build: set netgo & osusergo tags for Linux build (#10261)

Avoid:

/_/GOROOT/src/os/user/cgo_lookup_cgo.go:45:(.text+0x54): warning: Using
'getgrgid_r' in statically linked applications requires at runtime the
shared libraries from the glibc version used for linking

and

/tmp/go-build/cgo-gcc-prolog:60:(.text+0x40): warning: Using
'getaddrinfo' in statically linked applications requires at runtime the
shared libraries from the glibc version used for linking

.github/workflows/build-infra-dockers.yaml

@@ -7,7 +7,7 @@ on:
       - infra-*
 
 env:
-  GO_VERSION: "~1.24.0"
+  GO_VERSION: "~1.25.0"
   CGO_ENABLED: "0"
   BUILD_USER: docker
   BUILD_HOST: github.syncthing.net

.github/workflows/build-syncthing.yaml

@@ -13,9 +13,9 @@ env:
   # The go version to use for builds. We set check-latest to true when
   # installing, so we get the latest patch version that matches the
   # expression.
-  GO_VERSION: "~1.24.0"
+  GO_VERSION: "~1.25.0"
 
-  # Optimize compatibility on the slow archictures.
+  # Optimize compatibility on the slow architectures.
   GOMIPS: softfloat
   GOARM: "6"
 
@@ -26,7 +26,8 @@ env:
   BUILD_USER: builder
   BUILD_HOST: github.syncthing.net
 
-  TAGS: "netgo osusergo sqlite_omit_load_extension sqlite_dbstat"
+  TAGS: "sqlite_omit_load_extension sqlite_dbstat"
+  TAGS_LINUX: "sqlite_omit_load_extension sqlite_dbstat netgo osusergo"
 
 # A note on actions and third party code... The actions under actions/ (like
 # `uses: actions/checkout`) are maintained by GitHub, and we need to trust
@@ -47,6 +48,7 @@ jobs:
     outputs:
       version: ${{ steps.get-version.outputs.version }}
       release-kind: ${{ steps.get-version.outputs.release-kind }}
+      release-generation: ${{ steps.get-version.outputs.release-generation }}
       go-version: ${{ steps.get-go.outputs.go-version }}
     steps:
       - uses: actions/checkout@v4
@@ -76,6 +78,12 @@ jobs:
           echo "release-kind=$kind" >> "$GITHUB_OUTPUT"
           echo "Release kind: $kind"
 
+          generation=v1
+          if [[ $version == v2.* ]] ; then
+            generation=v2
+          fi
+          echo "release-generation=$generation" >> "$GITHUB_OUTPUT"
+          echo "Release generation: $generation"
       - name: Get Go version
         id: get-go
         run: |
@@ -95,7 +103,7 @@ jobs:
         runner: ["windows-latest", "ubuntu-latest", "macos-latest"]
         # The oldest version in this list should match what we have in our go.mod.
         # Variables don't seem to be supported here, or we could have done something nice.
-        go: ["~1.23.0", "~1.24.0"]
+        go: ["~1.24.0", "~1.25.0"]
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Set git to use LF
@@ -200,7 +208,7 @@ jobs:
             go run build.go -tags "${{env.TAGS}}" -goos windows -goarch amd64 -cc "zig cc -target x86_64-windows" zip $tgt
             go run build.go -tags "${{env.TAGS}}" -goos windows -goarch 386 -cc "zig cc -target x86-windows" zip $tgt
             go run build.go -tags "${{env.TAGS}}" -goos windows -goarch arm64 -cc "zig cc -target aarch64-windows" zip $tgt
-            # go run build.go -tags "${{env.TAGS}}" -goos windows -goarch arm -cc "zig cc -target thumb-windows" zip $tgt # failes with linker errors
+            # go run build.go -tags "${{env.TAGS}}" -goos windows -goarch arm -cc "zig cc -target thumb-windows" zip $tgt # fails with linker errors
           done
         env:
           CGO_ENABLED: "1"
@@ -303,19 +311,19 @@ jobs:
         run: |
           sudo apt-get install -y gcc-mips64-linux-gnuabi64 gcc-mips64el-linux-gnuabi64
           for tgt in syncthing stdiscosrv strelaysrv ; do
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch amd64 -cc "zig cc -target x86_64-linux-musl" tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch 386 -cc "zig cc -target x86-linux-musl" tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch arm -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch arm64 -cc "zig cc -target aarch64-linux-musl" tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch mips -cc "zig cc -target mips-linux-musleabi" tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch mipsle -cc "zig cc -target mipsel-linux-musleabi" tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch mips64 -cc mips64-linux-gnuabi64-gcc tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch mips64le -cc mips64el-linux-gnuabi64-gcc tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch riscv64 -cc "zig cc -target riscv64-linux-musl" tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch s390x -cc "zig cc -target s390x-linux-musl" tar "$tgt"
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch loong64 -cc "zig cc -target loongarch64-linux-musl" tar "$tgt"
-            # go run build.go -tags "${{env.TAGS}}" -goos linux -goarch ppc64 -cc "zig cc -target powerpc64-linux-musl" tar "$tgt" # fails with linkmode not supported
-            go run build.go -tags "${{env.TAGS}}" -goos linux -goarch ppc64le -cc "zig cc -target powerpc64le-linux-musl" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch amd64 -cc "zig cc -target x86_64-linux-musl" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch 386 -cc "zig cc -target x86-linux-musl" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch arm -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch arm64 -cc "zig cc -target aarch64-linux-musl" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch mips -cc "zig cc -target mips-linux-musleabi" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch mipsle -cc "zig cc -target mipsel-linux-musleabi" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch mips64 -cc mips64-linux-gnuabi64-gcc tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch mips64le -cc mips64el-linux-gnuabi64-gcc tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch riscv64 -cc "zig cc -target riscv64-linux-musl" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch s390x -cc "zig cc -target s390x-linux-musl" tar "$tgt"
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch loong64 -cc "zig cc -target loongarch64-linux-musl" tar "$tgt"
+            # go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch ppc64 -cc "zig cc -target powerpc64-linux-musl" tar "$tgt" # fails with linkmode not supported
+            go run build.go -tags "${{env.TAGS_LINUX}}" -goos linux -goarch ppc64le -cc "zig cc -target powerpc64le-linux-musl" tar "$tgt"
           done
         env:
           CGO_ENABLED: "1"
@@ -697,10 +705,10 @@ jobs:
       - name: Package for Debian (CGO)
         run: |
           for tgt in syncthing stdiscosrv strelaysrv ; do
-            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch amd64 -cc "zig cc -target x86_64-linux-musl" deb "$tgt"
-            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch armel -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" deb "$tgt"
-            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch armhf -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" deb "$tgt"
-            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch arm64 -cc "zig cc -target aarch64-linux-musl" deb "$tgt"
+            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS_LINUX}}" -goos linux -goarch amd64 -cc "zig cc -target x86_64-linux-musl" deb "$tgt"
+            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS_LINUX}}" -goos linux -goarch armel -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" deb "$tgt"
+            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS_LINUX}}" -goos linux -goarch armhf -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" deb "$tgt"
+            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS_LINUX}}" -goos linux -goarch arm64 -cc "zig cc -target aarch64-linux-musl" deb "$tgt"
           done
         env:
           BUILD_USER: debian
@@ -879,6 +887,7 @@ jobs:
     env:
       VERSION: ${{ needs.facts.outputs.version }}
       RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
+      RELEASE_GENERATION: ${{ needs.facts.outputs.release-generation }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -892,6 +901,9 @@ jobs:
       # Decide whether packages should go to stable, candidate or nightly
       - name: Prepare packages
         run: |
+          if [[ $RELEASE_KIND == stable && $RELEASE_GENERATION == v2 ]] ; then
+            RELEASE_KIND=stable-v2
+          fi
           mkdir -p packages/syncthing/$RELEASE_KIND
           mv packages/*.deb packages/syncthing/$RELEASE_KIND
 
@@ -982,15 +994,15 @@ jobs:
       - name: Build binaries (CGO)
         run: |
           # amd64
-          go run build.go -goos linux -goarch amd64 -tags "${{env.TAGS}}" -cc "zig cc -target x86_64-linux-musl" -no-upgrade build ${{ matrix.pkg }}
+          go run build.go -goos linux -goarch amd64 -tags "${{env.TAGS_LINUX}}" -cc "zig cc -target x86_64-linux-musl" -no-upgrade build ${{ matrix.pkg }}
           mv ${{ matrix.pkg }} ${{ matrix.pkg }}-linux-amd64
 
           # arm64
-          go run build.go -goos linux -goarch arm64 -tags "${{env.TAGS}}" -cc "zig cc -target aarch64-linux-musl" -no-upgrade build ${{ matrix.pkg }}
+          go run build.go -goos linux -goarch arm64 -tags "${{env.TAGS_LINUX}}" -cc "zig cc -target aarch64-linux-musl" -no-upgrade build ${{ matrix.pkg }}
           mv ${{ matrix.pkg }} ${{ matrix.pkg }}-linux-arm64
 
           # arm
-          go run build.go -goos linux -goarch arm -tags "${{env.TAGS}}" -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" -no-upgrade build ${{ matrix.pkg }}
+          go run build.go -goos linux -goarch arm -tags "${{env.TAGS_LINUX}}" -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" -no-upgrade build ${{ matrix.pkg }}
           mv ${{ matrix.pkg }} ${{ matrix.pkg }}-linux-arm
         env:
           CGO_ENABLED: "1"

.github/workflows/mirrors.yaml

@@ -0,0 +1,18 @@
+name: Mirrors
+
+on: [push, delete]
+
+jobs:
+  codeberg:
+    name: Mirror to Codeberg
+    if: github.repository_owner == 'syncthing'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: yesolutions/mirror-action@master
+        with:
+          REMOTE: ssh://git@codeberg.org/${{ github.repository }}.git
+          GIT_SSH_PRIVATE_KEY: ${{ secrets.CODEBERG_PUSH_KEY }}
+          GIT_SSH_NO_VERIFY_HOST: "true"

build.go

@@ -870,7 +870,6 @@ func testmocks() {
 		"github.com/syncthing/syncthing/lib/connections",
 		"github.com/syncthing/syncthing/lib/discover",
 		"github.com/syncthing/syncthing/lib/events",
-		"github.com/syncthing/syncthing/lib/logger",
 		"github.com/syncthing/syncthing/lib/model",
 		"github.com/syncthing/syncthing/lib/protocol",
 	}

cmd/infra/stcrashreceiver/main.go

@@ -44,7 +44,7 @@ type cli struct {
 	SentryQueue    int    `help:"Maximum number of reports to queue for sending to Sentry" default:"64" env:"SENTRY_QUEUE"`
 	DiskQueue      int    `help:"Maximum number of reports to queue for writing to disk" default:"64" env:"DISK_QUEUE"`
 	MetricsListen  string `help:"HTTP listen address for metrics" default:":8081" env:"METRICS_LISTEN_ADDRESS"`
-	IngorePatterns string `help:"File containing ignore patterns (regexp)" env:"IGNORE_PATTERNS" type:"existingfile"`
+	IgnorePatterns string `help:"File containing ignore patterns (regexp)" env:"IGNORE_PATTERNS" type:"existingfile"`
 }
 
 func main() {
@@ -68,9 +68,9 @@ func main() {
 	go ss.Serve(context.Background())
 
 	var ip *ignorePatterns
-	if params.IngorePatterns != "" {
+	if params.IgnorePatterns != "" {
 		var err error
-		ip, err = loadIgnorePatterns(params.IngorePatterns)
+		ip, err = loadIgnorePatterns(params.IgnorePatterns)
 		if err != nil {
 			log.Fatalf("Failed to load ignore patterns: %v", err)
 		}

cmd/infra/stupgrades/main.go

@@ -138,7 +138,7 @@ func (p *githubReleases) serveReleases(w http.ResponseWriter, req *http.Request)
 	osv := req.Header.Get("Syncthing-Os-Version")
 	if ua != "" && osv != "" {
 		// We should determine the compatibility of the releases.
-		rels = filterForCompabitility(rels, ua, osv)
+		rels = filterForCompatibility(rels, ua, osv)
 	} else {
 		metricFilterCalls.WithLabelValues("no-ua-or-osversion").Inc()
 	}
@@ -224,7 +224,7 @@ func filterForLatest(rels []upgrade.Release) []upgrade.Release {
 
 var userAgentOSArchExp = regexp.MustCompile(`^syncthing.*\(.+ (\w+)-(\w+)\)$`)
 
-func filterForCompabitility(rels []upgrade.Release, ua, osv string) []upgrade.Release {
+func filterForCompatibility(rels []upgrade.Release, ua, osv string) []upgrade.Release {
 	osArch := userAgentOSArchExp.FindStringSubmatch(ua)
 	if len(osArch) != 3 {
 		metricFilterCalls.WithLabelValues("bad-os-arch").Inc()

cmd/syncthing/generate/generate.go

@@ -12,6 +12,7 @@ import (
 	"context"
 	"crypto/tls"
 	"fmt"
+	"log/slog"
 	"os"
 
