons will
 /// vary based on platform implementation.
-pub fn type_input(input: Vec<u16>, keyboard_shortcut: Vec<String>) -> Result<()> {
+pub fn type_input(input: &[u16], keyboard_shortcut: &[String]) -> Result<()> {
    windowing::type_input(input, keyboard_shortcut)
 }
--- a/apps/desktop/desktop_native/autotype/src/linux.rs
+++ b/apps/desktop/desktop_native/autotype/src/linux.rs
@@ -2,6 +2,6 @@ pub fn get_foreground_window_title() -> anyhow::Result<String> {
    todo!("Bitwarden does not yet support Linux autotype");
 }

-pub fn type_input(_input: Vec<u16>, _keyboard_shortcut: Vec<String>) -> anyhow::Result<()> {
+pub fn type_input(_input: &[u16], _keyboard_shortcut: &[String]) -> anyhow::Result<()> {
    todo!("Bitwarden does not yet support Linux autotype");
 }
--- a/apps/desktop/desktop_native/autotype/src/macos.rs
+++ b/apps/desktop/desktop_native/autotype/src/macos.rs
@@ -2,6 +2,6 @@ pub fn get_foreground_window_title() -> anyhow::Result<String> {
    todo!("Bitwarden does not yet support macOS autotype");
 }

-pub fn type_input(_input: Vec<u16>, _keyboard_shortcut: Vec<String>) -> anyhow::Result<()> {
+pub fn type_input(_input: &[u16], _keyboard_shortcut: &[String]) -> anyhow::Result<()> {
    todo!("Bitwarden does not yet support macOS autotype");
 }
--- a/apps/desktop/desktop_native/autotype/src/windows/mod.rs
+++ b/apps/desktop/desktop_native/autotype/src/windows/mod.rs
@@ -1,6 +1,10 @@
 use anyhow::Result;
+use itertools::Itertools;
 use tracing::debug;
-use windows::Win32::Foundation::{GetLastError, SetLastError, WIN32_ERROR};
+use windows::Win32::{
+    Foundation::{GetLastError, SetLastError, WIN32_ERROR},
+    UI::Input::KeyboardAndMouse::INPUT,
+};

 mod type_input;
 mod window_title;
@@ -12,7 +16,7 @@ const WIN32_SUCCESS: WIN32_ERROR = WIN32_ERROR(0);
 /// win32 errors.
 #[cfg_attr(test, mockall::automock)]
 trait ErrorOperations {
-    /// https://learn.microsoft.com/en-us/windows/win32/api/errhandlingapi/nf-errhandlingapi-setlasterror
+    /// <https://learn.microsoft.com/en-us/windows/win32/api/errhandlingapi/nf-errhandlingapi-setlasterror>
    fn set_last_error(err: u32) {
        debug!(err, "Calling SetLastError");
        unsafe {
@@ -20,7 +24,7 @@ trait ErrorOperations {
        }
    }

-    /// https://learn.microsoft.com/en-us/windows/win32/api/errhandlingapi/nf-errhandlingapi-getlasterror
+    /// <https://learn.microsoft.com/en-us/windows/win32/api/errhandlingapi/nf-errhandlingapi-getlasterror>
    fn get_last_error() -> WIN32_ERROR {
        let last_err = unsafe { GetLastError() };
        debug!("GetLastError(): {}", last_err.to_hresult().message());
@@ -36,6 +40,23 @@ pub fn get_foreground_window_title() -> Result<String> {
    window_title::get_foreground_window_title()
 }

-pub fn type_input(input: Vec<u16>, keyboard_shortcut: Vec<String>) -> Result<()> {
-    type_input::type_input(input, keyboard_shortcut)
+/// `KeyboardShortcutInput` is an `INPUT` of one of the valid shortcut keys:
+///     - Control
+///     - Alt
+///     - Super
+///     - Shift
+///     - \[a-z\]\[A-Z\]
+struct KeyboardShortcutInput(INPUT);
+
+pub fn type_input(input: &[u16], keyboard_shortcut: &[String]) -> Result<()> {
+    debug!(?keyboard_shortcut, "type_input() called.");
+
+    // convert the raw string input to Windows input and error
+    // if any key is not a valid keyboard shortcut input
+    let keyboard_shortcut: Vec<KeyboardShortcutInput> = keyboard_shortcut
+        .iter()
+        .map(|s| KeyboardShortcutInput::try_from(s.as_str()))
+        .try_collect()?;
+
+    type_input::type_input(input, &keyboard_shortcut)
 }
--- a/apps/desktop/desktop_native/autotype/src/windows/type_input.rs
+++ b/apps/desktop/desktop_native/autotype/src/windows/type_input.rs
@@ -5,7 +5,15 @@ use windows::Win32::UI::Input::KeyboardAndMouse::{
    VIRTUAL_KEY,
 };

-use super::{ErrorOperations, Win32ErrorOperations};
+use super::{ErrorOperations, KeyboardShortcutInput, Win32ErrorOperations};
+
+const SHIFT_KEY_STR: &str = "Shift";
+const CONTROL_KEY_STR: &str = "Control";
+const ALT_KEY_STR: &str = "Alt";
+const LEFT_WINDOWS_KEY_STR: &str = "Super";
+
+const IS_VIRTUAL_KEY: bool = true;
+const IS_REAL_KEY: bool = false;

 /// `InputOperations` provides an interface to Window32 API for
 /// working with inputs.
@@ -13,7 +21,7 @@ use super::{ErrorOperations, Win32ErrorOperations};
 trait InputOperations {
    /// Attempts to type the provided input wherever the user's cursor is.
    ///
-    /// https://learn.microsoft.com/en-in/windows/win32/api/winuser/nf-winuser-sendinput
+    /// <https://learn.microsoft.com/en-in/windows/win32/api/winuser/nf-winuser-sendinput>
    fn send_input(inputs: &[INPUT]) -> u32;
 }

@@ -21,8 +29,11 @@ struct Win32InputOperations;

 impl InputOperations for Win32InputOperations {
    fn send_input(inputs: &[INPUT]) -> u32 {
-        const INPUT_STRUCT_SIZE: i32 = std::mem::size_of::<INPUT>() as i32;
-        let insert_count = unsafe { SendInput(inputs, INPUT_STRUCT_SIZE) };
+        const INPUT_STRUCT_SIZE: usize = std::mem::size_of::<INPUT>();
+
+        let size = i32::try_from(INPUT_STRUCT_SIZE).expect("INPUT size to fit in i32");
+
+        let insert_count = unsafe { SendInput(inputs, size) };

        debug!(insert_count, "SendInput() called.");

@@ -33,40 +44,37 @@ impl InputOperations for Win32InputOperations {
 /// Attempts to type the input text wherever the user's cursor is.
 ///
 /// `input` must be a vector of utf-16 encoded characters to insert.
-/// `keyboard_shortcut` must be a vector of Strings, where valid shortcut keys: Control, Alt, Super,
-/// Shift, letters a - Z
+/// `keyboard_shortcut` is a vector of valid shortcut keys.
 ///
-/// https://learn.microsoft.com/en-in/windows/win32/api/winuser/nf-winuser-sendinput
-pub(super) fn type_input(input: Vec<u16>, keyboard_shortcut: Vec<String>) -> Result<()> {
+/// <https://learn.microsoft.com/en-in/windows/win32/api/winuser/nf-winuser-sendinput>
+pub(super) fn type_input(input: &[u16], keyboard_shortcut: &[KeyboardShortcutInput]) -> Result<()> {
    // the length of this vec is always shortcut keys to release + (2x length of input chars)
    let mut keyboard_inputs: Vec<INPUT> =
        Vec::with_capacity(keyboard_shortcut.len() + (input.len() * 2));

-    debug!(?keyboard_shortcut, "Converting keyboard shortcut to input.");
-
-    // Add key "up" inputs for the shortcut
-    for key in keyboard_shortcut {
-        keyboard_inputs.push(convert_shortcut_key_to_up_input(key)?);
+    // insert the keyboard shortcut
+    for shortcut in keyboard_shortcut {
+        keyboard_inputs.push(shortcut.0);
    }

-    add_input(&input, &mut keyboard_inputs);
+    add_input(input, &mut keyboard_inputs);

-    send_input::<Win32InputOperations, Win32ErrorOperations>(keyboard_inputs)
+    send_input::<Win32InputOperations, Win32ErrorOperations>(&keyboard_inputs)
 }

 // Add key "down" and "up" inputs for the input
 // (currently in this form: {username}/t{password})
 fn add_input(input: &[u16], keyboard_inputs: &mut Vec<INPUT>) {
-    const TAB_KEY: u8 = 9;
+    const TAB_KEY: u16 = 9;

    for i in input {
-        let next_down_input = if *i == TAB_KEY.into() {
-            build_virtual_key_input(InputKeyPress::Down, *i as u8)
+        let next_down_input = if *i == TAB_KEY {
+            build_virtual_key_input(InputKeyPress::Down, *i)
        } else {
            build_unicode_input(InputKeyPress::Down, *i)
        };
-        let next_up_input = if *i == TAB_KEY.into() {
-            build_virtual_key_input(InputKeyPress::Up, *i as u8)
+        let next_up_input = if *i == TAB_KEY {
+            build_virtual_key_input(InputKeyPress::Up, *i)
        } else {
            build_unicode_input(InputKeyPress::Up, *i)
        };
@@ -76,26 +84,27 @@ fn add_input(input: &[u16], keyboard_inputs: &mut Vec<INPUT>) {
    }
 }

-/// Converts a valid shortcut key to an "up" keyboard input.
-///
-/// `input` must be a valid shortcut key: Control, Alt, Super, Shift, letters [a-z][A-Z]
-fn convert_shortcut_key_to_up_input(key: String) -> Result<INPUT> {
-    const SHIFT_KEY: u8 = 0x10;
-    const SHIFT_KEY_STR: &str = "Shift";
-    const CONTROL_KEY: u8 = 0x11;
-    const CONTROL_KEY_STR: &str = "Control";
-    const ALT_KEY: u8 = 0x12;
-    const ALT_KEY_STR: &str = "Alt";
-    const LEFT_WINDOWS_KEY: u8 = 0x5B;
-    const LEFT_WINDOWS_KEY_STR: &str = "Super";
+impl TryFrom<&str> for KeyboardShortcutInput {
+    type Error = anyhow::Error;

-    Ok(match key.as_str() {
-        SHIFT_KEY_STR => build_virtual_key_input(InputKeyPress::Up, SHIFT_KEY),
-        CONTROL_KEY_STR => build_virtual_key_input(InputKeyPress::Up, CONTROL_KEY),
-        ALT_KEY_STR => build_virtual_key_input(InputKeyPress::Up, ALT_KEY),
-        LEFT_WINDOWS_KEY_STR => build_virtual_key_input(InputKeyPress::Up, LEFT_WINDOWS_KEY),
-        _ => build_unicode_input(InputKeyPress::Up, get_alphabetic_hotkey(key)?),
-    })
+    fn try_from(key: &str) -> std::result::Result<Self, Self::Error> {
+        const SHIFT_KEY: u16 = 0x10;
+        const CONTROL_KEY: u16 = 0x11;
+        const ALT_KEY: u16 = 0x12;
+        const LEFT_WINDOWS_KEY: u16 = 0x5B;
+
+        // the modifier keys are using the Up keypress variant because the user has already
+        // pressed those keys in order to trigger the feature.
+        let input = match key {
+            SHIFT_KEY_STR => build_virtual_key_input(InputKeyPress::Up, SHIFT_KEY),
+            CONTROL_KEY_STR => build_virtual_key_input(InputKeyPress::Up, CONTROL_KEY),
+            ALT_KEY_STR => build_virtual_key_input(InputKeyPress::Up, ALT_KEY),
+            LEFT_WINDOWS_KEY_STR => build_virtual_key_input(InputKeyPress::Up, LEFT_WINDOWS_KEY),
+            _ => build_unicode_input(InputKeyPress::Up, get_alphabetic_hotkey(key)?),
+        };
+
+        Ok(KeyboardShortcutInput(input))
+    }
 }

