fix(model): don't clobber local flags when receiving index (#10190 )

feat(connections, nat): add UDP portmapping/pinhole for QUIC (fixes #7403 ) (#10171 )
Fixes #7403. Tested by enabling UPnP on the router, and checking on the router page that the external ports of the UDP mappings match what is shown in the logs and the internal ports matching the QUIC listening port.
2025-06-20 07:08:06 +00:00 · 2025-06-20 04:24:45 +00:00 · 2025-06-18 19:33:41 +02:00 · 2025-06-17 12:27:12 +02:00 · 2025-06-17 09:46:38 +02:00 · 2025-06-16 15:12:33 +00:00
134 changed files with 1462 additions and 790 deletions
@@ -1,6 +1,7 @@
 name: Feature request
 description: File a new feature request
 labels: ["enhancement", "needs-triage"]
+type: Feature
 body:

  - type: textarea
@@ -1,6 +1,7 @@
 name: Bug report
 description: If you're actually looking for support instead, see "I need help / I have a question".
 labels: ["bug", "needs-triage"]
+type: Bug
 body:
  - type: markdown
    attributes:
@@ -0,0 +1,23 @@
+version: 1
+labels:
+
+- label: enhancement
+  title: ^feat\b
+
+- label: bug
+  title: ^fix\b
+
+- label: documentation
+  title: ^docs\b
+
+- label: chore
+  title: ^chore\b
+
+- label: chore
+  title: ^refactor\b
+
+- label: build
+  title: ^build\b
+
+- label: dependencies
+  title: ^build\(deps\)\b
@@ -0,0 +1,52 @@
+  version: 1
+  creds:
+    - registry: docker.io
+      user: "{{env \"DOCKERHUB_USERNAME\"}}"
+      pass: "{{env \"DOCKERHUB_TOKEN\"}}"
+
+  defaults:
+    ratelimit:
+      min: 100
+      retry: 1m
+    parallel: 4
+
+  sync:
+
+    - source: ghcr.io/syncthing/syncthing
+      target: docker.io/syncthing/syncthing
+      type: repository
+      tags:
+        allow:
+          - latest
+          - rc
+          - edge
+          - \d+
+          - \d+\.\d+
+          - \d+\.\d+\.\d+
+          - \d+\.\d+\.\d+-rc\.\d+
+
+    - source: ghcr.io/syncthing/relaysrv
+      target: docker.io/syncthing/relaysrv
+      type: repository
+      tags:
+        allow:
+          - latest
+          - rc
+          - edge
+          - \d+
+          - \d+\.\d+
+          - \d+\.\d+\.\d+
+          - \d+\.\d+\.\d+-rc\.\d+
+
+    - source: ghcr.io/syncthing/discosrv
+      target: docker.io/syncthing/discosrv
+      type: repository
+      tags:
+        allow:
+          - latest
+          - rc
+          - edge
+          - \d+
+          - \d+\.\d+
+          - \d+\.\d+\.\d+
+          - \d+\.\d+\.\d+-rc\.\d+
@@ -0,0 +1,17 @@
+changelog:
+  exclude:
+    labels:
+      - dependencies
+
+  categories:
+    - title: Fixes
+      labels:
+        - bug
+
+    - title: Features
+      labels:
+        - enhancement
+
+    - title: Other
+      labels:
+        - '*'
@@ -3,6 +3,9 @@ name: Build Syncthing
 on:
  pull_request:
  push:
+    branches-ignore:
+      - release
+      - release-rc*
  workflow_call:
  workflow_dispatch:

@@ -34,6 +37,51 @@ env:

 jobs:

+  #
+  # Source
+  #
+
+  facts:
+    name: Gather common facts
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.get-version.outputs.version }}
+      release-kind: ${{ steps.get-version.outputs.release-kind }}
+      go-version: ${{ steps.get-go.outputs.go-version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: false
+          check-latest: true
+
+      - name: Get Syncthing version
+        id: get-version
+        run: |
+          version=$(go run build.go version)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Version: $version"
+
+          kind=stable
+          if [[ $version == *-rc.[0-9] || $version == *-rc.[0-9][0-9] ]] ; then
+            kind=candidate
+          elif [[ $version == *-* ]] ; then
+            kind=nightly
+          fi
+          echo "release-kind=$kind" >> "$GITHUB_OUTPUT"
+          echo "Release kind: $kind"
+
+      - name: Get Go version
+        id: get-go
+        run: |
+          go version
+          echo "go-version=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_OUTPUT
+
  #
  # Tests for all platforms. Runs a matrix build on Windows, Linux and Mac,
  # with the list of expected supported Go versions (current, previous).
@@ -108,6 +156,8 @@ jobs:
      - package-debian
      - package-windows
      - govulncheck
+      - golangci
+      - meta
    steps:
      - uses: actions/checkout@v4

@@ -118,17 +168,18 @@ jobs:
  package-windows:
    name: Package for Windows
    runs-on: ubuntu-latest
+    needs:
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true

      - uses: mlugg/setup-zig@v2

@@ -137,7 +188,7 @@ jobs:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-package-windows-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ needs.facts.outputs.go-version }}-package-windows-${{ hashFiles('**/go.sum') }}

      - name: Install dependencies
        run: |
@@ -160,6 +211,12 @@ jobs:
          name: unsigned-packages-windows
          path: "*.zip"

+  #
+  # Codesign binaries for Windows. This job runs only when called in the
+  # Syncthing repo for release branches and tags, as it requires our
+  # specific code signing keys etc.
+  #
+
  codesign-windows:
    name: Codesign for Windows
    if: github.repository_owner == 'syncthing' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/release-nightly' || startsWith(github.ref, 'refs/tags/v'))
@@ -220,22 +277,18 @@ jobs:
  package-linux:
    name: Package for Linux
    runs-on: ubuntu-latest
+    needs:
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true
-
-      - name: Get actual Go version
-        run: |
-          go version
-          echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV

      - uses: mlugg/setup-zig@v2

@@ -244,7 +297,7 @@ jobs:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-package-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ needs.facts.outputs.go-version }}-package-${{ hashFiles('**/go.sum') }}

      - name: Create packages
        run: |
@@ -277,39 +330,36 @@ jobs:
            compat.json

  #
-  # macOS
+  # macOS. The entire build runs in the release environment because code
+  # signing is part of the build process, so it is limited to release
+  # branches on the Syncthing repo.
  #

  package-macos:
    name: Package for macOS
-    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/release-nightly' || startsWith(github.ref, 'refs/tags/v'))
+    if: github.repository_owner == 'syncthing' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/release-nightly' || startsWith(github.ref, 'refs/tags/v'))
    environment: release
+    runs-on: macos-latest
+    needs:
+      - facts
    env:
      CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}
-    runs-on: macos-latest
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true
-
-      - name: Get actual Go version
-        run: |
-          go version
-          echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV

      - uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-package-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ needs.facts.outputs.go-version }}-package-${{ hashFiles('**/go.sum') }}

      - name: Import signing certificate
        if: env.CODESIGN_IDENTITY != ''
@@ -419,29 +469,25 @@ jobs:
  package-cross:
    name: Package cross compiled
    runs-on: ubuntu-latest
+    needs:
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true
-
-      - name: Get actual Go version
-        run: |
-          go version
-          echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV

      - uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-cross-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ needs.facts.outputs.go-version }}-cross-${{ hashFiles('**/go.sum') }}

      - name: Create packages
        run: |
@@ -489,33 +535,33 @@ jobs:
  package-source:
    name: Package source code
    runs-on: ubuntu-latest
+    needs:
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true

      - name: Package source
        run: |
-          version=$(go run build.go version)
-          echo "$version" > RELEASE
+          echo "$VERSION" > RELEASE

          go mod vendor
          go run build.go assets

          cd ..

-          tar c -z -f "syncthing-source-$version.tar.gz" \
+          tar c -z -f "syncthing-source-$VERSION.tar.gz" \
            --exclude .git \
            syncthing

-          mv "syncthing-source-$version.tar.gz" syncthing
+          mv "syncthing-source-$VERSION.tar.gz" syncthing

      - name: Archive artifacts
        uses: actions/upload-artifact@v4
@@ -537,27 +583,26 @@ jobs:
      - package-macos
      - package-cross
      - package-source
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - uses: actions/checkout@v4
        with:
          repository: syncthing/release-tools
          path: tools
-          fetch-depth: 0

      - name: Download artifacts
        uses: actions/download-artifact@v4

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true

      - name: Install signing tool
        run: |
@@ -584,9 +629,6 @@ jobs:
          sha256sum "${files[@]}" > sha256sum.txt
          popd

-          version=$(go run build.go version)
-          echo "VERSION=$version" >> $GITHUB_ENV
-
      - name: Sign shasum files
        uses: docker://ghcr.io/kastelo/ezapt:latest
        with:
@@ -622,22 +664,18 @@ jobs:
  package-debian:
    name: Package for Debian
    runs-on: ubuntu-latest
+    needs:
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true
-
-      - name: Get actual Go version
-        run: |
-          go version
-          echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV

      - uses: ruby/setup-ruby@v1
        with:
@@ -654,13 +692,14 @@ jobs:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-debian-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ needs.facts.outputs.go-version }}-debian-${{ hashFiles('**/go.sum') }}

      - name: Package for Debian (CGO)
        run: |
          for tgt in syncthing stdiscosrv strelaysrv ; do
            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch amd64 -cc "zig cc -target x86_64-linux-musl" deb "$tgt"
-            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch arm -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" deb "$tgt"
+            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch armel -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" deb "$tgt"
+            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch armhf -cc "zig cc -target arm-linux-musleabi -mcpu=arm1136j_s" deb "$tgt"
            go run build.go -no-upgrade -installsuffix=no-upgrade -tags "${{env.TAGS}}" -goos linux -goarch arm64 -cc "zig cc -target aarch64-linux-musl" deb "$tgt"
          done
        env:
@@ -684,13 +723,13 @@ jobs:
    environment: release
    needs:
      - sign-for-upgrade
+      - facts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: syncthing/release-tools
          path: tools
-          fetch-depth: 0

      - name: Download artifacts
        uses: actions/download-artifact@v4
@@ -700,9 +739,8 @@ jobs:

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true

      - name: Create release json
        run: |
@@ -722,7 +760,7 @@ jobs:
          RCLONE_CONFIG_OBJSTORE_REGION: ${{ secrets.S3_REGION }}
          RCLONE_CONFIG_OBJSTORE_ACL: public-read
        with:
-          args: sync -v packages objstore:nightly
+          args: sync -v --no-update-modtime packages objstore:nightly

  #
  # Push release artifacts to Spaces
@@ -737,6 +775,10 @@ jobs:
    needs:
      - sign-for-upgrade
      - package-debian
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
@@ -758,14 +800,8 @@ jobs:

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true
-
-      - name: Set version
-        run: |
-          version=$(go run build.go version)
-          echo "VERSION=$version" >> $GITHUB_ENV

      - name: Push to object store (${{ env.VERSION }})
        uses: docker://docker.io/rclone/rclone:latest
@@ -778,7 +814,7 @@ jobs:
          RCLONE_CONFIG_OBJSTORE_REGION: ${{ secrets.S3_REGION }}
          RCLONE_CONFIG_OBJSTORE_ACL: public-read
        with:
-          args: sync -v packages objstore:release/${{ env.VERSION }}
+          args: sync -v --no-update-modtime packages objstore:release/${{ env.VERSION }}

      - name: Push to object store (latest)
        uses: docker://docker.io/rclone/rclone:latest
@@ -791,9 +827,9 @@ jobs:
          RCLONE_CONFIG_OBJSTORE_REGION: ${{ secrets.S3_REGION }}
          RCLONE_CONFIG_OBJSTORE_ACL: public-read
        with:
-          args: sync -v objstore:release/${{ env.VERSION }} objstore:release/latest
+          args: sync -v --no-update-modtime objstore:release/${{ env.VERSION }} objstore:release/latest

-      - name: Create GitHub release and push binaries
+      - name: Create GitHub releases and push binaries
        run: |
          maybePrerelease=""
          if [[ $VERSION == *-* ]]; then
@@ -801,19 +837,33 @@ jobs:
          fi
          export GH_PROMPT_DISABLED=1
          if ! gh release view --json name "$VERSION" >/dev/null 2>&1 ; then
-            gh release create \
-              "$VERSION" \
+            gh release create "$VERSION" \
              $maybePrerelease \
              --title "$VERSION" \
              --notes-from-tag
          fi
-          gh release upload "$VERSION" \
+          gh release upload --clobber "$VERSION" \
            packages/*.asc packages/*.json \
            packages/syncthing-*.tar.gz \
            packages/syncthing-*.zip \
-            packages/syncthing*.deb
+            packages/syncthing_*.deb
+
+          PKGS=$(pwd)/packages
+          cd /tmp # gh will not release for repo x while inside repo y
+          for repo in relaysrv discosrv ; do
+            export GH_REPO="syncthing/$repo"
+            if ! gh release view --json name "$VERSION" >/dev/null 2>&1 ; then
+              gh release create "$VERSION" \
+                $maybePrerelease \
+                --title "$VERSION" \
+                --notes "https://github.com/syncthing/syncthing/releases/tag/$VERSION"
+            fi
+            gh release upload --clobber "$VERSION" \
+              $PKGS/*.asc \
+              $PKGS/*${repo}*
+          done
        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.ACTIONS_GITHUB_TOKEN }}

  #
  # Push Debian/APT archive
@@ -825,12 +875,13 @@ jobs:
    environment: release
    needs:
      - package-debian
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - name: Download packages
        uses: actions/download-artifact@v4
@@ -838,26 +889,11 @@ jobs:
          name: debian-packages
          path: packages

-      - name: Set version
-        run: |
-          version=$(go run build.go version)
-          echo "Version: $version"
-          echo "VERSION=$version" >> $GITHUB_ENV
-
      # Decide whether packages should go to stable, candidate or nightly
      - name: Prepare packages
        run: |
-          kind=stable
-          if [[ $VERSION == v2* ]] ; then
-            kind=v2
-          elif [[ $VERSION == *-rc.[0-9] ]] ; then
-            kind=candidate
-          elif [[ $VERSION == *-* ]] ; then
-            kind=nightly
-          fi
-          echo "Kind: $kind"
-          mkdir -p packages/syncthing/$kind
-          mv packages/*.deb packages/syncthing/$kind
+          mkdir -p packages/syncthing/$RELEASE_KIND
+          mv packages/*.deb packages/syncthing/$RELEASE_KIND

      - name: Pull archive
        uses: docker://docker.io/rclone/rclone:latest
@@ -893,22 +929,23 @@ jobs:
          RCLONE_CONFIG_OBJSTORE_REGION: ${{ secrets.S3_REGION }}
          RCLONE_CONFIG_OBJSTORE_ACL: public-read
        with:
-          args: sync -v dists objstore:apt/dists
+          args: sync -v --no-update-modtime dists objstore:apt/dists

  #
-  # Build and push to Docker Hub
+  # Build and push (except for PRs) to GHCR.
  #

-  docker-syncthing:
-    name: Build and push Docker images
+  docker-ghcr:
+    name: Build and push Docker images (GHCR)
    runs-on: ubuntu-latest
-    if: github.repository_owner == 'syncthing' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release-nightly' || github.ref == 'refs/heads/infrastructure' || startsWith(github.ref, 'refs/tags/v'))
-    environment: docker
-    env:
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
    permissions:
      contents: read
      packages: write
+    needs:
+      - facts
+    env:
+      VERSION: ${{ needs.facts.outputs.version }}
+      RELEASE_KIND: ${{ needs.facts.outputs.release-kind }}
    strategy:
      matrix:
        pkg:
@@ -927,20 +964,11 @@ jobs:
            image: discosrv
    steps:
      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true
-
-      - name: Get actual Go version
-        run: |
-          go version
-          echo "GO_VERSION=$(go version | sed 's#^.*go##;s# .*##')" >> $GITHUB_ENV

      - uses: mlugg/setup-zig@v2

@@ -949,7 +977,7 @@ jobs:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-docker-${{ matrix.pkg }}-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ needs.facts.outputs.go-version }}-docker-${{ matrix.pkg }}-${{ hashFiles('**/go.sum') }}

      - name: Build binaries (CGO)
        run: |
@@ -969,14 +997,6 @@ jobs:
          BUILD_USER: docker
          EXTRA_LDFLAGS: "-linkmode=external -extldflags=-static"

-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        if: env.DOCKERHUB_USERNAME != ''
-        with:
-          registry: docker.io
-          username: ${{ env.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
@@ -989,8 +1009,7 @@ jobs:

      - name: Set version tags
        run: |
-          version=$(go run build.go version)
-          version=${version#v}
+          version=${VERSION#v}
          repo=ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
          ref="${{github.ref_name}}"
          ref=${ref//\//-} # slashes to dashes
@@ -1008,16 +1027,8 @@ jobs:
            tags=$repo:$ref
          fi

-          # If we have a Docker Hub secret, also push to there.
-          if [[ $DOCKERHUB_USERNAME != "" ]] ; then
-            dockerhubtags="${tags//ghcr.io\/syncthing/docker.io\/syncthing}"
-            tags="$tags,$dockerhubtags"
-          fi
-
          echo Pushing to $tags
-
          echo "DOCKER_TAGS=$tags" >> $GITHUB_ENV
-          echo "VERSION=$version" >> $GITHUB_ENV

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
@@ -1026,11 +1037,35 @@ jobs:
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64,linux/arm64,linux/arm/7
          tags: ${{ env.DOCKER_TAGS }}
-          push: true
+          push: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
          labels: |
            org.opencontainers.image.version=${{ env.VERSION }}
            org.opencontainers.image.revision=${{ github.sha }}