 	"github.com/syncthing/syncthing/lib/config"
@@ -20,7 +21,6 @@ import (
 	"github.com/syncthing/syncthing/lib/locations"
 	"github.com/syncthing/syncthing/lib/protocol"
 	"github.com/syncthing/syncthing/lib/syncthing"
-	"golang.org/x/exp/slog"
 )
 
 type CLI struct {
@@ -61,15 +61,16 @@ func Generate(confDir, guiUser, guiPassword string, skipPortProbing bool) error
 	certFile, keyFile := locations.Get(locations.CertFile), locations.Get(locations.KeyFile)
 	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
 	if err == nil {
-		slog.Warn("Key exists; will not overwrite.")
+		slog.Warn("Key exists; will not overwrite")
 	} else {
 		cert, err = syncthing.GenerateCertificate(certFile, keyFile)
 		if err != nil {
 			return fmt.Errorf("create certificate: %w", err)
 		}
 	}
+
 	myID = protocol.NewDeviceID(cert.Certificate[0])
-	slog.Info("Genereated new keypair", myID.LogAttr())
+	slog.Info("Calculated device ID", slog.String("device", myID.String()))
 
 	cfgFile := locations.Get(locations.ConfigFile)
 	cfg, _, err := config.Load(cfgFile, myID, events.NoopLogger)

cmd/syncthing/main.go

@@ -155,7 +155,7 @@ type serveCmd struct {
 	Audit                     bool          `help:"Write events to audit file" env:"STAUDIT"`
 	AuditFile                 string        `name:"auditfile" help:"Specify audit file (use \"-\" for stdout, \"--\" for stderr)" placeholder:"PATH" env:"STAUDITFILE"`
 	DBMaintenanceInterval     time.Duration `help:"Database maintenance interval" default:"8h" env:"STDBMAINTENANCEINTERVAL"`
-	DBDeleteRetentionInterval time.Duration `help:"Database deleted item retention interval" default:"4320h" env:"STDBDELETERETENTIONINTERVAL"`
+	DBDeleteRetentionInterval time.Duration `help:"Database deleted item retention interval" default:"10920h" env:"STDBDELETERETENTIONINTERVAL"`
 	GUIAddress                string        `name:"gui-address" help:"Override GUI address (e.g. \"http://192.0.2.42:8443\")" placeholder:"URL" env:"STGUIADDRESS"`
 	GUIAPIKey                 string        `name:"gui-apikey" help:"Override GUI API key" placeholder:"API-KEY" env:"STGUIAPIKEY"`
 	LogFile                   string        `name:"log-file" aliases:"logfile" help:"Log file name (see below)" default:"${logFile}" placeholder:"PATH" env:"STLOGFILE"`
@@ -868,12 +868,16 @@ func (u upgradeCmd) Run() error {
 		lf := flock.New(locations.Get(locations.LockFile))
 		var locked bool
 		locked, err = lf.TryLock()
-		if err != nil {
+		// ErrNotExist is a valid error if this is a new/blank installation
+		// without a config dir, in which case we can proceed with a normal
+		// non-API upgrade.
+		switch {
+		case err != nil && !os.IsNotExist(err):
 			slog.Error("Failed to lock for upgrade", slogutil.Error(err))
 			os.Exit(1)
-		} else if locked {
+		case locked:
 			err = upgradeViaRest()
-		} else {
+		default:
 			err = upgrade.To(release)
 		}
 	}

etc/linux-desktop/syncthing-ui.desktop

@@ -2,7 +2,7 @@
 Name=Syncthing Web UI
 GenericName=File synchronization UI
 Comment=Opens Syncthing's Web UI in the default browser (Syncthing must already be started).
-Exec=syncthing --browser-only
+Exec=syncthing browser
 Icon=syncthing
 Terminal=false
 Type=Application

go.mod

@@ -1,12 +1,12 @@
 module github.com/syncthing/syncthing
 
-go 1.23.0
+go 1.24.0
 
 require (
-	github.com/AudriusButkevicius/recli v0.0.7-0.20220911121932-d000ce8fbf0f
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1
-	github.com/alecthomas/kong v1.11.0
-	github.com/aws/aws-sdk-go v1.55.7
+	github.com/AudriusButkevicius/recli v0.0.7
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2
+	github.com/alecthomas/kong v1.12.1
+	github.com/aws/aws-sdk-go v1.55.8
 	github.com/calmh/incontainer v1.0.0
 	github.com/calmh/xdr v1.2.0
 	github.com/ccding/go-stun v0.1.5
@@ -23,50 +23,50 @@ require (
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/maruel/panicparse/v2 v2.5.0
-	github.com/mattn/go-sqlite3 v1.14.28
-	github.com/maxbrunsfeld/counterfeiter/v6 v6.11.2
+	github.com/mattn/go-sqlite3 v1.14.31
+	github.com/maxbrunsfeld/counterfeiter/v6 v6.11.3
 	github.com/maxmind/geoipupdate/v6 v6.1.0
 	github.com/miscreant/miscreant.go v0.0.0-20200214223636-26d376326b75
-	github.com/oschwald/geoip2-golang v1.11.0
+	github.com/oschwald/geoip2-golang v1.13.0
 	github.com/pierrec/lz4/v4 v4.1.22
-	github.com/prometheus/client_golang v1.22.0
+	github.com/prometheus/client_golang v1.23.0
 	github.com/puzpuzpuz/xsync/v3 v3.5.1
 	github.com/quic-go/quic-go v0.52.0
 	github.com/rabbitmq/amqp091-go v1.10.0
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9
-	github.com/shirou/gopsutil/v4 v4.25.4
+	github.com/shirou/gopsutil/v4 v4.25.7
 	github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d
 	github.com/thejerf/suture/v4 v4.0.6
-	github.com/urfave/cli v1.22.16
+	github.com/urfave/cli v1.22.17
 	github.com/vitrun/qart v0.0.0-20160531060029-bf64b92db6b0
 	github.com/willabides/kongplete v0.4.0
 	github.com/wlynxg/anet v0.0.5
 	go.uber.org/automaxprocs v1.6.0
-	golang.org/x/crypto v0.38.0
-	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
-	golang.org/x/net v0.40.0
-	golang.org/x/sys v0.33.0
-	golang.org/x/text v0.25.0
-	golang.org/x/time v0.11.0
-	golang.org/x/tools v0.33.0
-	google.golang.org/protobuf v1.36.6
-	modernc.org/sqlite v1.37.0
-	sigs.k8s.io/yaml v1.4.0
+	golang.org/x/crypto v0.41.0
+	golang.org/x/exp v0.0.0-20250811191247-51f88131bc50
+	golang.org/x/net v0.43.0
+	golang.org/x/sys v0.35.0
+	golang.org/x/text v0.28.0
+	golang.org/x/time v0.12.0
+	golang.org/x/tools v0.36.0
+	google.golang.org/protobuf v1.36.7
+	modernc.org/sqlite v1.38.2
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/certifi/gocertifi v0.0.0-20210507211836-431795d63e8d // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.8.3 // indirect
+	github.com/ebitengine/purego v0.8.4 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
@@ -88,28 +88,29 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/posener/complete v1.2.3 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/riywo/loginshell v0.0.0-20200815045211-7d26008be1ab // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/stretchr/testify v1.10.0 // indirect
-	github.com/tklauser/go-sysconf v0.3.14 // indirect
-	github.com/tklauser/numcpus v0.9.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.15 // indirect
+	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.uber.org/mock v0.5.2 // indirect
-	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/sync v0.14.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.62.1 // indirect
+	modernc.org/libc v1.66.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.9.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )
 
 // https://github.com/gobwas/glob/pull/55
 replace github.com/gobwas/glob v0.2.3 => github.com/calmh/glob v0.0.0-20220615080505-1d823af5017b
 
 // https://github.com/mattn/go-sqlite3/pull/1338
-replace github.com/mattn/go-sqlite3 v1.14.28 => github.com/calmh/go-sqlite3 v1.14.29-0.20250520105817-2e94cda3f7f8
+replace github.com/mattn/go-sqlite3 v1.14.31 => github.com/calmh/go-sqlite3 v1.14.32-0.20250812195006-80712c77b76a