 /// Given a letter that is a String, get the utf16 encoded
@@ -105,7 +114,7 @@ fn convert_shortcut_key_to_up_input(key: String) -> Result<INPUT> {
 /// Because we only accept [a-z][A-Z], the decimal u16
 /// cast of the letter is safe because the unicode code point
 /// of these characters fits in a u16.
-fn get_alphabetic_hotkey(letter: String) -> Result<u16> {
+fn get_alphabetic_hotkey(letter: &str) -> Result<u16> {
    if letter.len() != 1 {
        error!(
            len = letter.len(),
@@ -135,23 +144,28 @@ fn get_alphabetic_hotkey(letter: String) -> Result<u16> {
 }

 /// An input key can be either pressed (down), or released (up).
+#[derive(Copy, Clone)]
 enum InputKeyPress {
    Down,
    Up,
 }

-/// A function for easily building keyboard unicode INPUT structs used in SendInput().
-///
-/// Before modifying this function, make sure you read the SendInput() documentation:
-/// https://learn.microsoft.com/en-in/windows/win32/api/winuser/nf-winuser-sendinput
-fn build_unicode_input(key_press: InputKeyPress, character: u16) -> INPUT {
+/// Before modifying this function, make sure you read the `SendInput()` documentation:
+/// <https://learn.microsoft.com/en-in/windows/win32/api/winuser/nf-winuser-sendinput>
+/// <https://learn.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes>
+fn build_input(key_press: InputKeyPress, character: u16, is_virtual: bool) -> INPUT {
+    let (w_vk, w_scan) = if is_virtual {
+        (VIRTUAL_KEY(character), 0)
+    } else {
+        (VIRTUAL_KEY::default(), character)
+    };
    match key_press {
        InputKeyPress::Down => INPUT {
            r#type: INPUT_KEYBOARD,
            Anonymous: INPUT_0 {
                ki: KEYBDINPUT {
-                    wVk: Default::default(),
-                    wScan: character,
+                    wVk: w_vk,
+                    wScan: w_scan,
                    dwFlags: KEYEVENTF_UNICODE,
                    time: 0,
                    dwExtraInfo: 0,
@@ -162,8 +176,8 @@ fn build_unicode_input(key_press: InputKeyPress, character: u16) -> INPUT {
            r#type: INPUT_KEYBOARD,
            Anonymous: INPUT_0 {
                ki: KEYBDINPUT {
-                    wVk: Default::default(),
-                    wScan: character,
+                    wVk: w_vk,
+                    wScan: w_scan,
                    dwFlags: KEYEVENTF_KEYUP | KEYEVENTF_UNICODE,
                    time: 0,
                    dwExtraInfo: 0,
@@ -173,53 +187,29 @@ fn build_unicode_input(key_press: InputKeyPress, character: u16) -> INPUT {
    }
 }

-/// A function for easily building keyboard virtual-key INPUT structs used in SendInput().
-///
-/// Before modifying this function, make sure you read the SendInput() documentation:
-/// https://learn.microsoft.com/en-in/windows/win32/api/winuser/nf-winuser-sendinput
-/// https://learn.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes
-fn build_virtual_key_input(key_press: InputKeyPress, virtual_key: u8) -> INPUT {
-    match key_press {
-        InputKeyPress::Down => INPUT {
-            r#type: INPUT_KEYBOARD,
-            Anonymous: INPUT_0 {
-                ki: KEYBDINPUT {
-                    wVk: VIRTUAL_KEY(virtual_key as u16),
-                    wScan: Default::default(),
-                    dwFlags: Default::default(),
-                    time: 0,
-                    dwExtraInfo: 0,
-                },
-            },
-        },
-        InputKeyPress::Up => INPUT {
-            r#type: INPUT_KEYBOARD,
-            Anonymous: INPUT_0 {
-                ki: KEYBDINPUT {
-                    wVk: VIRTUAL_KEY(virtual_key as u16),
-                    wScan: Default::default(),
-                    dwFlags: KEYEVENTF_KEYUP,
-                    time: 0,
-                    dwExtraInfo: 0,
-                },
-            },
-        },
-    }
+/// A function for easily building keyboard unicode `INPUT` structs used in `SendInput()`.
+fn build_unicode_input(key_press: InputKeyPress, character: u16) -> INPUT {
+    build_input(key_press, character, IS_REAL_KEY)
 }

-fn send_input<I, E>(inputs: Vec<INPUT>) -> Result<()>
+/// A function for easily building keyboard virtual-key `INPUT` structs used in `SendInput()`.
+fn build_virtual_key_input(key_press: InputKeyPress, character: u16) -> INPUT {
+    build_input(key_press, character, IS_VIRTUAL_KEY)
+}
+
+fn send_input<I, E>(inputs: &[INPUT]) -> Result<()>
 where
    I: InputOperations,
    E: ErrorOperations,
 {
-    let insert_count = I::send_input(&inputs);
+    let insert_count = I::send_input(inputs);

    if insert_count == 0 {
        let last_err = E::get_last_error().to_hresult().message();
        error!(GetLastError = %last_err, "SendInput sent 0 inputs. Input was blocked by another thread.");

        return Err(anyhow!("SendInput sent 0 inputs. Input was blocked by another thread. GetLastError: {last_err}"));
-    } else if insert_count != inputs.len() as u32 {
+    } else if insert_count != u32::try_from(inputs.len()).expect("to convert inputs len to u32") {
        let last_err = E::get_last_error().to_hresult().message();
        error!(sent = %insert_count, expected = inputs.len(), GetLastError = %last_err,
            "SendInput sent does not match expected."
@@ -237,8 +227,9 @@ where
 mod tests {
    //! For the mocking of the traits that are static methods, we need to use the `serial_test`
    //! crate in order to mock those, since the mock expectations set have to be global in
-    //! absence of a `self`. More info: https://docs.rs/mockall/latest/mockall/#static-methods
+    //! absence of a `self`. More info: <https://docs.rs/mockall/latest/mockall/#static-methods>

+    use itertools::Itertools;
    use serial_test::serial;
    use windows::Win32::Foundation::WIN32_ERROR;

@@ -249,7 +240,7 @@ mod tests {
    fn get_alphabetic_hot_key_succeeds() {
        for c in ('a'..='z').chain('A'..='Z') {
            let letter = c.to_string();
-            let converted = get_alphabetic_hotkey(letter).unwrap();
+            let converted = get_alphabetic_hotkey(&letter).unwrap();
            assert_eq!(converted, c as u16);
        }
    }
@@ -258,14 +249,14 @@ mod tests {
    #[should_panic = "Final keyboard shortcut key should be a single character: foo"]
    fn get_alphabetic_hot_key_fail_not_single_char() {
        let letter = String::from("foo");
-        get_alphabetic_hotkey(letter).unwrap();
+        get_alphabetic_hotkey(&letter).unwrap();
    }

    #[test]
    #[should_panic = "Letter is not ASCII Alphabetic ([a-z][A-Z]): '}'"]
    fn get_alphabetic_hot_key_fail_not_alphabetic() {
        let letter = String::from("}");
-        get_alphabetic_hotkey(letter).unwrap();
+        get_alphabetic_hotkey(&letter).unwrap();
    }

    #[test]
@@ -275,7 +266,7 @@ mod tests {
        ctxi.checkpoint();
        ctxi.expect().returning(|_| 1);

-        send_input::<MockInputOperations, MockErrorOperations>(vec![build_unicode_input(
+        send_input::<MockInputOperations, MockErrorOperations>(&[build_unicode_input(
            InputKeyPress::Up,
            0,
        )])
@@ -284,6 +275,29 @@ mod tests {
        drop(ctxi);
    }

+    #[test]
+    #[serial]
+    fn keyboard_shortcut_conversion_succeeds() {
+        let keyboard_shortcut = [CONTROL_KEY_STR, SHIFT_KEY_STR, "B"];
+        let _: Vec<KeyboardShortcutInput> = keyboard_shortcut
+            .iter()
+            .map(|s| KeyboardShortcutInput::try_from(*s))
+            .try_collect()
+            .unwrap();
+    }
+
+    #[test]
+    #[serial]
+    #[should_panic = "Letter is not ASCII Alphabetic ([a-z][A-Z]): '1'"]
+    fn keyboard_shortcut_conversion_fails_invalid_key() {
+        let keyboard_shortcut = [CONTROL_KEY_STR, SHIFT_KEY_STR, "1"];
+        let _: Vec<KeyboardShortcutInput> = keyboard_shortcut
+            .iter()
+            .map(|s| KeyboardShortcutInput::try_from(*s))
+            .try_collect()
+            .unwrap();
+    }
+
    #[test]
    #[serial]
    #[should_panic(
@@ -298,7 +312,7 @@ mod tests {
        ctxge.checkpoint();
        ctxge.expect().returning(|| WIN32_ERROR(1));

-        send_input::<MockInputOperations, MockErrorOperations>(vec![build_unicode_input(
+        send_input::<MockInputOperations, MockErrorOperations>(&[build_unicode_input(
            InputKeyPress::Up,
            0,
        )])
@@ -320,7 +334,7 @@ mod tests {
        ctxge.checkpoint();
        ctxge.expect().returning(|| WIN32_ERROR(1));

-        send_input::<MockInputOperations, MockErrorOperations>(vec![build_unicode_input(
+        send_input::<MockInputOperations, MockErrorOperations>(&[build_unicode_input(
            InputKeyPress::Up,
            0,
        )])
--- a/apps/desktop/desktop_native/autotype/src/windows/window_title.rs
+++ b/apps/desktop/desktop_native/autotype/src/windows/window_title.rs
@@ -11,10 +11,10 @@ use super::{ErrorOperations, Win32ErrorOperations, WIN32_SUCCESS};

 #[cfg_attr(test, mockall::automock)]
 trait WindowHandleOperations {
-    // https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextlengthw
+    // <https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextlengthw>
    fn get_window_text_length_w(&self) -> Result<i32>;

-    // https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextw
+    // <https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextw>
    fn get_window_text_w(&self, buffer: &mut Vec<u16>) -> Result<i32>;
 }

@@ -70,7 +70,7 @@ pub(super) fn get_foreground_window_title() -> Result<String> {