+  #
+  # Sync images to Docker hub. This takes the images already pushed to GHCR
+  # and copies them to Docker hub. Runs for releases only.
+  #
+
+  docker-hub:
+    name: Sync images to Docker hub
+    if: github.repository_owner == 'syncthing' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release-nightly' || github.ref == 'refs/heads/infrastructure' || startsWith(github.ref, 'refs/tags/v'))
+    runs-on: ubuntu-latest
+    needs:
+      - docker-ghcr
+    environment: docker
+    env:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Sync images
+        uses: docker://docker.io/regclient/regsync:latest
+        with:
+          args:
+            -c ./.github/regsync.yml
+            once
+
  #
  # Check for known vulnerabilities in Go dependencies
  #
@@ -1038,17 +1073,57 @@ jobs:
  govulncheck:
    runs-on: ubuntu-latest
    name: Run govulncheck
+    needs:
+      - facts
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ needs.facts.outputs.go-version }}
          cache: false
-          check-latest: true

      - name: run govulncheck
        run: |
          go run build.go assets
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...
+
+  #
+  # golangci-lint runs a suite of static analysis checks on the code
+  #
+
+  golangci:
+    runs-on: ubuntu-latest
+    name: Run golangci-lint
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+
+      - name: ensure asset generation
+        run: go run build.go assets
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v8
+        with:
+          only-new-issues: true
+
+  #
+  # Meta checks for formatting, copyright, etc
+  #
+
+  meta:
+    name: Run meta checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+
+      - run: |
+          go run build.go assets
+          go test -v ./meta
@@ -1,49 +0,0 @@
-name: Run PR linters
-
-on:
-  pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-
-  #
-  # golangci-lint runs a suite of static analysis checks on the code
-  #
-
-  golangci:
-    runs-on: ubuntu-latest
-    name: Golangci-lint
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-
-      - name: ensure asset generation
-        run: go run build.go assets
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
-        with:
-          only-new-issues: true
-
-  #
-  # Meta checks for formatting, copyright, etc
-  #
-
-  meta:
-    name: Meta checks
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-
-      - run: |
-          go run build.go assets
-          go test -v ./meta
@@ -0,0 +1,27 @@
+name: PR metadata
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+
+  #
+  # Set labels on PRs, which are then used to categorise release notes
+  #
+
+  labels:
+    name: Set labels
+    runs-on: ubuntu-latest
+    steps:
+    - uses: srvaroa/labeler@v1
+      env:
+        GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
@@ -19,22 +19,18 @@ jobs:
        with:
          fetch-depth: 0
          ref: ${{ github.ref }} # https://github.com/actions/checkout/issues/882
-          token: ${{ secrets.STRELEASE_GITHUB_TOKEN }}
+          token: ${{ secrets.ACTIONS_GITHUB_TOKEN }}

      - uses: actions/setup-go@v5
        with:
          go-version: stable

-      - name: Get svu
-        run: |
-          go install github.com/caarlos0/svu@latest
-
      - name: Determine version to release
        run: |
          if [[ "$GITHUB_REF_NAME" == "release" ]] ; then
-            next=$(svu next)
+            next=$(go run ./script/next-version.go)
          else
-            next=$(svu prerelease --pre-release rc)
+            next=$(go run ./script/next-version.go --pre)
          fi
          echo "NEXT=$next" >> $GITHUB_ENV
          echo "Next version is $next"
@@ -47,7 +43,7 @@ jobs:
        run: |
          go run ./script/relnotes.go --new-ver "$NEXT" --branch "$GITHUB_REF_NAME" --prev-ver "$PREV" > notes.md
        env:
-          GITHUB_TOKEN: ${{ secrets.STRELEASE_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.ACTIONS_GITHUB_TOKEN }}

      - name: Create and push tag
        run: |
@@ -55,3 +51,10 @@ jobs:
          git config --global user.email 'release@syncthing.net'
          git tag -a -F notes.md --cleanup=whitespace "$NEXT"
          git push origin "$NEXT"
+
+      - name: Trigger the build
+        uses: benc-uk/workflow-dispatch@v1
+        with:
+          workflow: build-syncthing.yaml
+          ref: refs/tags/${{ env.NEXT }}
+          token: ${{ secrets.ACTIONS_GITHUB_TOKEN }}
@@ -8,12 +8,14 @@ linters:
    - exhaustive
    - exhaustruct
    - forbidigo
+    - funcorder
    - funlen
    - gochecknoglobals
    - gochecknoinits
    - gocognit
    - goconst
    - gocyclo
+    - godot
    - godox
    - gomoddirectives
    - inamedparam
@@ -49,6 +51,7 @@ linters:
      - std-error-handling
    paths:
      - internal/gen
+      - internal/db/olddb
      - cmd/dev
      - repos
      - third_party$
@@ -56,10 +56,12 @@ Anthony Goeckner <agoeckner@users.noreply.github.com>
 Antoine Lamielle (0x010C) <antoine.lamielle@0x010c.fr> <gh@0x010c.fr>
 Anur <anurnomeru@163.com>
 Aranjedeath <Aranjedeath@users.noreply.github.com>
+ardevd <ardevd@users.noreply.github.com>
 Arkadiusz Tymiński <gevleeog@gmail.com>
 Aroun <login@b-vo.fr>
 Arthur Axel fREW Schmidt (frioux) <frew@afoolishmanifesto.com> <frioux@gmail.com>
 Artur Zubilewicz <AkaZecik@users.noreply.github.com>
+Ashish Bhate <bhate.ashish@gmail.com>
 Aurélien Rainone <476650+arl@users.noreply.github.com>
 BAHADIR YILMAZ <bahadiryilmaz32@gmail.com>
 Bart De Vries (mogwa1) <devriesb@gmail.com>
@@ -192,6 +194,7 @@ Luke Hamburg <1992842+luckman212@users.noreply.github.com>
 luzpaz <luzpaz@users.noreply.github.com>
 Majed Abdulaziz (majedev) <majed.alhajry@gmail.com>
 Marc Laporte (marclaporte) <marc@marclaporte.com> <marc@laporte.name>
+Marcel Meyer <mm.marcelmeyer@gmail.com>
 Marcin Dziadus (marcindziadus) <dziadus.marcin@gmail.com>
 Marcus B Spencer <marcus@marcusspencer.xyz> <marcus@marcusspencer.us>
 Marcus Legendre <marcus.legendre@gmail.com>
@@ -252,6 +255,7 @@ Philippe Schommers (filoozoom) <philippe@schommers.be>
 Phill Luby (pluby) <phill.luby@newredo.com>
 Piotr Bejda (piobpl) <piotrb10@gmail.com>
 polyfloyd <polyfloyd@users.noreply.github.com>
+pullmerge <166967364+pullmerge@users.noreply.github.com>
 Quentin Hibon <qh.public@yahoo.com>
 Rahmi Pruitt <rjpruitt16@gmail.com>
 red_led <red-led@users.noreply.github.com>
@@ -329,7 +329,7 @@ func runCommand(cmd string, target target) {
 		writeCompatJSON()

 	case "deb":
-		buildDeb(target)
+		buildDeb(target, tags)

 	case "vet":
 		metalintShort()
@@ -592,7 +592,7 @@ func buildZip(target target, tags []string) {
 	fmt.Println(filename)
 }

-func buildDeb(target target) {
+func buildDeb(target target, tags []string) {
 	os.RemoveAll("deb")

 	// "goarch" here is set to whatever the Debian packages expect. We correct
@@ -606,7 +606,7 @@ func buildDeb(target target) {
 		goarch = "arm"
 	}

-	build(target, []string{"noupgrade"})
+	build(target, append(tags, "noupgrade"))

 	for i := range target.installationFiles {
 		target.installationFiles[i].src = strings.Replace(target.installationFiles[i].src, "{{binary}}", target.BinaryName(), 1)
@@ -922,6 +922,9 @@ func rmr(paths ...string) {
 }

 func getReleaseVersion() (string, error) {
+	if ver := os.Getenv("VERSION"); ver != "" {
+		return strings.TrimSpace(ver), nil
+	}
 	bs, err := os.ReadFile("RELEASE")
 	if err != nil {
 		return "", err
@@ -966,7 +969,7 @@ func getGitVersion() (string, error) {
 }

 func getVersion() string {
-	// First try for a RELEASE file,
+	// First try for a RELEASE file or $VERSION env var,
 	if ver, err := getReleaseVersion(); err == nil {
 		return ver
 	}
@@ -620,7 +620,7 @@ func createTestCertificate() tls.Certificate {
 	}

 	certFile, keyFile := filepath.Join(tmpDir, "cert.pem"), filepath.Join(tmpDir, "key.pem")
-	cert, err := tlsutil.NewCertificate(certFile, keyFile, "relaypoolsrv", 20*365)
+	cert, err := tlsutil.NewCertificate(certFile, keyFile, "relaypoolsrv", 20*365, false)
 	if err != nil {
 		log.Fatalln("Failed to create test X509 key pair:", err)
 	}
@@ -173,7 +173,7 @@ func fetchStats(relay *relay) *stats {

 	var stats stats

-	if json.NewDecoder(response.Body).Decode(&stats); err != nil {
+	if err := json.NewDecoder(response.Body).Decode(&stats); err != nil {
 		return nil
 	}
 	return &stats
@@ -201,17 +201,21 @@ func (p *proxy) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 // looking for a prerelease at all.
 func filterForLatest(rels []upgrade.Release) []upgrade.Release {
 	var filtered []upgrade.Release
-	var havePre bool
+	havePre := make(map[string]bool)
+	haveStable := make(map[string]bool)
 	for _, rel := range rels {
-		if !rel.Prerelease {
-			// We found a stable version, we're good now.
+		major, _, _ := strings.Cut(rel.Tag, ".")
+		if !rel.Prerelease && !haveStable[major] {
+			// Remember the first non-pre for each major
 			filtered = append(filtered, rel)
-			break
+			haveStable[major] = true
+			continue
 		}
-		if rel.Prerelease && !havePre {
-			// We remember the first prerelease we find.
+		if rel.Prerelease && !havePre[major] && !haveStable[major] {
+			// We remember the first prerelease we find, unless we've
+			// already found a non-pre of the same major.
 			filtered = append(filtered, rel)
-			havePre = true
+			havePre[major] = true
 		}
 	}
 	return filtered
@@ -115,7 +115,7 @@ func BenchmarkAPIRequests(b *testing.B) {
 	srv := httptest.NewServer(http.HandlerFunc(api.handler))

 	kf := b.TempDir() + "/cert"
-	crt, err := tlsutil.NewCertificate(kf+".crt", kf+".key", "localhost", 7)
+	crt, err := tlsutil.NewCertificate(kf+".crt", kf+".key", "localhost", 7, true)
 	if err != nil {
 		b.Fatal(err)
 	}
@@ -107,7 +107,7 @@ func main() {
 		cert, err = tls.LoadX509KeyPair(cli.Cert, cli.Key)
 		if os.IsNotExist(err) {
 			log.Println("Failed to load keypair. Generating one, this might take a while...")
-			cert, err = tlsutil.NewCertificate(cli.Cert, cli.Key, "stdiscosrv", 20*365)
+			cert, err = tlsutil.NewCertificate(cli.Cert, cli.Key, "stdiscosrv", 20*365, false)
 			if err != nil {
 				log.Fatalln("Failed to generate X509 key pair:", err)
 			}
@@ -157,7 +157,7 @@ func main() {
 	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
 	if err != nil {
 		log.Println("Failed to load keypair. Generating one, this might take a while...")
-		cert, err = tlsutil.NewCertificate(certFile, keyFile, "strelaysrv", 20*365)
+		cert, err = tlsutil.NewCertificate(certFile, keyFile, "strelaysrv", 20*365, false)
 		if err != nil {
 			log.Fatalln("Failed to generate X509 key pair:", err)
 		}
@@ -14,7 +14,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
-	"sort"
+	"slices"
 	"strings"
 	"time"
 )
@@ -37,7 +37,9 @@ func uploadPanicLogs(ctx context.Context, urlBase, dir string) {
 		return
 	}

-	sort.Sort(sort.Reverse(sort.StringSlice(files)))
+	slices.SortFunc(files, func(a, b string) int {
+		return strings.Compare(b, a)
+	})
 	for _, file := range files {
 		if strings.Contains(file, ".reported.") {
 			// We've already sent this file. It'll be cleaned out at some
@@ -403,9 +403,11 @@ func upgradeViaRest() error {
 	if err != nil {
 		return err
 	}
+
+	defer resp.Body.Close()
+
 	if resp.StatusCode != 200 {
 		bs, err := io.ReadAll(resp.Body)
-		defer resp.Body.Close()
 		if err != nil {
 			return err
 		}
@@ -473,6 +475,7 @@ func (c *serveCmd) syncthingMain() {
 		os.Exit(svcutil.ExitError.AsInt())
 	}
 	earlyService.Add(cfgWrapper)
+	config.RegisterInfoMetrics(cfgWrapper)

 	// Candidate builds should auto upgrade. Make sure the option is set,
 	// unless we are in a build where it's disabled or the STNOUPGRADE
@@ -610,8 +613,7 @@ func setupSignalHandling(app *syncthing.App) {
 	// Exit cleanly with "restarting" code on SIGHUP.

 	restartSign := make(chan os.Signal, 1)
-	sigHup := syscall.Signal(1)
-	signal.Notify(restartSign, sigHup)
+	signal.Notify(restartSign, syscall.SIGHUP)
 	go func() {
 		<-restartSign
 		app.Stop(svcutil.ExitRestart)
@@ -238,19 +238,18 @@ func copyStderr(stderr io.Reader, dst io.Writer) {
 			return
 		}

-		if panicFd == nil {
-			dst.Write([]byte(line))
+		dst.Write([]byte(line))

-			if strings.HasPrefix(line, "panic:") || strings.HasPrefix(line, "fatal error:") {
-				panicFd, err = os.Create(locations.GetTimestamped(locations.PanicLog))
-				if err != nil {
-					l.Warnln("Create panic log:", err)
-					continue
-				}
+		if panicFd == nil && (strings.HasPrefix(line, "panic:") || strings.HasPrefix(line, "fatal error:")) {
+			panicFd, err = os.Create(locations.GetTimestamped(locations.PanicLog))
+			if err != nil {
+				l.Warnln("Create panic log:", err)
+				continue
+			}

-				l.Warnf("Panic detected, writing to \"%s\"", panicFd.Name())
-				if strings.Contains(line, "leveldb") && strings.Contains(line, "corrupt") {
-					l.Warnln(`
+			l.Warnf("Panic detected, writing to \"%s\"", panicFd.Name())
+			if strings.Contains(line, "leveldb") && strings.Contains(line, "corrupt") {
+				l.Warnln(`
 *********************************************************************************
 * Crash due to corrupt database.                                                *
 *                                                                               *
@@ -263,22 +262,21 @@ func copyStderr(stderr io.Reader, dst io.Writer) {
 *   https://docs.syncthing.net/users/faq.html#my-syncthing-database-is-corrupt  *
 *********************************************************************************
 `)
-				} else {
-					l.Warnln("Please check for existing issues with similar panic message at https://github.com/syncthing/syncthing/issues/")
-					l.Warnln("If no issue with similar panic message exists, please create a new issue with the panic log attached")
-				}
-
-				stdoutMut.Lock()
-				for _, line := range stdoutFirstLines {
-					panicFd.WriteString(line)
-				}
-				panicFd.WriteString("...\n")
-				for _, line := range stdoutLastLines {
-					panicFd.WriteString(line)
-				}
-				stdoutMut.Unlock()
+			} else {
+				l.Warnln("Please check for existing issues with similar panic message at https://github.com/syncthing/syncthing/issues/")
+				l.Warnln("If no issue with similar panic message exists, please create a new issue with the panic log attached")
 			}

+			stdoutMut.Lock()
+			for _, line := range stdoutFirstLines {
+				panicFd.WriteString(line)
+			}
+			panicFd.WriteString("...\n")
+			for _, line := range stdoutLastLines {
+				panicFd.WriteString(line)
+			}
+			stdoutMut.Unlock()
+
 			panicFd.WriteString("Panic at " + time.Now().Format(time.RFC3339) + "\n")
 		}

@@ -32,3 +32,10 @@
    darwin: "20"
    linux: "3.2"
    windows: "10.0"
+
+- runtime: go1.25
+  requirements:
+    # macOS 12 (Monterey) per https://tip.golang.org/doc/go1.25#darwin
+    darwin: "21"
+    linux: "3.2"
+    windows: "10.0"
@@ -18,4 +18,4 @@ env STNORESTART=yes
 respawn