go.sum

@@ -1,38 +1,38 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/AudriusButkevicius/recli v0.0.7-0.20220911121932-d000ce8fbf0f h1:GmH5lT+moM7PbAJFBq57nH9WJ+wRnBXr/tyaYWbSAx8=
-github.com/AudriusButkevicius/recli v0.0.7-0.20220911121932-d000ce8fbf0f/go.mod h1:Nhfib1j/VFnLrXL9cHgA+/n2O6P5THuWelOnbfPNd78=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 h1:Gt0j3wceWMwPmiazCa8MzMA0MfhmPIz0Qp0FJ6qcM0U=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0/go.mod h1:Ot/6aikWnKWi4l9QB7qVSwa8iMphQNqkWALMoNT3rzM=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0 h1:OVoM452qUFBrX+URdH3VpR299ma4kfom0yB0URYky9g=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0/go.mod h1:kUjrAo8bgEwLeZ/CmHqNl3Z/kPm7y6FKfxxK0izYUg4=
+github.com/AudriusButkevicius/recli v0.0.7 h1:9zjbYlTupi+W5SJXm2cR2sV2mJAIg1sIfDcsW7hrkPM=
+github.com/AudriusButkevicius/recli v0.0.7/go.mod h1:Nhfib1j/VFnLrXL9cHgA+/n2O6P5THuWelOnbfPNd78=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.1 h1:Wc1ml6QlJs2BHQ/9Bqu1jiyggbsSjramq2oUmp5WeIo=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.1/go.mod h1:Ot/6aikWnKWi4l9QB7qVSwa8iMphQNqkWALMoNT3rzM=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1 h1:B+blDbyVIG3WaikNxPnhPiJ1MThR03b3vKGtER95TP4=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1/go.mod h1:JdM5psgjfBf5fo2uWOZhflPWyDBZ/O/CNAH9CtsuZE4=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 h1:FPKJS1T+clwv+OLGt13a8UjqeRuh0O4SJ3lUriThc+4=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1/go.mod h1:j2chePtV91HrC22tGoRX3sGY42uF13WzmmV80/OdVAA=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.0 h1:LR0kAX9ykz8G4YgLCaRDVJ3+n43R8MneB5dTy2konZo=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.0/go.mod h1:DWAciXemNf++PQJLeXUB4HHH5OpsAh12HZnu2wXE1jA=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1 h1:lhZdRq7TIx0GJQvSyX2Si406vrYsov2FXGp/RnSEtcs=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1/go.mod h1:8cl44BDmi+effbARHMQjgOKA2AYvcohNm7KEt42mSV8=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 h1:/Zt+cDPnpC3OVDm/JKLOs7M2DKmLRIIp3XIx9pHHiig=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1/go.mod h1:Ng3urmn6dYe8gnbCMoHHVl5APYz2txho3koEkV2o2HA=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2 h1:FwladfywkNirM+FZYLBR2kBz5C8Tg0fw5w5Y7meRXWI=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2/go.mod h1:vv5Ad0RrIoT1lJFdWBZwt4mB1+j+V8DUroixmKDTCdk=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
-github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/kong v1.11.0 h1:y++1gI7jf8O7G7l4LZo5ASFhrhJvzc+WgF/arranEmM=
-github.com/alecthomas/kong v1.11.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
+github.com/alecthomas/kong v1.12.1 h1:iq6aMJDcFYP9uFrLdsiZQ2ZMmcshduyGv4Pek0MQPW0=
+github.com/alecthomas/kong v1.12.1/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
-github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
-github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
+github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/calmh/glob v0.0.0-20220615080505-1d823af5017b h1:Fjm4GuJ+TGMgqfGHN42IQArJb77CfD/mAwLbDUoJe6g=
 github.com/calmh/glob v0.0.0-20220615080505-1d823af5017b/go.mod h1:91K7jfEsgJSyfSrX+gmrRfZMtntx6JsHolWubGXDopg=
-github.com/calmh/go-sqlite3 v1.14.29-0.20250520105817-2e94cda3f7f8 h1:oNVrBJGXkD334ToEmxJz8G6LhzD1/sMA4twMHsMLzQo=
-github.com/calmh/go-sqlite3 v1.14.29-0.20250520105817-2e94cda3f7f8/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/calmh/go-sqlite3 v1.14.32-0.20250812195006-80712c77b76a h1:lTe5qJApKNO+zZCa3/P/7UxM4c58CXWOegv9eODPWvs=
+github.com/calmh/go-sqlite3 v1.14.32-0.20250812195006-80712c77b76a/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/calmh/incontainer v1.0.0 h1:g2cTUtZuFGmMGX8GoykPkN1Judj2uw8/3/aEtq4Z/rg=
 github.com/calmh/incontainer v1.0.0/go.mod h1:eOhqnw15c9X+4RNBe0W3HlUZFfX16O0EDsCOInTndHY=
 github.com/calmh/xdr v1.2.0 h1:GaGSNH4ZDw9kNdYqle6+RcAENiaQ8/611Ok+jQbBEeU=
@@ -50,8 +50,8 @@ github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5P
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
-github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/d4l3k/messagediff v1.2.1 h1:ZcAIMYsUg0EAp9X+tt8/enBE/Q8Yd5kzPynLyKptt9U=
 github.com/d4l3k/messagediff v1.2.1/go.mod h1:Oozbb1TVXFac9FtSIxHBMnBCq2qeH/2KkEQxENCrlLo=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -59,8 +59,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.8.3 h1:K+0AjQp63JEZTEMZiwsI9g0+hAMNohwUOtY0RPGexmc=
-github.com/ebitengine/purego v0.8.3/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
+github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
@@ -85,8 +85,8 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.2.3 h1:kkGXqQOBSDDWRhWNXTFpqGSCMyh/PLnqUvMGJPDJDs0=
+github.com/golang-jwt/jwt/v5 v5.2.3/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
@@ -102,7 +102,6 @@ github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -168,8 +167,8 @@ github.com/maruel/panicparse/v2 v2.5.0/go.mod h1:DA2fDiBk63bKfBf4CVZP9gb4fuvzdPb
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/maxbrunsfeld/counterfeiter/v6 v6.11.2 h1:yVCLo4+ACVroOEr4iFU1iH46Ldlzz2rTuu18Ra7M8sU=
-github.com/maxbrunsfeld/counterfeiter/v6 v6.11.2/go.mod h1:VzB2VoMh1Y32/QqDfg9ZJYHj99oM4LiGtqPZydTiQSQ=
+github.com/maxbrunsfeld/counterfeiter/v6 v6.11.3 h1:Eaq36EIyJNp7b3qDhjV7jmDVq/yPeW2v4pTqzGbOGB4=
+github.com/maxbrunsfeld/counterfeiter/v6 v6.11.3/go.mod h1:6KKUoQBZBW6PDXJtNfqeEjPXMj/ITTk+cWK9t9uS5+E=
 github.com/maxmind/geoipupdate/v6 v6.1.0 h1:sdtTHzzQNJlXF5+fd/EoPTucRHyMonYt/Cok8xzzfqA=
 github.com/maxmind/geoipupdate/v6 v6.1.0/go.mod h1:cZYCDzfMzTY4v6dKRdV7KTB6SStxtn3yFkiJ1btTGGc=
 github.com/miscreant/miscreant.go v0.0.0-20200214223636-26d376326b75 h1:cUVxyR+UfmdEAZGJ8IiKld1O0dbGotEnkMolG5hfMSY=
@@ -194,10 +193,10 @@ github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7J
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
 github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
-github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
-github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
-github.com/oschwald/geoip2-golang v1.11.0 h1:hNENhCn1Uyzhf9PTmquXENiWS6AlxAEnBII6r8krA3w=
-github.com/oschwald/geoip2-golang v1.11.0/go.mod h1:P9zG+54KPEFOliZ29i7SeYZ/GM6tfEL+rgSn03hYuUo=
+github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
+github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/oschwald/geoip2-golang v1.13.0 h1:Q44/Ldc703pasJeP5V9+aFSZFmBN7DKHbNsSFzQATJI=
+github.com/oschwald/geoip2-golang v1.13.0/go.mod h1:P9zG+54KPEFOliZ29i7SeYZ/GM6tfEL+rgSn03hYuUo=
 github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5MbwsmL4MRQE=
 github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
 github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
@@ -215,14 +214,14 @@ github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/puzpuzpuz/xsync/v3 v3.5.1 h1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=
 github.com/puzpuzpuz/xsync/v3 v3.5.1/go.mod h1:VjzYrABPabuM4KyBh1Ftq6u8nhwY5tBPKP9jpmh0nnA=
 github.com/quic-go/quic-go v0.52.0 h1:/SlHrCRElyaU6MaEPKqKr9z83sBg2v4FLLvWM+Z47pA=
@@ -241,8 +240,8 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sclevine/spec v1.4.0 h1:z/Q9idDcay5m5irkZ28M7PtQM4aOISzOpj4bUPkDee8=
 github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
-github.com/shirou/gopsutil/v4 v4.25.4 h1:cdtFO363VEOOFrUCjZRh4XVJkb548lyF0q0uTeMqYPw=
-github.com/shirou/gopsutil/v4 v4.25.4/go.mod h1:xbuxyoZj+UsgnZrENu3lQivsngRR5BdjbJwf2fv4szA=
+github.com/shirou/gopsutil/v4 v4.25.7 h1:bNb2JuqKuAu3tRlPv5piSmBZyMfecwQ+t/ILq+1JqVM=
+github.com/shirou/gopsutil/v4 v4.25.7/go.mod h1:XV/egmwJtd3ZQjBpJVY5kndsiOO4IRqy9TQnmm6VP7U=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -254,7 +253,6 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465 h1:yhxdTGmFkAM2TFA65c3NgGwpnIkUM8oVqPX2e9S7IVg=
@@ -263,13 +261,13 @@ github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDd
 github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48=
 github.com/thejerf/suture/v4 v4.0.6 h1:QsuCEsCqb03xF9tPAsWAj8QOAJBgQI1c0VqJNaingg8=
 github.com/thejerf/suture/v4 v4.0.6/go.mod h1:gu9Y4dXNUWFrByqRt30Rm9/UZ0wzRSt9AJS6xu/ZGxU=
-github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
-github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
-github.com/tklauser/numcpus v0.9.0 h1:lmyCHtANi8aRUgkckBgoDk1nHCux3n2cgkJLXdQGPDo=
-github.com/tklauser/numcpus v0.9.0/go.mod h1:SN6Nq1O3VychhC1npsWostA+oW+VOQTxZrS604NSRyI=
+github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
+github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
+github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
+github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
 github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
-github.com/urfave/cli v1.22.16 h1:MH0k6uJxdwdeWQTwhSO42Pwr4YLrNLwBtg1MRgTqPdQ=
-github.com/urfave/cli v1.22.16/go.mod h1:EeJR6BKodywf4zciqrdw6hpCPk68JO9z5LazXZMn5Po=
+github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
+github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo=
 github.com/vitrun/qart v0.0.0-20160531060029-bf64b92db6b0 h1:okhMind4q9H1OxF44gNegWkiP4H/gsTFLalHFa4OOUI=
 github.com/vitrun/qart v0.0.0-20160531060029-bf64b92db6b0/go.mod h1:TTbGUfE+cXXceWtbTHq6lqcTvYPBKLNejBEbnUsQJtU=
 github.com/willabides/kongplete v0.4.0 h1:eivXxkp5ud5+4+NVN9e4goxC5mSh3n1RHov+gsblM2g=
@@ -285,16 +283,20 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
 go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
-golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
-golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
-golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/exp v0.0.0-20250811191247-51f88131bc50 h1:3yiSh9fhy5/RhCSntf4Sy0Tnx50DmMpQ4MQdKKk4yg4=
+golang.org/x/exp v0.0.0-20250811191247-51f88131bc50/go.mod h1:rT6SFzZ7oxADUDx58pcaKFTcZ+inxAa9fTrYx/uVYwg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -303,13 +305,13 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
-golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
-golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180926160741-c2ed4eda69e7/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -332,23 +334,23 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
-golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
-golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
-golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
-golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -362,8 +364,8 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
+google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -379,29 +381,31 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.25.2 h1:T2oH7sZdGvTaie0BRNFbIYsabzCxUQg8nLqCdQ2i0ic=
-modernc.org/cc/v4 v4.25.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.25.1 h1:TFSzPrAGmDsdnhT9X2UrcPMI3N/mJ9/X9ykKXwLhDsU=
-modernc.org/ccgo/v4 v4.25.1/go.mod h1:njjuAYiPflywOOrm3B7kCB444ONP5pAVr8PIEoE0uDw=
-modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
-modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
+modernc.org/cc/v4 v4.26.2 h1:991HMkLjJzYBIfha6ECZdjrIYz2/1ayr+FL8GN+CNzM=
+modernc.org/cc/v4 v4.26.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
+modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
+modernc.org/fileutil v1.3.8 h1:qtzNm7ED75pd1C7WgAGcK4edm4fvhtBsEiI/0NQ54YM=
+modernc.org/fileutil v1.3.8/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/libc v1.62.1 h1:s0+fv5E3FymN8eJVmnk0llBe6rOxCu/DEU+XygRbS8s=
-modernc.org/libc v1.62.1/go.mod h1:iXhATfJQLjG3NWy56a6WVU73lWOcdYVxsvwCgoPljuo=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.66.3 h1:cfCbjTUcdsKyyZZfEUKfoHcP3S0Wkvz3jgSzByEWVCQ=
+modernc.org/libc v1.66.3/go.mod h1:XD9zO8kt59cANKvHPXpx7yS2ELPheAey0vjIuZOhOU8=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.9.1 h1:V/Z1solwAVmMW1yttq3nDdZPJqV1rM05Ccq6KMSZ34g=
-modernc.org/memory v1.9.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.37.0 h1:s1TMe7T3Q3ovQiK2Ouz4Jwh7dw4ZDqbebSDTlSJdfjI=
-modernc.org/sqlite v1.37.0/go.mod h1:5YiWv+YviqGMuGw4V+PNplcyaJ5v+vQd7TQOgkACoJM=
+modernc.org/sqlite v1.38.2 h1:Aclu7+tgjgcQVShZqim41Bbw9Cho0y/7WzYptXqkEek=
+modernc.org/sqlite v1.38.2/go.mod h1:cPTJYSlgg3Sfg046yBShXENNtPrWrDX8bsbAQBzgQ5E=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

gui/default/assets/lang/lang-en.json

@@ -82,6 +82,7 @@
     "Custom Range": "Custom Range",
     "Danger!": "Danger!",
     "Database Location": "Database Location",
+    "Debug": "Debug",
     "Debugging Facilities": "Debugging Facilities",
     "Default": "Default",
     "Default Configuration": "Default Configuration",
@@ -210,6 +211,7 @@
     "Incoming Rate Limit (KiB/s)": "Incoming Rate Limit (KiB/s)",
     "Incorrect configuration may damage your folder contents and render Syncthing inoperable.": "Incorrect configuration may damage your folder contents and render Syncthing inoperable.",
     "Incorrect user name or password.": "Incorrect user name or password.",
+    "Info": "Info",
     "Internally used paths:": "Internally used paths:",
     "Introduced By": "Introduced By",
     "Introducer": "Introducer",

gui/default/index.html

@@ -108,27 +108,23 @@
               <li><a href="" ng-click="about.show()"><span class="fa fa-fw fa-heart"></span>&nbsp;<span translate>About</span></a></li>
             </ul>
           </li>
-          <li ng-if="authenticated || config.gui.debugging" class="dropdown action-menu">
+          <li ng-if="authenticated" class="dropdown action-menu">
             <a href="#" class="dropdown-toggle" data-toggle="dropdown" aria-expanded="false">
               <span class="fa fa-cog"></span>
               <span class="hidden-xs" translate>Actions</span>
               <span class="caret"></span>
             </a>
             <ul class="dropdown-menu">
-              <li ng-if="authenticated"><a href="" ng-click="showSettings()"><span class="fa fa-fw fa-cog"></span>&nbsp;<span translate>Settings</span></a></li>
-              <li ng-if="authenticated"><a href="" ng-click="showDeviceIdentification(thisDevice())"><span class="fa fa-fw fa-qrcode"></span>&nbsp;<span translate>Show ID</span></a></li>
-
-              <li ng-if="authenticated" class="divider" aria-hidden="true"></li>
-              <li ng-if="authenticated"><a href="" ng-click="advanced()"><span class="fa fa-fw fa-cogs"></span>&nbsp;<span translate>Advanced</span></a></li>
-              <li ng-if="authenticated"><a href="" ng-click="logging.show()"><span class="fa fa-fw fa-wrench"></span>&nbsp;<span translate>Logs</span></a></li>
-
-              <li class="divider" aria-hidden="true" ng-if="config.gui.debugging"></li>
-              <li><a href="/rest/debug/support" target="_blank" ng-if="config.gui.debugging"><span class="fa fa-fw fa-user-md"></span>&nbsp;<span translate>Support Bundle</span></a></li>
-
-              <li ng-if="authenticated" class="divider" aria-hidden="true"></li>
-              <li ng-if="authenticated && isAuthEnabled()"><a href="" ng-click="logout()"><span class="far fa-fw fa-sign-out"></span>&nbsp;<span translate>Log Out</span></a></li>
-              <li ng-if="authenticated"><a href="" ng-click="restart()"><span class="fa fa-fw fa-refresh"></span>&nbsp;<span translate>Restart</span></a></li>
-              <li ng-if="authenticated"><a href="" ng-click="shutdown()"><span class="fa fa-fw fa-power-off"></span>&nbsp;<span translate>Shut Down</span></a></li>
+              <li><a href="" ng-click="showSettings()"><span class="fa fa-fw fa-cog"></span>&nbsp;<span translate>Settings</span></a></li>
+              <li><a href="" ng-click="advanced()"><span class="fa fa-fw fa-cogs"></span>&nbsp;<span translate>Advanced</span></a></li>
+              <li class="divider" aria-hidden="true"></li>
+              <li><a href="" ng-click="showDeviceIdentification(thisDevice())"><span class="fa fa-fw fa-qrcode"></span>&nbsp;<span translate>Show ID</span></a></li>
+              <li><a href="" ng-click="logging.show()"><span class="fa fa-fw fa-wrench"></span>&nbsp;<span translate>Logs</span></a></li>
+              <li><a href="/rest/debug/support" target="_blank"><span class="fa fa-fw fa-user-md"></span>&nbsp;<span translate>Support Bundle</span></a></li>
+              <li class="divider" aria-hidden="true"></li>
+              <li ng-if="isAuthEnabled()"><a href="" ng-click="logout()"><span class="far fa-fw fa-sign-out"></span>&nbsp;<span translate>Log Out</span></a></li>
+              <li><a href="" ng-click="restart()"><span class="fa fa-fw fa-refresh"></span>&nbsp;<span translate>Restart</span></a></li>
+              <li><a href="" ng-click="shutdown()"><span class="fa fa-fw fa-power-off"></span>&nbsp;<span translate>Shut Down</span></a></li>
             </ul>
           </li>
         </ul>

gui/default/syncthing/core/modalDirective.js

@@ -27,7 +27,7 @@ angular.module('syncthing.core')
                 // before modal show animation
                 $(element).on('show.bs.modal', function () {
 
-                    // cycle through open modals, acertain modal with highest z-index
+                    // cycle through open modals, ascertain modal with highest z-index
                     var largestZ = 1040;
                     $('.modal:visible').each(function (i) {
                         var thisZ = parseInt($(this).css('zIndex'));

internal/db/sqlite/basedb.go

@@ -10,6 +10,7 @@ import (
 	"database/sql"
 	"embed"
 	"io/fs"
+	"net/url"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -44,7 +45,12 @@ type baseDB struct {
 func openBase(path string, maxConns int, pragmas, schemaScripts, migrationScripts []string) (*baseDB, error) {
 	// Open the database with options to enable foreign keys and recursive
 	// triggers (needed for the delete+insert triggers on row replace).
-	sqlDB, err := sqlx.Open(dbDriver, "file:"+path+"?"+commonOptions)
+	pathURL := url.URL{
+		Scheme:   "file",
+		Path:     fileToUriPath(path),
+		RawQuery: commonOptions,
+	}
+	sqlDB, err := sqlx.Open(dbDriver, pathURL.String())
 	if err != nil {
 		return nil, wrap(err)
 	}
@@ -110,6 +116,16 @@ func openBase(path string, maxConns int, pragmas, schemaScripts, migrationScript
 	return db, nil
 }
 