 /// Retrieves the foreground window handle and validates it.
 fn get_foreground_window_handle() -> Result<WindowHandle> {
-    // https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getforegroundwindow
+    // <https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getforegroundwindow>
    let handle = unsafe { GetForegroundWindow() };

    debug!("GetForegroundWindow() called.");
@@ -87,7 +87,7 @@ fn get_foreground_window_handle() -> Result<WindowHandle> {
 ///
 /// # Errors
 ///
-/// - If the length zero and GetLastError() != 0, return the GetLastError() message.
+/// - If the length zero and `GetLastError()` != 0, return the `GetLastError()` message.
 fn get_window_title_length<H, E>(window_handle: &H) -> Result<usize>
 where
    H: WindowHandleOperations,
@@ -128,7 +128,7 @@ where
 /// # Errors
 ///
 /// - If the actual window title length (what the win32 API declares was written into the buffer),
-///   is length zero and GetLastError() != 0 , return the GetLastError() message.
+///   is length zero and `GetLastError()` != 0 , return the `GetLastError()` message.
 fn get_window_title<H, E>(window_handle: &H, expected_title_length: usize) -> Result<String>
 where
    H: WindowHandleOperations,
@@ -140,7 +140,7 @@ where
        // The upstream will make a contains comparison on what we return, so an empty string
        // will not result on a match.
        warn!("Window title length is zero.");
-        return Ok(String::from(""));
+        return Ok(String::new());
    }

    let mut buffer: Vec<u16> = vec![0; expected_title_length + 1]; // add extra space for the null character
@@ -171,7 +171,7 @@ where
 mod tests {
    //! For the mocking of the traits that are static methods, we need to use the `serial_test`
    //! crate in order to mock those, since the mock expectations set have to be global in
-    //! absence of a `self`. More info: https://docs.rs/mockall/latest/mockall/#static-methods
+    //! absence of a `self`. More info: <https://docs.rs/mockall/latest/mockall/#static-methods>

    use mockall::predicate;
    use serial_test::serial;
--- a/apps/desktop/desktop_native/napi/src/lib.rs
+++ b/apps/desktop/desktop_native/napi/src/lib.rs
@@ -1241,8 +1241,7 @@ pub mod autotype {
        input: Vec<u16>,
        keyboard_shortcut: Vec<String>,
    ) -> napi::Result<(), napi::Status> {
-        autotype::type_input(input, keyboard_shortcut).map_err(|_| {
-            napi::Error::from_reason("Autotype Error: failed to type input".to_string())
-        })
+        autotype::type_input(&input, &keyboard_shortcut)
+            .map_err(|e| napi::Error::from_reason(format!("Autotype Error: {e}")))
    }
 }
--- a/apps/desktop/electron-builder.beta.json
+++ b/apps/desktop/electron-builder.beta.json
@@ -5,7 +5,7 @@
  "productName": "Bitwarden Beta",
  "appId": "com.bitwarden.desktop.beta",
  "buildDependenciesFromSource": true,
-  "copyright": "Copyright © 2015-2025 Bitwarden Inc.",
+  "copyright": "Copyright © 2015-2026 Bitwarden Inc.",
  "directories": {
    "buildResources": "resources",
    "output": "dist",
--- a/apps/desktop/electron-builder.json
+++ b/apps/desktop/electron-builder.json
@@ -5,7 +5,7 @@
  "productName": "Bitwarden",
  "appId": "com.bitwarden.desktop",
  "buildDependenciesFromSource": true,
-  "copyright": "Copyright © 2015-2025 Bitwarden Inc.",
+  "copyright": "Copyright © 2015-2026 Bitwarden Inc.",
  "directories": {
    "buildResources": "resources",
    "output": "dist",
--- a/apps/desktop/src/app/layout/desktop-layout.component.spec.ts
+++ b/apps/desktop/src/app/layout/desktop-layout.component.spec.ts
@@ -4,7 +4,9 @@ import { RouterModule } from "@angular/router";
 import { mock } from "jest-mock-extended";

 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { FakeGlobalStateProvider } from "@bitwarden/common/spec";
 import { NavigationModule } from "@bitwarden/components";
+import { GlobalStateProvider } from "@bitwarden/state";

 import { SendFiltersNavComponent } from "../tools/send-v2/send-filters-nav.component";

@@ -36,6 +38,8 @@ describe("DesktopLayoutComponent", () => {
  let component: DesktopLayoutComponent;
  let fixture: ComponentFixture<DesktopLayoutComponent>;

+  const fakeGlobalStateProvider = new FakeGlobalStateProvider();
+
  beforeEach(async () => {
    await TestBed.configureTestingModule({
      imports: [DesktopLayoutComponent, RouterModule.forRoot([]), NavigationModule],
@@ -44,6 +48,10 @@ describe("DesktopLayoutComponent", () => {
          provide: I18nService,
          useValue: mock<I18nService>(),
        },
+        {
+          provide: GlobalStateProvider,
+          useValue: fakeGlobalStateProvider,
+        },
      ],
    })
      .overrideComponent(DesktopLayoutComponent, {
--- a/apps/desktop/src/app/layout/desktop-side-nav.component.spec.ts
+++ b/apps/desktop/src/app/layout/desktop-side-nav.component.spec.ts
@@ -2,7 +2,9 @@ import { ComponentFixture, TestBed } from "@angular/core/testing";
 import { mock } from "jest-mock-extended";

 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { FakeGlobalStateProvider } from "@bitwarden/common/spec";
 import { NavigationModule } from "@bitwarden/components";
+import { GlobalStateProvider } from "@bitwarden/state";

 import { DesktopSideNavComponent } from "./desktop-side-nav.component";

@@ -24,6 +26,8 @@ describe("DesktopSideNavComponent", () => {
  let component: DesktopSideNavComponent;
  let fixture: ComponentFixture<DesktopSideNavComponent>;

+  const fakeGlobalStateProvider = new FakeGlobalStateProvider();
+
  beforeEach(async () => {
    await TestBed.configureTestingModule({
      imports: [DesktopSideNavComponent, NavigationModule],
@@ -32,6 +36,10 @@ describe("DesktopSideNavComponent", () => {
          provide: I18nService,
          useValue: mock<I18nService>(),
        },
+        {
+          provide: GlobalStateProvider,
+          useValue: fakeGlobalStateProvider,
+        },
      ],
    }).compileComponents();

--- a/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.spec.ts
+++ b/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.spec.ts
@@ -5,9 +5,11 @@ import { RouterTestingHarness } from "@angular/router/testing";
 import { BehaviorSubject } from "rxjs";

 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { FakeGlobalStateProvider } from "@bitwarden/common/spec";
 import { SendType } from "@bitwarden/common/tools/send/enums/send-type";
 import { NavigationModule } from "@bitwarden/components";
 import { SendListFiltersService } from "@bitwarden/send-ui";
+import { GlobalStateProvider } from "@bitwarden/state";

 import { SendFiltersNavComponent } from "./send-filters-nav.component";

@@ -35,6 +37,8 @@ describe("SendFiltersNavComponent", () => {
  let filterFormValueSubject: BehaviorSubject<{ sendType: SendType | null }>;
  let mockSendListFiltersService: Partial<SendListFiltersService>;

+  const fakeGlobalStateProvider = new FakeGlobalStateProvider();
+
  beforeEach(async () => {
    filterFormValueSubject = new BehaviorSubject<{ sendType: SendType | null }>({
      sendType: null,
@@ -72,6 +76,10 @@ describe("SendFiltersNavComponent", () => {
            t: jest.fn((key) => key),
          },
        },
+        {
+          provide: GlobalStateProvider,
+          useValue: fakeGlobalStateProvider,
+        },
      ],
    }).compileComponents();

--- a/apps/desktop/src/locales/en/messages.json
+++ b/apps/desktop/src/locales/en/messages.json
@@ -4388,6 +4388,9 @@
  "sessionTimeoutHeader": {
    "message": "Session timeout"
  },
+  "resizeSideNavigation": {
+    "message": "Resize side navigation"
+  },
  "sessionTimeoutSettingsManagedByOrganization": {
    "message": "This setting is managed by your organization."
  },
--- a/apps/desktop/src/locales/zh_CN/messages.json
+++ b/apps/desktop/src/locales/zh_CN/messages.json
@@ -709,7 +709,7 @@
    "message": "添加附件"
  },
  "itemsTransferred": {
-    "message": "项目已传输"
+    "message": "项目已转移"
  },
  "fixEncryption": {
    "message": "修复加密"
@@ -4454,7 +4454,7 @@
    "message": "我该如何管理我的密码库？"
  },
  "transferItemsToOrganizationTitle": {
-    "message": "传输项目到 $ORGANIZATION$",
+    "message": "转移项目到 $ORGANIZATION$",
    "placeholders": {
      "organization": {
        "content": "$1",
@@ -4463,7 +4463,7 @@
    }
  },
  "transferItemsToOrganizationContent": {
-    "message": "出于安全和合规考虑，$ORGANIZATION$ 要求所有项目归组织所有。点击「接受」以传输您的项目的所有权。",
+    "message": "出于安全和合规考虑，$ORGANIZATION$ 要求所有项目归组织所有。点击「接受」以转移您的项目的所有权。",
    "placeholders": {
      "organization": {
        "content": "$1",
@@ -4472,7 +4472,7 @@
    }
  },
  "acceptTransfer": {
-    "message": "接受传输"
+    "message": "接受转移"
  },
  "declineAndLeave": {
    "message": "拒绝并退出"
--- a/apps/desktop/src/vault/app/vault/vault-v2.component.ts
+++ b/apps/desktop/src/vault/app/vault/vault-v2.component.ts
@@ -565,7 +565,7 @@ export class VaultV2Component<C extends CipherViewLike>
      }
    }

-    if (!cipher.organizationId && !cipher.isDeleted && !cipher.isArchived) {
+    if (userCanArchive && !cipher.isDeleted && !cipher.isArchived) {
      menu.push({
        label: this.i18nService.t("archiveVerb"),
        click: async () => {
--- a/apps/desktop/stores/chocolatey/bitwarden.nuspec
+++ b/apps/desktop/stores/chocolatey/bitwarden.nuspec
@@ -10,7 +10,7 @@
    <authors>Bitwarden Inc.</authors>
    <projectUrl>https://bitwarden.com/</projectUrl>
    <iconUrl>https://raw.githubusercontent.com/bitwarden/brand/master/icons/256x256.png</iconUrl>
-    <copyright>Copyright © 2015-2025 Bitwarden Inc.</copyright>
+    <copyright>Copyright © 2015-2026 Bitwarden Inc.</copyright>
    <projectSourceUrl>https://github.com/bitwarden/clients/</projectSourceUrl>
    <docsUrl>https://bitwarden.com/help/</docsUrl>
    <bugTrackerUrl>https://github.com/bitwarden/clients/issues</bugTrackerUrl>
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@bitwarden/web-vault",
-  "version": "2025.12.1",
+  "version": "2025.12.2",
  "scripts": {
    "build:oss": "webpack",
    "build:bit": "webpack -c ../../bitwarden_license/bit-web/webpack.config.js",
--- a/apps/web/src/app/auth/settings/two-factor/two-factor-setup-webauthn.component.html
+++ b/apps/web/src/app/auth/settings/two-factor/two-factor-setup-webauthn.component.html
@@ -16,27 +16,26 @@
      <img class="tw-float-right tw-ml-5 mfaType7" alt="FIDO2 WebAuthn logo" />
      <ul class="bwi-ul">
        <li *ngFor="let k of keys; let i = index" #removeKeyBtn [appApiAction]="k.removePromise">
-          <i class="bwi bwi-li bwi-key"></i>
-          <span *ngIf="!k.configured || !k.name" bitTypography="body1" class="tw-font-medium">
-            {{ "webAuthnkeyX" | i18n: (i + 1).toString() }}
-          </span>
-          <span *ngIf="k.configured && k.name" bitTypography="body1" class="tw-font-medium">
-            {{ k.name }}
-          </span>
-          <ng-container *ngIf="k.configured && !$any(removeKeyBtn).loading">
-            <ng-container *ngIf="k.migrated">
-              <span>{{ "webAuthnMigrated" | i18n }}</span>
+          <ng-container *ngIf="k.configured">
+            <i class="bwi bwi-li bwi-key"></i>
+            <span *ngIf="k.configured" bitTypography="body1" class="tw-font-medium">
+              {{ k.name || ("unnamedKey" | i18n) }}
+            </span>
+            <ng-container *ngIf="k.configured && !$any(removeKeyBtn).loading">
+              <ng-container *ngIf="k.migrated">
+                <span>{{ "webAuthnMigrated" | i18n }}</span>
+              </ng-container>
+            </ng-container>
+            <ng-container *ngIf="keysConfiguredCount > 1 && k.configured">
+              <i
+                class="bwi bwi-spin bwi-spinner tw-text-muted bwi-fw"
+                title="{{ 'loading' | i18n }}"
+                *ngIf="$any(removeKeyBtn).loading"
+                aria-hidden="true"
+              ></i>
+              -
+              <a bitLink href="#" appStopClick (click)="remove(k)">{{ "remove" | i18n }}</a>
            </ng-container>
-          </ng-container>
-          <ng-container *ngIf="keysConfiguredCount > 1 && k.configured">
-            <i
-              class="bwi bwi-spin bwi-spinner tw-text-muted bwi-fw"
-              title="{{ 'loading' | i18n }}"
-              *ngIf="$any(removeKeyBtn).loading"
-              aria-hidden="true"
-            ></i>
-            -
-            <a bitLink href="#" appStopClick (click)="remove(k)">{{ "remove" | i18n }}</a>
          </ng-container>
        </li>
      </ul>
@@ -60,7 +59,9 @@
        type="button"
        [bitAction]="readKey"
        buttonType="secondary"
-        [disabled]="$any(readKeyBtn).loading() || webAuthnListening || !keyIdAvailable"
+        [disabled]="
+          $any(readKeyBtn).loading() || webAuthnListening || !keyIdAvailable || formGroup.invalid
+        "
        class="tw-mr-2"
        #readKeyBtn
      >
--- a/apps/web/src/app/auth/settings/two-factor/two-factor-setup-webauthn.component.ts
+++ b/apps/web/src/app/auth/settings/two-factor/two-factor-setup-webauthn.component.ts
@@ -1,6 +1,6 @@
 import { CommonModule } from "@angular/common";
 import { Component, Inject, NgZone } from "@angular/core";
-import { FormControl, FormGroup, ReactiveFormsModule } from "@angular/forms";
+import { FormControl, FormGroup, ReactiveFormsModule, Validators } from "@angular/forms";

 import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
@@ -99,7 +99,7 @@ export class TwoFactorSetupWebAuthnComponent extends TwoFactorSetupMethodBaseCom
      toastService,
    );
    this.formGroup = new FormGroup({
-      name: new FormControl({ value: "", disabled: false }),
+      name: new FormControl({ value: "", disabled: false }, Validators.required),
    });
    this.auth(data);
  }
@@ -213,7 +213,22 @@ export class TwoFactorSetupWebAuthnComponent extends TwoFactorSetupMethodBaseCom
    this.webAuthnListening = listening;
  }