 # the syncthing command Upstart is to execute when it is started up
-exec $SYNCTHING_EXE -no-browser
+exec $SYNCTHING_EXE --no-browser
@@ -5,11 +5,12 @@ go 1.23.0
 require (
 	github.com/AudriusButkevicius/recli v0.0.7-0.20220911121932-d000ce8fbf0f
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1
-	github.com/alecthomas/kong v1.10.0
+	github.com/alecthomas/kong v1.11.0
 	github.com/aws/aws-sdk-go v1.55.7
 	github.com/calmh/incontainer v1.0.0
 	github.com/calmh/xdr v1.2.0
 	github.com/ccding/go-stun v0.1.5
+	github.com/coreos/go-semver v0.3.1
 	github.com/d4l3k/messagediff v1.2.1
 	github.com/getsentry/raven-go v0.2.0
 	github.com/go-ldap/ldap/v3 v3.4.11
@@ -30,24 +31,24 @@ require (
 	github.com/pierrec/lz4/v4 v4.1.22
 	github.com/prometheus/client_golang v1.22.0
 	github.com/puzpuzpuz/xsync/v3 v3.5.1
-	github.com/quic-go/quic-go v0.51.0
+	github.com/quic-go/quic-go v0.52.0
 	github.com/rabbitmq/amqp091-go v1.10.0
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9
 	github.com/shirou/gopsutil/v4 v4.25.4
-	github.com/syncthing/notify v0.0.0-20250207082249-f0fa8f99c2bc
+	github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d
 	github.com/thejerf/suture/v4 v4.0.6
 	github.com/urfave/cli v1.22.16
 	github.com/vitrun/qart v0.0.0-20160531060029-bf64b92db6b0
 	github.com/willabides/kongplete v0.4.0
 	go.uber.org/automaxprocs v1.6.0
-	golang.org/x/crypto v0.37.0
+	golang.org/x/crypto v0.38.0
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
-	golang.org/x/net v0.39.0
-	golang.org/x/sys v0.32.0
-	golang.org/x/text v0.24.0
+	golang.org/x/net v0.40.0
+	golang.org/x/sys v0.33.0
+	golang.org/x/text v0.25.0
 	golang.org/x/time v0.11.0
-	golang.org/x/tools v0.32.0
+	golang.org/x/tools v0.33.0
 	google.golang.org/protobuf v1.36.6
 	modernc.org/sqlite v1.37.0
 	sigs.k8s.io/yaml v1.4.0
@@ -99,7 +100,7 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.uber.org/mock v0.5.2 // indirect
 	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/sync v0.13.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.62.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
@@ -19,8 +19,8 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83
 github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/kong v1.10.0 h1:8K4rGDpT7Iu+jEXCIJUeKqvpwZHbsFRoebLbnzlmrpw=
-github.com/alecthomas/kong v1.10.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
+github.com/alecthomas/kong v1.11.0 h1:y++1gI7jf8O7G7l4LZo5ASFhrhJvzc+WgF/arranEmM=
+github.com/alecthomas/kong v1.11.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
@@ -48,6 +48,8 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
 github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/d4l3k/messagediff v1.2.1 h1:ZcAIMYsUg0EAp9X+tt8/enBE/Q8Yd5kzPynLyKptt9U=
@@ -223,8 +225,8 @@ github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0leargg
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/puzpuzpuz/xsync/v3 v3.5.1 h1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=
 github.com/puzpuzpuz/xsync/v3 v3.5.1/go.mod h1:VjzYrABPabuM4KyBh1Ftq6u8nhwY5tBPKP9jpmh0nnA=
-github.com/quic-go/quic-go v0.51.0 h1:K8exxe9zXxeRKxaXxi/GpUqYiTrtdiWP8bo1KFya6Wc=
-github.com/quic-go/quic-go v0.51.0/go.mod h1:MFlGGpcpJqRAfmYi6NC2cptDPSxRWTOGNuP4wqrWmzQ=
+github.com/quic-go/quic-go v0.52.0 h1:/SlHrCRElyaU6MaEPKqKr9z83sBg2v4FLLvWM+Z47pA=
+github.com/quic-go/quic-go v0.52.0/go.mod h1:MFlGGpcpJqRAfmYi6NC2cptDPSxRWTOGNuP4wqrWmzQ=
 github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=
 github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
 github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 h1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=
@@ -255,8 +257,8 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/syncthing/notify v0.0.0-20250207082249-f0fa8f99c2bc h1:xc3UfSFlH/X5hRw3h21RF6WXnRUYKmGRx06FEaVxfkM=
-github.com/syncthing/notify v0.0.0-20250207082249-f0fa8f99c2bc/go.mod h1:J0q59IWjLtpRIJulohwqEZvjzwOfTEPp8SVhDJl+y0Y=
+github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465 h1:yhxdTGmFkAM2TFA65c3NgGwpnIkUM8oVqPX2e9S7IVg=
+github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465/go.mod h1:J0q59IWjLtpRIJulohwqEZvjzwOfTEPp8SVhDJl+y0Y=
 github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDdvS342BElfbETmL1Aiz3i2t0zfRj16Hs=
 github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48=
 github.com/thejerf/suture/v4 v4.0.6 h1:QsuCEsCqb03xF9tPAsWAj8QOAJBgQI1c0VqJNaingg8=
@@ -284,8 +286,8 @@ go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -299,13 +301,13 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
-golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180926160741-c2ed4eda69e7/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -328,23 +330,23 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
 golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.32.0 h1:Q7N1vhpkQv7ybVzLFtTjvQya2ewbwNDZzUgfXGqtMWU=
-golang.org/x/tools v0.32.0/go.mod h1:ZxrU41P/wAbZD8EDa6dDCa6XfpkhJ7HFMjHJXfBDu8s=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -27,6 +27,7 @@
    "Allowed Networks": "Xarxes permeses",
    "Alphabetic": "Alfabètic",
    "Altered by ignoring deletes.": "S'ha alterat ignorant les supressions.",
+    "Always turned on when the folder type is \"{%foldertype%}\".": "Sempre activat quan el tipus de carpeta és \"{{foldertype}}\".",
    "An external command handles the versioning. It has to remove the file from the shared folder. If the path to the application contains spaces, it should be quoted.": "Una ordre externa gestiona la versió. Ha d'eliminar el fitxer de la carpeta compartida. Si el camí a l'aplicació conté espais, s'ha de citar.",
    "Anonymous Usage Reporting": "Informe anònim d'ús",
    "Anonymous usage report format has changed. Would you like to move to the new format?": "El format de l'informe d'ús anònim ha canviat. Voleu canviar a aquest nou format?",
@@ -52,6 +53,7 @@
    "Body:": "Cos de text:",
    "Bugs": "Errors (Bugs)",
    "Cancel": "Cancel·la",
+    "Cannot be enabled when the folder type is \"{%foldertype%}\".": "No es pot habilitar quan el tipus de carpeta és \"{{foldertype}}\".",
    "Changelog": "Historial de canvis",
    "Clean out after": "Netejar després",
    "Cleaning Versions": "Netejant versions",
@@ -227,6 +227,7 @@
    "Learn more": "Learn more",
    "Learn more at {%url%}": "Learn more at {{url}}",
    "Limit": "Limit",
+    "Limit Bandwidth in LAN": "Limit Bandwidth in LAN",
    "Listener Failures": "Listener Failures",
    "Listener Status": "Listener Status",
    "Listeners": "Listeners",
@@ -27,6 +27,7 @@
    "Allowed Networks": "Mga Pinapayagang Network",
    "Alphabetic": "Alpabetiko",
    "Altered by ignoring deletes.": "Binago sa pamamagitan ng hindi pagpansin sa mga pagtanggal.",
+    "Always turned on when the folder type is \"{%foldertype%}\".": "Palaging nakabukas kung ang uri ng folder ay nakatakda bilang \"{{foldertype}}\".",
    "An external command handles the versioning. It has to remove the file from the shared folder. If the path to the application contains spaces, it should be quoted.": "Pinapamahala ng external na command ang file versioning. Kailangan nitong tanggalin ang file mula sa binabahaging folder. Kung may mga space ang path sa application, kailangan itong i-quote.",
    "Anonymous Usage Reporting": "Anonymous na Pag-uulat ng Paggamit",
    "Anonymous usage report format has changed. Would you like to move to the new format?": "Nagbago ang pormat ng anonymous na ulat ng paggamit. Gusto mo bang lumipat sa bagong pormat?",
@@ -52,6 +53,7 @@
    "Body:": "Body:",
    "Bugs": "Mga Bug",
    "Cancel": "Kanselahin",
+    "Cannot be enabled when the folder type is \"{%foldertype%}\".": "Hindi maaaring paganahin kapag ang uri ng folder ay \"{{foldertype}}\".",
    "Changelog": "Mga Pagbabago",
    "Clean out after": "Linisin pagkatapos",
    "Cleaning Versions": "Mga Bersyon ng Paglinis",
@@ -311,7 +313,7 @@
    "Receive Encrypted": "Makatanggap Naka-Encrypt",
    "Receive Only": "Makatanggap Lamang",
    "Received data is already encrypted": "Naka-encrypt na ang natanggap na data",
-    "Recent Changes": "Mga Kamakilang Pagbabago",
+    "Recent Changes": "Mga Kamakailang Pagbabago",
    "Reduced by ignore patterns": "Binabawasan ng mga ignore pattern",
    "Relay LAN": "Relay na LAN",
    "Relay WAN": "Relay na WAN",
@@ -27,6 +27,7 @@
    "Allowed Networks": "רשתות מורשות",
    "Alphabetic": "אלפביתי",
    "Altered by ignoring deletes.": "השתנה על ידי התעלמות ממחיקות.",
+    "Always turned on when the folder type is \"{%foldertype%}\".": "תמיד מופעל כאשר סוג התיקייה הוא \"{{foldertype}}\".",
    "An external command handles the versioning. It has to remove the file from the shared folder. If the path to the application contains spaces, it should be quoted.": "פקודה חיצונית מטפלת בניהול הגרסאות. היא חייבת להסיר את הקובץ מהתיקייה המשותפת. אם הנתיב ליישום מכיל רווחים, יש לצטט אותו.",
    "Anonymous Usage Reporting": "דיווח שימוש אנונימי",
    "Anonymous usage report format has changed. Would you like to move to the new format?": "פורמט דוח שימוש אנונימי השתנה. האם ברצונך לעבור לפורמט החדש?",
@@ -52,6 +53,7 @@
    "Body:": "גוף:",
    "Bugs": "באגים",
    "Cancel": "ביטול",
+    "Cannot be enabled when the folder type is \"{%foldertype%}\".": "לא ניתן לאפשור כאשר סוג התיקייה הוא \"{{foldertype}}\".",
    "Changelog": "יומן שינויים",
    "Clean out after": "נקה לאחר",
    "Cleaning Versions": "מנקה גרסאות",
@@ -27,6 +27,7 @@
    "Allowed Networks": "Toegestane netwerken",
    "Alphabetic": "Alfabetisch",
    "Altered by ignoring deletes.": "Veranderd door het negeren van verwijderingen.",
+    "Always turned on when the folder type is \"{%foldertype%}\".": "Altijd aanzetten als het map-type \"{{foldertype}}\" is.",
    "An external command handles the versioning. It has to remove the file from the shared folder. If the path to the application contains spaces, it should be quoted.": "Een externe opdracht regelt het versiebeheer. Hij moet het bestand verwijderen uit de gedeelde map. Als het pad naar de toepassing spaties bevat, moet dit tussen aanhalingstekens geplaatst worden.",
    "Anonymous Usage Reporting": "Anonieme gebruikersstatistieken",
    "Anonymous usage report format has changed. Would you like to move to the new format?": "Het formaat voor anonieme gebruikersrapporten is gewijzigd. Wil je naar het nieuwe formaat overschakelen?",
@@ -52,6 +53,7 @@
    "Body:": "Inhoud:",
    "Bugs": "Bugs",
    "Cancel": "Annuleren",
+    "Cannot be enabled when the folder type is \"{%foldertype%}\".": "Kan niet aangezet worden als het map-type \"{{foldertype}}\" is.",
    "Changelog": "Wijzigingenlogboek",
    "Clean out after": "Opruimen na",
    "Cleaning Versions": "Versies opruimen",
@@ -386,6 +388,7 @@
    "Staggered File Versioning": "Gespreid versiebeheer",
    "Start Browser": "Browser starten",
    "Statistics": "Statistieken",
+    "Stay logged in": "Blijf aangemeld",
    "Stopped": "Gestopt",
    "Stores and syncs only encrypted data. Folders on all connected devices need to be set up with the same password or be of type \"{%receiveEncrypted%}\" too.": "Bewaart en synchroniseert alleen versleutelde gegevens. Mappen op alle verbonden apparaten moeten met hetzelfde wachtwoord ingesteld worden of ook van het type \"{{receiveEncrypted}}\" zijn.",
    "Subject:": "Onderwerp:",
@@ -874,11 +874,11 @@
                        <td ng-if="!connections[deviceCfg.deviceID].connected" class="text-right">
                          <span ng-repeat="addr in deviceCfg.addresses">
                            <span tooltip data-original-title="{{'Configured' | translate}}">{{addr}}</span><br>
-                            <small ng-if="system.lastDialStatus[addr].error" tooltip data-original-title="{{system.lastDialStatus[addr].error}}" class="text-danger">{{abbreviatedError(addr)}}<br></small>
+                            <small ng-if="system.lastDialStatus[addr].error && !deviceCfg.paused" tooltip data-original-title="{{system.lastDialStatus[addr].error}}" class="text-danger">{{abbreviatedError(addr)}}<br></small>
                          </span>
                          <span ng-repeat="addr in discoveryCache[deviceCfg.deviceID].addresses">
                            <span tooltip data-original-title="{{'Discovered' | translate}}">{{addr}}</span><br>
-                            <small ng-if="system.lastDialStatus[addr].error" tooltip data-original-title="{{system.lastDialStatus[addr].error}}" class="text-danger">{{abbreviatedError(addr)}}<br></small>
+                            <small ng-if="system.lastDialStatus[addr].error && !deviceCfg.paused" tooltip data-original-title="{{system.lastDialStatus[addr].error}}" class="text-danger">{{abbreviatedError(addr)}}<br></small>
                          </span>
                        </td>
                      </tr>
@@ -30,7 +30,7 @@
        <h4 class="text-center" translate>The Syncthing Authors</h4>
        <div class="row">
          <div class="col-md-12" id="contributor-list">
-Jakob Borg, Audrius Butkevicius, Simon Frei, Tomasz Wilczyński, Alexander Graf, Alexandre Viau, Anderson Mesquita, André Colomb, Antony Male, Ben Schulz, bt90, Caleb Callaway, Daniel Harte, Emil Lundberg, Eric P, Evgeny Kuznetsov, greatroar, Lars K.W. Gohlke, Lode Hoste, Michael Ploujnikov, Ross Smith II, Stefan Tatschner, Wulf Weich, Adam Piggott, Adel Qalieh, Aleksey Vasenev, Alessandro G., Alex Ionescu, Alex Lindeman, Alex Xu, Alexander Seiler, Alexandre Alves, Aman Gupta, Andreas Sommer, andresvia, Andrew Rabert, Andrey D, andyleap, Anjan Momi, Anthony Goeckner, Antoine Lamielle, Anur, Aranjedeath, Arkadiusz Tymiński, Aroun, Arthur Axel fREW Schmidt, Artur Zubilewicz, Aurélien Rainone, BAHADIR YILMAZ, Bart De Vries, Beat Reichenbach, Ben Shepherd, Ben Sidhom, Benedikt Heine, Benno Fünfstück, Benny Ng, boomsquared, Boqin Qin, Boris Rybalkin, Brendan Long, Catfriend1, Cathryne Linenweaver, Cedric Staniewski, Chih-Hsuan Yen, Choongkyu, Chris Howie, Chris Joel, Christian Kujau, Christian Prescott, chucic, cjc7373, Colin Kennedy, Cromefire_, Cyprien Devillez, d-volution, Dan, Daniel Barczyk, Daniel Bergmann, Daniel Martí, Daniel Padrta, Darshil Chanpura, dashangcun, David Rimmer, DeflateAwning, Denis A., Dennis Wilson, derekriemer, DerRockWolf, desbma, Devon G. Redekopp, digital, Dimitri Papadopoulos Orfanos, Dmitry Saveliev, domain, Domenic Horner, Dominik Heidler, Elias Jarlebring, Elliot Huffman, Emil Hessman, Eng Zer Jun, entity0xfe, Eric Lesiuta, Erik Meitner, Evan Spensley, Federico Castagnini, Felix, Felix Ableitner, Felix Lampe, Felix Unterpaintner, Francois-Xavier Gsell, Frank Isemann, Gahl Saraf, georgespatton, ghjklw, Gilli Sigurdsson, Gleb Sinyavskiy, Graham Miln, Greg, guangwu, gudvinr, Gusted, Han Boetes, HansK-p, Harrison Jones, Hazem Krimi, Heiko Zuerker, Hireworks, Hugo Locurcio, Iain Barnett, Ian Johnson, ignacy123, Iskander Sharipov, Jaakko Hannikainen, Jack Croft, Jacob, Jake Peterson, James O'Beirne, James Patterson, Jaroslav Lichtblau, Jaroslav Malec, Jaspitta, Jaya Chithra, Jaya Kumar, Jeffery To, jelle van der Waa, Jens Diemer, Jochen Voss, Johan Vromans, John Rinehart, Jonas Thelemann, Jonathan, Jose Manuel Delicado, jtagcat, Julian Lehrhuber, Jörg Thalheim, Jędrzej Kula, Kapil Sareen, Karol Różycki, Kebin Liu, Keith Harrison, Kelong Cong, Ken'ichi Kamada, Kevin Allen, Kevin Bushiri, Kevin White, Jr., klemens, Kurt Fitzner, kylosus, Lars Lehtonen, Laurent Etiemble, Leo Arias, Liu Siyuan, Lord Landon Agahnim, LSmithx2, Lukas Lihotzki, Luke Hamburg, luzpaz, Majed Abdulaziz, Marc Laporte, Marcin Dziadus, Marcus B Spencer, Marcus Legendre, Mario Majila, Mark Pulford, Martchus, Mateusz Naściszewski, Mateusz Ż, mathias4833, Matic Potočnik, Matt Burke, Matt Robenolt, Matteo Ruina, Maurizio Tomasi, Max, Max Schulze, MaximAL, Maximilian, Michael Jephcote, Michael Rienstra, MichaIng, Migelo, Mike Boone, MikeLund, MikolajTwarog, Mingxuan Lin, mv1005, Nate Morrison, nf, Nicholas Rishel, Nick Busey, Nico Stapelbroek, Nicolas Braud-Santoni, Nicolas Perraut, Niels Peter Roest, Nils Jakobi, NinoM4ster, Nitroretro, NoLooseEnds, Oliver Freyermuth, orangekame3, otbutz, overkill, Oyebanji Jacob Mayowa, Pablo, Pascal Jungblut, Paul Brit, Paul Donald, Pawel Palenica, perewa, Peter Badida, Peter Dave Hello, Peter Hoeg, Peter Marquardt, Phani Rithvij, Phil Davis, Philippe Schommers, Phill Luby, Piotr Bejda, polyfloyd, Quentin Hibon, Rahmi Pruitt, red_led, Robert Carosi, Roberto Santalla, Robin Schoonover, Roman Zaynetdinov, rubenbe, Ruslan Yevdokymov, Ryan Qian, Ryan Sullivan, Sacheendra Talluri, Scott Klupfel, sec65, Sergey Mishin, Sertonix, Severin von Wnuck-Lipinski, Shaarad Dalvi, Simon Mwepu, Simon Pickup, Sly_tom_cat, Sonu Kumar Saw, Stefan Kuntz, Steven Eckhoff, Suhas Gundimeda, Sven Bachmann, Sébastien WENSKE, Taylor Khan, Terrance, TheCreeper, Thomas, Thomas Hipp, Tim Abell, Tim Howes, Tobias Frölich, Tobias Klauser, Tobias Nygren, Tobias Tom, Tom Jakubowski, Tommy van der Vorst, Tully Robinson, Tyler Brazier, Tyler Kropp, Unrud, vapatel2, Veeti Paananen, Victor Buinsky, Vik, Vil Brekin, villekalliomaki, Vladimir Rusinov, wangguoliang, WangXi, Will Rouesnel, William A. Kennington III, wouter bolsterlee, xarx00, Xavier O., xjtdy888, Yannic A., 佛跳墙, 落心
+Jakob Borg, Audrius Butkevicius, Simon Frei, Tomasz Wilczyński, Alexander Graf, Alexandre Viau, Anderson Mesquita, André Colomb, Antony Male, Ben Schulz, bt90, Caleb Callaway, Daniel Harte, Emil Lundberg, Eric P, Evgeny Kuznetsov, greatroar, Lars K.W. Gohlke, Lode Hoste, Michael Ploujnikov, Ross Smith II, Stefan Tatschner, Wulf Weich, Adam Piggott, Adel Qalieh, Aleksey Vasenev, Alessandro G., Alex Ionescu, Alex Lindeman, Alex Xu, Alexander Seiler, Alexandre Alves, Aman Gupta, Andreas Sommer, andresvia, Andrew Rabert, Andrey D, andyleap, Anjan Momi, Anthony Goeckner, Antoine Lamielle, Anur, Aranjedeath, ardevd, Arkadiusz Tymiński, Aroun, Arthur Axel fREW Schmidt, Artur Zubilewicz, Ashish Bhate, Aurélien Rainone, BAHADIR YILMAZ, Bart De Vries, Beat Reichenbach, Ben Shepherd, Ben Sidhom, Benedikt Heine, Benno Fünfstück, Benny Ng, boomsquared, Boqin Qin, Boris Rybalkin, Brendan Long, Catfriend1, Cathryne Linenweaver, Cedric Staniewski, Chih-Hsuan Yen, Choongkyu, Chris Howie, Chris Joel, Christian Kujau, Christian Prescott, chucic, cjc7373, Colin Kennedy, Cromefire_, Cyprien Devillez, d-volution, Dan, Daniel Barczyk, Daniel Bergmann, Daniel Martí, Daniel Padrta, Darshil Chanpura, dashangcun, David Rimmer, DeflateAwning, Denis A., Dennis Wilson, derekriemer, DerRockWolf, desbma, Devon G. Redekopp, digital, Dimitri Papadopoulos Orfanos, Dmitry Saveliev, domain, Domenic Horner, Dominik Heidler, Elias Jarlebring, Elliot Huffman, Emil Hessman, Eng Zer Jun, entity0xfe, Eric Lesiuta, Erik Meitner, Evan Spensley, Federico Castagnini, Felix, Felix Ableitner, Felix Lampe, Felix Unterpaintner, Francois-Xavier Gsell, Frank Isemann, Gahl Saraf, georgespatton, ghjklw, Gilli Sigurdsson, Gleb Sinyavskiy, Graham Miln, Greg, guangwu, gudvinr, Gusted, Han Boetes, HansK-p, Harrison Jones, Hazem Krimi, Heiko Zuerker, Hireworks, Hugo Locurcio, Iain Barnett, Ian Johnson, ignacy123, Iskander Sharipov, Jaakko Hannikainen, Jack Croft, Jacob, Jake Peterson, James O'Beirne, James Patterson, Jaroslav Lichtblau, Jaroslav Malec, Jaspitta, Jaya Chithra, Jaya Kumar, Jeffery To, jelle van der Waa, Jens Diemer, Jochen Voss, Johan Vromans, John Rinehart, Jonas Thelemann, Jonathan, Jose Manuel Delicado, jtagcat, Julian Lehrhuber, Jörg Thalheim, Jędrzej Kula, Kapil Sareen, Karol Różycki, Kebin Liu, Keith Harrison, Kelong Cong, Ken'ichi Kamada, Kevin Allen, Kevin Bushiri, Kevin White, Jr., klemens, Kurt Fitzner, kylosus, Lars Lehtonen, Laurent Etiemble, Leo Arias, Liu Siyuan, Lord Landon Agahnim, LSmithx2, Lukas Lihotzki, Luke Hamburg, luzpaz, Majed Abdulaziz, Marc Laporte, Marcel Meyer, Marcin Dziadus, Marcus B Spencer, Marcus Legendre, Mario Majila, Mark Pulford, Martchus, Mateusz Naściszewski, Mateusz Ż, mathias4833, Matic Potočnik, Matt Burke, Matt Robenolt, Matteo Ruina, Maurizio Tomasi, Max, Max Schulze, MaximAL, Maximilian, Michael Jephcote, Michael Rienstra, MichaIng, Migelo, Mike Boone, MikeLund, MikolajTwarog, Mingxuan Lin, mv1005, Nate Morrison, nf, Nicholas Rishel, Nick Busey, Nico Stapelbroek, Nicolas Braud-Santoni, Nicolas Perraut, Niels Peter Roest, Nils Jakobi, NinoM4ster, Nitroretro, NoLooseEnds, Oliver Freyermuth, orangekame3, otbutz, overkill, Oyebanji Jacob Mayowa, Pablo, Pascal Jungblut, Paul Brit, Paul Donald, Pawel Palenica, perewa, Peter Badida, Peter Dave Hello, Peter Hoeg, Peter Marquardt, Phani Rithvij, Phil Davis, Philippe Schommers, Phill Luby, Piotr Bejda, polyfloyd, pullmerge, Quentin Hibon, Rahmi Pruitt, red_led, Robert Carosi, Roberto Santalla, Robin Schoonover, Roman Zaynetdinov, rubenbe, Ruslan Yevdokymov, Ryan Qian, Ryan Sullivan, Sacheendra Talluri, Scott Klupfel, sec65, Sergey Mishin, Sertonix, Severin von Wnuck-Lipinski, Shaarad Dalvi, Simon Mwepu, Simon Pickup, Sly_tom_cat, Sonu Kumar Saw, Stefan Kuntz, Steven Eckhoff, Suhas Gundimeda, Sven Bachmann, Sébastien WENSKE, Taylor Khan, Terrance, TheCreeper, Thomas, Thomas Hipp, Tim Abell, Tim Howes, Tobias Frölich, Tobias Klauser, Tobias Nygren, Tobias Tom, Tom Jakubowski, Tommy van der Vorst, Tully Robinson, Tyler Brazier, Tyler Kropp, Unrud, vapatel2, Veeti Paananen, Victor Buinsky, Vik, Vil Brekin, villekalliomaki, Vladimir Rusinov, wangguoliang, WangXi, Will Rouesnel, William A. Kennington III, wouter bolsterlee, xarx00, Xavier O., xjtdy888, Yannic A., 佛跳墙, 落心
          </div>
        </div>
      </div>
@@ -58,7 +58,6 @@ Jakob Borg, Audrius Butkevicius, Simon Frei, Tomasz Wilczyński, Alexander Graf,
          <li><a href="https://github.com/calmh/xdr">calmh/xdr</a>, Copyright &copy; 2014 Jakob Borg.</li>
          <li><a href="https://github.com/ccding/go-stun">ccding/go-stun</a>, Copyright &copy; 2016 Cong Ding.</li>
          <li><a href="https://github.com/cespare/xxhash/v2">cespare/xxhash/v2</a>, Copyright &copy; 2016 Caleb Spare.</li>
-          <li><a href="https://github.com/chmduquesne/rollinghash">chmduquesne/rollinghash</a>, Copyright &copy; 2015 Christophe-Marie Duquesne.</li>
          <li><a href="https://github.com/cpuguy83/go-md2man/v2">cpuguy83/go-md2man/v2</a>, Copyright &copy; 2014 Brian Goff.</li>
          <li><a href="https://github.com/davecgh/go-spew">davecgh/go-spew</a>, Copyright &copy; 2012-2016 Dave Collins.</li>
          <li><a href="https://github.com/go-asn1-ber/asn1-ber">go-asn1-ber/asn1-ber</a>, Copyright &copy; 2011-2015 Michael Mitton (mmitton@gmail.com).</li>
@@ -70,14 +69,15 @@ Jakob Borg, Audrius Butkevicius, Simon Frei, Tomasz Wilczyński, Alexander Graf,
          <li><a href="https://github.com/protocolbuffers/protobuf-go">google.golang.org/protobuf</a>, Copyright &copy; 2018 The Go Authors.</li>
          <li><a href="https://github.com/google/uuid">google/uuid</a>, Copyright &copy; 2009,2014 Google Inc.</li>
          <li><a href="https://gopkg.in/yaml.v3">gopkg.in/yaml.v3</a>, Copyright &copy; 2025, the gopkg.in/yaml.v3 authors.</li>
-          <li><a href="https://github.com/greatroar/blobloom">greatroar/blobloom</a>, Copyright &copy; 2020-2024 the Blobloom authors.</li>
          <li><a href="https://github.com/hashicorp/errwrap">hashicorp/errwrap</a>, Copyright &copy; 2014 HashiCorp, Inc.</li>
          <li><a href="https://github.com/hashicorp/go-multierror">hashicorp/go-multierror</a>, Copyright &copy; 2014 HashiCorp, Inc.</li>
          <li><a href="https://github.com/hashicorp/golang-lru">hashicorp/golang-lru</a>, Copyright &copy; 2014 HashiCorp, Inc.</li>
          <li><a href="https://github.com/jackpal/gateway">jackpal/gateway</a>, Copyright &copy; 2010 Jack Palevich.</li>
          <li><a href="https://github.com/jackpal/go-nat-pmp">jackpal/go-nat-pmp</a>, Copyright 2013 John Howard Palevich.</li>
+          <li><a href="https://github.com/jmoiron/sqlx">jmoiron/sqlx</a>, Copyright &copy; 2013, Jason Moiron.</li>
          <li><a href="https://github.com/julienschmidt/httprouter">julienschmidt/httprouter</a>, Copyright &copy; 2013, Julien Schmidt.</li>
          <li><a href="https://github.com/kballard/go-shellquote">kballard/go-shellquote</a>, Copyright &copy; 2014 Kevin Ballard.</li>
+          <li><a href="https://github.com/mattn/go-sqlite3">mattn/go-sqlite3</a>, Copyright &copy; 2014 Yasuhiro Matsumoto.</li>
          <li><a href="https://github.com/miscreant/miscreant.go">miscreant/miscreant.go</a>, Copyright &copy; 2017-2019 The Miscreant Developers.</li>
          <li><a href="https://github.com/munnerz/goautoneg">munnerz/goautoneg</a>, Copyright &copy; 2011, Open Knowledge Foundation Ltd.</li>
          <li><a href="https://github.com/pierrec/lz4">pierrec/lz4</a>, Copyright &copy; 2015 Pierre Curto.</li>
@@ -210,6 +210,17 @@
              </div>
            </div>
          </div>
+          <div class="row">
+            <div class="col-md-6">
+              <div class="form-group">
+                <div class="checkbox">
+                  <label>
+                    <input id="LimitBandwidthInLan" type="checkbox" ng-model="tmpOptions.limitBandwidthInLan" /> <span translate>Limit Bandwidth in LAN</span>
+                  </label>
+                </div>
+              </div>
+            </div>
+          </div>
          <div class="row">
            <div class="col-md-6">
              <div class="form-group">
@@ -19,9 +19,9 @@ type Counts struct {
 	Symlinks    int
 	Deleted     int
 	Bytes       int64
-	Sequence    int64             // zero for the global state
-	DeviceID    protocol.DeviceID // device ID for remote devices, or special values for local/global
-	LocalFlags  uint32            // the local flag for this count bucket
+	Sequence    int64              // zero for the global state
+	DeviceID    protocol.DeviceID  // device ID for remote devices, or special values for local/global
+	LocalFlags  protocol.FlagLocal // the local flag for this count bucket
 }