+func fileToUriPath(path string) string {
+	path = filepath.ToSlash(path)
+	if (build.IsWindows && len(path) >= 2 && path[1] == ':') ||
+		(strings.HasPrefix(path, "//") && !strings.HasPrefix(path, "///")) {
+		// Add an extra leading slash for Windows drive letter or UNC path
+		path = "/" + path
+	}
+	return path
+}
+
 func (s *baseDB) Close() error {
 	s.updateLock.Lock()
 	s.statementsMut.Lock()

internal/db/sqlite/db_open.go

@@ -17,14 +17,17 @@ import (
 	"github.com/syncthing/syncthing/internal/slogutil"
 )
 
-const maxDBConns = 16
+const (
+	maxDBConns         = 16
+	minDeleteRetention = 24 * time.Hour
+)
 
 type DB struct {
+	*baseDB
+
 	pathBase        string
 	deleteRetention time.Duration
 
-	*baseDB
-
 	folderDBsMut   sync.RWMutex
 	folderDBs      map[string]*folderDB
 	folderDBOpener func(folder, path string, deleteRetention time.Duration) (*folderDB, error)
@@ -36,7 +39,11 @@ type Option func(*DB)
 
 func WithDeleteRetention(d time.Duration) Option {
 	return func(s *DB) {
-		s.deleteRetention = d
+		if d <= 0 {
+			s.deleteRetention = 0
+		} else {
+			s.deleteRetention = max(d, minDeleteRetention)
+		}
 	}
 }
 

internal/db/sqlite/db_service.go

@@ -19,10 +19,8 @@ import (
 )
 
 const (
-	internalMetaPrefix     = "dbsvc"
-	lastMaintKey           = "lastMaint"
-	defaultDeleteRetention = 180 * 24 * time.Hour
-	minDeleteRetention     = 24 * time.Hour
+	internalMetaPrefix = "dbsvc"
+	lastMaintKey       = "lastMaint"
 )
 
 func (s *DB) Service(maintenanceInterval time.Duration) suture.Service {

internal/db/sqlite/db_test.go

@@ -12,6 +12,8 @@ import (
 	"encoding/binary"
 	"errors"
 	"iter"
+	"os"
+	"path"
 	"path/filepath"
 	"sync"
 	"testing"
@@ -20,6 +22,7 @@ import (
 	"github.com/syncthing/syncthing/internal/db"
 	"github.com/syncthing/syncthing/internal/itererr"
 	"github.com/syncthing/syncthing/internal/timeutil"
+	"github.com/syncthing/syncthing/lib/build"
 	"github.com/syncthing/syncthing/lib/config"
 	"github.com/syncthing/syncthing/lib/protocol"
 )
@@ -1157,6 +1160,47 @@ func TestStrangeDeletedGlobalBug(t *testing.T) {
 	}
 }
 
+func TestOpenSpecialName(t *testing.T) {
+	dir := t.TempDir()
+
+	// Create a "base" dir that is in the way if the path becomes
+	// incorrectly truncated in the next steps.
+	base := path.Join(dir, "test")
+	if err := os.Mkdir(base, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	// Should be able to open a path with a hash sign in it.
+	p1 := base + "#foo"
+	db, err := Open(p1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Log(db.path)
+	db.Close()
+
+	if !build.IsWindows {
+		// Should be able to open a path with something that looks like
+		// query params.
+		p2 := base + "?foo=bar"
+		db, err = Open(p2)
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Log(db.path)
+		db.Close()
+	}
+
+	// Better not a have problem with a single ampersand either.
+	p2 := base + "&foo"
+	db, err = Open(p2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Log(db.path)
+	db.Close()
+}
+
 func mustCollect[T any](t *testing.T) func(it iter.Seq[T], errFn func() error) []T {
 	t.Helper()
 	return func(it iter.Seq[T], errFn func() error) []T {

internal/db/sqlite/sql/schema/folder/20-files.sql

@@ -12,7 +12,7 @@
 -- version of each file is considered the "global" version - the latest one,
 -- that all other devices strive to replicate. This instance gets the Global
 -- flag bit set. There may be other identical instances of this file
--- announced by other devices, but only one onstance gets the Global flag;
+-- announced by other devices, but only one instance gets the Global flag;
 -- this simplifies accounting. If the current device has the Global version,
 -- the LocalDeviceID instance of the file is the one that has the Global
 -- bit.

internal/slogutil/formatting.go

@@ -116,6 +116,7 @@ func expandAttrs(prefix string, a slog.Attr) []slog.Attr {
 }
 
 func appendAttr(sb *strings.Builder, prefix string, a slog.Attr, attrCount *int) {
+	const confusables = ` "()[]{},`
 	if a.Key == "" {
 		return
 	}
@@ -127,7 +128,7 @@ func appendAttr(sb *strings.Builder, prefix string, a slog.Attr, attrCount *int)
 	sb.WriteString(a.Key)
 	sb.WriteRune('=')
 	v := a.Value.Resolve().String()
-	if strings.ContainsAny(v, ` "()`) {
+	if v == "" || strings.ContainsAny(v, confusables) {
 		v = strconv.Quote(v)
 	}
 	sb.WriteString(v)

internal/slogutil/formatting_test.go

@@ -24,6 +24,7 @@ func TestFormattingHandler(t *testing.T) {
 	l := slog.New(h).With("a", "a")
 	l.Info("A basic info line", "attr1", "val with spaces", "attr2", 2, "attr3", `val"quote`)
 	l.Info("A basic info line", "attr1", "paren)thesis")
+	l.Info("An info line with an empty value", "attr1", "")
 	l.Info("An info line with grouped values", "attr1", "val1", slog.Group("foo", "attr2", 2, slog.Group("bar", "attr3", "3")))
 
 	l2 := l.WithGroup("foo")
@@ -39,6 +40,7 @@ func TestFormattingHandler(t *testing.T) {
 	exp := `
 2009-02-13 23:31:30 INF A basic info line (attr1="val with spaces" attr2=2 attr3="val\"quote" a=a log.pkg=slogutil)
 2009-02-13 23:31:30 INF A basic info line (attr1="paren)thesis" a=a log.pkg=slogutil)
+2009-02-13 23:31:30 INF An info line with an empty value (attr1="" a=a log.pkg=slogutil)
 2009-02-13 23:31:30 INF An info line with grouped values (attr1=val1 foo.attr2=2 foo.bar.attr3=3 a=a log.pkg=slogutil)
 2009-02-13 23:31:30 INF An info line with grouped values via logger (foo.attr1=val1 foo.attr2=2 a=a log.pkg=slogutil)
 2009-02-13 23:31:30 INF An info line with nested grouped values via logger (bar.foo.attr1=val1 bar.foo.attr2=2 a=a log.pkg=slogutil)

lib/api/api.go

@@ -36,7 +36,6 @@ import (
 	"github.com/calmh/incontainer"
 	"github.com/julienschmidt/httprouter"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
-	"github.com/rcrowley/go-metrics"
 	"github.com/thejerf/suture/v4"
 	"github.com/vitrun/qart/qr"
 	"golang.org/x/text/runes"
@@ -336,16 +335,14 @@ func (s *service) Serve(ctx context.Context) error {
 
 	// Debug endpoints, not for general use
 	debugMux := http.NewServeMux()
-	debugMux.HandleFunc("/rest/debug/peerCompletion", s.getPeerCompletion)
-	debugMux.HandleFunc("/rest/debug/httpmetrics", s.getSystemHTTPMetrics)
 	debugMux.HandleFunc("/rest/debug/cpuprof", s.getCPUProf) // duration
 	debugMux.HandleFunc("/rest/debug/heapprof", s.getHeapProf)
 	debugMux.HandleFunc("/rest/debug/support", s.getSupportBundle)
 	debugMux.HandleFunc("/rest/debug/file", s.getDebugFile)
-	restMux.Handler(http.MethodGet, "/rest/debug/*method", s.whenDebugging(debugMux))
+	restMux.Handler(http.MethodGet, "/rest/debug/*method", debugMux)
 
 	// A handler that disables caching
-	noCacheRestMux := noCacheMiddleware(metricsMiddleware(restMux))
+	noCacheRestMux := noCacheMiddleware(restMux)
 
 	// The main routing handler
 	mux := http.NewServeMux()
@@ -489,9 +486,6 @@ func (*service) VerifyConfiguration(_, to config.Configuration) error {
 }
 
 func (s *service) CommitConfiguration(from, to config.Configuration) bool {
-	// No action required when this changes, so mask the fact that it changed at all.
-	from.GUI.Debugging = to.GUI.Debugging
-
 	if to.GUI == from.GUI {
 		// No GUI changes, we're done here.
 		return true
@@ -594,15 +588,6 @@ func corsMiddleware(next http.Handler, allowFrameLoading bool) http.Handler {
 	})
 }
 
-func metricsMiddleware(h http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		t := metrics.GetOrRegisterTimer(r.URL.Path, nil)
-		t0 := time.Now()
-		h.ServeHTTP(w, r)
-		t.UpdateSince(t0)
-	})
-}
-
 func redirectToHTTPSMiddleware(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.TLS == nil {
@@ -644,17 +629,6 @@ func localhostMiddleware(h http.Handler) http.Handler {
 	})
 }
 
-func (s *service) whenDebugging(h http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if s.cfg.GUI().Debugging {
-			h.ServeHTTP(w, r)
-			return
-		}
-
-		http.Error(w, "Debugging disabled", http.StatusForbidden)
-	})
-}
-
 func (s *service) getPendingDevices(w http.ResponseWriter, _ *http.Request) {
 	devices, err := s.model.PendingDevices()
 	if err != nil {
@@ -1284,26 +1258,6 @@ func (s *service) getSupportBundle(w http.ResponseWriter, r *http.Request) {
 	io.Copy(w, &zipFilesBuffer)
 }
 
-func (*service) getSystemHTTPMetrics(w http.ResponseWriter, _ *http.Request) {
-	stats := make(map[string]interface{})
-	metrics.Each(func(name string, intf interface{}) {
-		if m, ok := intf.(*metrics.StandardTimer); ok {
-			pct := m.Percentiles([]float64{0.50, 0.95, 0.99})
-			for i := range pct {
-				pct[i] /= 1e6 // ns to ms
-			}
-			stats[name] = map[string]interface{}{
-				"count":         m.Count(),
-				"sumMs":         m.Sum() / 1e6, // ns to ms
-				"ratesPerS":     []float64{m.Rate1(), m.Rate5(), m.Rate15()},
-				"percentilesMs": pct,
-			}
-		}
-	})
-	bs, _ := json.MarshalIndent(stats, "", "  ")
-	w.Write(bs)
-}
-
 func (s *service) getSystemDiscovery(w http.ResponseWriter, _ *http.Request) {
 	devices := make(map[string]discover.CacheEntry)
 
@@ -1628,35 +1582,6 @@ func (*service) getQR(w http.ResponseWriter, r *http.Request) {
 	w.Write(code.PNG())
 }
 
-func (s *service) getPeerCompletion(w http.ResponseWriter, _ *http.Request) {
-	tot := map[string]float64{}
-	count := map[string]float64{}
-
-	for _, folder := range s.cfg.Folders() {
-		for _, device := range folder.DeviceIDs() {
-			deviceStr := device.String()
-			if s.model.ConnectedTo(device) {
-				comp, err := s.model.Completion(device, folder.ID)
-				if err != nil {
-					http.Error(w, err.Error(), http.StatusInternalServerError)
-					return
-				}
-				tot[deviceStr] += comp.CompletionPct
-			} else {
-				tot[deviceStr] = 0
-			}
-			count[deviceStr]++
-		}
-	}
-
-	comp := map[string]int{}
-	for device := range tot {
-		comp[device] = int(tot[device] / count[device])
-	}
-
-	sendJSON(w, comp)
-}
-
 func (s *service) getFolderVersions(w http.ResponseWriter, r *http.Request) {
 	qs := r.URL.Query()
 	versions, err := s.model.GetFolderVersions(qs.Get("folder"))

lib/api/api_test.go

@@ -888,7 +888,7 @@ func TestHtmlFormLogin(t *testing.T) {
 				t.Errorf("Unexpected non-200 return code %d at %s", resp.StatusCode, noAuthPath)
 			}
 			if hasSessionCookie(resp.Cookies()) {
-				t.Errorf("Unexpected session cookie at " + noAuthPath)
+				t.Errorf("Unexpected session cookie at %s", noAuthPath)
 			}
 		})
 	}

lib/build/build.go

@@ -49,8 +49,8 @@ var (
 	replaceTags = map[string]string{
 		"sqlite_omit_load_extension": "",
 		"sqlite_dbstat":              "",
-		"osusergo":                   "",
 		"netgo":                      "",
+		"osusergo":                   "",
 	}
 )
 