+  private findNextAvailableKeyId(existingIds: Set<number>): number {
+    // Search for first gap, bounded by current key count + 1
+    for (let i = 1; i <= existingIds.size + 1; i++) {
+      if (!existingIds.has(i)) {
+        return i;
+      }
+    }
+
+    // This should never be reached due to loop bounds, but TypeScript requires a return
+    throw new Error("Unable to find next available key ID");
+  }
+
  private processResponse(response: TwoFactorWebAuthnResponse) {
+    if (!response.keys || response.keys.length === 0) {
+      response.keys = [];
+    }
    this.resetWebAuthn();
    this.keys = [];
    this.keyIdAvailable = null;
@@ -223,26 +238,37 @@ export class TwoFactorSetupWebAuthnComponent extends TwoFactorSetupMethodBaseCom
      nameControl.setValue("");
    }
    this.keysConfiguredCount = 0;
-    for (let i = 1; i <= 5; i++) {
-      if (response.keys != null) {
-        const key = response.keys.filter((k) => k.id === i);
-        if (key.length > 0) {
-          this.keysConfiguredCount++;
-          this.keys.push({
-            id: i,
-            name: key[0].name,
-            configured: true,
-            migrated: key[0].migrated,
-            removePromise: null,
-          });
-          continue;
-        }
-      }
-      this.keys.push({ id: i, name: "", configured: false, removePromise: null });
-      if (this.keyIdAvailable == null) {
-        this.keyIdAvailable = i;
-      }
+
+    // Build configured keys
+    for (const key of response.keys) {
+      this.keysConfiguredCount++;
+      this.keys.push({
+        id: key.id,
+        name: key.name,
+        configured: true,
+        migrated: key.migrated,
+        removePromise: null,
+      });
    }
+
+    // [PM-20109]: To accommodate the existing form logic with minimal changes,
+    // we need to have at least one unconfigured key slot available to the collection.
+    // Prior to PM-20109, both client and server had hard checks for IDs <= 5.
+    // While we don't have any technical constraints _at this time_, we should avoid
+    // unbounded growth of key IDs over time as users add/remove keys;
+    // this strategy gap-fills key IDs.
+    const existingIds = new Set(response.keys.map((k) => k.id));
+    const nextId = this.findNextAvailableKeyId(existingIds);
+
+    // Add unconfigured slot, which can be used to add a new key
+    this.keys.push({
+      id: nextId,
+      name: "",
+      configured: false,
+      removePromise: null,
+    });
+    this.keyIdAvailable = nextId;
+
    this.enabled = response.enabled;
    this.onUpdated.emit(this.enabled);
  }
--- a/apps/web/src/app/dirt/reports/pages/exposed-passwords-report.component.html
+++ b/apps/web/src/app/dirt/reports/pages/exposed-passwords-report.component.html
@@ -26,7 +26,7 @@
          </bit-toggle>
        </ng-container>
      </bit-toggle-group>
-      <bit-table-scroll [dataSource]="dataSource" [rowSize]="53">
+      <bit-table-scroll [dataSource]="dataSource" [rowSize]="75">
        <ng-container header>
          <th bitCell></th>
          <th bitCell bitSortable="name">{{ "name" | i18n }}</th>
--- a/apps/web/src/app/dirt/reports/pages/weak-passwords-report.component.html
+++ b/apps/web/src/app/dirt/reports/pages/weak-passwords-report.component.html
@@ -31,7 +31,7 @@
          </bit-toggle>
        </ng-container>
      </bit-toggle-group>
-      <bit-table-scroll [dataSource]="dataSource" [rowSize]="53">
+      <bit-table-scroll [dataSource]="dataSource" [rowSize]="75">
        <ng-container header>
          <th bitCell></th>
          <th bitCell bitSortable="name">{{ "name" | i18n }}</th>
--- a/apps/web/src/app/key-management/data-recovery/steps/cipher-step.spec.ts
+++ b/apps/web/src/app/key-management/data-recovery/steps/cipher-step.spec.ts
@@ -132,7 +132,10 @@ describe("CipherStep", () => {
        userKey: null,
        encryptedPrivateKey: null,
        isPrivateKeyCorrupt: false,
-        ciphers: [{ id: "cipher-1", organizationId: null } as Cipher],
+        ciphers: [
+          { id: "cipher-1", organizationId: null } as Cipher,
+          { id: "cipher-2", organizationId: null } as Cipher,
+        ],
        folders: [],
      };

@@ -144,14 +147,39 @@ describe("CipherStep", () => {
      expect(result).toBe(false);
    });

-    it("returns true when there are undecryptable ciphers", async () => {
+    it("returns true when there are undecryptable ciphers but at least one decryptable cipher", async () => {
      const userId = "user-id" as UserId;
      const workingData: RecoveryWorkingData = {
        userId,
        userKey: null,
        encryptedPrivateKey: null,
        isPrivateKeyCorrupt: false,
-        ciphers: [{ id: "cipher-1", organizationId: null } as Cipher],
+        ciphers: [
+          { id: "cipher-1", organizationId: null } as Cipher,
+          { id: "cipher-2", organizationId: null } as Cipher,
+        ],
+        folders: [],
+      };
+
+      cipherEncryptionService.decrypt.mockRejectedValueOnce(new Error("Decryption failed"));
+
+      await cipherStep.runDiagnostics(workingData, logger);
+      const result = cipherStep.canRecover(workingData);
+
+      expect(result).toBe(true);
+    });
+
+    it("returns false when all ciphers are undecryptable", async () => {
+      const userId = "user-id" as UserId;
+      const workingData: RecoveryWorkingData = {
+        userId,
+        userKey: null,
+        encryptedPrivateKey: null,
+        isPrivateKeyCorrupt: false,
+        ciphers: [
+          { id: "cipher-1", organizationId: null } as Cipher,
+          { id: "cipher-2", organizationId: null } as Cipher,
+        ],
        folders: [],
      };

@@ -160,7 +188,7 @@ describe("CipherStep", () => {
      await cipherStep.runDiagnostics(workingData, logger);
      const result = cipherStep.canRecover(workingData);

-      expect(result).toBe(true);
+      expect(result).toBe(false);
    });
  });

--- a/apps/web/src/app/key-management/data-recovery/steps/cipher-step.ts
+++ b/apps/web/src/app/key-management/data-recovery/steps/cipher-step.ts
@@ -10,6 +10,7 @@ export class CipherStep implements RecoveryStep {
  title = "recoveryStepCipherTitle";

  private undecryptableCipherIds: string[] = [];
+  private decryptableCipherIds: string[] = [];

  constructor(
    private apiService: ApiService,
@@ -31,18 +32,21 @@ export class CipherStep implements RecoveryStep {
    for (const cipher of userCiphers) {
      try {
        await this.cipherService.decrypt(cipher, workingData.userId);
+        this.decryptableCipherIds.push(cipher.id);
      } catch {
        logger.record(`Cipher ID ${cipher.id} was undecryptable`);
        this.undecryptableCipherIds.push(cipher.id);
      }
    }
    logger.record(`Found ${this.undecryptableCipherIds.length} undecryptable ciphers`);
+    logger.record(`Found ${this.decryptableCipherIds.length} decryptable ciphers`);

    return this.undecryptableCipherIds.length == 0;
  }

  canRecover(workingData: RecoveryWorkingData): boolean {
-    return this.undecryptableCipherIds.length > 0;
+    // If everything fails to decrypt, it's a deeper issue and we shouldn't offer recovery here.
+    return this.undecryptableCipherIds.length > 0 && this.decryptableCipherIds.length > 0;
  }

  async runRecovery(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<void> {
--- a/apps/web/src/app/key-management/data-recovery/steps/folder-step.ts
+++ b/apps/web/src/app/key-management/data-recovery/steps/folder-step.ts
@@ -11,6 +11,7 @@ export class FolderStep implements RecoveryStep {
  title = "recoveryStepFoldersTitle";

  private undecryptableFolderIds: string[] = [];
+  private decryptableFolderIds: string[] = [];

  constructor(
    private folderService: FolderApiServiceAbstraction,
@@ -36,18 +37,21 @@ export class FolderStep implements RecoveryStep {
          folder.name.encryptedString,
          workingData.userKey.toEncoded(),
        );
+        this.decryptableFolderIds.push(folder.id);
      } catch {
        logger.record(`Folder name for folder ID ${folder.id} was undecryptable`);
        this.undecryptableFolderIds.push(folder.id);
      }
    }
    logger.record(`Found ${this.undecryptableFolderIds.length} undecryptable folders`);
+    logger.record(`Found ${this.decryptableFolderIds.length} decryptable folders`);

    return this.undecryptableFolderIds.length == 0;
  }

  canRecover(workingData: RecoveryWorkingData): boolean {
-    return this.undecryptableFolderIds.length > 0;
+    // If everything fails to decrypt, it's a deeper issue and we shouldn't offer recovery here.
+    return this.undecryptableFolderIds.length > 0 && this.decryptableFolderIds.length > 0;
  }

  async runRecovery(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<void> {
--- a/apps/web/src/app/layouts/product-switcher/navigation-switcher/navigation-switcher.component.spec.ts
+++ b/apps/web/src/app/layouts/product-switcher/navigation-switcher/navigation-switcher.component.spec.ts
@@ -7,10 +7,12 @@ import { BehaviorSubject } from "rxjs";

 import { I18nPipe } from "@bitwarden/angular/platform/pipes/i18n.pipe";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { FakeGlobalStateProvider } from "@bitwarden/common/spec";
 import { IconButtonModule, NavigationModule } from "@bitwarden/components";
 // FIXME: remove `src` and fix import
 // eslint-disable-next-line no-restricted-imports
 import { NavItemComponent } from "@bitwarden/components/src/navigation/nav-item.component";
+import { GlobalStateProvider } from "@bitwarden/state";

 import { ProductSwitcherItem, ProductSwitcherService } from "../shared/product-switcher.service";

@@ -59,6 +61,8 @@ describe("NavigationProductSwitcherComponent", () => {
    productSwitcherService.shouldShowPremiumUpgradeButton$ = mockShouldShowPremiumUpgradeButton$;
    mockProducts$.next({ bento: [], other: [] });