 func (c Counts) Add(other Counts) Counts {
@@ -100,10 +100,9 @@ type FileMetadata struct {
 	Sequence   int64
 	ModNanos   int64
 	Size       int64
-	LocalFlags int64
+	LocalFlags protocol.FlagLocal
 	Type       protocol.FileInfoType
 	Deleted    bool
-	Invalid    bool
 }

 func (f *FileMetadata) ModTime() time.Time {
@@ -121,3 +120,7 @@ func (f *FileMetadata) IsDirectory() bool {
 func (f *FileMetadata) ShouldConflict() bool {
 	return f.LocalFlags&protocol.LocalConflictFlags != 0
 }
+
+func (f *FileMetadata) IsInvalid() bool {
+	return f.LocalFlags.IsInvalid()
+}
@@ -21,6 +21,7 @@ var (
 		Namespace: "syncthing",
 		Subsystem: "db",
 		Name:      "operations_current",
+		Help:      "Number of database operations currently ongoing, per folder and operation",
 	}, []string{"folder", "operation"})
 	metricTotalOperationSeconds = promauto.NewCounterVec(prometheus.CounterOpts{
 		Namespace: "syncthing",
@@ -22,7 +22,7 @@ import (
 	"github.com/syncthing/syncthing/lib/protocol"
 )

-const currentSchemaVersion = 1
+const currentSchemaVersion = 3

 //go:embed sql/**
 var embedded embed.FS
@@ -62,6 +62,17 @@ func openBase(path string, maxConns int, pragmas, schemaScripts, migrationScript
 		baseName:   filepath.Base(path),
 		sql:        sqlDB,
 		statements: make(map[string]*sqlx.Stmt),
+		tplInput: map[string]any{
+			"FlagLocalUnsupported":   protocol.FlagLocalUnsupported,
+			"FlagLocalIgnored":       protocol.FlagLocalIgnored,
+			"FlagLocalMustRescan":    protocol.FlagLocalMustRescan,
+			"FlagLocalReceiveOnly":   protocol.FlagLocalReceiveOnly,
+			"FlagLocalGlobal":        protocol.FlagLocalGlobal,
+			"FlagLocalNeeded":        protocol.FlagLocalNeeded,
+			"FlagLocalRemoteInvalid": protocol.FlagLocalRemoteInvalid,
+			"LocalInvalidFlags":      protocol.LocalInvalidFlags,
+			"SyncthingVersion":       build.LongVersion,
+		},
 	}

 	for _, script := range schemaScripts {
@@ -96,16 +107,6 @@ func openBase(path string, maxConns int, pragmas, schemaScripts, migrationScript
 		return nil, wrap(err)
 	}

-	db.tplInput = map[string]any{
-		"FlagLocalUnsupported": protocol.FlagLocalUnsupported,
-		"FlagLocalIgnored":     protocol.FlagLocalIgnored,
-		"FlagLocalMustRescan":  protocol.FlagLocalMustRescan,
-		"FlagLocalReceiveOnly": protocol.FlagLocalReceiveOnly,
-		"FlagLocalGlobal":      protocol.FlagLocalGlobal,
-		"FlagLocalNeeded":      protocol.FlagLocalNeeded,
-		"SyncthingVersion":     build.LongVersion,
-	}
-
 	return db, nil
 }

@@ -151,15 +152,8 @@ func (s *baseDB) stmt(tpl string) stmt {
 		return stmt
 	}

-	// Apply template expansions
-	var sb strings.Builder
-	compTpl := template.Must(template.New("tpl").Funcs(tplFuncs).Parse(tpl))
-	if err := compTpl.Execute(&sb, s.tplInput); err != nil {
-		panic("bug: bad template: " + err.Error())
-	}
-
 	// Prepare and cache
-	stmt, err := s.sql.Preparex(sb.String())
+	stmt, err := s.sql.Preparex(s.expandTemplateVars(tpl))
 	if err != nil {
 		return failedStmt{err}
 	}
@@ -167,6 +161,17 @@ func (s *baseDB) stmt(tpl string) stmt {
 	return stmt
 }

+// expandTemplateVars just applies template expansions to the template
+// string, or dies trying
+func (s *baseDB) expandTemplateVars(tpl string) string {
+	var sb strings.Builder
+	compTpl := template.Must(template.New("tpl").Funcs(tplFuncs).Parse(tpl))
+	if err := compTpl.Execute(&sb, s.tplInput); err != nil {
+		panic("bug: bad template: " + err.Error())
+	}
+	return sb.String()
+}
+
 type stmt interface {
 	Exec(args ...any) (sql.Result, error)
 	Get(dest any, args ...any) error
@@ -211,7 +216,7 @@ nextScript:
 		// separately. We require it on a separate line because there are
 		// also statement-internal semicolons in the triggers.
 		for _, stmt := range strings.Split(string(bs), "\n;") {
-			if _, err := tx.Exec(stmt); err != nil {
+			if _, err := tx.Exec(s.expandTemplateVars(stmt)); err != nil {
 				return wrap(err, stmt)
 			}
 		}
@@ -255,7 +255,7 @@ func (s *DB) ListDevicesForFolder(folder string) ([]protocol.DeviceID, error) {
 func (s *DB) RemoteSequences(folder string) (map[protocol.DeviceID]int64, error) {
 	fdb, err := s.getFolderDB(folder, false)
 	if errors.Is(err, errNoSuchFolder) {
-		return nil, nil
+		return nil, nil //nolint:nilnil
 	}
 	if err != nil {
 		return nil, err
@@ -268,6 +268,57 @@ func TestDontNeedIgnored(t *testing.T) {
 	}
 }