@@ -134,6 +134,7 @@ func TagsList() []string {
 		tags = tags[1:]
 	}
 
+	tags = slices.Compact(tags)
 	return tags
 }
 

lib/build/parse.go

@@ -49,7 +49,7 @@ func (v VersionParts) Environment() string {
 func ParseVersion(line string) (VersionParts, error) {
 	m := longVersionRE.FindStringSubmatch(line)
 	if len(m) == 0 {
-		return VersionParts{}, errors.New("unintelligeble version string")
+		return VersionParts{}, errors.New("unintelligible version string")
 	}
 
 	v := VersionParts{

lib/config/config.go

@@ -333,7 +333,7 @@ func (cfg *Configuration) prepareDeviceList() map[protocol.DeviceID]*DeviceConfi
 	// - free from duplicates
 	// - no devices with empty ID
 	// - sorted by ID
-	// Happen before preparting folders as that needs a correct device list.
+	// Happen before preparing folders as that needs a correct device list.
 	cfg.Devices = ensureNoDuplicateOrEmptyIDDevices(cfg.Devices)
 	slices.SortFunc(cfg.Devices, func(a, b DeviceConfiguration) int {
 		return a.DeviceID.Compare(b.DeviceID)

lib/config/guiconfiguration.go

@@ -30,7 +30,6 @@ type GUIConfiguration struct {
 	APIKey                    string   `json:"apiKey" xml:"apikey,omitempty"`
 	InsecureAdminAccess       bool     `json:"insecureAdminAccess" xml:"insecureAdminAccess,omitempty"`
 	Theme                     string   `json:"theme" xml:"theme" default:"default"`
-	Debugging                 bool     `json:"debugging" xml:"debugging,attr"`
 	InsecureSkipHostCheck     bool     `json:"insecureSkipHostcheck" xml:"insecureSkipHostcheck,omitempty"`
 	InsecureAllowFrameLoading bool     `json:"insecureAllowFrameLoading" xml:"insecureAllowFrameLoading,omitempty"`
 	SendBasicAuthPrompt       bool     `json:"sendBasicAuthPrompt" xml:"sendBasicAuthPrompt,attr"`

lib/config/optionsconfiguration.go

@@ -235,7 +235,7 @@ func (opts OptionsConfiguration) MaxFolderConcurrency() int {
 		return 0
 	}
 	// Otherwise default to the number of CPU cores in the system as a rough
-	// approximation of system powerfullness.
+	// approximation of system powerfulness.
 	if n := runtime.GOMAXPROCS(-1); n > 0 {
 		return n
 	}

lib/fs/fakefs.go

@@ -657,7 +657,7 @@ func (*fakeFS) SetXattr(_ string, _ []protocol.Xattr, _ XattrFilter) error {
 	return nil
 }
 
-// A basic glob-impelementation that should be able to handle
+// A basic glob-implementation that should be able to handle
 // simple test cases.
 func (fs *fakeFS) Glob(pattern string) ([]string, error) {
 	dir := filepath.Dir(pattern)

lib/fs/filesystem.go

@@ -323,7 +323,7 @@ func Canonicalize(file string) (string, error) {
 	}
 
 	// The relative path should be clean from internal dotdots and similar
-	// funkyness.
+	// funkiness.
 	file = filepath.Clean(file)
 
 	// It is not acceptable to attempt to traverse upwards.

lib/ignore/ignore_test.go

@@ -1080,7 +1080,7 @@ func TestIssue4901(t *testing.T) {
 
 	fd, err := pats.fs.Create(".stignore")
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err)
 	}
 	if _, err := fd.Write([]byte(stignore)); err != nil {
 		t.Fatal(err)
@@ -1102,7 +1102,7 @@ func TestIssue4901(t *testing.T) {
 
 	fd, err = pats.fs.Create("unicorn-lazor-death")
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err)
 	}
 	if _, err := fd.Write([]byte(" ")); err != nil {
 		t.Fatal(err)
@@ -1494,7 +1494,7 @@ func TestEscapePipe(t *testing.T) {
 
 // overrideBackslashTests has the same wants as the pipeTests tests.
 // The only difference in the tests is the pipe symbol in the pattern has been
-// changed to a backslash. This could be done programatically, if desired.
+// changed to a backslash. This could be done programmatically, if desired.
 var overrideBackslashTests = []escapeTest{
 	{`a\*`, `a*`, true},
 	{`a\*b`, `a*b`, true},

lib/model/devicedownloadstate.go

@@ -14,7 +14,7 @@ import (
 )
 
 // deviceFolderFileDownloadState holds current download state of a file that
-// a remote device has advertised. blockIndexes represends indexes within
+// a remote device has advertised. blockIndexes represents indexes within
 // FileInfo.Blocks that the remote device already has, and version represents
 // the version of the file that the remote device is downloading.
 type deviceFolderFileDownloadState struct {

lib/model/devicedownloadstate_test.go

@@ -66,7 +66,7 @@ func TestDeviceDownloadState(t *testing.T) {
 			[]protocol.FileDownloadProgressUpdate{f1v1p1, f1v1p2, f1v2p2},
 		},
 		{ // 7
-			// v2 replacees v1, v2 gets deleted, and v2 part 2 gets added.
+			// v2 replaces v1, v2 gets deleted, and v2 part 2 gets added.
 			[]protocol.FileDownloadProgressUpdate{f1v1p1, f1v1p2, f1v2p1, f1v2del, f1v2p2},
 			[]protocol.FileDownloadProgressUpdate{f1v2p2},
 			[]protocol.FileDownloadProgressUpdate{f1v1p1, f1v1p2, f1v2p1},

lib/model/folder.go

@@ -951,7 +951,7 @@ func (f *folder) scanTimerFired() error {
 		if err != nil {
 			f.sl.Error("Failed initial scan", slogutil.Error(err))
 		} else {
-			f.sl.Info("Competed initial scan")
+			f.sl.Info("Completed initial scan")
 		}
 		close(f.initialScanFinished)
 	}

lib/model/model.go

@@ -1541,7 +1541,7 @@ func (m *model) ccCheckEncryption(fcfg config.FolderConfiguration, folderDevice
 	}
 
 	if isEncryptedRemote && isEncryptedLocal {
-		// Should never happen, but config racyness and be safe.
+		// Should never happen, but config raciness and be safe.
 		return errEncryptionInvConfigLocal
 	}
 
@@ -3105,7 +3105,7 @@ func (m *model) CommitConfiguration(from, to config.Configuration) bool {
 
 	// Some options don't require restart as those components handle it fine
 	// by themselves. Compare the options structs containing only the
-	// attributes that require restart and act apprioriately.
+	// attributes that require restart and act appropriately.
 	if !reflect.DeepEqual(from.Options.RequiresRestartOnly(), to.Options.RequiresRestartOnly()) {
 		l.Debugln(m, "requires restart, options differ")
 		return false

lib/model/requests_test.go

@@ -745,7 +745,7 @@ func TestRequestRemoteRenameChanged(t *testing.T) {
 			}
 		case strings.HasPrefix(path, b+".sync-conflict-"):
 			if err := equalContents(tfs, path, otherData); err != nil {
-				t.Error(`Sync conflict of "b" has unexptected content`)
+				t.Error(`Sync conflict of "b" has unexpected content`)
 			}
 		case path == "." || strings.HasPrefix(path, ".stfolder"):
 		default:

lib/osutil/net.go

@@ -14,7 +14,7 @@ import (
 )
 
 // GetInterfaceAddrs returns the IP networks of all interfaces that are up.
-// Point-to-point interfaces are exluded unless includePtP is true.
+// Point-to-point interfaces are excluded unless includePtP is true.
 func GetInterfaceAddrs(includePtP bool) ([]*net.IPNet, error) {
 	intfs, err := netutil.Interfaces()
 	if err != nil {

lib/protocol/protocol.go

@@ -933,7 +933,7 @@ func (c *rawConnection) shouldCompressMessage(msg proto.Message) bool {
 	}
 }
 
-// Close is called when the connection is regularely closed and thus the Close
+// Close is called when the connection is regularly closed and thus the Close
 // BEP message is sent before terminating the actual connection. The error
 // argument specifies the reason for closing the connection.
 func (c *rawConnection) Close(err error) {

lib/protocol/protocol_test.go

@@ -289,7 +289,7 @@ func TestWriteCompressed(t *testing.T) {
 
 		msg := (&Response{Data: make([]byte, 10240)}).toWire()
 		if random {
-			// This should make the message uncompressible.
+			// This should make the message incompressible.
 			rand.Read(msg.Data)
 		}
 

lib/relay/client/dynamic.go

@@ -139,7 +139,7 @@ type dynamicAnnouncement struct {
 // relayAddressesOrder checks the latency to each relay, rounds latency down to
 // the closest 50ms, and puts them in buckets of 50ms latency ranges. Then
 // shuffles each bucket, and returns all addresses starting with the ones from
-// the lowest latency bucket, ending with the highest latency buceket.
+// the lowest latency bucket, ending with the highest latency bucket.
 func relayAddressesOrder(ctx context.Context, input []string) []string {
 	buckets := make(map[int][]string)
 

lib/syncthing/syncthing.go

@@ -136,7 +136,7 @@ func (a *App) startup() error {
 
 	// Figure out our device ID and log it.
 	a.myID = protocol.NewDeviceID(a.cert.Certificate[0])
-	slog.Info("Calculated our device ID", a.myID.LogAttr())
+	slog.Info("Calculated our device ID", slog.String("device", a.myID.String()))
 
 	// Emit the Starting event, now that we know who we are.
 

lib/ur/usage_report.go

@@ -308,9 +308,6 @@ func (s *Service) reportData(ctx context.Context, urVersion int, preview bool) (
 			if guiCfg.InsecureAdminAccess {
 				report.GUIStats.InsecureAdminAccess++
 			}
-			if guiCfg.Debugging {
-				report.GUIStats.Debugging++
-			}
 			if guiCfg.InsecureSkipHostCheck {
 				report.GUIStats.InsecureSkipHostCheck++
 			}

man/stdiscosrv.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "STDISCOSRV" "1" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "STDISCOSRV" "1" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 stdiscosrv \- Syncthing Discovery Server
 .SH SYNOPSIS
@@ -394,6 +394,6 @@ the discovery server and your particular setup.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/strelaysrv.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "STRELAYSRV" "1" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "STRELAYSRV" "1" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 strelaysrv \- Syncthing Relay Server
 .SH SYNOPSIS
@@ -317,6 +317,6 @@ relay://<host name|IP>[:port]/?id=<relay device ID>&token=mySecretToken
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-bep.7

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-BEP" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-BEP" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-bep \- Block Exchange Protocol v1
 .SH INTRODUCTION AND DEFINITIONS
@@ -267,13 +267,11 @@ message ClusterConfig {
 }
 
 message Folder {
-    string id                   = 1;
-    string label                = 2;
-    bool   read_only            = 3;
-    bool   ignore_permissions   = 4;
-    bool   ignore_delete        = 5;
-    bool   disable_temp_indexes = 6;
-    bool   paused               = 7;
+    string id                    = 1;
+    string label                 = 2;
+    FolderType type              = 3;
+    FolderStopReason stop_reason = 7;
+    reserved 4 to 6;
 
     repeated Device devices = 16;
 }
@@ -296,6 +294,18 @@ enum Compression {
     NEVER    = 1;
     ALWAYS   = 2;
 }
+
+enum FolderType {
+    FOLDER_TYPE_SEND_RECEIVE      = 0;
+    FOLDER_TYPE_SEND_ONLY         = 1;
+    FOLDER_TYPE_RECEIVE_ONLY      = 2;
+    FOLDER_TYPE_RECEIVE_ENCRYPTED = 3;
+}
+
+enum FolderStopReason {
+    FOLDER_STOP_REASON_RUNNING = 0;
+    FOLDER_STOP_REASON_PAUSED  = 1;
+}
 .EE
 .UNINDENT
 .UNINDENT
@@ -311,20 +321,12 @@ the folder.
 The \fBlabel\fP field contains the folder label, the human readable name of
 the folder.
 .sp
-The \fBread_only\fP field is set for folders that the device will accept no
-updates from the network for.
+The \fBfolder_type\fP field contains the type of the folder as defined by the
+FolderType enumeration.
 .sp
-The \fBignore_permissions\fP field is set for folders that the device will not
-accept or announce file permissions for.
-.sp
-The \fBignore_delete\fP field is set for folders that the device will ignore
-deletes for.
-.sp
-The \fBdisable_temp_indexes\fP field is set for folders that will not dispatch
-and do not wish to receive progress updates about partially downloaded files
-via Download Progress messages.
-.sp
-The \fBpaused\fP field is set for folders that are currently paused.
+The \fBstop_reason\fP field is set for folders that are currently stopped for
+any reason. The zero means that the folder is not stopped; further reasons
+are defined by the FolderStopReason enumeration.
 .sp
 The \fBdevices\fP field is a list of devices participating in sharing this
 folder.
@@ -430,10 +432,10 @@ enum FileInfoType {
 }
 
 message BlockInfo {
-    int64 offset     = 1;
-    int32 size       = 2;
-    bytes hash       = 3;
-    uint32 weak_hash = 4;
+    int64 offset = 1;
+    int32 size   = 2;
+    bytes hash   = 3;
+    reserved 4;
 }
 
 message Vector {
@@ -536,6 +538,8 @@ message Request {
     int32  size           = 5;
     bytes  hash           = 6;
     bool   from_temporary = 7;
+    int32 block_no        = 9;
+    reserved 8;
 }
 .EE
 .UNINDENT
@@ -1053,6 +1057,6 @@ process occurs for device A at 15.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-config.5