+    const fakeGlobalStateProvider = new FakeGlobalStateProvider();
+
    await TestBed.configureTestingModule({
      imports: [RouterModule, NavigationModule, IconButtonModule, MockUpgradeNavButtonComponent],
      declarations: [NavigationProductSwitcherComponent, I18nPipe],
@@ -72,6 +76,10 @@ describe("NavigationProductSwitcherComponent", () => {
          provide: ActivatedRoute,
          useValue: mock<ActivatedRoute>(),
        },
+        {
+          provide: GlobalStateProvider,
+          useValue: fakeGlobalStateProvider,
+        },
      ],
    }).compileComponents();
  });
--- a/apps/web/src/app/layouts/product-switcher/navigation-switcher/navigation-switcher.stories.ts
+++ b/apps/web/src/app/layouts/product-switcher/navigation-switcher/navigation-switcher.stories.ts
@@ -16,10 +16,15 @@ import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.servic
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { SyncService } from "@bitwarden/common/platform/sync";
 import { UserId } from "@bitwarden/common/types/guid";
-import { LayoutComponent, NavigationModule } from "@bitwarden/components";
+import {
+  LayoutComponent,
+  NavigationModule,
+  StorybookGlobalStateProvider,
+} from "@bitwarden/components";
 // FIXME: remove `src` and fix import
 // eslint-disable-next-line no-restricted-imports
 import { I18nMockService } from "@bitwarden/components/src/utils/i18n-mock.service";
+import { GlobalStateProvider } from "@bitwarden/state";
 import { I18nPipe } from "@bitwarden/ui-common";

 import { ProductSwitcherService } from "../shared/product-switcher.service";
@@ -82,7 +87,7 @@ class MockAccountService implements Partial<AccountService> {
    name: "Test User 1",
    email: "test@email.com",
    emailVerified: true,
-    creationDate: "2024-01-01T00:00:00.000Z",
+    creationDate: new Date("2024-01-01T00:00:00.000Z"),
  });
 }

@@ -183,6 +188,10 @@ export default {
            },
          ]),
        ),
+        {
+          provide: GlobalStateProvider,
+          useClass: StorybookGlobalStateProvider,
+        },
      ],
    }),
  ],
--- a/apps/web/src/app/layouts/product-switcher/product-switcher.stories.ts
+++ b/apps/web/src/app/layouts/product-switcher/product-switcher.stories.ts
@@ -82,7 +82,7 @@ class MockAccountService implements Partial<AccountService> {
    name: "Test User 1",
    email: "test@email.com",
    emailVerified: true,
-    creationDate: "2024-01-01T00:00:00.000Z",
+    creationDate: new Date("2024-01-01T00:00:00.000Z"),
  });
 }

--- a/apps/web/src/app/vault/components/vault-items/vault-items.stories.ts
+++ b/apps/web/src/app/vault/components/vault-items/vault-items.stories.ts
@@ -39,7 +39,8 @@ import { LoginView } from "@bitwarden/common/vault/models/view/login.view";
 import { CipherAuthorizationService } from "@bitwarden/common/vault/services/cipher-authorization.service";
 import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
 import { CipherViewLike } from "@bitwarden/common/vault/utils/cipher-view-like-utils";
-import { LayoutComponent } from "@bitwarden/components";
+import { LayoutComponent, StorybookGlobalStateProvider } from "@bitwarden/components";
+import { GlobalStateProvider } from "@bitwarden/state";
 import { RoutedVaultFilterService } from "@bitwarden/web-vault/app/vault/individual-vault/vault-filter/services/routed-vault-filter.service";

 import { GroupView } from "../../../admin-console/organizations/core";
@@ -168,6 +169,10 @@ export default {
      providers: [
        importProvidersFrom(RouterModule.forRoot([], { useHash: true })),
        importProvidersFrom(PreloadedEnglishI18nModule),
+        {
+          provide: GlobalStateProvider,
+          useClass: StorybookGlobalStateProvider,
+        },
      ],
    }),
  ],
--- a/apps/web/src/index.html
+++ b/apps/web/src/index.html
@@ -122,7 +122,6 @@
                </clipPath>
              </defs>
            </svg>
-            `;
          </div>