+func TestDontNeedRemoteInvalid(t *testing.T) {
+	t.Parallel()
+
+	db, err := OpenTemp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := db.Close(); err != nil {
+			t.Fatal(err)
+		}
+	})
+
+	// A remote file with the invalid bit set
+	files := []protocol.FileInfo{
+		genFile("test1", 1, 103),
+	}
+	files[0].LocalFlags = protocol.FlagLocalRemoteInvalid
+	err = db.Update(folderID, protocol.DeviceID{42}, files)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// It's not part of the global size
+	s, err := db.CountGlobal(folderID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.Bytes != 0 || s.Files != 0 {
+		t.Log(s)
+		t.Error("bad global")
+	}
+
+	// We don't need it
+	s, err = db.CountNeed(folderID, protocol.LocalDeviceID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.Bytes != 0 || s.Files != 0 {
+		t.Log(s)
+		t.Error("bad need")
+	}
+
+	// It shouldn't show up in the need list
+	names := mustCollect[protocol.FileInfo](t)(db.AllNeededGlobalFiles(folderID, protocol.LocalDeviceID, config.PullOrderAlphabetic, 0, 0))
+	if len(names) != 0 {
+		t.Log(names)
+		t.Error("need no files")
+	}
+}
+
 func TestRemoteDontNeedLocalIgnored(t *testing.T) {
 	t.Parallel()

@@ -50,10 +50,14 @@ func Open(path string, opts ...Option) (*DB, error) {
 		"sql/schema/common/*",
 		"sql/schema/main/*",
 	}
+	migrations := []string{
+		"sql/migrations/common/*",
+		"sql/migrations/main/*",
+	}

-	os.MkdirAll(path, 0o700)
+	_ = os.MkdirAll(path, 0o700)
 	mainPath := filepath.Join(path, "main.db")
-	mainBase, err := openBase(mainPath, maxDBConns, pragmas, schemas, nil)
+	mainBase, err := openBase(mainPath, maxDBConns, pragmas, schemas, migrations)
 	if err != nil {
 		return nil, err
 	}
@@ -88,10 +92,14 @@ func OpenForMigration(path string) (*DB, error) {
 		"sql/schema/common/*",
 		"sql/schema/main/*",
 	}
+	migrations := []string{
+		"sql/migrations/common/*",
+		"sql/migrations/main/*",
+	}

-	os.MkdirAll(path, 0o700)
+	_ = os.MkdirAll(path, 0o700)
 	mainPath := filepath.Join(path, "main.db")
-	mainBase, err := openBase(mainPath, 1, pragmas, schemas, nil)
+	mainBase, err := openBase(mainPath, 1, pragmas, schemas, migrations)
 	if err != nil {
 		return nil, err
 	}
@@ -84,8 +84,11 @@ func (s *Service) periodic(ctx context.Context) error {
 	defer func() { l.Debugln("Periodic done in", time.Since(t1), "+", t1.Sub(t0)) }()

 	s.sdb.updateLock.Lock()
-	tidy(ctx, s.sdb.sql)
+	err := tidy(ctx, s.sdb.sql)
 	s.sdb.updateLock.Unlock()
+	if err != nil {
+		return err
+	}

 	return wrap(s.sdb.forEachFolder(func(fdb *folderDB) error {
 		fdb.updateLock.Lock()
@@ -97,8 +100,7 @@ func (s *Service) periodic(ctx context.Context) error {
 		if err := garbageCollectBlocklistsAndBlocksLocked(ctx, fdb); err != nil {
 			return wrap(err)
 		}
-		tidy(ctx, fdb.sql)
-		return nil
+		return tidy(ctx, fdb.sql)
 	}))
 }

@@ -39,13 +39,10 @@ func (s *folderDB) CountNeed(device protocol.DeviceID) (db.Counts, error) {
 }

 func (s *folderDB) CountGlobal() (db.Counts, error) {
-	// Exclude ignored and receive-only changed files from the global count
-	// (legacy expectation? it's a bit weird since those files can in fact
-	// be global and you can get them with GetGlobal etc.)
 	var res []countsRow
 	err := s.stmt(`
 		SELECT s.type, s.count, s.size, s.local_flags, s.deleted FROM counts s
-		WHERE s.local_flags & {{.FlagLocalGlobal}} != 0 AND s.local_flags & {{or .FlagLocalReceiveOnly .FlagLocalIgnored}} = 0
+		WHERE s.local_flags & {{.FlagLocalGlobal}} != 0 AND s.local_flags & {{.LocalInvalidFlags}} = 0
 	`).Select(&res)
 	if err != nil {
 		return db.Counts{}, wrap(err)
@@ -84,7 +81,7 @@ func (s *folderDB) needSizeRemote(device protocol.DeviceID) (db.Counts, error) {
 	// See neededGlobalFilesRemote for commentary as that is the same query without summing
 	if err := s.stmt(`
 		SELECT g.type, count(*) as count, sum(g.size) as size, g.local_flags, g.deleted FROM files g
-		WHERE g.local_flags & {{.FlagLocalGlobal}} != 0 AND NOT g.deleted AND NOT g.invalid AND NOT EXISTS (
+		WHERE g.local_flags & {{.FlagLocalGlobal}} != 0 AND NOT g.deleted AND g.local_flags & {{.LocalInvalidFlags}} = 0 AND NOT EXISTS (
 			SELECT 1 FROM FILES f
 			INNER JOIN devices d ON d.idx = f.device_idx
 			WHERE f.name = g.name AND f.version = g.version AND d.device_id = ?
@@ -94,10 +91,10 @@ func (s *folderDB) needSizeRemote(device protocol.DeviceID) (db.Counts, error) {
 		UNION ALL

 		SELECT g.type, count(*) as count, sum(g.size) as size, g.local_flags, g.deleted FROM files g
-		WHERE g.local_flags & {{.FlagLocalGlobal}} != 0 AND g.deleted AND NOT g.invalid AND EXISTS (
+		WHERE g.local_flags & {{.FlagLocalGlobal}} != 0 AND g.deleted AND g.local_flags & {{.LocalInvalidFlags}} = 0 AND EXISTS (
 			SELECT 1 FROM FILES f
 			INNER JOIN devices d ON d.idx = f.device_idx
-			WHERE f.name = g.name AND d.device_id = ? AND NOT f.deleted AND NOT f.invalid
+			WHERE f.name = g.name AND d.device_id = ? AND NOT f.deleted AND f.local_flags & {{.LocalInvalidFlags}} = 0
 		)
 		GROUP BY g.type, g.local_flags, g.deleted
 	`).Select(&res, device.String(),
@@ -74,7 +74,7 @@ func (s *folderDB) GetGlobalAvailability(file string) ([]protocol.DeviceID, erro

 func (s *folderDB) AllGlobalFiles() (iter.Seq[db.FileMetadata], func() error) {
 	it, errFn := iterStructs[db.FileMetadata](s.stmt(`
-		SELECT f.sequence, f.name, f.type, f.modified as modnanos, f.size, f.deleted, f.invalid, f.local_flags as localflags FROM files f
+		SELECT f.sequence, f.name, f.type, f.modified as modnanos, f.size, f.deleted, f.local_flags as localflags FROM files f
 		WHERE f.local_flags & {{.FlagLocalGlobal}} != 0
 		ORDER BY f.name
 	`).Queryx())
@@ -93,7 +93,7 @@ func (s *folderDB) AllGlobalFilesPrefix(prefix string) (iter.Seq[db.FileMetadata
 	end := prefixEnd(prefix)

 	it, errFn := iterStructs[db.FileMetadata](s.stmt(`
-		SELECT f.sequence, f.name, f.type, f.modified as modnanos, f.size, f.deleted, f.invalid, f.local_flags as localflags FROM files f
+		SELECT f.sequence, f.name, f.type, f.modified as modnanos, f.size, f.deleted, f.local_flags as localflags FROM files f
 		WHERE f.name >= ? AND f.name < ? AND f.local_flags & {{.FlagLocalGlobal}} != 0
 		ORDER BY f.name
 	`).Queryx(prefix, end))
@@ -158,7 +158,7 @@ func (s *folderDB) neededGlobalFilesRemote(device protocol.DeviceID, selectOpts
 		SELECT fi.fiprotobuf, bl.blprotobuf, g.name, g.size, g.modified FROM fileinfos fi
 		INNER JOIN files g on fi.sequence = g.sequence
 		LEFT JOIN blocklists bl ON bl.blocklist_hash = g.blocklist_hash
-		WHERE g.local_flags & {{.FlagLocalGlobal}} != 0 AND NOT g.deleted AND NOT g.invalid AND NOT EXISTS (
+		WHERE g.local_flags & {{.FlagLocalGlobal}} != 0 AND NOT g.deleted AND g.local_flags & {{.LocalInvalidFlags}} = 0 AND NOT EXISTS (
 			SELECT 1 FROM FILES f
 			INNER JOIN devices d ON d.idx = f.device_idx
 			WHERE f.name = g.name AND f.version = g.version AND d.device_id = ?
@@ -169,10 +169,10 @@ func (s *folderDB) neededGlobalFilesRemote(device protocol.DeviceID, selectOpts
 		SELECT fi.fiprotobuf, bl.blprotobuf, g.name, g.size, g.modified FROM fileinfos fi
 		INNER JOIN files g on fi.sequence = g.sequence
 		LEFT JOIN blocklists bl ON bl.blocklist_hash = g.blocklist_hash
-		WHERE g.local_flags & {{.FlagLocalGlobal}} != 0 AND g.deleted AND NOT g.invalid AND EXISTS (
+		WHERE g.local_flags & {{.FlagLocalGlobal}} != 0 AND g.deleted AND g.local_flags & {{.LocalInvalidFlags}} = 0 AND EXISTS (
 			SELECT 1 FROM FILES f
 			INNER JOIN devices d ON d.idx = f.device_idx
-			WHERE f.name = g.name AND d.device_id = ? AND NOT f.deleted AND NOT f.invalid
+			WHERE f.name = g.name AND d.device_id = ? AND NOT f.deleted AND f.local_flags & {{.LocalInvalidFlags}} = 0 
 		)
 	`+selectOpts).Queryx(
 		device.String(),
@@ -89,7 +89,7 @@ func (s *folderDB) AllLocalFilesWithPrefix(device protocol.DeviceID, prefix stri

 func (s *folderDB) AllLocalFilesWithBlocksHash(h []byte) (iter.Seq[db.FileMetadata], func() error) {
 	return iterStructs[db.FileMetadata](s.stmt(`
-		SELECT f.sequence, f.name, f.type, f.modified as modnanos, f.size, f.deleted, f.invalid, f.local_flags as localflags FROM files f
+		SELECT f.sequence, f.name, f.type, f.modified as modnanos, f.size, f.deleted, f.local_flags as localflags FROM files f
 		WHERE f.device_idx = {{.LocalDeviceIdx}} AND f.blocklist_hash = ?
 	`).Queryx(h))
 }
@@ -32,8 +32,12 @@ func openFolderDB(folder, path string, deleteRetention time.Duration) (*folderDB
 		"sql/schema/common/*",
 		"sql/schema/folder/*",
 	}
+	migrations := []string{
+		"sql/migrations/common/*",
+		"sql/migrations/folder/*",
+	}

-	base, err := openBase(path, maxDBConns, pragmas, schemas, nil)
+	base, err := openBase(path, maxDBConns, pragmas, schemas, migrations)
 	if err != nil {
 		return nil, err
 	}
@@ -46,8 +46,8 @@ func (s *folderDB) Update(device protocol.DeviceID, fs []protocol.FileInfo) erro

 	//nolint:sqlclosecheck
 	insertFileStmt, err := txp.Preparex(`
-		INSERT OR REPLACE INTO files (device_idx, remote_sequence, name, type, modified, size, version, deleted, invalid, local_flags, blocklist_hash)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		INSERT OR REPLACE INTO files (device_idx, remote_sequence, name, type, modified, size, version, deleted, local_flags, blocklist_hash)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 		RETURNING sequence
 	`)
 	if err != nil {
@@ -101,7 +101,7 @@ func (s *folderDB) Update(device protocol.DeviceID, fs []protocol.FileInfo) erro
 			remoteSeq = &f.Sequence
 		}
 		var localSeq int64
-		if err := insertFileStmt.Get(&localSeq, deviceIdx, remoteSeq, f.Name, f.Type, f.ModTime().UnixNano(), f.Size, f.Version.String(), f.IsDeleted(), f.IsInvalid(), f.LocalFlags, blockshash); err != nil {
+		if err := insertFileStmt.Get(&localSeq, deviceIdx, remoteSeq, f.Name, f.Type, f.ModTime().UnixNano(), f.Size, f.Version.String(), f.IsDeleted(), f.LocalFlags, blockshash); err != nil {
 			return wrap(err, "insert file")
 		}

@@ -329,7 +329,7 @@ func (s *folderDB) recalcGlobalForFolder(txp *txPreparedStmts) error {
 func (s *folderDB) recalcGlobalForFile(txp *txPreparedStmts, file string) error {
 	//nolint:sqlclosecheck
 	selStmt, err := txp.Preparex(`
-		SELECT name, device_idx, sequence, modified, version, deleted, invalid, local_flags FROM files
+		SELECT name, device_idx, sequence, modified, version, deleted, local_flags FROM files
 		WHERE name = ?
 	`)
 	if err != nil {
@@ -350,7 +350,7 @@ func (s *folderDB) recalcGlobalForFile(txp *txPreparedStmts, file string) error
 	// The global version is the first one in the list that is not invalid,
 	// or just the first one in the list if all are invalid.
 	var global fileRow
-	globIdx := slices.IndexFunc(es, func(e fileRow) bool { return !e.Invalid })
+	globIdx := slices.IndexFunc(es, func(e fileRow) bool { return !e.IsInvalid() })
 	if globIdx < 0 {
 		globIdx = 0
 	}
@@ -368,7 +368,7 @@ func (s *folderDB) recalcGlobalForFile(txp *txPreparedStmts, file string) error
 	// Set the global flag on the global entry. Set the need flag if the
 	// local device needs this file, unless it's invalid.
 	global.LocalFlags |= protocol.FlagLocalGlobal
-	if hasLocal || global.Invalid {
+	if hasLocal || global.IsInvalid() {
 		global.LocalFlags &= ^protocol.FlagLocalNeeded
 	} else {
 		global.LocalFlags |= protocol.FlagLocalNeeded
@@ -426,18 +426,17 @@ type fileRow struct {
 	Sequence   int64
 	Modified   int64
 	Size       int64
-	LocalFlags int64 `db:"local_flags"`
+	LocalFlags protocol.FlagLocal `db:"local_flags"`
 	Deleted    bool
-	Invalid    bool
 }

 func (e fileRow) Compare(other fileRow) int {
 	// From FileInfo.WinsConflict
-	vc := e.Version.Vector.Compare(other.Version.Vector)
+	vc := e.Version.Compare(other.Version.Vector)
 	switch vc {
 	case protocol.Equal:
-		if e.Invalid != other.Invalid {
-			if e.Invalid {
+		if e.IsInvalid() != other.IsInvalid() {
+			if e.IsInvalid() {
 				return 1
 			}
 			return -1
@@ -453,8 +452,8 @@ func (e fileRow) Compare(other fileRow) int {
 	case protocol.Lesser: // we are older
 		return 1
 	case protocol.ConcurrentGreater, protocol.ConcurrentLesser: // there is a conflict
-		if e.Invalid != other.Invalid {
-			if e.Invalid { // we are invalid, we lose
+		if e.IsInvalid() != other.IsInvalid() {
+			if e.IsInvalid() { // we are invalid, we lose
 				return 1
 			}
 			return -1 // they are invalid, we win
@@ -477,6 +476,10 @@ func (e fileRow) Compare(other fileRow) int {
 	}
 }

+func (e fileRow) IsInvalid() bool {
+	return e.LocalFlags.IsInvalid()
+}
+
 func (s *folderDB) periodicCheckpointLocked(fs []protocol.FileInfo) {
 	// Induce periodic checkpoints. We add points for each file and block,
 	// and checkpoint when we've written more than a threshold of points.
@@ -519,11 +522,12 @@ func (s *folderDB) periodicCheckpointLocked(fs []protocol.FileInfo) {
 		// failed, we'll keep trying it until we succeed. Increase it faster
 		// when we fail to checkpoint, as it's more likely the WAL is
 		// growing and will need truncation when we get out of this state.
-		if res == 1 {
+		switch {
+		case res == 1:
 			s.checkpointsCount += 10
-		} else if res == 0 && checkpointType == "TRUNCATE" {
+		case res == 0 && checkpointType == "TRUNCATE":
 			s.checkpointsCount = 0
-		} else {
+		default:
 			s.checkpointsCount++
 		}
 		s.updatePoints = 0
@@ -1,7 +0,0 @@
-- Copyright (C) 2025 The Syncthing Authors.
--
-- This Source Code Form is subject to the terms of the Mozilla Public
-- License, v. 2.0. If a copy of the MPL was not distributed with this file,
-- You can obtain one at https://mozilla.org/MPL/2.0/.
-
-- The next migration should be number two.
@@ -0,0 +1,20 @@
+-- Copyright (C) 2025 The Syncthing Authors.
+--
+-- This Source Code Form is subject to the terms of the Mozilla Public
+-- License, v. 2.0. If a copy of the MPL was not distributed with this file,
+-- You can obtain one at https://mozilla.org/MPL/2.0/.
+
+-- Remote files with the invalid bit instead gain the RemoteInvalid local
+-- flag.
+UPDATE files
+    SET local_flags = local_flags | {{.FlagLocalRemoteInvalid}}
+    FROM (
+        SELECT idx FROM devices
+        WHERE device_id = '7777777-777777N-7777777-777777N-7777777-777777N-7777777-77777Q4'
+    ) AS local_device
+    WHERE invalid AND device_idx != local_device.idx
+;
+
+-- The invalid column goes away.
+ALTER TABLE files DROP COLUMN invalid
+;
@@ -0,0 +1,17 @@
+-- Copyright (C) 2025 The Syncthing Authors.
+--
+-- This Source Code Form is subject to the terms of the Mozilla Public
+-- License, v. 2.0. If a copy of the MPL was not distributed with this file,
+-- You can obtain one at https://mozilla.org/MPL/2.0/.
+
+-- Remove broken file entries in the database.
+DELETE FROM files
+    WHERE type == 0 -- files
+        AND NOT deleted -- that are not deleted
+        AND blocklist_hash IS null -- with no blocks
+        AND local_flags & {{.LocalInvalidFlags}} == 0 -- and not invalid
+;
+
+-- Force a new index transmission.
+DELETE FROM indexids
+;
@@ -31,7 +31,6 @@ CREATE TABLE IF NOT EXISTS files (
    size INTEGER NOT NULL,
    version TEXT NOT NULL COLLATE BINARY,
    deleted INTEGER NOT NULL, -- boolean
-    invalid INTEGER NOT NULL, -- boolean
    local_flags INTEGER NOT NULL,
    blocklist_hash BLOB, -- null when there are no blocks
    FOREIGN KEY(device_idx) REFERENCES devices(idx) ON DELETE CASCADE
@@ -12,9 +12,9 @@ CREATE TABLE IF NOT EXISTS counts (
    device_idx INTEGER NOT NULL,
    type INTEGER NOT NULL,
    local_flags INTEGER NOT NULL,
+    deleted INTEGER NOT NULL, -- boolean
    count INTEGER NOT NULL,
    size INTEGER NOT NULL,
-    deleted INTEGER NOT NULL, -- boolean
    PRIMARY KEY(device_idx, type, local_flags, deleted),
    FOREIGN KEY(device_idx) REFERENCES devices(idx) ON DELETE CASCADE
 ) STRICT, WITHOUT ROWID
@@ -24,8 +24,8 @@ CREATE TABLE IF NOT EXISTS counts (