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-CONFIG" "5" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-CONFIG" "5" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-config \- Syncthing Configuration
 .SH SYNOPSIS
@@ -89,9 +89,9 @@ corresponding environment variables (\fB$STDATADIR\fP or \fBSTHOMEDIR\fP).
 The database directory contains the following files, among others:
 .INDENT 0.0
 .TP
-.B \fBindex\-\fP\fI*\fP\fB\&.db\fP
-A directory holding the database with metadata and hashes of the files
-currently on disk and available from peers.
+.B \fBindex\-\fP\fI*\fP
+The database with metadata and hashes of the files currently on disk and
+available from peers.
 .TP
 .B \fBsyncthing.log\fP
 Log output, on some systems.
@@ -139,9 +139,7 @@ may no longer correspond to the defaults.
         <pullerPauseS>0</pullerPauseS>
         <maxConflicts>\-1</maxConflicts>
         <disableSparseFiles>false</disableSparseFiles>
-        <disableTempIndexes>false</disableTempIndexes>
         <paused>false</paused>
-        <weakHashThresholdPct>25</weakHashThresholdPct>
         <markerName>.stfolder</markerName>
         <copyOwnershipFromParent>false</copyOwnershipFromParent>
         <modTimeWindowS>0</modTimeWindowS>
@@ -167,7 +165,7 @@ may no longer correspond to the defaults.
         <untrusted>false</untrusted>
         <remoteGUIPort>0</remoteGUIPort>
     </device>
-    <gui enabled=\(dqtrue\(dq tls=\(dqfalse\(dq debugging=\(dqfalse\(dq>
+    <gui enabled=\(dqtrue\(dq tls=\(dqfalse\(dq>
         <address>127.0.0.1:8384</address>
         <apikey>k1dnz1Dd0rzTBjjFFh7CXPnrF12C49B1</apikey>
         <theme>default</theme>
@@ -215,7 +213,6 @@ may no longer correspond to the defaults.
         <stunKeepaliveStartS>180</stunKeepaliveStartS>
         <stunKeepaliveMinS>20</stunKeepaliveMinS>
         <stunServer>default</stunServer>
-        <databaseTuning>auto</databaseTuning>
         <maxConcurrentIncomingRequestKiB>0</maxConcurrentIncomingRequestKiB>
         <announceLANAddresses>true</announceLANAddresses>
         <sendFullIndexOnUpgrade>false</sendFullIndexOnUpgrade>
@@ -244,9 +241,7 @@ may no longer correspond to the defaults.
             <pullerPauseS>0</pullerPauseS>
             <maxConflicts>10</maxConflicts>
             <disableSparseFiles>false</disableSparseFiles>
-            <disableTempIndexes>false</disableTempIndexes>
             <paused>false</paused>
-            <weakHashThresholdPct>25</weakHashThresholdPct>
             <markerName>.stfolder</markerName>
             <copyOwnershipFromParent>false</copyOwnershipFromParent>
             <modTimeWindowS>0</modTimeWindowS>
@@ -336,9 +331,7 @@ GUI.
     <pullerPauseS>0</pullerPauseS>
     <maxConflicts>\-1</maxConflicts>
     <disableSparseFiles>false</disableSparseFiles>
-    <disableTempIndexes>false</disableTempIndexes>
     <paused>false</paused>
-    <weakHashThresholdPct>25</weakHashThresholdPct>
     <markerName>.stfolder</markerName>
     <copyOwnershipFromParent>false</copyOwnershipFromParent>
     <modTimeWindowS>0</modTimeWindowS>
@@ -580,26 +573,11 @@ sparse files will not be created.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B disableTempIndexes
-By default, devices exchange information about blocks available in
-transfers that are still in progress, which allows other devices to
-download parts of files that are not yet fully downloaded on your own
-device, essentially making transfers more torrent like. When set to
-\fBtrue\fP, such information is not exchanged for this folder.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B paused
 True if this folder is (temporarily) suspended.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B weakHashThresholdPct
-Use weak hash if more than the given percentage of the file has changed. Set
-to \fB\-1\fP to always use weak hash. Default is \fB25\fP\&.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B markerName
 Name of a directory or file in the folder root to be used as a marker \- see
 \fI\%marker FAQ\fP for its purpose.
@@ -945,7 +923,7 @@ The number of connections to this device. See
 .INDENT 3.5
 .sp
 .EX
-<gui enabled=\(dqtrue\(dq tls=\(dqfalse\(dq debugging=\(dqfalse\(dq>
+<gui enabled=\(dqtrue\(dq tls=\(dqfalse\(dq>
     <address>127.0.0.1:8384</address>
     <apikey>k1dnz1Dd0rzTBjjFFh7CXPnrF12C49B1</apikey>
     <theme>default</theme>
@@ -969,12 +947,6 @@ If set to \fBtrue\fP, TLS (HTTPS) will be enforced. Non\-HTTPS requests will
 be redirected to HTTPS. When set to \fBfalse\fP, TLS connections are
 still possible but not required.
 .UNINDENT
-.INDENT 0.0
-.TP
-.B debugging
-This enables \fI\%Profiling\fP and additional endpoints in the REST
-API, see \fI\%Debug Endpoints\fP\&.
-.UNINDENT
 .sp
 The following child elements may be present:
 .INDENT 0.0
@@ -1196,7 +1168,6 @@ Search filter for user searches.
     <stunKeepaliveStartS>180</stunKeepaliveStartS>
     <stunKeepaliveMinS>20</stunKeepaliveMinS>
     <stunServer>default</stunServer>
-    <databaseTuning>auto</databaseTuning>
     <maxConcurrentIncomingRequestKiB>0</maxConcurrentIncomingRequestKiB>
     <announceLANAddresses>true</announceLANAddresses>
     <sendFullIndexOnUpgrade>false</sendFullIndexOnUpgrade>
@@ -1488,13 +1459,6 @@ troubles.  Defaults to \fBtrue\fP, to help the developers troubleshoot.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B databaseTuning
-Controls how Syncthing uses the backend key\-value database that stores the
-index data and other persistent data it needs.  The available options and
-implications are explained in a \fI\%separate chapter\fP\&.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B maxConcurrentIncomingRequestKiB
 This limits how many bytes we have “in the air” in the form of response data
 being read and processed.
@@ -1509,7 +1473,7 @@ addresses to global discovery.
 .TP
 .B sendFullIndexOnUpgrade
 Controls whether all index data is resent when an upgrade has happened,
-equivalent to starting Syncthing with \fI\%\-\-reset\-deltas\fP\&.  This used
+equivalent to starting Syncthing with \fB\-\-reset\-deltas\fP\&.  This used
 to be the default behavior in older versions, but is mainly useful as a
 troubleshooting step and causes high database churn. The default is now
 \fBfalse\fP\&.
@@ -1582,9 +1546,7 @@ are set, \fI\%\-\-auditfile\fP takes priority.
         <pullerPauseS>0</pullerPauseS>
         <maxConflicts>10</maxConflicts>
         <disableSparseFiles>false</disableSparseFiles>
-        <disableTempIndexes>false</disableTempIndexes>
         <paused>false</paused>
-        <weakHashThresholdPct>25</weakHashThresholdPct>
         <markerName>.stfolder</markerName>
         <copyOwnershipFromParent>false</copyOwnershipFromParent>
         <modTimeWindowS>0</modTimeWindowS>
@@ -1732,6 +1694,6 @@ send only mode for just the configuration folder.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-device-ids.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-DEVICE-IDS" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-DEVICE-IDS" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-device-ids \- Understanding Device IDs
 .sp
@@ -255,6 +255,6 @@ accepting the connection.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-event-api.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-EVENT-API" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-EVENT-API" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-event-api \- Event API
 .SH DESCRIPTION
@@ -1116,6 +1116,6 @@ seconds and is now in state \fBidle\fP\&.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-faq.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-FAQ" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-FAQ" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-faq \- Frequently Asked Questions
 .INDENT 0.0
@@ -544,7 +544,7 @@ files \fBqax\fP, \fBqbx\fP and \fBqcx\fP\&.
 To match an actual file \fIcalled\fP \fBq[abc]x\fP the pattern needs to “escape”
 the brackets, like so: \fBq\e[abc\e]x\fP\&.
 .sp
-On Windows, escaping special characters is not supported as the \fB\e\fP
+On Windows, use the \fB|\fP character to escape the brackets (\fBq|[abc|]x\fP), as the \fB\e\fP
 character is used as a path separator.
 .SS How do I access the web GUI from another computer?
 .sp
@@ -732,7 +732,7 @@ For example, the two emphasized lines below would be removed from the file.
 .INDENT 3.5
 .sp
 .EX
-<gui enabled=\(dqtrue\(dq tls=\(dqfalse\(dq debugging=\(dqfalse\(dq>
+<gui enabled=\(dqtrue\(dq tls=\(dqfalse\(dq>
    <address>127.0.0.1:8384</address>
    <user>syncguy</user>
    <password>$2a$10$s9wWHOQe...Cq7GPye69</password>
@@ -745,6 +745,6 @@ For example, the two emphasized lines below would be removed from the file.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-globaldisco.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-GLOBALDISCO" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-GLOBALDISCO" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-globaldisco \- Global Discovery Protocol v3
 .SH ANNOUNCEMENTS
@@ -119,6 +119,6 @@ The discovery server prints its certificate ID in this manner on startup.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-localdisco.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-LOCALDISCO" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-LOCALDISCO" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-localdisco \- Local Discovery Protocol v4
 .SH MODE OF OPERATION
@@ -114,6 +114,6 @@ between two announces and conclude that the announcing device has restarted.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-networking.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-NETWORKING" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-NETWORKING" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-networking \- Firewall Setup
 .SH ROUTER SETUP
@@ -163,6 +163,6 @@ Syncthing can use a SOCKS5 proxy for outbound connections. Please see \fI\%Using
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-relay.7

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-RELAY" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-RELAY" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-relay \- Relay Protocol v1
 .SH WHAT IS A RELAY?
@@ -695,6 +695,6 @@ T}
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-rest-api.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-REST-API" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-REST-API" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-rest-api \- REST API
 .sp
@@ -152,9 +152,7 @@ Returns the current configuration.
       \(dqpullerPauseS\(dq: 0,
       \(dqmaxConflicts\(dq: \-1,
       \(dqdisableSparseFiles\(dq: false,
-      \(dqdisableTempIndexes\(dq: false,
       \(dqpaused\(dq: false,
-      \(dqweakHashThresholdPct\(dq: 25,
       \(dqmarkerName\(dq: \(dq.stfolder\(dq,
       \(dqcopyOwnershipFromParent\(dq: false,
       \(dqmodTimeWindowS\(dq: 0,
@@ -207,7 +205,6 @@ Returns the current configuration.
     \(dqapiKey\(dq: \(dqk1dnz1Dd0rzTBjjFFh7CXPnrF12C49B1\(dq,
     \(dqinsecureAdminAccess\(dq: false,
     \(dqtheme\(dq: \(dqdefault\(dq,
-    \(dqdebugging\(dq: false,
     \(dqinsecureSkipHostcheck\(dq: false,
     \(dqinsecureAllowFrameLoading\(dq: false
   },
@@ -273,7 +270,6 @@ Returns the current configuration.
     \(dqstunServers\(dq: [
       \(dqdefault\(dq
     ],
-    \(dqdatabaseTuning\(dq: \(dqauto\(dq,
     \(dqmaxConcurrentIncomingRequestKiB\(dq: 0,
     \(dqannounceLANAddresses\(dq: true,
     \(dqsendFullIndexOnUpgrade\(dq: false,
@@ -328,9 +324,7 @@ Returns the current configuration.
       \(dqpullerPauseS\(dq: 0,
       \(dqmaxConflicts\(dq: 10,
       \(dqdisableSparseFiles\(dq: false,
-      \(dqdisableTempIndexes\(dq: false,
       \(dqpaused\(dq: false,
-      \(dqweakHashThresholdPct\(dq: 25,
       \(dqmarkerName\(dq: \(dq.stfolder\(dq,
       \(dqcopyOwnershipFromParent\(dq: false,
       \(dqmodTimeWindowS\(dq: 0,
@@ -464,61 +458,6 @@ The connection types are \fBTCP (Client)\fP, \fBTCP (Server)\fP, \fBRelay (Clien
 .EE
 .UNINDENT
 .UNINDENT
-.SS GET /rest/system/debug
-.sp
-Added in version 0.12.0.
-
-.sp
-Returns the set of debug facilities and which of them are currently enabled.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.EX
-{
-  \(dqenabled\(dq: [
-    \(dqbeacon\(dq
-  ],
-  \(dqfacilities\(dq: {
-    \(dqbeacon\(dq: \(dqMulticast and broadcast discovery\(dq,
-    \(dqconfig\(dq: \(dqConfiguration loading and saving\(dq,
-    \(dqconnections\(dq: \(dqConnection handling\(dq,
-    \(dqdb\(dq: \(dqThe database layer\(dq,
-    \(dqdialer\(dq: \(dqDialing connections\(dq,
-    \(dqdiscover\(dq: \(dqRemote device discovery\(dq,
-    \(dqevents\(dq: \(dqEvent generation and logging\(dq,
-    \(dqhttp\(dq: \(dqREST API\(dq,
-    \(dqmain\(dq: \(dqMain package\(dq,
-    \(dqmodel\(dq: \(dqThe root hub\(dq,
-    \(dqprotocol\(dq: \(dqThe BEP protocol\(dq,
-    \(dqrelay\(dq: \(dqRelay connection handling\(dq,
-    \(dqscanner\(dq: \(dqFile change detection and hashing\(dq,
-    \(dqstats\(dq: \(dqPersistent device and folder statistics\(dq,
-    \(dqsync\(dq: \(dqMutexes\(dq,
-    \(dqupgrade\(dq: \(dqBinary upgrades\(dq,
-    \(dqupnp\(dq: \(dqUPnP discovery and port mapping\(dq,
-    \(dqversioner\(dq: \(dqFile versioning\(dq
-  }
-}
-.EE
-.UNINDENT
-.UNINDENT
-.SS POST /rest/system/debug
-.sp
-Added in version 0.12.0.
-
-.sp
-Enables or disables debugging for specified facilities. Give one or both of
-\fBenable\fP and \fBdisable\fP query parameters, with comma separated facility
-names. To disable debugging of the beacon and discovery packages, and enable it
-for config and db:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.EX
-$ curl \-H X\-API\-Key:abc123 \-X POST \(aqhttp://localhost:8384/rest/system/debug?disable=beacon,discovery&enable=config,db\(aq
-.EE
-.UNINDENT
-.UNINDENT
 .SS GET /rest/system/discovery
 .sp
 Returns the contents of the local discovery cache.
@@ -612,6 +551,51 @@ the results to message newer than the given timestamp in \X'tty: link https://da
 .SS GET /rest/system/log.txt
 .sp
 Returns the same information, formatted as a text log instead of a JSON object.
+.SS GET /rest/system/loglevels
+.sp
+Added in version 2.0.0.
+
+.sp
+Returns the set of log facilities and their current log level.
+.INDENT 0.0
+.INDENT 3.5
+.sp
+.EX
+{
+  \(dqlevels\(dq: {
+    \(dqapi\(dq: \(dqINFO\(dq,
+    \(dqbeacon\(dq: \(dqINFO\(dq,
+    ...
+    \(dqversioner\(dq: \(dqINFO\(dq,
+    \(dqwatchaggregator\(dq: \(dqINFO\(dq
+  },
+  \(dqpackages\(dq: {
+    \(dqapi\(dq: \(dqREST API\(dq,
+    \(dqbeacon\(dq: \(dqMulticast and broadcast discovery\(dq,
+    ...
+    \(dqversioner\(dq: \(dqFile versioning\(dq,
+    \(dqwatchaggregator\(dq: \(dqFilesystem event watcher\(dq
+  }
+}
+.EE
+.UNINDENT
+.UNINDENT
+.SS POST /rest/system/loglevels
+.sp
+Added in version 2.0.0.
+
+.sp
+Changes the log level for specified facilities. Post an object with the log
+facilites as keys and desired log level (\fBDEBUG\fP, \fBINFO\fP, \fBWARN\fP, or
+\fBERROR\fP) as the values.
+.INDENT 0.0
+.INDENT 3.5
+.sp
+.EX
+$ curl \-H X\-API\-Key:abc123 \-d \(aq{\(dqbeacon\(dq:\(dqDEBUG\(dq,\(dqdiscovery\(dq:\(dqWARN\(dq}\(aq \(aqhttp://localhost:8384/rest/system/loglevels\(aq
+.EE
+.UNINDENT
+.UNINDENT
 .SS GET /rest/system/paths
 .sp
 Added in version 1.21.0.
@@ -631,7 +615,7 @@ and others.
   \(dqcertFile\(dq: \(dq/home/user/.config/syncthing/cert.pem\(dq,
   \(dqconfig\(dq: \(dq/home/user/.config/syncthing/config.xml\(dq,
   \(dqcsrfTokens\(dq: \(dq/home/user/.config/syncthing/csrftokens.txt\(dq,
-  \(dqdatabase\(dq: \(dq/home/user/.local/share/syncthing/index\-v0.14.0.db\(dq,
+  \(dqdatabase\(dq: \(dq/home/user/.local/share/syncthing/index\-v2\(dq,
   \(dqdefFolder\(dq: \(dq/home/user/Sync\(dq,
   \(dqguiAssets\(dq: \(dq/home/user/src/syncthing/gui\(dq,
   \(dqhttpsCertFile\(dq: \(dq/home/user/.config/syncthing/https\-cert.pem\(dq,
@@ -681,7 +665,7 @@ curl \-X POST \-H \(dqX\-API\-Key: abc123\(dq http://localhost:8384/rest/system/
 .UNINDENT
 .UNINDENT
 .sp
-\fBCaution\fP: See \fI\%\-\-reset\-database\fP for \fB\&.stfolder\fP creation
+\fBCaution\fP: See \fB\-\-reset\-database\fP for \fB\&.stfolder\fP creation
 side\-effect and caution regarding mountpoints.
 .SS POST /rest/system/restart
 .sp
@@ -1923,17 +1907,6 @@ Returns the data sent in the anonymous usage report.
 .UNINDENT
 .SH DEBUG ENDPOINTS
 .SS Debug Endpoints
-.sp
-These endpoints require the \fI\%gui.debugging\fP configuration option to
-be enabled and yield an access denied error code otherwise.
-.SS GET /rest/debug/peerCompletion
-.sp
-Summarizes the completion percentage for each remote device.  Returns an object
-with device IDs as keys and an integer percentage as values.
-.SS GET /rest/debug/httpmetrics
-.sp
-Returns statistics about each served REST API endpoint, to diagnose how much
-time was spent generating the responses.
 .SS GET /rest/debug/cpuprof
 .sp
 Used to capture a profile of what Syncthing is doing on the CPU.  See
@@ -1982,6 +1955,6 @@ Returns a \fB{\(dqstatus\(dq: \(dqOK\(dq}\fP object.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-security.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-SECURITY" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-SECURITY" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-security \- Security Principles
 .sp
@@ -167,6 +167,6 @@ avoid leaking keys and metadata. Or, use whole disk encryption.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-stignore.5