          <div
--- a/apps/web/src/locales/az/messages.json
+++ b/apps/web/src/locales/az/messages.json
@@ -5871,7 +5871,7 @@
    "description": "This is the policy description shown in the policy list."
  },
  "organizationDataOwnershipDescContent": {
-    "message": "All items will be owned and saved to the organization, enabling organization-wide controls, visibility, and reporting. When turned on, a default collection will be available for each member to store items. Learn more about managing the ",
+    "message": "Bütün elementlər bir təşkilata məxsus olacaq və orada saxlanılacaq, bu da təşkilat üzrə kontrollar, görünürlük və hesabatları mümkün edəcək. İşə salındığı zaman, hər üzv üçün elementləri saxlaya biləcəyi ilkin bir kolleksiya mövcud olacaq. Daha ətraflı ",
    "description": "This will be used as part of a larger sentence, broken up to include links. The full sentence will read 'All items will be owned and saved to the organization, enabling organization-wide controls, visibility, and reporting. When turned on, a default collection will be available for each member to store items. Learn more about managing the credential lifecycle.'"
  },
  "organizationDataOwnershipContentAnchor": {
@@ -6752,7 +6752,7 @@
    "message": "Bütün üzvlər üçün maksimum bitmə vaxtını \"Heç vaxt\" olaraq icazə vermək istədiyinizə əminsiniz?"
  },
  "sessionTimeoutConfirmationNeverDescription": {
-    "message": "This option will save your members' encryption keys on their devices. If you choose this option, ensure that their devices are adequately protected."
+    "message": "Bu seçim, üzvlərinizin şifrələmə açarlarını onların cihazlarında saxlayacaq. Bu seçimi seçsəniz, onların cihazlarının lazımi səviyyədə qorunduğuna əmin olun."
  },
  "learnMoreAboutDeviceProtection": {
    "message": "Cihaz mühafizəsi barədə daha ətraflı"
--- a/apps/web/src/locales/de/messages.json
+++ b/apps/web/src/locales/de/messages.json
@@ -12436,7 +12436,7 @@
    "message": "Du hast Bitwarden Premium"
  },
  "viewAndManagePremiumSubscription": {
-    "message": "View and manage your Premium subscription"
+    "message": "Dein Premium-Abonnement anzeigen und verwalten"
  },
  "youNeedToUpdateLicenseFile": {
    "message": "Du musst deine Lizenzdatei aktualisieren"
@@ -12472,7 +12472,7 @@
    "message": "Du hast bereits ein Abonnement?"
  },
  "alreadyHaveSubscriptionSelfHostedMessage": {
-    "message": "Open the subscription page on your Bitwarden cloud account and download your license file. Then return to this screen and upload it below."
+    "message": "Öffne die Abonnementseite in deinem Bitwarden Cloud-Konto und lade deine Lizenzdatei herunter. Gehe dann zu dieser Seite zurück und lade sie unten hoch."
  },
  "viewAllPlans": {
    "message": "Alle Tarife anzeigen"
--- a/apps/web/src/locales/en/messages.json
+++ b/apps/web/src/locales/en/messages.json
@@ -2634,6 +2634,9 @@
  "key": {
    "message": "Key"
  },
+  "unnamedKey": {
+    "message": "Unnamed key"
+  },
  "twoStepAuthenticatorEnterCodeV2": {
    "message": "Verification code"
  },
@@ -12305,6 +12308,9 @@
  "userVerificationFailed": {
    "message": "User verification failed."
  },
+  "resizeSideNavigation": {
+    "message": "Resize side navigation"
+  },
  "recoveryDeleteCiphersTitle": {
    "message": "Delete unrecoverable vault items"
  },
--- a/apps/web/src/locales/it/messages.json
+++ b/apps/web/src/locales/it/messages.json
@@ -1970,11 +1970,11 @@
    "message": "Le chiavi di cifratura dell'account sono uniche per ogni account utente Bitwarden, quindi non è possibile importare un'esportazione cifrata in un account diverso."
  },
  "exportNoun": {
-    "message": "Export",
+    "message": "Esporta",
    "description": "The noun form of the word Export"
  },
  "exportVerb": {
-    "message": "Export",
+    "message": "Esporta",
    "description": "The verb form of the word Export"
  },
  "exportFrom": {
@@ -2303,11 +2303,11 @@
    "message": "Strumenti"
  },
  "importNoun": {
-    "message": "Import",
+    "message": "Importa",
    "description": "The noun form of the word Import"
  },
  "importVerb": {
-    "message": "Import",
+    "message": "Importa",
    "description": "The verb form of the word Import"
  },
  "importData": {
@@ -3294,7 +3294,7 @@
    "message": "Avvia abbonamento cloud"
  },
  "launchCloudSubscriptionSentenceCase": {
-    "message": "Launch cloud subscription"
+    "message": "Avvia abbonamento cloud"
  },
  "storage": {
    "message": "Spazio di archiviazione"
@@ -4212,10 +4212,10 @@
    }
  },
  "userAcceptedTransfer": {
-    "message": "Accepted transfer to organization ownership."
+    "message": "Trasferimento di proprietà all'organizzazione accettato."
  },
  "userDeclinedTransfer": {
-    "message": "Revoked for declining transfer to organization ownership."
+    "message": "Revocato per il rifiuto di trasferimento di proprietà all'organizzazione."
  },
  "invitedUserId": {
    "message": "Utente $ID$ invitato.",
@@ -11607,7 +11607,7 @@
    "message": "Togli dall'archivio"
  },
  "unArchiveAndSave": {
-    "message": "Unarchive and save"
+    "message": "Togli dall'archivio e salva"
  },
  "itemsInArchive": {
    "message": "Elementi archiviati"
@@ -12251,43 +12251,43 @@
    }
  },
  "removeMasterPasswordForOrgUserKeyConnector": {
-    "message": "Your organization is no longer using master passwords to log into Bitwarden. To continue, verify the organization and domain."
+    "message": "La tua organizzazione non utilizza più le password principali per accedere a Bitwarden. Per continuare, verifica l'organizzazione e il dominio."
  },
  "continueWithLogIn": {
-    "message": "Continue with log in"
+    "message": "Accedi e continua"
  },
  "doNotContinue": {
-    "message": "Do not continue"
+    "message": "Non continuare"
  },
  "domain": {
-    "message": "Domain"
+    "message": "Dominio"
  },
  "keyConnectorDomainTooltip": {
-    "message": "This domain will store your account encryption keys, so make sure you trust it. If you're not sure, check with your admin."
+    "message": "Questo dominio memorizzerà le chiavi di crittografia del tuo account, quindi assicurati di impostarlo come affidabile. Se non hai la certezza che lo sia, verifica con l'amministratore."
  },
  "verifyYourOrganization": {
-    "message": "Verify your organization to log in"
+    "message": "Verifica la tua organizzazione per accedere"
  },
  "organizationVerified": {
-    "message": "Organization verified"
+    "message": "Organizzazione verificata"
  },
  "domainVerified": {
-    "message": "Domain verified"
+    "message": "Dominio verificato"
  },
  "leaveOrganizationContent": {
-    "message": "If you don't verify your organization, your access to the organization will be revoked."
+    "message": "Se non verifichi l'organizzazione, il tuo accesso sarà revocato."
  },
  "leaveNow": {
-    "message": "Leave now"
+    "message": "Abbandona"
  },
  "verifyYourDomainToLogin": {
-    "message": "Verify your domain to log in"
+    "message": "Verifica il tuo dominio per accedere"
  },
  "verifyYourDomainDescription": {
-    "message": "To continue with log in, verify this domain."
+    "message": "Per continuare con l'accesso, verifica questo dominio."
  },
  "confirmKeyConnectorOrganizationUserDescription": {
-    "message": "To continue with log in, verify the organization and domain."
+    "message": "Per continuare con l'accesso, verifica l'organizzazione e il dominio."
  },
  "confirmNoSelectedCriticalApplicationsTitle": {
    "message": "Non ci sono applicazioni contrassegnate come critiche"
@@ -12433,13 +12433,13 @@
    "message": "Perché vedo questo avviso?"
  },
  "youHaveBitwardenPremium": {
-    "message": "You have Bitwarden Premium"
+    "message": "Hai Bitwarden Premium"
  },
  "viewAndManagePremiumSubscription": {
-    "message": "View and manage your Premium subscription"
+    "message": "Visualizza e gestisci il tuo abbonamento Premium"
  },
  "youNeedToUpdateLicenseFile": {
-    "message": "You'll need to update your license file"
+    "message": "Dovrai aggiornare il tuo file di licenza"
  },
  "youNeedToUpdateLicenseFileDate": {
    "message": "$DATE$.",
@@ -12451,16 +12451,16 @@
    }
  },
  "uploadLicenseFile": {
-    "message": "Upload license file"
+    "message": "Carica il file di licenza"
  },
  "uploadYourLicenseFile": {
-    "message": "Upload your license file"
+    "message": "Carica il file di licenza"
  },
  "uploadYourPremiumLicenseFile": {
-    "message": "Upload your Premium license file"
+    "message": "Carica il tuo file di licenza Premium"
  },
  "uploadLicenseFileDesc": {
-    "message": "Your license file name will be similar to: $FILE_NAME$",
+    "message": "Il nome del file di licenza sarà simile a $FILE_NAME$",
    "placeholders": {
      "file_name": {
        "content": "$1",
@@ -12469,15 +12469,15 @@
    }
  },
  "alreadyHaveSubscriptionQuestion": {
-    "message": "Already have a subscription?"
+    "message": "Hai già un abbonamento?"
  },
  "alreadyHaveSubscriptionSelfHostedMessage": {
-    "message": "Open the subscription page on your Bitwarden cloud account and download your license file. Then return to this screen and upload it below."
+    "message": "Vai alla pagina degli abbonamenti del tuo account Bitwarden e scarica il file di licenza, poi torna a caricarlo qui."
  },
  "viewAllPlans": {
-    "message": "View all plans"
+    "message": "Visualizza tutti i piani"
  },
  "planDescPremium": {
-    "message": "Complete online security"
+    "message": "Sicurezza online completa"
  }
 }
--- a/apps/web/src/locales/pt_BR/messages.json
+++ b/apps/web/src/locales/pt_BR/messages.json
@@ -1943,7 +1943,7 @@
    "message": "Copiar UUID"
  },
  "errorRefreshingAccessToken": {
-    "message": "Erro de recarregamento do token de acesso"
+    "message": "Erro de Recarregamento do Token de Acesso"
  },
  "errorRefreshingAccessTokenDesc": {
    "message": "Nenhum token de atualização ou chave de API foi encontrado. Tente se desconectar e se conectar novamente."
@@ -3294,7 +3294,7 @@
    "message": "Iniciar Assinatura na Nuvem"
  },
  "launchCloudSubscriptionSentenceCase": {
-    "message": "Launch cloud subscription"
+    "message": "Executar assinatura na nuvem"
  },
  "storage": {
    "message": "Armazenamento"
--- a/apps/web/src/locales/zh_CN/messages.json
+++ b/apps/web/src/locales/zh_CN/messages.json
@@ -3862,7 +3862,7 @@
    "description": "Browser extension/addon"
  },
  "desktop": {
-    "message": "桌面版应用",
+    "message": "桌面端",
    "description": "Desktop app"
  },
  "webVault": {
@@ -4212,10 +4212,10 @@
    }
  },
  "userAcceptedTransfer": {
-    "message": "Accepted transfer to organization ownership."
+    "message": "接受了转移至组织所有权。"
  },
  "userDeclinedTransfer": {
-    "message": "Revoked for declining transfer to organization ownership."
+    "message": "因拒绝转移至组织所有权而被撤销。"
  },
  "invitedUserId": {
    "message": "邀请了用户 $ID$。",
@@ -5195,7 +5195,7 @@
    "message": "需要先修复您的密码库中的旧文件附件，然后才能轮换您账户的加密密钥。"
  },
  "itemsTransferred": {
-    "message": "项目已传输"
+    "message": "项目已转移"
  },
  "yourAccountsFingerprint": {
    "message": "您的账户指纹短语",
@@ -6825,7 +6825,7 @@
    "message": "密码库超时不在允许的范围内。"
  },
  "disableExport": {
-    "message": "移除导出"
+    "message": "禁用导出"
  },
  "disablePersonalVaultExportDescription": {
    "message": "不允许成员从个人密码库导出数据。"
@@ -12406,7 +12406,7 @@
    "message": "我该如何管理我的密码库？"
  },
  "transferItemsToOrganizationTitle": {
-    "message": "传输项目到 $ORGANIZATION$",
+    "message": "转移项目到 $ORGANIZATION$",
    "placeholders": {
      "organization": {
        "content": "$1",
@@ -12415,7 +12415,7 @@
    }
  },
  "transferItemsToOrganizationContent": {
-    "message": "出于安全和合规考虑，$ORGANIZATION$ 要求所有项目归组织所有。点击「接受」以传输您的项目的所有权。",
+    "message": "出于安全和合规考虑，$ORGANIZATION$ 要求所有项目归组织所有。点击「接受」以转移您的项目的所有权。",
    "placeholders": {
      "organization": {
        "content": "$1",
@@ -12424,7 +12424,7 @@
    }
  },
  "acceptTransfer": {
-    "message": "接受传输"
+    "message": "接受转移"
  },
  "declineAndLeave": {
    "message": "拒绝并退出"
@@ -12439,7 +12439,7 @@
    "message": "查看和管理您的高级版订阅"
  },
  "youNeedToUpdateLicenseFile": {
-    "message": "您需要更新您的许可文件"
+    "message": "您需要更新您的许可证文件"
  },
  "youNeedToUpdateLicenseFileDate": {
    "message": "$DATE$。",
@@ -12469,13 +12469,13 @@
    }
  },
  "alreadyHaveSubscriptionQuestion": {
-    "message": "已经有一个订阅？"
+    "message": "已经有一个订阅了吗？"
  },
  "alreadyHaveSubscriptionSelfHostedMessage": {
-    "message": "打开您的 Bitwarden 云账户上的订阅页面并下载您的许可证文件，然后返回此屏幕并上传。"
+    "message": "打开您的 Bitwarden 云账户中的订阅页面并下载您的许可证文件。然后返回此界面并在下方上传该文件。"
  },
  "viewAllPlans": {
-    "message": "查看所有套餐"
+    "message": "查看所有方案"
  },
  "planDescPremium": {
    "message": "全面的在线安全防护"
--- a/libs/angular/src/vault/index.ts
+++ b/libs/angular/src/vault/index.ts
@@ -1,3 +1,4 @@
 // Note: Nudge related code is exported from `libs/angular` because it is consumed by multiple
 // `libs/*` packages. Exporting from the `libs/vault` package creates circular dependencies.
 export { NudgesService, NudgeStatus, NudgeType } from "./services/nudges.service";
+export { AUTOFILL_NUDGE_SERVICE } from "./services/nudge-injection-tokens";
--- a/libs/angular/src/vault/services/custom-nudges-services/index.ts
+++ b/libs/angular/src/vault/services/custom-nudges-services/index.ts
@@ -4,3 +4,4 @@ export * from "./empty-vault-nudge.service";
 export * from "./vault-settings-import-nudge.service";
 export * from "./new-item-nudge.service";
 export * from "./new-account-nudge.service";
+export * from "./noop-nudge.service";
--- a/libs/angular/src/vault/services/custom-nudges-services/noop-nudge.service.ts
+++ b/libs/angular/src/vault/services/custom-nudges-services/noop-nudge.service.ts
@@ -0,0 +1,27 @@
+import { Injectable } from "@angular/core";
+import { Observable, of } from "rxjs";
+
+import { UserId } from "@bitwarden/common/types/guid";
+
+import { SingleNudgeService } from "../default-single-nudge.service";
+import { NudgeStatus, NudgeType } from "../nudges.service";
+
+/**
+ * A no-op nudge service that always returns dismissed status.
+ * Use this for nudges that should be completely ignored/hidden in certain clients.
+ * For example, browser-specific nudges can use this as the default in non-browser clients.
+ */
+@Injectable({ providedIn: "root" })
+export class NoOpNudgeService implements SingleNudgeService {
+  nudgeStatus$(_nudgeType: NudgeType, _userId: UserId): Observable<NudgeStatus> {
+    return of({ hasBadgeDismissed: true, hasSpotlightDismissed: true });
+  }
+
+  async setNudgeStatus(
+    _nudgeType: NudgeType,
+    _newStatus: NudgeStatus,
+    _userId: UserId,
+  ): Promise<void> {
+    // No-op: state changes are ignored
+  }
+}
--- a/libs/angular/src/vault/services/nudge-injection-tokens.ts
+++ b/libs/angular/src/vault/services/nudge-injection-tokens.ts
@@ -0,0 +1,7 @@
+import { InjectionToken } from "@angular/core";
+
+import { SingleNudgeService } from "./default-single-nudge.service";
+
+export const AUTOFILL_NUDGE_SERVICE = new InjectionToken<SingleNudgeService>(
+  "AutofillNudgeService",
+);
--- a/libs/angular/src/vault/services/nudges.service.ts
+++ b/libs/angular/src/vault/services/nudges.service.ts
@@ -12,8 +12,10 @@ import {
  NewItemNudgeService,
  AccountSecurityNudgeService,
  VaultSettingsImportNudgeService,
+  NoOpNudgeService,
 } from "./custom-nudges-services";
 import { DefaultSingleNudgeService, SingleNudgeService } from "./default-single-nudge.service";
+import { AUTOFILL_NUDGE_SERVICE } from "./nudge-injection-tokens";

 export type NudgeStatus = {
  hasBadgeDismissed: boolean;
@@ -56,6 +58,12 @@ export class NudgesService {
  private newItemNudgeService = inject(NewItemNudgeService);
  private newAcctNudgeService = inject(NewAccountNudgeService);

+  // NoOp service that always returns dismissed
+  private noOpNudgeService = inject(NoOpNudgeService);
+
+  // Optional Browser-specific service provided via injection token (not all clients have autofill)
+  private autofillNudgeService = inject(AUTOFILL_NUDGE_SERVICE, { optional: true });
+
  /**
   * Custom nudge services to use for specific nudge types
   * Each nudge type can have its own service to determine when to show the nudge
@@ -66,7 +74,7 @@ export class NudgesService {
    [NudgeType.EmptyVaultNudge]: inject(EmptyVaultNudgeService),
    [NudgeType.VaultSettingsImportNudge]: inject(VaultSettingsImportNudgeService),
    [NudgeType.AccountSecurity]: inject(AccountSecurityNudgeService),
-    [NudgeType.AutofillNudge]: this.newAcctNudgeService,
+    [NudgeType.AutofillNudge]: this.autofillNudgeService ?? this.noOpNudgeService,
    [NudgeType.DownloadBitwarden]: this.newAcctNudgeService,
    [NudgeType.GeneratorNudgeStatus]: this.newAcctNudgeService,
    [NudgeType.NewLoginItemStatus]: this.newItemNudgeService,
--- a/libs/auth/src/angular/login-decryption-options/login-decryption-options.component.spec.ts
+++ b/libs/auth/src/angular/login-decryption-options/login-decryption-options.component.spec.ts
@@ -107,7 +107,7 @@ describe("LoginDecryptionOptionsComponent", () => {
      email: mockEmail,
      name: "Test User",
      emailVerified: true,
-      creationDate: new Date().toISOString(),
+      creationDate: new Date(),
    });
    platformUtilsService.getClientType.mockReturnValue(ClientType.Browser);
    deviceTrustService.getShouldTrustDevice.mockResolvedValue(true);
--- a/libs/common/spec/fake-account-service.ts
+++ b/libs/common/spec/fake-account-service.ts
@@ -15,7 +15,7 @@ export function mockAccountInfoWith(info: Partial<AccountInfo> = {}): AccountInf
    name: "name",
    email: "email",
    emailVerified: true,
-    creationDate: "2024-01-01T00:00:00.000Z",
+    creationDate: new Date("2024-01-01T00:00:00.000Z"),
    ...info,
  };
 }
@@ -111,7 +111,7 @@ export class FakeAccountService implements AccountService {
    await this.mock.setAccountEmailVerified(userId, emailVerified);
  }