 CREATE TRIGGER IF NOT EXISTS counts_insert AFTER INSERT ON files
 BEGIN
-    INSERT INTO counts (device_idx, type, local_flags, count, size, deleted)
-        VALUES (NEW.device_idx, NEW.type, NEW.local_flags, 1, NEW.size, NEW.deleted)
+    INSERT INTO counts (device_idx, type, local_flags, deleted, count, size)
+        VALUES (NEW.device_idx, NEW.type, NEW.local_flags, NEW.deleted, 1, NEW.size)
        ON CONFLICT DO UPDATE SET count = count + 1, size = size + NEW.size;
 END
 ;
@@ -38,8 +38,8 @@ END
 CREATE TRIGGER IF NOT EXISTS counts_update AFTER UPDATE OF local_flags ON files
 WHEN NEW.local_flags != OLD.local_flags
 BEGIN
-    INSERT INTO counts (device_idx, type, local_flags, count, size, deleted)
-        VALUES (NEW.device_idx, NEW.type, NEW.local_flags, 1, NEW.size, NEW.deleted)
+    INSERT INTO counts (device_idx, type, local_flags, deleted, count, size)
+        VALUES (NEW.device_idx, NEW.type, NEW.local_flags, NEW.deleted, 1, NEW.size)
        ON CONFLICT DO UPDATE SET count = count + 1, size = size + NEW.size;
    UPDATE counts SET count = count - 1, size = size - OLD.size
        WHERE device_idx = OLD.device_idx AND type = OLD.type AND local_flags = OLD.local_flags AND deleted = OLD.deleted;
@@ -37,7 +37,7 @@ func NewTyped(db KV, prefix string) *Typed {
 // is overwritten.
 func (n *Typed) PutInt64(key string, val int64) error {
 	var valBs [8]byte
-	binary.BigEndian.PutUint64(valBs[:], uint64(val))
+	binary.BigEndian.PutUint64(valBs[:], uint64(val)) //nolint:gosec
 	return n.db.PutKV(n.prefixedKey(key), valBs[:])
 }

@@ -49,7 +49,7 @@ func (n *Typed) Int64(key string) (int64, bool, error) {
 		return 0, false, filterNotFound(err)
 	}
 	val := binary.BigEndian.Uint64(valBs)
-	return int64(val), true, nil
+	return int64(val), true, nil //nolint:gosec
 }

 // PutTime stores a new time.Time. Any existing value (even if of another
@@ -7,14 +7,16 @@
 package protoutil

 import (
-	"fmt"
+	"errors"

 	"google.golang.org/protobuf/proto"
 )

+var errBufferTooSmall = errors.New("buffer too small")
+
 func MarshalTo(buf []byte, pb proto.Message) (int, error) {
 	if sz := proto.Size(pb); len(buf) < sz {
-		return 0, fmt.Errorf("buffer too small")
+		return 0, errBufferTooSmall
 	} else if sz == 0 {
 		return 0, nil
 	}
@@ -166,7 +166,7 @@ func (s *service) getListener(guiCfg config.GUIConfiguration) (net.Listener, err
 			name = s.tlsDefaultCommonName
 		}

-		cert, err = tlsutil.NewCertificate(httpsCertFile, httpsKeyFile, name, httpsCertLifetimeDays)
+		cert, err = tlsutil.NewCertificate(httpsCertFile, httpsKeyFile, name, httpsCertLifetimeDays, true)
 	}
 	if err != nil {
 		return nil, err
@@ -117,8 +117,8 @@ func (m *tokenManager) saveLocked() {
 		for token, expiry := range m.tokens.Tokens {
 			tokens = append(tokens, tokenExpiry{token, expiry})
 		}
-		slices.SortFunc(tokens, func(i, j tokenExpiry) int {
-			return int(i.expiry - j.expiry)
+		slices.SortFunc(tokens, func(a, b tokenExpiry) int {
+			return int(a.expiry - b.expiry)
 		})
 		// Remove the oldest tokens.
 		for _, token := range tokens[:len(tokens)-m.maxItems] {
@@ -18,7 +18,6 @@ import (
 	"os"
 	"reflect"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"

@@ -338,8 +337,8 @@ func (cfg *Configuration) prepareDeviceList() map[protocol.DeviceID]*DeviceConfi
 	// - sorted by ID
 	// Happen before preparting folders as that needs a correct device list.
 	cfg.Devices = ensureNoDuplicateOrEmptyIDDevices(cfg.Devices)
-	sort.Slice(cfg.Devices, func(a, b int) bool {
-		return cfg.Devices[a].DeviceID.Compare(cfg.Devices[b].DeviceID) == -1
+	slices.SortFunc(cfg.Devices, func(a, b DeviceConfiguration) int {
+		return a.DeviceID.Compare(b.DeviceID)
 	})

 	// Build a list of available devices
@@ -8,12 +8,12 @@ package config

 import (
 	"fmt"
-	"sort"
+	"slices"

 	"github.com/syncthing/syncthing/lib/protocol"
 )

-const defaultNumConnections = 1 // number of connections to use by default; may change in the future.
+const defaultNumConnections = 3 // number of connections to use by default

 type DeviceConfiguration struct {
 	DeviceID                 protocol.DeviceID `json:"deviceID" xml:"id,attr" nodefault:"true"`
@@ -100,8 +100,8 @@ func sortedObservedFolderSlice(input map[string]ObservedFolder) []ObservedFolder
 	for _, folder := range input {
 		output = append(output, folder)
 	}
-	sort.Slice(output, func(i, j int) bool {
-		return output[i].Time.Before(output[j].Time)
+	slices.SortFunc(output, func(a, b ObservedFolder) int {
+		return a.Time.Compare(b.Time)
 	})
 	return output
 }
@@ -15,7 +15,7 @@ import (
 	"fmt"
 	"path"
 	"path/filepath"
-	"sort"
+	"slices"
 	"strings"
 	"time"

@@ -288,8 +288,8 @@ func (f *FolderConfiguration) prepare(myID protocol.DeviceID, existingDevices ma
 	f.Devices = ensureDevicePresent(f.Devices, myID)
 	f.Devices = ensureNoUntrustedTrustingSharing(f, f.Devices, existingDevices)

-	sort.Slice(f.Devices, func(a, b int) bool {
-		return f.Devices[a].DeviceID.Compare(f.Devices[b].DeviceID) == -1
+	slices.SortFunc(f.Devices, func(a, b FolderDeviceConfiguration) int {
+		return a.DeviceID.Compare(b.DeviceID)
 	})

 	if f.RescanIntervalS > MaxRescanIntervalS {
@@ -0,0 +1,62 @@
+// Copyright (C) 2025 The Syncthing Authors.
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this file,
+// You can obtain one at https://mozilla.org/MPL/2.0/.
+
+package config
+
+import (
+	"strconv"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// RegisterInfoMetrics registers Prometheus metrics for the given config
+// wrapper.
+func RegisterInfoMetrics(cfg Wrapper) {
+	prometheus.DefaultRegisterer.MustRegister(prometheus.CollectorFunc((&folderInfoMetric{cfg}).Collect))
+	prometheus.DefaultRegisterer.MustRegister(prometheus.CollectorFunc((&folderDeviceMetric{cfg}).Collect))
+}
+
+type folderInfoMetric struct {
+	cfg Wrapper
+}
+
+var folderInfoMetricDesc = prometheus.NewDesc(
+	"syncthing_config_folder_info",
+	"Provides additional information labels on folders",
+	[]string{"folder", "label", "type", "path", "paused"},
+	nil,
+)
+
+func (m *folderInfoMetric) Collect(ch chan<- prometheus.Metric) {
+	for _, folder := range m.cfg.FolderList() {
+		ch <- prometheus.MustNewConstMetric(
+			folderInfoMetricDesc,
+			prometheus.GaugeValue, 1,
+			folder.ID, folder.Label, folder.Type.String(), folder.Path, strconv.FormatBool(folder.Paused),
+		)
+	}
+}
+
+type folderDeviceMetric struct {
+	cfg Wrapper
+}
+
+var folderDeviceMetricDesc = prometheus.NewDesc(
+	"syncthing_config_device_info",
+	"Provides additional information labels on devices",
+	[]string{"device", "name", "introducer", "paused", "untrusted"},
+	nil,
+)
+
+func (m *folderDeviceMetric) Collect(ch chan<- prometheus.Metric) {
+	for _, device := range m.cfg.DeviceList() {
+		ch <- prometheus.MustNewConstMetric(
+			folderDeviceMetricDesc,
+			prometheus.GaugeValue, 1,
+			device.DeviceID.String(), device.Name, strconv.FormatBool(device.Introducer), strconv.FormatBool(device.Paused), strconv.FormatBool(device.Untrusted),
+		)
+	}
+}
@@ -49,9 +49,11 @@ type quicListener struct {
 	registry   *registry.Registry
 	lanChecker *lanChecker

-	address *url.URL
-	laddr   net.Addr
-	mut     sync.Mutex
+	address    *url.URL
+	natService *nat.Service
+	mapping    *nat.Mapping
+	laddr      net.Addr
+	mut        sync.Mutex
 }

 func (t *quicListener) OnNATTypeChanged(natType stun.NATType) {
@@ -126,7 +128,24 @@ func (t *quicListener) serve(ctx context.Context) error {
 	l.Infof("QUIC listener (%v) starting", udpConn.LocalAddr())
 	defer l.Infof("QUIC listener (%v) shutting down", udpConn.LocalAddr())

+	var ipVersion nat.IPVersion
+	switch t.uri.Scheme {
+	case "quic4":
+		ipVersion = nat.IPv4Only
+	case "quic6":
+		ipVersion = nat.IPv6Only
+	default:
+		ipVersion = nat.IPvAny
+	}
+	mapping := t.natService.NewMapping(nat.UDP, ipVersion, udpAddr.IP, udpAddr.Port)
+	mapping.OnChanged(func() {
+		t.notifyAddressesChanged(t)
+	})
+	// Should be called after t.mapping is nil'ed out.
+	defer t.natService.RemoveMapping(mapping)
+
 	t.mut.Lock()
+	t.mapping = mapping
 	t.laddr = udpConn.LocalAddr()
 	t.mut.Unlock()
 	defer func() {
@@ -196,6 +215,9 @@ func (t *quicListener) WANAddresses() []*url.URL {
 	if t.address != nil {
 		uris = append(uris, t.address)
 	}
+
+	uris = append(uris, portMappingURIs(t.mapping, *t.uri)...)
+
 	t.mut.Unlock()
 	return uris
 }
@@ -232,12 +254,13 @@ func (*quicListenerFactory) Valid(config.Configuration) error {
 	return nil
 }

-func (f *quicListenerFactory) New(uri *url.URL, cfg config.Wrapper, tlsCfg *tls.Config, conns chan internalConn, _ *nat.Service, registry *registry.Registry, lanChecker *lanChecker) genericListener {
+func (f *quicListenerFactory) New(uri *url.URL, cfg config.Wrapper, tlsCfg *tls.Config, conns chan internalConn, natService *nat.Service, registry *registry.Registry, lanChecker *lanChecker) genericListener {
 	l := &quicListener{
 		uri:        fixupPort(uri, config.DefaultQUICPort),
 		cfg:        cfg,
 		tlsCfg:     tlsCfg,
 		conns:      conns,
+		natService: natService,
 		factory:    f,
 		registry:   registry,
 		lanChecker: lanChecker,
@@ -444,7 +444,7 @@ func (s *service) handleHellos(ctx context.Context) error {
 		// connections are limited.
 		rd, wr := s.limiter.getLimiters(remoteID, c, c.IsLocal())

-		protoConn := protocol.NewConnection(remoteID, rd, wr, c, s.model, c, deviceCfg.Compression.ToProtocol(), s.cfg.FolderPasswords(remoteID), s.keyGen)
+		protoConn := protocol.NewConnection(remoteID, rd, wr, c, s.model, c, deviceCfg.Compression.ToProtocol(), s.keyGen)
 		s.accountAddedConnection(protoConn, hello, s.cfg.Options().ConnectionPriorityUpgradeThreshold)
 		go func() {
 			<-protoConn.Closed()
@@ -175,24 +175,9 @@ func (t *tcpListener) WANAddresses() []*url.URL {
 	uris := []*url.URL{
 		maybeReplacePort(t.uri, t.laddr),
 	}
-	if t.mapping != nil {
-		addrs := t.mapping.ExternalAddresses()
-		for _, addr := range addrs {
-			uri := *t.uri
-			// Does net.JoinHostPort internally
-			uri.Host = addr.String()
-			uris = append(uris, &uri)

-			// For every address with a specified IP, add one without an IP,
-			// just in case the specified IP is still internal (router behind DMZ).
-			if len(addr.IP) != 0 && !addr.IP.IsUnspecified() {
-				zeroUri := *t.uri
-				addr.IP = nil
-				zeroUri.Host = addr.String()
-				uris = append(uris, &zeroUri)
-			}
-		}
-	}
+	uris = append(uris, portMappingURIs(t.mapping, *t.uri)...)
+
 	t.mut.RUnlock()

 	// If we support ReusePort, add an unspecified zero port address, which will be resolved by the discovery server
@@ -12,6 +12,7 @@ import (
 	"strconv"
 	"strings"

+	"github.com/syncthing/syncthing/lib/nat"
 	"github.com/syncthing/syncthing/lib/osutil"
 )

@@ -130,3 +131,27 @@ func maybeReplacePort(uri *url.URL, laddr net.Addr) *url.URL {
 	uriCopy.Host = net.JoinHostPort(host, lportStr)
 	return &uriCopy
 }
+
+func portMappingURIs(mapping *nat.Mapping, listener_uri url.URL) []*url.URL {
+	var uris []*url.URL
+	if mapping != nil {
+		addrs := mapping.ExternalAddresses()
+		for _, addr := range addrs {
+			uri := listener_uri
+			// Does net.JoinHostPort internally
+			uri.Host = addr.String()
+			uris = append(uris, &uri)
+
+			// For every address with a specified IP, add one without an IP,
+			// just in case the specified IP is still internal (router behind DMZ).
+			if len(addr.IP) != 0 && !addr.IP.IsUnspecified() {
+				zeroUri := listener_uri
+				addr.IP = nil
+				zeroUri.Host = addr.String()
+				uris = append(uris, &zeroUri)
+			}
+		}
+	}
+
+	return uris
+}
@@ -379,12 +379,12 @@ func longFilenameSupport(path string) string {
 	return path
 }

-type ErrWatchEventOutsideRoot struct{ msg string }
+type WatchEventOutsideRootError struct{ msg string }

-func (e *ErrWatchEventOutsideRoot) Error() string {
+func (e *WatchEventOutsideRootError) Error() string {
 	return e.msg
 }

-func (f *BasicFilesystem) newErrWatchEventOutsideRoot(absPath string, roots []string) *ErrWatchEventOutsideRoot {
-	return &ErrWatchEventOutsideRoot{fmt.Sprintf("Watching for changes encountered an event outside of the filesystem root: f.root==%v, roots==%v, path==%v. This should never happen, please report this message to forum.syncthing.net.", f.root, roots, absPath)}
+func (f *BasicFilesystem) newErrWatchEventOutsideRoot(absPath string, roots []string) *WatchEventOutsideRootError {
+	return &WatchEventOutsideRootError{fmt.Sprintf("Watching for changes encountered an event outside of the filesystem root: f.root==%v, roots==%v, path==%v. This should never happen, please report this message to forum.syncthing.net.", f.root, roots, absPath)}
 }
@@ -15,7 +15,7 @@ import (
 )

 func (fi basicFileInfo) InodeChangeTime() time.Time {
-	if sys, ok := fi.FileInfo.Sys().(*syscall.Stat_t); ok {
+	if sys, ok := fi.Sys().(*syscall.Stat_t); ok {
 		return time.Unix(0, sys.Ctimespec.Nano())
 	}
 	return time.Time{}
@@ -86,7 +86,7 @@ func (f *BasicFilesystem) Remove(name string) error {
 // unrooted) or an error if the given path is not a subpath and handles the
 // special case when the given path is the folder root without a trailing
 // pathseparator.
-func (f *BasicFilesystem) unrootedChecked(absPath string, roots []string) (string, *ErrWatchEventOutsideRoot) {
+func (f *BasicFilesystem) unrootedChecked(absPath string, roots []string) (string, *WatchEventOutsideRootError) {
 	for _, root := range roots {
 		// Make sure the root ends with precisely one path separator, to
 		// ease prefix comparisons.
@@ -69,7 +69,7 @@ var xattrBufPool = sync.Pool{
 }

 func getXattr(path, name string) ([]byte, error) {
-	buf := xattrBufPool.Get().([]byte)
+	buf := xattrBufPool.Get().([]byte) //nolint:forcetypeassert
 	defer func() {
 		// Put the buffer back in the pool, or not if we're not supposed to
 		// (we returned it to the caller).
@@ -24,16 +24,16 @@ const (
 	caseCacheItemLimit = 4 << 10
 )

-type ErrCaseConflict struct {
+type CaseConflictError struct {
 	Given, Real string
 }

-func (e *ErrCaseConflict) Error() string {
+func (e *CaseConflictError) Error() string {
 	return fmt.Sprintf(`remote "%v" uses different upper or lowercase characters than local "%v"; change the casing on either side to match the other`, e.Given, e.Real)
 }

 func IsErrCaseConflict(err error) bool {
-	e := &ErrCaseConflict{}
+	e := &CaseConflictError{}
 	return errors.As(err, &e)
 }

@@ -239,7 +239,7 @@ func (f *caseFilesystem) Rename(oldpath, newpath string) error {
 	}
 	if err := f.checkCase(newpath); err != nil {
 		// Case-only rename is ok
-		e := &ErrCaseConflict{}
+		e := &CaseConflictError{}
 		if !errors.As(err, &e) || e.Real != oldpath {
 			return err
 		}
@@ -389,7 +389,7 @@ func (f *caseFilesystem) checkCaseExisting(name string) error {
 	// comparing, as we don't want to treat a normalization difference as a
 	// case conflict.
 	if norm.NFC.String(realName) != norm.NFC.String(name) {
-		return &ErrCaseConflict{name, realName}
+		return &CaseConflictError{name, realName}
 	}
 	return nil
 }
@@ -147,29 +147,29 @@ func newFakeFilesystem(rootURI string, _ ...Option) *fakeFS {
 		// *look* like file I/O, but they are not. Do not worry that they
 		// might fail.