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-STIGNORE" "5" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-STIGNORE" "5" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-stignore \- Prevent files from being synchronized to other nodes
 .SH SYNOPSIS
@@ -92,12 +92,32 @@ and does not denote a set of alternatives as above.
 \fBNOTE:\fP
 .INDENT 2.0
 .INDENT 3.5
-Escaped characters are not supported on Windows, where \fB\e\fP is the
-path separator. If you still need to match files that have square or
-curly brackets in their names, one possible workaround is to replace
-them with \fB?\fP, which will then match any character. For example,
-you can type \fB?banana?\fP to match both \fB[banana]\fP and
-\fB{banana}\fP, and so on.
+On Windows, \fB\e\fP is the path separator, so use \fB|\fP to escape special
+characters. For example, \fB|{banana|}\fP matches
+\fB{banana}\fP\&.
+.sp
+To use \fB\e\fP to escape special characters (and use \fB/\fP as the path separator),
+insert a \fB#escape=\e\fP at the top of the file. Here’s a short example:
+.INDENT 0.0
+.INDENT 3.5
+.nf
+\fB#escape=\e\fP
+\fB/foo\fP
+\fB/path/bar/\e{banana\e}\fP
+\fB/path/baz\e[2\e]/ex\e[3\e].txt\fP
+.fi
+.sp
+.UNINDENT
+.UNINDENT
+.sp
+\fB#escape=\e\fP must be placed at the top of the file, before any patterns,
+but leading comments, and blank lines are OK.
+.sp
+Any files included using \fB#include\fP (see below) will each need their
+own \fB#escape=\e\fP\&.
+.sp
+Using \fB#escape=\e\fP allows the same file to be synced and used on any
+operating system.
 .UNINDENT
 .UNINDENT
 .IP \(bu 2
@@ -259,9 +279,15 @@ accepting a folder from a remote device.  The GUI suggests the same patterns
 when adding a folder manually.  In either case, the \fB\&.stignore\fP file is
 created with these defaults if none is present yet.
 
+.sp
+Added in version 2.0.0: Windows users can now use the pipe character (\fB|\fP) to escape
+metacharacters in the \fB\&.stignore\fP file.  Additionally, adding
+\fB#escape=X\fP to the top of the file, allows users to define \fBX\fP
+as the escape character for that particular file.
+
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing-versioning.7

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-VERSIONING" "7" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING-VERSIONING" "7" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-versioning \- Keep automatic backups of deleted files by other nodes
 .sp
@@ -375,6 +375,6 @@ quoted.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

man/syncthing.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING" "1" "Aug 01, 2025" "v1.29.7" "Syncthing"
+.TH "SYNCTHING" "1" "Aug 11, 2025" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing \- Syncthing
 .SH SYNOPSIS
@@ -36,33 +36,60 @@ syncthing \- Syncthing
 .sp
 .EX
 syncthing [serve]
-          [\-\-audit] [\-\-auditfile=<file|\-|\-\->] [\-\-browser\-only] [\-\-device\-id]
-          [\-\-generate=<dir>] [\-\-gui\-address=<address>] [\-\-gui\-apikey=<key>]
           [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
-          [\-\-logfile=<filename>] [\-\-logflags=<flags>]
+          [\-\-allow\-newer\-config] [\-\-audit] [\-\-auditfile=<file|\-|\-\->]
+          [\-\-db\-maintenance\-interval=<interval>]
+          [\-\-db\-delete\-retention\-interval=<interval>]
+          [\-\-gui\-address=<address>] [\-\-gui\-apikey=<key>]
+          [\-\-log\-level=<level>] [\-\-log\-file=<filename>]
           [\-\-log\-max\-old\-files=<num>] [\-\-log\-max\-size=<num>]
-          [\-\-no\-browser] [\-\-no\-console] [\-\-no\-restart] [\-\-paths] [\-\-paused]
-          [\-\-no\-default\-folder] [\-\-skip\-port\-probing]
-          [\-\-reset\-database] [\-\-reset\-deltas] [\-\-unpaused] [\-\-allow\-newer\-config]
-          [\-\-upgrade] [\-\-no\-upgrade] [\-\-upgrade\-check] [\-\-upgrade\-to=<url>]
+          [\-\-no\-browser] [\-\-no\-console]
+          [\-\-no\-port\-probing] [\-\-no\-restart] [\-\-no\-upgrade]
+          [\-\-paused] [\-\-unpaused]
           [\-\-verbose] [\-\-version] [\-\-help] [\-\-debug\-*]
 