-  async setAccountCreationDate(userId: UserId, creationDate: string): Promise<void> {
+  async setAccountCreationDate(userId: UserId, creationDate: Date): Promise<void> {
    await this.mock.setAccountCreationDate(userId, creationDate);
  }

--- a/libs/common/src/auth/abstractions/account.service.ts
+++ b/libs/common/src/auth/abstractions/account.service.ts
@@ -2,33 +2,25 @@ import { Observable } from "rxjs";

 import { UserId } from "../../types/guid";

+/**
+ * Holds state that represents a user's account with Bitwarden.
+ * Any additions here should be added to the equality check in the AccountService
+ * to ensure that emissions are done on every change.
+ *
+ * @property email - User's email address.
+ * @property emailVerified - Whether the email has been verified.
+ * @property name - User's display name (optional).
+ * @property creationDate - Date when the account was created.
+ *   Will be undefined immediately after login until the first sync completes.
+ */
 export type AccountInfo = {
  email: string;
  emailVerified: boolean;
  name: string | undefined;
-  creationDate: string | undefined;
+  creationDate: Date | undefined;
 };

 export type Account = { id: UserId } & AccountInfo;
-
-export function accountInfoEqual(a: AccountInfo, b: AccountInfo) {
-  if (a == null && b == null) {
-    return true;
-  }
-
-  if (a == null || b == null) {
-    return false;
-  }
-
-  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof AccountInfo>;
-  for (const key of keys) {
-    if (a[key] !== b[key]) {
-      return false;
-    }
-  }
-  return true;
-}
-
 export abstract class AccountService {
  abstract accounts$: Observable<Record<UserId, AccountInfo>>;

@@ -77,7 +69,7 @@ export abstract class AccountService {
   * @param userId
   * @param creationDate
   */
-  abstract setAccountCreationDate(userId: UserId, creationDate: string): Promise<void>;
+  abstract setAccountCreationDate(userId: UserId, creationDate: Date): Promise<void>;
  /**
   * updates the `accounts$` observable with the new VerifyNewDeviceLogin property for the account.
   * @param userId
--- a/libs/common/src/auth/services/account.service.spec.ts
+++ b/libs/common/src/auth/services/account.service.spec.ts
@@ -17,7 +17,7 @@ import { LogService } from "../../platform/abstractions/log.service";
 import { MessagingService } from "../../platform/abstractions/messaging.service";
 import { Utils } from "../../platform/misc/utils";
 import { UserId } from "../../types/guid";
-import { AccountInfo, accountInfoEqual } from "../abstractions/account.service";
+import { AccountInfo } from "../abstractions/account.service";

 import {
  ACCOUNT_ACCOUNTS,
@@ -27,63 +27,6 @@ import {
  AccountServiceImplementation,
 } from "./account.service";

-describe("accountInfoEqual", () => {
-  const accountInfo = mockAccountInfoWith();
-
-  it("compares nulls", () => {
-    expect(accountInfoEqual(null, null)).toBe(true);
-    expect(accountInfoEqual(null, accountInfo)).toBe(false);
-    expect(accountInfoEqual(accountInfo, null)).toBe(false);
-  });
-
-  it("compares all keys, not just those defined in AccountInfo", () => {
-    const different = { ...accountInfo, extra: "extra" };
-
-    expect(accountInfoEqual(accountInfo, different)).toBe(false);
-  });
-
-  it("compares name", () => {
-    const same = { ...accountInfo };
-    const different = { ...accountInfo, name: "name2" };
-
-    expect(accountInfoEqual(accountInfo, same)).toBe(true);
-    expect(accountInfoEqual(accountInfo, different)).toBe(false);
-  });
-
-  it("compares email", () => {
-    const same = { ...accountInfo };
-    const different = { ...accountInfo, email: "email2" };
-
-    expect(accountInfoEqual(accountInfo, same)).toBe(true);
-    expect(accountInfoEqual(accountInfo, different)).toBe(false);
-  });
-
-  it("compares emailVerified", () => {
-    const same = { ...accountInfo };
-    const different = { ...accountInfo, emailVerified: false };
-
-    expect(accountInfoEqual(accountInfo, same)).toBe(true);
-    expect(accountInfoEqual(accountInfo, different)).toBe(false);
-  });
-
-  it("compares creationDate", () => {
-    const same = { ...accountInfo };
-    const different = { ...accountInfo, creationDate: "2024-12-31T00:00:00.000Z" };
-
-    expect(accountInfoEqual(accountInfo, same)).toBe(true);
-    expect(accountInfoEqual(accountInfo, different)).toBe(false);
-  });
-
-  it("compares undefined creationDate", () => {
-    const accountWithoutCreationDate = mockAccountInfoWith({ creationDate: undefined });
-    const same = { ...accountWithoutCreationDate };
-    const different = { ...accountWithoutCreationDate, creationDate: "2024-01-01T00:00:00.000Z" };
-
-    expect(accountInfoEqual(accountWithoutCreationDate, same)).toBe(true);
-    expect(accountInfoEqual(accountWithoutCreationDate, different)).toBe(false);
-  });
-});
-
 describe("accountService", () => {
  let messagingService: MockProxy<MessagingService>;
  let logService: MockProxy<LogService>;
@@ -121,6 +64,60 @@ describe("accountService", () => {
    jest.resetAllMocks();
  });

+  describe("accountInfoEqual", () => {
+    const accountInfo = mockAccountInfoWith();
+
+    it("compares nulls", () => {
+      expect((sut as any).accountInfoEqual(null, null)).toBe(true);
+      expect((sut as any).accountInfoEqual(null, accountInfo)).toBe(false);
+      expect((sut as any).accountInfoEqual(accountInfo, null)).toBe(false);
+    });
+
+    it("compares name", () => {
+      const same = { ...accountInfo };
+      const different = { ...accountInfo, name: "name2" };
+
+      expect((sut as any).accountInfoEqual(accountInfo, same)).toBe(true);
+      expect((sut as any).accountInfoEqual(accountInfo, different)).toBe(false);
+    });
+
+    it("compares email", () => {
+      const same = { ...accountInfo };
+      const different = { ...accountInfo, email: "email2" };
+
+      expect((sut as any).accountInfoEqual(accountInfo, same)).toBe(true);
+      expect((sut as any).accountInfoEqual(accountInfo, different)).toBe(false);
+    });
+
+    it("compares emailVerified", () => {
+      const same = { ...accountInfo };
+      const different = { ...accountInfo, emailVerified: false };
+
+      expect((sut as any).accountInfoEqual(accountInfo, same)).toBe(true);
+      expect((sut as any).accountInfoEqual(accountInfo, different)).toBe(false);
+    });
+
+    it("compares creationDate", () => {
+      const same = { ...accountInfo };
+      const different = { ...accountInfo, creationDate: new Date("2024-12-31T00:00:00.000Z") };
+
+      expect((sut as any).accountInfoEqual(accountInfo, same)).toBe(true);
+      expect((sut as any).accountInfoEqual(accountInfo, different)).toBe(false);
+    });
+
+    it("compares undefined creationDate", () => {
+      const accountWithoutCreationDate = mockAccountInfoWith({ creationDate: undefined });
+      const same = { ...accountWithoutCreationDate };
+      const different = {
+        ...accountWithoutCreationDate,
+        creationDate: new Date("2024-01-01T00:00:00.000Z"),
+      };
+
+      expect((sut as any).accountInfoEqual(accountWithoutCreationDate, same)).toBe(true);
+      expect((sut as any).accountInfoEqual(accountWithoutCreationDate, different)).toBe(false);
+    });
+  });
+
  describe("activeAccount$", () => {
    it("should emit null if no account is active", () => {
      const emissions = trackEmissions(sut.activeAccount$);
@@ -281,7 +278,7 @@ describe("accountService", () => {
    });

    it("should update the account with a new creation date", async () => {
-      const newCreationDate = "2024-12-31T00:00:00.000Z";
+      const newCreationDate = new Date("2024-12-31T00:00:00.000Z");
      await sut.setAccountCreationDate(userId, newCreationDate);
      const currentState = await firstValueFrom(accountsState.state$);

@@ -297,6 +294,24 @@ describe("accountService", () => {
      expect(currentState).toEqual(initialState);
    });

+    it("should not update if the creation date has the same timestamp but different Date object", async () => {
+      const sameTimestamp = new Date(userInfo.creationDate.getTime());
+      await sut.setAccountCreationDate(userId, sameTimestamp);
+      const currentState = await firstValueFrom(accountsState.state$);
+
+      expect(currentState).toEqual(initialState);
+    });
+
+    it("should update if the creation date has a different timestamp", async () => {
+      const differentDate = new Date(userInfo.creationDate.getTime() + 1000);
+      await sut.setAccountCreationDate(userId, differentDate);
+      const currentState = await firstValueFrom(accountsState.state$);
+
+      expect(currentState).toEqual({
+        [userId]: { ...userInfo, creationDate: differentDate },
+      });
+    });
+
    it("should update from undefined to a defined creation date", async () => {
      const accountWithoutCreationDate = mockAccountInfoWith({
        ...userInfo,
@@ -304,7 +319,7 @@ describe("accountService", () => {
      });
      accountsState.stateSubject.next({ [userId]: accountWithoutCreationDate });

-      const newCreationDate = "2024-06-15T12:30:00.000Z";
+      const newCreationDate = new Date("2024-06-15T12:30:00.000Z");
      await sut.setAccountCreationDate(userId, newCreationDate);
      const currentState = await firstValueFrom(accountsState.state$);

@@ -313,14 +328,19 @@ describe("accountService", () => {
      });
    });

-    it("should update to a different creation date string format", async () => {
-      const newCreationDate = "2023-03-15T08:45:30.123Z";
-      await sut.setAccountCreationDate(userId, newCreationDate);
-      const currentState = await firstValueFrom(accountsState.state$);
-
-      expect(currentState).toEqual({
-        [userId]: { ...userInfo, creationDate: newCreationDate },
+    it("should not update when both creation dates are undefined", async () => {
+      const accountWithoutCreationDate = mockAccountInfoWith({
+        ...userInfo,
+        creationDate: undefined,
      });
+      accountsState.stateSubject.next({ [userId]: accountWithoutCreationDate });
+
+      // Attempt to set to undefined (shouldn't trigger update)
+      const currentStateBefore = await firstValueFrom(accountsState.state$);
+
+      // We can't directly call setAccountCreationDate with undefined, but we can verify
+      // the behavior through setAccountInfo which accountInfoEqual uses internally
+      expect(currentStateBefore[userId].creationDate).toBeUndefined();
    });
  });

--- a/libs/common/src/auth/services/account.service.ts
+++ b/libs/common/src/auth/services/account.service.ts
@@ -18,7 +18,6 @@ import {
  Account,
  AccountInfo,
  InternalAccountService,
-  accountInfoEqual,
 } from "../../auth/abstractions/account.service";
 import { LogService } from "../../platform/abstractions/log.service";
 import { MessagingService } from "../../platform/abstractions/messaging.service";
@@ -37,7 +36,10 @@ export const ACCOUNT_ACCOUNTS = KeyDefinition.record<AccountInfo, UserId>(
  ACCOUNT_DISK,
  "accounts",
  {
-    deserializer: (accountInfo) => accountInfo,
+    deserializer: (accountInfo) => ({
+      ...accountInfo,
+      creationDate: accountInfo.creationDate ? new Date(accountInfo.creationDate) : undefined,
+    }),
  },
 );