-		rng := rand.New(rand.NewSource(int64(seed)))
+		rng := rand.New(rand.NewSource(int64(seed))) //nolint:gosec
 		var createdFiles int
 		var writtenData int64
 		for (files == 0 || createdFiles < files) && (maxsize == 0 || writtenData>>20 < int64(maxsize)) {
 			dir := filepath.Join(fmt.Sprintf("%02x", rng.Intn(255)), fmt.Sprintf("%02x", rng.Intn(255)))
 			file := fmt.Sprintf("%016x", rng.Int63())
-			fs.MkdirAll(dir, 0o755)
+			_ = fs.MkdirAll(dir, 0o755)

 			fd, _ := fs.Create(filepath.Join(dir, file))
 			createdFiles++

 			fsize := int64(sizeavg/2 + rng.Intn(sizeavg))
-			fd.Truncate(fsize)
+			_ = fd.Truncate(fsize)
 			writtenData += fsize

 			ftime := time.Unix(1000000000+rng.Int63n(10*365*86400), 0)
-			fs.Chtimes(filepath.Join(dir, file), ftime, ftime)
+			_ = fs.Chtimes(filepath.Join(dir, file), ftime, ftime)
 		}
 	}

 	if !nostfolder {
 		// Also create a default folder marker for good measure
-		fs.Mkdir(".stfolder", 0o700)
+		_ = fs.Mkdir(".stfolder", 0o700)
 	}

 	// We only set the latency after doing the operations required to create
@@ -284,9 +284,10 @@ func (fs *fakeFS) create(name string) (*fakeEntry, error) {
 	time.Sleep(fs.latency)

 	if entry := fs.entryForName(name); entry != nil {
-		if entry.entryType == fakeEntryTypeDir {
+		switch entry.entryType {
+		case fakeEntryTypeDir:
 			return nil, os.ErrExist
-		} else if entry.entryType == fakeEntryTypeSymlink {
+		case fakeEntryTypeSymlink:
 			return nil, errors.New("following symlink not supported")
 		}
 		entry.size = 0
@@ -731,6 +732,7 @@ func (fs *fakeFS) resetCounters() {
 }

 func (fs *fakeFS) reportMetricsPerOp(b *testing.B) {
+	b.Helper()
 	fs.reportMetricsPer(b, 1, "op")
 }

@@ -829,7 +831,7 @@ func (f *fakeFile) readShortAt(p []byte, offs int64) (int, error) {
 	if f.seed == 0 {
 		hf := fnv.New64()
 		hf.Write([]byte(f.name))
-		f.seed = int64(hf.Sum64())
+		f.seed = int64(hf.Sum64()) //nolint:gosec
 	}

 	// Check whether the read is a continuation of an RNG we already have or
@@ -839,14 +841,14 @@ func (f *fakeFile) readShortAt(p []byte, offs int64) (int, error) {
 	nextBlockOffs := (seedNo + 1) << randomBlockShift
 	if f.rng == nil || f.offset != offs || seedNo != f.seedOffs {
 		// This is not a straight read continuing from a previous one
-		f.rng = rand.New(rand.NewSource(f.seed + seedNo))
+		f.rng = rand.New(rand.NewSource(f.seed + seedNo)) //nolint:gosec

 		// If the read is not at the start of the block, discard data
 		// accordingly.
 		diff := offs - minOffs
 		if diff > 0 {
 			lr := io.LimitReader(f.rng, diff)
-			io.Copy(io.Discard, lr)
+			_, _ = io.Copy(io.Discard, lr)
 		}

 		f.offset = offs
@@ -180,7 +180,7 @@ const (
 // SkipDir is used as a return value from WalkFuncs to indicate that
 // the directory named in the call is to be skipped. It is not returned
 // as an error by any function.
-var SkipDir = filepath.SkipDir
+var SkipDir = filepath.SkipDir //nolint:errname

 func IsExist(err error) bool {
 	return errors.Is(err, ErrExist)
@@ -259,15 +259,16 @@ func NewFilesystem(fsType FilesystemType, uri string, opts ...Option) Filesystem
 		// attributed to the calling function.
 		layersAboveWalkFilesystem++
 	}
-	if l.ShouldDebug("walkfs") {
+	switch {
+	case l.ShouldDebug("walkfs"):
 		// A walkFilesystem is not a layer to skip, it embeds the underlying
 		// filesystem, passing calls directly trough. Except for calls made
 		// during walking, however those are truly originating in the walk
 		// filesystem.
 		fs = NewWalkFilesystem(newLogFilesystem(fs, layersAboveWalkFilesystem))
-	} else if l.ShouldDebug("fs") {
+	case l.ShouldDebug("fs"):
 		fs = newLogFilesystem(NewWalkFilesystem(fs), layersAboveWalkFilesystem)
-	} else {
+	default:
 		fs = NewWalkFilesystem(fs)
 	}

@@ -7,6 +7,7 @@
 package fs

 import (
+	"errors"
 	"io"
 )

@@ -28,7 +29,7 @@ func copyRangeStandard(src, dst File, srcOffset, dstOffset, size int64) error {
 		}
 		n, err := src.ReadAt(buf, srcOffset)
 		if err != nil {
-			if err == io.EOF {
+			if errors.Is(err, io.EOF) {
 				return io.ErrUnexpectedEOF
 			}
 			return err
@@ -8,6 +8,7 @@ package fs

 import (
 	"bytes"
+	"errors"
 	"io"
 	"math/rand"
 	"os"
@@ -329,7 +330,7 @@ func TestCopyRange(tttt *testing.T) {
 								t.Fatal("dst file is not a basic file")
 							}
 							if err := impl(srcBasic, dstBasic, testCase.srcOffset, testCase.dstOffset, testCase.copySize); err != nil {
-								if err == syscall.ENOTSUP {
+								if errors.Is(err, errors.ErrUnsupported) {
 									// Test runner can adjust directory in which to run the tests, that allow broader tests.
 									t.Skip("Not supported on the current filesystem, set STFSTESTPATH env var.")
 								}
@@ -68,7 +68,7 @@ func (*optionMtime) String() string {

 func (f *mtimeFS) Chtimes(name string, atime, mtime time.Time) error {
 	// Do a normal Chtimes call, don't care if it succeeds or not.
-	f.chtimes(name, atime, mtime)
+	_ = f.chtimes(name, atime, mtime)

 	// Stat the file to see what happened. Here we *do* return an error,
 	// because it might be "does not exist" or similar.
@@ -26,8 +26,10 @@ type Option interface {
 type FilesystemFactory func(string, ...Option) (Filesystem, error)

 // For each registered file system type, a function to construct a file system.
-var filesystemFactories map[FilesystemType]FilesystemFactory = make(map[FilesystemType]FilesystemFactory)
-var filesystemFactoriesMutex sync.Mutex = sync.Mutex{}
+var (
+	filesystemFactories      map[FilesystemType]FilesystemFactory = make(map[FilesystemType]FilesystemFactory)
+	filesystemFactoriesMutex sync.Mutex                           = sync.Mutex{}
+)

 // Register a function to be called when a filesystem is to be constructed with
 // the specified fsType. The function will receive the URI for the file system as well
@@ -192,7 +192,7 @@ func CommonPrefix(first, second string) string {
 	}

 	common := make([]string, 0, count)
-	for i := 0; i < count; i++ {
+	for i := range count {
 		if firstParts[i] != secondParts[i] {
 			break
 		}
@@ -89,7 +89,7 @@ func (f *walkFilesystem) walk(path string, info FileInfo, walkFn WalkFunc, ances

 	err = walkFn(path, info, nil)
 	if err != nil {
-		if info.IsDir() && err == SkipDir {
+		if info.IsDir() && errors.Is(err, SkipDir) {
 			return nil
 		}
 		return err
@@ -117,13 +117,13 @@ func (f *walkFilesystem) walk(path string, info FileInfo, walkFn WalkFunc, ances
 		filename := filepath.Join(path, name)
 		fileInfo, err := f.Lstat(filename)
 		if err != nil {
-			if err := walkFn(filename, fileInfo, err); err != nil && err != SkipDir {
+			if err := walkFn(filename, fileInfo, err); err != nil && !errors.Is(err, SkipDir) {
 				return err
 			}
 		} else {
 			err = f.walk(filename, fileInfo, walkFn, ancestors)
 			if err != nil {
-				if !fileInfo.IsDir() || err != SkipDir {
+				if !fileInfo.IsDir() || !errors.Is(err, SkipDir) {
 					return err
 				}
 			}
@@ -7,7 +7,7 @@
 package model

 import (
-	"sort"
+	"slices"

 	"github.com/syncthing/syncthing/lib/config"
 	"github.com/syncthing/syncthing/lib/protocol"
@@ -51,9 +51,9 @@ type standardBlockPullReorderer struct {
 }

 func newStandardBlockPullReorderer(id protocol.DeviceID, otherDevices []protocol.DeviceID) *standardBlockPullReorderer {
-	allDevices := append(otherDevices, id)
-	sort.Slice(allDevices, func(i, j int) bool {
-		return allDevices[i].Compare(allDevices[j]) == -1
+	allDevices := append(otherDevices, id) //nolint:gocritic
+	slices.SortFunc(allDevices, func(a, b protocol.DeviceID) int {
+		return a.Compare(b)
 	})
 	// Find our index
 	myIndex := -1
@@ -92,7 +92,7 @@ func (p *standardBlockPullReorderer) Reorder(blocks []protocol.BlockInfo) []prot
 	// The rest of the chunks we fetch in a random order in whole chunks.
 	// Generate chunk index slice and shuffle it
 	indexes := make([]int, 0, len(chunks)-1)
-	for i := range len(chunks) {
+	for i := range chunks {
 		if i != p.myIndex {
 			indexes = append(indexes, i)
 		}
@@ -8,7 +8,7 @@ package model

 import (
 	"reflect"
-	"sort"
+	"slices"
 	"testing"

 	"github.com/syncthing/syncthing/lib/protocol"
@@ -65,8 +65,8 @@ func Test_inOrderBlockPullReorderer_Reorder(t *testing.T) {
 func Test_standardBlockPullReorderer_Reorder(t *testing.T) {
 	// Order the devices, so we know their ordering ahead of time.
 	devices := []protocol.DeviceID{myID, device1, device2}
-	sort.Slice(devices, func(i, j int) bool {
-		return devices[i].Compare(devices[j]) == -1
+	slices.SortFunc(devices, func(a, b protocol.DeviceID) int {
+		return a.Compare(b)
 	})

 	blocks := func(i ...int) []protocol.BlockInfo {
@@ -56,17 +56,18 @@ func (p *deviceFolderDownloadState) Update(updates []protocol.FileDownloadProgre
 		if update.UpdateType == protocol.FileDownloadProgressUpdateTypeForget && ok && local.version.Equal(update.Version) {
 			delete(p.files, update.Name)
 		} else if update.UpdateType == protocol.FileDownloadProgressUpdateTypeAppend {
-			if !ok {
+			switch {
+			case !ok:
 				local = deviceFolderFileDownloadState{
 					blockIndexes: update.BlockIndexes,
 					version:      update.Version,
 					blockSize:    update.BlockSize,
 				}
-			} else if !local.version.Equal(update.Version) {
+			case !local.version.Equal(update.Version):
 				local.blockIndexes = append(local.blockIndexes[:0], update.BlockIndexes...)
 				local.version = update.Version
 				local.blockSize = update.BlockSize
-			} else {
+			default:
 				local.blockIndexes = append(local.blockIndexes, update.BlockIndexes...)
 			}
 			p.files[update.Name] = local
@@ -74,7 +74,7 @@ func (f *fakeConnection) DownloadProgress(_ context.Context, dp *protocol.Downlo
 	})
 }

-func (f *fakeConnection) addFileLocked(name string, flags uint32, ftype protocol.FileInfoType, data []byte, version protocol.Vector, localFlags uint32) {
+func (f *fakeConnection) addFileLocked(name string, flags uint32, ftype protocol.FileInfoType, data []byte, version protocol.Vector, localFlags protocol.FlagLocal) {
 	blockSize := protocol.BlockSize(int64(len(data)))
 	blocks, _ := scanner.Blocks(context.TODO(), bytes.NewReader(data), blockSize, int64(len(data)), nil)

@@ -13,7 +13,7 @@ import (
 	"math/rand"
 	"path/filepath"
 	"slices"
-	"sort"
+	"strings"
 	"time"

 	"github.com/syncthing/syncthing/internal/db"
@@ -44,7 +44,7 @@ type folder struct {
 	*stats.FolderStatisticsReference
 	ioLimiter *semaphore.Semaphore

-	localFlags uint32
+	localFlags protocol.FlagLocal

 	model         *model
 	shortID       protocol.ShortID
@@ -52,7 +52,7 @@ type folder struct {
 	ignores       *ignore.Matcher
 	mtimefs       fs.Filesystem
 	modTimeWindow time.Duration
-	ctx           context.Context // used internally, only accessible on serve lifetime
+	ctx           context.Context //nolint:containedctx // used internally, only accessible on serve lifetime
 	done          chan struct{}   // used externally, accessible regardless of serve

 	scanInterval           time.Duration
@@ -188,8 +188,12 @@ func (f *folder) Serve(ctx context.Context) error {
 		case <-f.pullScheduled:
 			if f.PullerDelayS > 0 {
 				// Wait for incoming updates to settle before doing the
-				// actual pull
-				f.setState(FolderSyncWaiting)
+				// actual pull. Only set the state to SyncWaiting if we have
+				// reason to believe there is something to sync, to avoid
+				// unnecessary flashing in the GUI.
+				if needCount, err := f.db.CountNeed(f.folderID, protocol.LocalDeviceID); err == nil && needCount.TotalItems() > 0 {
+					f.setState(FolderSyncWaiting)
+				}
 				pullTimer.Reset(time.Duration(float64(time.Second) * f.PullerDelayS))
 			} else {
 				_, err = f.pull()
@@ -322,7 +326,7 @@ func (f *folder) Reschedule() {
 		return
 	}
 	// Sleep a random time between 3/4 and 5/4 of the configured interval.
-	sleepNanos := (f.scanInterval.Nanoseconds()*3 + rand.Int63n(2*f.scanInterval.Nanoseconds())) / 4
+	sleepNanos := (f.scanInterval.Nanoseconds()*3 + rand.Int63n(2*f.scanInterval.Nanoseconds())) / 4 //nolint:gosec
 	interval := time.Duration(sleepNanos) * time.Nanosecond
 	l.Debugln(f, "next rescan in", interval)
 	f.scanTimer.Reset(interval)
@@ -1077,7 +1081,7 @@ func (f *folder) monitorWatch(ctx context.Context) {
 			f.setWatchError(err, next)
 			// This error was previously a panic and should never occur, so generate
 			// a warning, but don't do it repetitively.
-			var errOutside *fs.ErrWatchEventOutsideRoot
+			var errOutside *fs.WatchEventOutsideRootError
 			if errors.As(err, &errOutside) {
 				if !warnedOutside {
 					l.Warnln(err)
@@ -1111,7 +1115,7 @@ func (f *folder) setWatchError(err error, nextTryIn time.Duration) {
 	prevErr := f.watchErr
 	f.watchErr = err
 	f.watchMut.Unlock()
-	if err != prevErr {
+	if err != prevErr { //nolint:errorlint
 		data := map[string]interface{}{
 			"folder": f.ID,
 		}
@@ -1127,7 +1131,7 @@ func (f *folder) setWatchError(err error, nextTryIn time.Duration) {
 		return
 	}
 	msg := fmt.Sprintf("Error while trying to start filesystem watcher for folder %s, trying again in %v: %v", f.Description(), nextTryIn, err)
-	if prevErr != err {
+	if prevErr != err { //nolint:errorlint
 		l.Infof(msg)
 		return
 	}
@@ -1226,7 +1230,9 @@ func (f *folder) Errors() []FileError {
 	errors := make([]FileError, scanLen+len(f.pullErrors))
 	copy(errors[:scanLen], f.scanErrors)
 	copy(errors[scanLen:], f.pullErrors)
-	sort.Sort(fileErrorList(errors))
+	slices.SortFunc(errors, func(a, b FileError) int {
+		return strings.Compare(a.Path, b.Path)
+	})
 	return errors
 }