-syncthing generate
-          [\-\-home=<dir> | \-\-config=<dir>]
-          [\-\-gui\-user=<username>] [\-\-gui\-password=<password|\->]
-          [\-\-no\-default\-folder] [\-\-skip\-port\-probing] [\-\-no\-console]
-          [\-\-help]
-
-syncthing decrypt (\-\-to=<dir> | \-\-verify\-only)
-          [\-\-password=<pw>] [\-\-folder\-id=<id>] [\-\-token\-path=<file>]
-          [\-\-continue] [\-\-verbose] [\-\-version] [\-\-help]
-          <path>
-
 syncthing cli
           [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
           [\-\-gui\-address=<address>] [\-\-gui\-apikey=<key>]
           [\-\-help]
           <command> [command options...] [arguments...]
+
+syncthing browser
+          [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
+          [\-\-help]
+
+syncthing decrypt (\-\-to=<dir> | \-\-verify\-only)
+          [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
+          [\-\-password=<pw>] [\-\-folder\-id=<id>] [\-\-token\-path=<file>]
+          [\-\-continue] [\-\-verbose] [\-\-help]
+          <path>
+
+syncthing device\-id
+          [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
+          [\-\-help]
+
+syncthing generate
+          [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
+          [\-\-gui\-user=<username>] [\-\-gui\-password=<password|\->]
+          [\-\-no\-port\-probing]
+          [\-\-help]
+
+syncthing paths
+          [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
+          [\-\-help]
+
+syncthing upgrade
+          [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
+          [\-\-check\-only] [\-\-from=<url>]
+          [\-\-help]
+
+syncthing version
+          [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
+          [\-\-help]
+
+syncthing debug <command>
+          [\-\-home=<dir> | \-\-config=<dir> \-\-data=<dir>]
+          [\-\-help]
 .EE
 .UNINDENT
 .UNINDENT
@@ -82,7 +109,35 @@ frontend communicates with the core application through some HTTP APIs, which
 other apps like graphical system integration helpers can use as well, for
 greatest flexibility. A link to reach the GUI and API is printed among the first
 few log messages.
-.SH OPTIONS
+.SH COMMON OPTIONS
+.INDENT 0.0
+.TP
+.B \-\-home=<dir>, \-H <dir>
+Set common configuration and data directory. The default configuration
+directory is \fB$XDG_STATE_HOME/syncthing\fP or
+\fB$HOME/.local/state/syncthing\fP (Unix\-like),
+\fB$HOME/Library/Application Support/Syncthing\fP (Mac) and
+\fB%LOCALAPPDATA%\eSyncthing\fP (Windows).
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-config=<dir>, \-C <dir>
+Set configuration directory. Alternative to \fB\-\-home\fP and must be used
+together with \fB\-\-data\fP\&.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-data=<dir>, \-D <dir>
+Set data (e.g. database) directory. Alternative to \fB\-\-home\fP and must be used
+together with \fB\-\-config\fP\&.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-help, \-h
+Show help text about command line usage.  Context\-sensitive depending on the
+given subcommand.
+.UNINDENT
+.SH SERVE OPTIONS
 .INDENT 0.0
 .TP
 .B \-\-allow\-newer\-config
@@ -102,18 +157,15 @@ audit events, rather than the timestamped default file name.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-browser\-only
-Open the web UI in a browser for an already running Syncthing instance.
+.B \-\-db\-maintenance\-interval=<interval>
+Database maintenance interval – internal database maintenance routines
+run this often.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-device\-id
-Print device ID to command line.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-generate=<dir>
-Generate key and config in specified dir, then exit.
+.B \-\-db\-delete\-retention\-interval=<interval>
+Database deleted item retention interval – deleted items are forgotten
+from the database after this interval.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -132,75 +184,18 @@ Override the API key needed to access the GUI / REST API.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-gui\-password=<password|\->
-Specify new GUI authentication password, to update the config file.  Read
-from the standard input stream if only a single dash (\fB\-\fP) is given.  A
-plaintext password is hashed before writing to the config file, but an
-already bcrypt\-hashed input is stored verbatim.  As a special case, giving
-the existing password hash as password will leave it untouched.
+.B \-\-log\-level=<level>
+Set the log level for all packages. Valid levels are DEBUG, INFO, WARN,
+and ERROR.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-gui\-user=<username>
-Specify new GUI authentication user name, to update the config file.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-help, \-h
-Show help text about command line usage.  Context\-sensitive depending on the
-given subcommand.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-home=<dir>
-Set common configuration and data directory. The default configuration
-directory is \fB$XDG_STATE_HOME/syncthing\fP or
-\fB$HOME/.local/state/syncthing\fP (Unix\-like),
-\fB$HOME/Library/Application Support/Syncthing\fP (Mac) and
-\fB%LOCALAPPDATA%\eSyncthing\fP (Windows).
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-config=<dir>
-Set configuration directory. Alternative to \fB\-\-home\fP and must be used
-together with \fB\-\-data\fP\&.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-data=<dir>
-Set data (e.g. database) directory. Alternative to \fB\-\-home\fP and must be used
-together with \fB\-\-config\fP\&.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-logfile=<filename>
+.B \-\-log\-file=<filename>
 Set destination filename for logging (use \fB\(dq\-\(dq\fP for stdout, which is the
 default option).
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-logflags=<flags>
-Select information in log line prefix. The \fB\-\-logflags\fP value is a sum of
-the following:
-.INDENT 7.0
-.IP \(bu 2
-1: Date
-.IP \(bu 2
-2: Time
-.IP \(bu 2
-4: Microsecond time
-.IP \(bu 2
-8: Long filename
-.IP \(bu 2
-16: Short filename
-.UNINDENT
-.sp
-To prefix each log line with date and time, set \fB\-\-logflags=3\fP (1 + 2 from
-above). The value 0 is used to disable all of the above. The default is to
-show time only (2).
-.UNINDENT
-.INDENT 0.0
-.TP
 .B \-\-log\-max\-old\-files=<num>
 Number of old files to keep (zero to keep only current).  Applies only when
 log rotation is enabled through \fB\-\-log\-max\-size\fP\&.
@@ -222,9 +217,9 @@ Hide the console window. (On Windows only)
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-no\-default\-folder
-Don’t create a default folder when generating an initial configuration /
-starting for the first time.
+.B \-\-no\-port\-probing
+Don’t try to find unused random ports for the GUI and listen address when
+generating an initial configuration / starting for the first time.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -240,37 +235,11 @@ variable, see below.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-paths
-Print the paths used for configuration, keys, database, GUI overrides,
-default sync folder and the log file.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B \-\-paused
 Start with all devices and folders paused.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-reset\-database
-Reset the database, forcing a full rescan and resync. Create \fI\&.stfolder\fP
-folders in each sync folder if they do not already exist. \fBCaution\fP:
-Ensure that all sync folders which are mountpoints are already mounted.
-Inconsistent versions may result if the mountpoint is later mounted and
-contains older versions.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-reset\-deltas
-Reset delta index IDs, forcing a full index exchange.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-skip\-port\-probing
-Don’t try to find unused random ports for the GUI and listen address when
-generating an initial configuration / starting for the first time.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B \-\-unpaused
 Start with all devices and folders unpaused.
 .UNINDENT
@@ -281,24 +250,10 @@ Perform upgrade.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-upgrade\-check
-Check for available upgrade.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-upgrade\-to=<url>
-Force upgrade directly from specified URL.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B \-\-verbose
 Print verbose log output.
 .UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-version
-Show version.
-.UNINDENT
+.SH DECRYPT OPTIONS
 .INDENT 0.0
 .TP
 .B \-\-to=<dir>
@@ -331,6 +286,33 @@ Path to the token file within the folder (used to determine folder ID).
 .B \-\-continue
 Continue processing next file in case of error, instead of aborting.
 .UNINDENT
+.SH GENERATE OPTIONS
+.INDENT 0.0
+.TP
+.B \-\-gui\-password=<password|\->
+Specify new GUI authentication password, to update the config file.  Read
+from the standard input stream if only a single dash (\fB\-\fP) is given.  A
+plaintext password is hashed before writing to the config file, but an
+already bcrypt\-hashed input is stored verbatim.  As a special case, giving
+the existing password hash as password will leave it untouched.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-gui\-user=<username>
+Specify new GUI authentication user name, to update the config file.
+.UNINDENT
+.SH UPGRADE OPTIONS
+.INDENT 0.0
+.TP
+.B \-\-check\-only
+Do not upgrade, only indicate whether an upgrade is available.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-from=<url>
+Upgrade to the Syncthing version available from loading the package at
+the given URL.
+.UNINDENT
 .SH EXIT CODES
 .INDENT 0.0
 .TP
@@ -435,160 +417,54 @@ path expansion may not be supported.
 .INDENT 0.0
 .TP
 .B STTRACE
-Used to increase the debugging verbosity in specific or all facilities,
-generally mapping to a Go package. Enabling any of these also enables
-microsecond timestamps, file names plus line numbers. Enter a
-comma\-separated string of facilities to trace. \fBsyncthing \-\-help\fP always
-outputs an up\-to\-date list. The valid facility strings are:
+Used to increase the debugging verbosity in specific facilities,
+generally mapping to a Go package. Enter a comma\-separated string of
+facilities to trace: \fBapi,beacon\fP\&. Optionally, a log level can be
+given per facility to specify something other than DEBUG:
+\fBapi:WARN,beacon:ERR\fP, potentially overriding a global \fB\-\-log\-level\fP
+adjustment.
 .INDENT 7.0
-.TP
-.B Main and operational facilities:
-.INDENT 7.0
-.TP
-.B config
-Configuration loading and saving.
-.TP
-.B db
-The database layer.
-.TP
-.B main
-Main package.
-.TP
-.B model
-The root hub; the largest chunk of the system. File pulling, index
-transmission and requests for chunks.
-.TP
-.B scanner
-File change detection and hashing.
-.TP
-.B versioner
-File versioning.
-.UNINDENT
-.TP
-.B Networking facilities:
-.INDENT 7.0
-.TP
-.B beacon
-Multicast and broadcast UDP discovery packets: Selected interfaces
-and addresses.
-.TP
-.B connections
-Connection handling.
-.TP
-.B dialer
-Dialing connections.
-.TP
-.B discover
-Remote device discovery requests, replies and registration of
-devices.
-.TP
-.B nat
-NAT discovery and port mapping.
-.TP
-.B pmp
-NAT\-PMP discovery and port mapping.
-.TP
-.B protocol
-The BEP protocol.
-.TP
-.B relay
-Relay interaction (\fBstrelaysrv\fP).
-.TP
-.B upnp
-UPnP discovery and port mapping.
-.UNINDENT
-.TP
-.B Other facilities:
-.INDENT 7.0
-.TP
-.B fs
-Filesystem access.
-.TP
-.B events
-Event generation and logging.
-.TP
-.B http
-REST API.
-.TP
-.B sha256
-SHA256 hashing package (this facility currently unused).
-.TP
-.B stats
-Persistent device and folder statistics.
-.TP
-.B sync
-Mutexes. Used for debugging race conditions and deadlocks.
-.TP
-.B upgrade
-Binary upgrades.
-.TP
-.B walkfs
-Filesystem access while walking.
-.TP
-.B all
-All of the above.
+.INDENT 3.5
+The valid facility strings are listed below; additionally, \fBsyncthing
+serve \-\-help\fP always outputs the most up\-to\-date list.
+.INDENT 0.0
+.INDENT 3.5
+api             \- REST API
+beacon          \- Multicast and broadcast discovery
+config          \- Configuration loading and saving
+connections     \- Connection handling
+db/sqlite       \- SQLite database
+dialer          \- Dialing connections
+discover        \- Remote device discovery
+events          \- Event generation and logging
+fs              \- Filesystem access
+main            \- Main package
+model           \- The root hub
+nat             \- NAT discovery and port mapping
+pmp             \- NAT\-PMP discovery and port mapping
+protocol        \- The BEP protocol
+relay/client    \- Relay client
+scanner         \- File change detection and hashing
+stun            \- STUN functionality
+syncthing       \- Main run facility
+upgrade         \- Binary upgrades
+upnp            \- UPnP discovery and port mapping
+ur              \- Usage reporting
+versioner       \- File versioning
+watchaggregator \- Filesystem event watcher
+.UNINDENT
+.UNINDENT
 .UNINDENT
 .UNINDENT
-.TP
-.B STBLOCKPROFILE
-Write block profiles to \fBblock\-$pid\-$timestamp.pprof\fP every 20 seconds.
-.TP
-.B STCPUPROFILE
-Write a CPU profile to \fBcpu\-$pid.pprof\fP on exit.
-.TP
-.B STDEADLOCKTIMEOUT
-Used for debugging internal deadlocks; sets debug sensitivity. Use only
-under direction of a developer.
 .TP
 .B STLOCKTHRESHOLD
 Used for debugging internal deadlocks; sets debug sensitivity. Use only
 under direction of a developer.
 .TP
-.B STGUIADDRESS
-Override GUI listen address.  Equivalent to passing \fI\%\-\-gui\-address\fP\&.
-.TP
-.B STGUIAPIKEY
-Override the API key needed to access the GUI / REST API.  Equivalent to
-passing \fI\%\-\-gui\-apikey\fP\&.
-.TP
-.B STGUIASSETS
-Directory to load GUI assets from. Overrides compiled in assets. Useful for
-developing webgui, commonly use \fBSTGUIASSETS=gui bin/syncthing\fP\&.
-.TP
-.B STHEAPPROFILE
-Write heap profiles to \fBheap\-$pid\-$timestamp.pprof\fP each time heap usage
-increases.
-.TP
-.B STNODEFAULTFOLDER
-Don’t create a default folder when starting for the first time. This
-variable will be ignored anytime after the first run.  Equivalent to the
-\fI\%\-\-no\-default\-folder\fP flag.
-.TP
-.B STNORESTART
-Equivalent to the \fI\%\-\-no\-restart\fP flag.
-.TP
-.B STNOUPGRADE
-Disable automatic upgrades.  Equivalent to the \fI\%\-\-no\-upgrade\fP flag.
-.TP
-.B STPROFILER
-Set to a listen address such as “127.0.0.1:9090” to start the profiler with
-HTTP access, which then can be reached at
-\X'tty: link http://localhost:9090/debug/pprof'\fI\%http://localhost:9090/debug/pprof\fP\X'tty: link'\&. See \fBgo tool pprof\fP for more
-information.
-.TP
-.B STPERFSTATS
-Write running performance statistics to \fBperf\-$pid.csv\fP\&. Not supported on
-Windows.
-.TP
-.B STRECHECKDBEVERY
-Time before folder statistics (file, dir, … counts) are recalculated from
-scratch. The given duration must be parseable by Go’s \fBtime.ParseDuration\fP\&. If
-missing or not parseable, the default value of 1 month is used. To force
-recalculation on every startup, set it to \fB1s\fP\&.
-.TP
-.B STGCINDIRECTEVERY
-Sets the time interval in between database garbage collection runs.  The
-given duration must be parseable by Go’s \fBtime.ParseDuration\fP\&.
+.B STVERSIONEXTRA
+Add extra information to the version string in logs and the version line
+in the GUI. Can be set to the name of a wrapper or tool controlling
+syncthing to communicate this to the end user.
 .TP
 .B GOMAXPROCS
 Set the maximum number of CPU cores to use. Defaults to all available CPU
@@ -612,6 +488,6 @@ Set to any nonempty value to use it.
 .SH AUTHOR
 The Syncthing Authors
 .SH COPYRIGHT
-2014-2019, The Syncthing Authors
+2014-2025, The Syncthing Authors
 .\" Generated by docutils manpage writer.
 .

relnotes/v2.0.md

@@ -15,8 +15,8 @@
   line options have been removed and will be ignored if given.
 
 - Deleted items are no longer kept forever in the database, instead they are
-  forgotten after six months. If your use case require deletes to take
-  effect after more than a six month delay, set the
+  forgotten after fifteen months. If your use case require deletes to take
+  effect after more than a fifteen month delay, set the
   `--db-delete-retention-interval` command line option or corresponding
   environment variable to zero, or a longer time interval of your choosing.
 

script/codecov-upload.sh

@@ -1133,7 +1133,7 @@ fi
 
 if [ "$ft_search" = "1" ];
 then
-  # detect bower comoponents location
+  # detect bower components location
   bower_components="bower_components"
   bower_rc=$(cd "$git_root" && cat .bowerrc 2>/dev/null || echo "")
   if [ "$bower_rc" != "" ];

test/h1/config.xml

@@ -65,7 +65,7 @@
         <remoteGUIPort>0</remoteGUIPort>
         <numConnections>3</numConnections>
     </device>
-    <gui enabled="true" tls="false" debugging="true" sendBasicAuthPrompt="false">
+    <gui enabled="true" tls="false" sendBasicAuthPrompt="false">
         <address>127.0.0.1:8081</address>
         <user>testuser</user>
         <password>$2a$10$7tKL5uvLDGn5s2VLPM2yWOK/II45az0mTel8hxAUJDRQN1Tk2QYwu</password>

test/h2/config.xml

@@ -65,7 +65,7 @@
         <remoteGUIPort>0</remoteGUIPort>
         <numConnections>3</numConnections>
     </device>
-    <gui enabled="true" tls="false" debugging="true" sendBasicAuthPrompt="false">
+    <gui enabled="true" tls="false" sendBasicAuthPrompt="false">
         <address>127.0.0.1:8082</address>
         <metricsWithoutAuth>false</metricsWithoutAuth>
         <apikey>abc123</apikey>

test/transfer-bench_test.go

@@ -75,7 +75,7 @@ func setupAndBenchmarkTransfer(t *testing.T, files, sizeExp int) {
 }
 
 // TestBenchmarkTransferSameFiles doesn't actually transfer anything, but tests
-// how fast two devicees get in sync if they have the same data locally.
+// how fast two devices get in sync if they have the same data locally.
 func TestBenchmarkTransferSameFiles(t *testing.T) {
 	cleanBenchmarkTransfer(t)
 

test/util.go

@@ -443,7 +443,7 @@ func startWalker(dir string, res chan<- fileInfo, abort <-chan struct{}) chan er
 				name: rn,
 				mode: info.Mode(),
 				// comparing timestamps with better precision than a second
-				// is problematic as there is rounding and truncatign going
+				// is problematic as there is rounding and truncation going
 				// on at every level
 				mod:  info.ModTime().Unix(),
 				size: info.Size(),