@@ -111,7 +113,7 @@ export class AccountServiceImplementation implements InternalAccountService {
    this.activeAccount$ = this.activeAccountIdState.state$.pipe(
      combineLatestWith(this.accounts$),
      map(([id, accounts]) => (id ? ({ id, ...(accounts[id] as AccountInfo) } as Account) : null)),
-      distinctUntilChanged((a, b) => a?.id === b?.id && accountInfoEqual(a, b)),
+      distinctUntilChanged((a, b) => a?.id === b?.id && this.accountInfoEqual(a, b)),
      shareReplay({ bufferSize: 1, refCount: false }),
    );
    this.accountActivity$ = this.globalStateProvider
@@ -168,7 +170,7 @@ export class AccountServiceImplementation implements InternalAccountService {
    await this.setAccountInfo(userId, { emailVerified });
  }

-  async setAccountCreationDate(userId: UserId, creationDate: string): Promise<void> {
+  async setAccountCreationDate(userId: UserId, creationDate: Date): Promise<void> {
    await this.setAccountInfo(userId, { creationDate });
  }

@@ -274,6 +276,23 @@ export class AccountServiceImplementation implements InternalAccountService {
    this._showHeader$.next(visible);
  }

+  private accountInfoEqual(a: AccountInfo, b: AccountInfo) {
+    if (a == null && b == null) {
+      return true;
+    }
+
+    if (a == null || b == null) {
+      return false;
+    }
+
+    return (
+      a.email === b.email &&
+      a.emailVerified === b.emailVerified &&
+      a.name === b.name &&
+      a.creationDate?.getTime() === b.creationDate?.getTime()
+    );
+  }
+
  private async setAccountInfo(userId: UserId, update: Partial<AccountInfo>): Promise<void> {
    function newAccountInfo(oldAccountInfo: AccountInfo): AccountInfo {
      return { ...oldAccountInfo, ...update };
@@ -291,7 +310,7 @@ export class AccountServiceImplementation implements InternalAccountService {
            throw new Error("Account does not exist");
          }

-          return !accountInfoEqual(accounts[userId], newAccountInfo(accounts[userId]));
+          return !this.accountInfoEqual(accounts[userId], newAccountInfo(accounts[userId]));
        },
      },
    );
--- a/libs/common/src/enums/feature-flag.enum.ts
+++ b/libs/common/src/enums/feature-flag.enum.ts
@@ -70,8 +70,6 @@ export enum FeatureFlag {

  /* Platform */
  IpcChannelFramework = "ipc-channel-framework",
-  InactiveUserServerNotification = "pm-25130-receive-push-notifications-for-inactive-users",
-  PushNotificationsWhenLocked = "pm-19388-push-notifications-when-locked",

  /* Innovation */
  PM19148_InnovationArchive = "pm-19148-innovation-archive",
@@ -157,8 +155,6 @@ export const DefaultFeatureFlagValue = {

  /* Platform */
  [FeatureFlag.IpcChannelFramework]: FALSE,
-  [FeatureFlag.InactiveUserServerNotification]: FALSE,
-  [FeatureFlag.PushNotificationsWhenLocked]: FALSE,

  /* Innovation */
  [FeatureFlag.PM19148_InnovationArchive]: FALSE,
--- a/libs/common/src/platform/server-notifications/internal/default-server-notifications.multiuser.spec.ts
+++ b/libs/common/src/platform/server-notifications/internal/default-server-notifications.multiuser.spec.ts
@@ -5,7 +5,6 @@ import { BehaviorSubject, bufferCount, firstValueFrom, Subject, ObservedValueOf
 import { LogoutReason } from "@bitwarden/auth/common";
 import { InternalPolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
 import { AuthRequestAnsweringServiceAbstraction } from "@bitwarden/common/auth/abstractions/auth-request-answering/auth-request-answering.service.abstraction";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";

 import { mockAccountInfoWith } from "../../../../spec";
 import { AccountService } from "../../../auth/abstractions/account.service";
@@ -130,15 +129,6 @@ describe("DefaultServerNotificationsService (multi-user)", () => {

    authRequestAnsweringService = mock<AuthRequestAnsweringServiceAbstraction>();

-    configService = mock<ConfigService>();
-    configService.getFeatureFlag$.mockImplementation((flag: FeatureFlag) => {
-      const flagValueByFlag: Partial<Record<FeatureFlag, boolean>> = {
-        [FeatureFlag.InactiveUserServerNotification]: true,
-        [FeatureFlag.PushNotificationsWhenLocked]: true,
-      };
-      return new BehaviorSubject(flagValueByFlag[flag] ?? false) as any;
-    });
-
    policyService = mock<InternalPolicyService>();

    defaultServerNotificationsService = new DefaultServerNotificationsService(
--- a/libs/common/src/platform/server-notifications/internal/default-server-notifications.service.ts
+++ b/libs/common/src/platform/server-notifications/internal/default-server-notifications.service.ts
@@ -71,48 +71,20 @@ export class DefaultServerNotificationsService implements ServerNotificationsSer
    private readonly configService: ConfigService,
    private readonly policyService: InternalPolicyService,
  ) {
-    this.notifications$ = this.configService
-      .getFeatureFlag$(FeatureFlag.InactiveUserServerNotification)
-      .pipe(
-        distinctUntilChanged(),
-        switchMap((inactiveUserServerNotificationEnabled) => {
-          if (inactiveUserServerNotificationEnabled) {
-            return this.accountService.accounts$.pipe(
-              map((accounts: Record<UserId, AccountInfo>): Set<UserId> => {
-                const validUserIds = Object.entries(accounts)
-                  .filter(
-                    ([_, accountInfo]) => accountInfo.email !== "" || accountInfo.emailVerified,
-                  )
-                  .map(([userId, _]) => userId as UserId);
-                return new Set(validUserIds);
-              }),
-              trackedMerge((id: UserId) => {
-                return this.userNotifications$(id as UserId).pipe(
-                  map(
-                    (notification: NotificationResponse) => [notification, id as UserId] as const,
-                  ),
-                );
-              }),
-            );
-          }
-
-          return this.accountService.activeAccount$.pipe(
-            map((account) => account?.id),
-            distinctUntilChanged(),
-            switchMap((activeAccountId) => {
-              if (activeAccountId == null) {
-                // We don't emit server-notifications for inactive accounts currently
-                return EMPTY;
-              }
-
-              return this.userNotifications$(activeAccountId).pipe(
-                map((notification) => [notification, activeAccountId] as const),
-              );
-            }),
-          );
-        }),
-        share(), // Multiple subscribers should only create a single connection to the server
-      );
+    this.notifications$ = this.accountService.accounts$.pipe(
+      map((accounts: Record<UserId, AccountInfo>): Set<UserId> => {
+        const validUserIds = Object.entries(accounts)
+          .filter(([_, accountInfo]) => accountInfo.email !== "" || accountInfo.emailVerified)
+          .map(([userId, _]) => userId as UserId);
+        return new Set(validUserIds);
+      }),
+      trackedMerge((id: UserId) => {
+        return this.userNotifications$(id as UserId).pipe(
+          map((notification: NotificationResponse) => [notification, id as UserId] as const),
+        );
+      }),
+      share(), // Multiple subscribers should only create a single connection to the server
+    );
  }

  /**
@@ -175,25 +147,13 @@ export class DefaultServerNotificationsService implements ServerNotificationsSer
  }

  private hasAccessToken$(userId: UserId) {
-    return this.configService.getFeatureFlag$(FeatureFlag.PushNotificationsWhenLocked).pipe(
+    return this.authService.authStatusFor$(userId).pipe(
+      map(
+        (authStatus) =>
+          authStatus === AuthenticationStatus.Locked ||
+          authStatus === AuthenticationStatus.Unlocked,
+      ),
      distinctUntilChanged(),
-      switchMap((featureFlagEnabled) => {
-        if (featureFlagEnabled) {
-          return this.authService.authStatusFor$(userId).pipe(
-            map(
-              (authStatus) =>
-                authStatus === AuthenticationStatus.Locked ||
-                authStatus === AuthenticationStatus.Unlocked,
-            ),
-            distinctUntilChanged(),
-          );
-        } else {
-          return this.authService.authStatusFor$(userId).pipe(
-            map((authStatus) => authStatus === AuthenticationStatus.Unlocked),
-            distinctUntilChanged(),
-          );
-        }
-      }),
    );
  }

@@ -208,19 +168,13 @@ export class DefaultServerNotificationsService implements ServerNotificationsSer
      return;
    }

-    if (
-      await firstValueFrom(
-        this.configService.getFeatureFlag$(FeatureFlag.InactiveUserServerNotification),
-      )
-    ) {
-      const activeAccountId = await firstValueFrom(
-        this.accountService.activeAccount$.pipe(map((a) => a?.id)),
-      );
+    const activeAccountId = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((a) => a?.id)),
+    );

-      const isActiveUser = activeAccountId === userId;
-      if (!isActiveUser && !AllowedMultiUserNotificationTypes.has(notification.type)) {
-        return;
-      }
+    const notificationIsForActiveUser = activeAccountId === userId;
+    if (!notificationIsForActiveUser && !AllowedMultiUserNotificationTypes.has(notification.type)) {
+      return;
    }

    switch (notification.type) {
--- a/libs/common/src/platform/sync/default-sync.service.ts
+++ b/libs/common/src/platform/sync/default-sync.service.ts
@@ -279,8 +279,8 @@ export class DefaultSyncService extends CoreSyncService {
    await this.avatarService.setSyncAvatarColor(response.id, response.avatarColor);
    await this.tokenService.setSecurityStamp(response.securityStamp, response.id);
    await this.accountService.setAccountEmailVerified(response.id, response.emailVerified);
+    await this.accountService.setAccountCreationDate(response.id, new Date(response.creationDate));
    await this.accountService.setAccountVerifyNewDeviceLogin(response.id, response.verifyDevices);
-    await this.accountService.setAccountCreationDate(response.id, response.creationDate);

    await this.billingAccountProfileStateService.setHasPremium(
      response.premiumPersonally,
--- a/libs/common/src/vault/abstractions/cipher.service.ts
+++ b/libs/common/src/vault/abstractions/cipher.service.ts
@@ -207,9 +207,13 @@ export abstract class CipherService implements UserKeyRotationDataProvider<Ciphe
   * Update the local store of CipherData with the provided data. Values are upserted into the existing store.
   *
   * @param cipher The cipher data to upsert. Can be a single CipherData object or an array of CipherData objects.
+   * @param userId Optional user ID for whom the cipher data is being upserted.
   * @returns A promise that resolves to a record of updated cipher store, keyed by their cipher ID. Returns all ciphers, not just those updated
   */
-  abstract upsert(cipher: CipherData | CipherData[]): Promise<Record<CipherId, CipherData>>;
+  abstract upsert(
+    cipher: CipherData | CipherData[],
+    userId?: UserId,
+  ): Promise<Record<CipherId, CipherData>>;
  abstract replace(ciphers: { [id: string]: CipherData }, userId: UserId): Promise<any>;
  abstract clear(userId?: string): Promise<void>;
  abstract moveManyWithServer(ids: string[], folderId: string, userId: UserId): Promise<any>;
--- a/libs/common/src/vault/services/cipher.service.ts
+++ b/libs/common/src/vault/services/cipher.service.ts
@@ -1196,12 +1196,15 @@ export class CipherService implements CipherServiceAbstraction {
    await this.encryptedCiphersState(userId).update(() => ciphers);
  }

-  async upsert(cipher: CipherData | CipherData[]): Promise<Record<CipherId, CipherData>> {
+  async upsert(
+    cipher: CipherData | CipherData[],
+    userId?: UserId,
+  ): Promise<Record<CipherId, CipherData>> {
    const ciphers = cipher instanceof CipherData ? [cipher] : cipher;
    const res = await this.updateEncryptedCipherState((current) => {
      ciphers.forEach((c) => (current[c.id as CipherId] = c));
      return current;
-    });
+    }, userId);
    // Some state storage providers (e.g. Electron) don't update the state immediately, wait for next tick
    // Otherwise, subscribers to cipherViews$ can get stale data
    await new Promise((resolve) => setTimeout(resolve, 0));
--- a/Show More
+++ b/Show More