@@ -8,7 +8,8 @@ package model

 import (
 	"fmt"
-	"sort"
+	"slices"
+	"strings"

 	"github.com/syncthing/syncthing/internal/itererr"
 	"github.com/syncthing/syncthing/lib/config"
@@ -104,7 +105,9 @@ func (f *receiveEncryptedFolder) revertHandleDirs(dirs []string) {
 	go f.pullScannerRoutine(scanChan)
 	defer close(scanChan)

-	sort.Sort(sort.Reverse(sort.StringSlice(dirs)))
+	slices.SortFunc(dirs, func(a, b string) int {
+		return strings.Compare(b, a)
+	})
 	for _, dir := range dirs {
 		if err := f.deleteDirOnDisk(dir, scanChan); err != nil {
 			f.newScanError(dir, fmt.Errorf("deleting unexpected dir: %w", err))
@@ -7,7 +7,8 @@
 package model

 import (
-	"sort"
+	"slices"
+	"strings"
 	"time"

 	"github.com/syncthing/syncthing/internal/itererr"
@@ -208,7 +209,9 @@ func (q *deleteQueue) handle(fi protocol.FileInfo) (bool, error) {

 func (q *deleteQueue) flush() ([]string, error) {
 	// Process directories from the leaves inward.
-	sort.Sort(sort.Reverse(sort.StringSlice(q.dirs)))
+	slices.SortFunc(q.dirs, func(a, b string) int {
+		return strings.Compare(b, a)
+	})

 	var firstError error
 	var deleted []string
@@ -28,7 +28,7 @@ func newSendOnlyFolder(model *model, ignores *ignore.Matcher, cfg config.FolderC
 	f := &sendOnlyFolder{
 		folder: newFolder(model, ignores, cfg, evLogger, ioLimiter, nil),
 	}
-	f.folder.puller = f
+	f.puller = f
 	return f
 }

@@ -14,7 +14,7 @@ import (
 	"fmt"
 	"io"
 	"path/filepath"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -136,7 +136,7 @@ func newSendReceiveFolder(model *model, ignores *ignore.Matcher, cfg config.Fold
 		blockPullReorderer: newBlockPullReorderer(cfg.BlockPullOrder, model.id, cfg.DeviceIDs()),
 		writeLimiter:       semaphore.New(cfg.MaxConcurrentWrites),
 	}
-	f.folder.puller = f
+	f.puller = f

 	if f.Copiers == 0 {
 		f.Copiers = defaultCopiers
@@ -359,13 +359,14 @@ loop:
 			}

 		case file.IsDeleted():
-			if file.IsDirectory() {
+			switch {
+			case file.IsDirectory():
 				// Perform directory deletions at the end, as we may have
 				// files to delete inside them before we get to that point.
 				dirDeletions = append(dirDeletions, file)
-			} else if file.IsSymlink() {
+			case file.IsSymlink():
 				f.deleteFile(file, dbUpdateChan, scanChan)
-			} else {
+			default:
 				df, ok, err := f.model.sdb.GetDeviceFile(f.folderID, protocol.LocalDeviceID, file.Name)
 				if err != nil {
 					return changed, nil, nil, err
@@ -976,7 +977,7 @@ func (f *sendReceiveFolder) renameFile(cur, source, target protocol.FileInfo, db
 	}
 	switch stat, serr := f.mtimefs.Lstat(target.Name); {
 	case serr != nil:
-		var caseErr *fs.ErrCaseConflict
+		var caseErr *fs.CaseConflictError
 		switch {
 		case errors.As(serr, &caseErr):
 			if caseErr.Real != source.Name {
@@ -1023,7 +1024,7 @@ func (f *sendReceiveFolder) renameFile(cur, source, target protocol.FileInfo, db
 	tempName := fs.TempName(target.Name)

 	if f.versioner != nil {
-		err = f.CheckAvailableSpace(uint64(source.Size))
+		err = f.CheckAvailableSpace(uint64(source.Size)) //nolint:gosec
 		if err == nil {
 			err = osutil.Copy(f.CopyRangeMethod.ToFS(), f.mtimefs, f.mtimefs, source.Name, tempName)
 			if err == nil {
@@ -1148,7 +1149,7 @@ func (f *sendReceiveFolder) reuseBlocks(blocks []protocol.BlockInfo, reused []in
 	// reuse.
 	tempBlocks, err := scanner.HashFile(f.ctx, f.ID, f.mtimefs, tempName, file.BlockSize(), nil)
 	if err != nil {
-		var caseErr *fs.ErrCaseConflict
+		var caseErr *fs.CaseConflictError
 		if errors.As(err, &caseErr) {
 			if rerr := f.mtimefs.Rename(caseErr.Real, tempName); rerr == nil {
 				tempBlocks, err = scanner.HashFile(f.ctx, f.ID, f.mtimefs, tempName, file.BlockSize(), nil)
@@ -1295,7 +1296,7 @@ func (f *sendReceiveFolder) copierRoutine(in <-chan copyBlocksState, pullChan ch
 	}

 	for state := range in {
-		if err := f.CheckAvailableSpace(uint64(state.file.Size)); err != nil {
+		if err := f.CheckAvailableSpace(uint64(state.file.Size)); err != nil { //nolint:gosec
 			state.fail(err)
 			// Nothing more to do for this failed file, since it would use to much disk space
 			out <- state.sharedPullerState
@@ -1461,7 +1462,7 @@ func (f *sendReceiveFolder) copyBlockFromFile(srcName string, srcOffset int64, s
 }

 func (*sendReceiveFolder) verifyBuffer(buf []byte, block protocol.BlockInfo) error {
-	if len(buf) != int(block.Size) {
+	if len(buf) != block.Size {
 		return fmt.Errorf("length mismatch %d != %d", len(buf), block.Size)
 	}

@@ -1489,8 +1490,7 @@ func (f *sendReceiveFolder) pullerRoutine(in <-chan pullBlockState, out chan<- *
 		// ongoing at any given time, based on the size of the blocks
 		// themselves.

-		state := state
-		bytes := int(state.block.Size)
+		bytes := state.block.Size

 		if err := requestLimiter.TakeWithContext(f.ctx, bytes); err != nil {
 			state.fail(err)
@@ -1713,7 +1713,7 @@ func (f *sendReceiveFolder) dbUpdaterRoutine(dbUpdateChan <-chan dbUpdateJob) {
 		// sync directories
 		for dir := range changedDirs {
 			delete(changedDirs, dir)
-			if !f.FolderConfiguration.DisableFsync {
+			if !f.DisableFsync {
 				fd, err := f.mtimefs.Open(dir)
 				if err != nil {
 					l.Debugf("fsync %q failed: %v", dir, err)
@@ -1854,7 +1854,9 @@ func (f *sendReceiveFolder) moveForConflict(name, lastModBy string, scanChan cha
 	if f.MaxConflicts > -1 {
 		matches := existingConflicts(name, f.mtimefs)
 		if len(matches) > f.MaxConflicts {
-			sort.Sort(sort.Reverse(sort.StringSlice(matches)))
+			slices.SortFunc(matches, func(a, b string) int {
+				return strings.Compare(b, a)
+			})
 			for _, match := range matches[f.MaxConflicts:] {
 				if gerr := f.mtimefs.Remove(match); gerr != nil {
 					l.Debugln(f, "removing extra conflict", gerr)
@@ -1994,7 +1996,7 @@ func (f *sendReceiveFolder) deleteDirOnDiskHandleChildren(dir string, scanChan c
 			// Lets just assume the file has changed.
 			scanChan <- path
 			hasToBeScanned = true
-			return nil
+			return nil //nolint:nilerr
 		}
 		if !cf.IsEquivalentOptional(diskFile, protocol.FileInfoComparison{
 			ModTimeWindow:   f.modTimeWindow,
@@ -2053,7 +2055,7 @@ func (f *sendReceiveFolder) deleteDirOnDiskHandleChildren(dir string, scanChan c
 // not changed.
 func (f *sendReceiveFolder) scanIfItemChanged(name string, stat fs.FileInfo, item protocol.FileInfo, hasItem bool, fromDelete bool, scanChan chan<- string) (err error) {
 	defer func() {
-		if err == errModified {
+		if errors.Is(err, errModified) {
 			scanChan <- name
 		}
 	}()
@@ -2196,20 +2198,6 @@ type FileError struct {
 	Err  string `json:"error"`
 }

-type fileErrorList []FileError
-
-func (l fileErrorList) Len() int {
-	return len(l)
-}
-
-func (l fileErrorList) Less(a, b int) bool {
-	return l[a].Path < l[b].Path
-}
-
-func (l fileErrorList) Swap(a, b int) {
-	l[a], l[b] = l[b], l[a]
-}
-
 func conflictName(name, lastModBy string) string {
 	ext := filepath.Ext(name)
 	return name[:len(name)-len(ext)] + time.Now().Format(".sync-conflict-20060102-150405-") + lastModBy + ext
@@ -1014,7 +1014,7 @@ func TestPullCaseOnlyPerformFinish(t *testing.T) {
 	default:
 	}

-	var caseErr *fs.ErrCaseConflict
+	var caseErr *fs.CaseConflictError
 	if !errors.As(err, &caseErr) {
 		t.Error("Expected case conflict error, got", err)
 	}
@@ -11,6 +11,7 @@ package model

 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -125,7 +126,7 @@ func (c *folderSummaryService) Summary(folder string) (*FolderSummary, error) {
 	var local, global, need, ro db.Counts
 	var ourSeq int64
 	var remoteSeq map[protocol.DeviceID]int64
-	errors, err := c.model.FolderErrors(folder)
+	errs, err := c.model.FolderErrors(folder)
 	if err == nil {
 		global, _ = c.model.GlobalSize(folder)
 		local, _ = c.model.LocalSize(folder, protocol.LocalDeviceID)
@@ -137,12 +138,12 @@ func (c *folderSummaryService) Summary(folder string) (*FolderSummary, error) {
 	// For API backwards compatibility (SyncTrayzor needs it) an empty folder
 	// summary is returned for not running folders, an error might actually be
 	// more appropriate
-	if err != nil && err != ErrFolderPaused && err != ErrFolderNotRunning {
+	if err != nil && !errors.Is(err, ErrFolderPaused) && !errors.Is(err, ErrFolderNotRunning) {
 		return nil, err
 	}

-	res.Errors = len(errors)
-	res.PullErrors = len(errors) // deprecated
+	res.Errors = len(errs)
+	res.PullErrors = len(errs) // deprecated

 	res.Invalid = "" // Deprecated, retains external API for now

@@ -66,7 +66,8 @@ func newIndexHandler(conn protocol.Connection, downloads *deviceDownloadState, f
 	// about us. Lets check to see if we can start sending index
 	// updates directly or need to send the index from start...

-	if startInfo.local.IndexID == myIndexID {
+	switch startInfo.local.IndexID {
+	case myIndexID:
 		// They say they've seen our index ID before, so we can
 		// send a delta update only.

@@ -83,15 +84,17 @@ func newIndexHandler(conn protocol.Connection, downloads *deviceDownloadState, f
 			l.Debugf("Device %v folder %s is delta index compatible (mlv=%d)", conn.DeviceID().Short(), folder.Description(), startInfo.local.MaxSequence)
 			startSequence = startInfo.local.MaxSequence
 		}
-	} else if startInfo.local.IndexID != 0 {
+
+	case 0:
+		l.Debugf("Device %v folder %s has no index ID for us", conn.DeviceID().Short(), folder.Description())
+
+	default:
 		// They say they've seen an index ID from us, but it's
 		// not the right one. Either they are confused or we
 		// must have reset our database since last talking to
 		// them. We'll start with a full index transfer.
 		l.Infof("Device %v folder %s has mismatching index ID for us (%v != %v)", conn.DeviceID().Short(), folder.Description(), startInfo.local.IndexID, myIndexID)
 		startSequence = 0
-	} else {
-		l.Debugf("Device %v folder %s has no index ID for us", conn.DeviceID().Short(), folder.Description())
 	}

 	// This is the other side's description of themselves. We
@@ -418,11 +421,6 @@ func (s *indexHandler) receive(fs []protocol.FileInfo, update bool, op string, p
 				"precedingSeq": fs[i-1].Sequence,
 			})
 		}
-
-		// The local attributes should never be transmitted over the wire.
-		// Make sure they look like they weren't.
-		fs[i].LocalFlags = 0
-		fs[i].VersionHash = nil
 	}

 	// Verify the claimed last sequence number
@@ -478,22 +476,14 @@ func (s *indexHandler) logSequenceAnomaly(msg string, extra map[string]any) {
 }

 func prepareFileInfoForIndex(f protocol.FileInfo) protocol.FileInfo {
-	// Mark the file as invalid if any of the local bad stuff flags are set.
-	f.RawInvalid = f.IsInvalid()
 	// If the file is marked LocalReceive (i.e., changed locally on a
 	// receive only folder) we do not want it to ever become the
 	// globally best version, invalid or not.
 	if f.IsReceiveOnlyChanged() {
 		f.Version = protocol.Vector{}
 	}
-	// The trailer with the encrypted fileinfo is device local, don't send info
-	// about that to remotes
+	// The trailer with the encrypted fileinfo is device local, announce the size without it to remotes.
 	f.Size -= int64(f.EncryptionTrailerSize)
-	f.EncryptionTrailerSize = 0
-	// never sent externally
-	f.LocalFlags = 0
-	f.VersionHash = nil
-	f.InodeChangeNs = 0
 	return f
 }

@@ -31,17 +31,17 @@ func TestIndexhandlerConcurrency(t *testing.T) {
 	ci := &protomock.ConnectionInfo{}

 	m1 := &mocks.Model{}
-	c1 := protocol.NewConnection(protocol.EmptyDeviceID, ar, bw, testutil.NoopCloser{}, m1, ci, protocol.CompressionNever, nil, nil)
+	c1 := protocol.NewConnection(protocol.EmptyDeviceID, ar, bw, testutil.NoopCloser{}, m1, ci, protocol.CompressionNever, nil)
 	c1.Start()
 	defer c1.Close(io.EOF)

 	m2 := &mocks.Model{}
-	c2 := protocol.NewConnection(protocol.EmptyDeviceID, br, aw, testutil.NoopCloser{}, m2, ci, protocol.CompressionNever, nil, nil)
+	c2 := protocol.NewConnection(protocol.EmptyDeviceID, br, aw, testutil.NoopCloser{}, m2, ci, protocol.CompressionNever, nil)
 	c2.Start()
 	defer c2.Close(io.EOF)

-	c1.ClusterConfig(&protocol.ClusterConfig{})
-	c2.ClusterConfig(&protocol.ClusterConfig{})
+	c1.ClusterConfig(&protocol.ClusterConfig{}, nil)
+	c2.ClusterConfig(&protocol.ClusterConfig{}, nil)
 	c1.Index(ctx, &protocol.Index{Folder: "foo"})
 	c2.Index(ctx, &protocol.Index{Folder: "foo"})

@@ -18,7 +18,7 @@ var (
 		Name:      "folder_state",
 		Help:      "Current folder state",
 	}, []string{"folder"})
-	metricFolderSummary = promauto.NewGaugeVec(prometheus.GaugeOpts{
+	metricFolderSummary = promauto.NewGaugeVec(prometheus.GaugeOpts{ //nolint:promlinter
 		Namespace: "syncthing",
 		Subsystem: "model",
 		Name:      "folder_summary",
@@ -195,7 +195,7 @@ var (
 	ErrFolderMissing    = errors.New("no such folder")
 	errNoVersioner      = errors.New("folder has no versioner")
 	// errors about why a connection is closed
-	errStopped                            = errors.New("Syncthing is being stopped")
+	errStopped                            = errors.New("Syncthing is being stopped") //nolint:staticcheck
 	errEncryptionInvConfigLocal           = errors.New("can't encrypt outgoing data because local data is encrypted (folder-type receive-encrypted)")
 	errEncryptionInvConfigRemote          = errors.New("remote has encrypted data and encrypts that data for us - this is impossible")
 	errEncryptionNotEncryptedLocal        = errors.New("remote expects to exchange encrypted data, but is configured for plain data")
@@ -460,6 +460,9 @@ func (m *model) warnAboutOverwritingProtectedFiles(cfg config.FolderConfiguratio
 }

 func (m *model) removeFolder(cfg config.FolderConfiguration) {
+	l.Infoln("Removing folder", cfg.Description())
+	defer l.Infoln("Removed folder", cfg.Description())
+
 	m.mut.RLock()
 	wait := m.folderRunners.StopAndWaitChan(cfg.ID, 0)
 	m.mut.RUnlock()
@@ -622,24 +625,26 @@ func (m *model) UsageReportingStats(report *contract.Report, version int, previe

 			for _, line := range lines {
 				// Allow prefixes to be specified in any order, but only once.
+			loop:
 				for {
-					if strings.HasPrefix(line, "!") && !seenPrefix[0] {
+					switch {
+					case strings.HasPrefix(line, "!") && !seenPrefix[0]:
 						seenPrefix[0] = true
 						line = line[1:]
 						report.IgnoreStats.Inverts++
-					} else if strings.HasPrefix(line, "(?i)") && !seenPrefix[1] {
+					case strings.HasPrefix(line, "(?i)") && !seenPrefix[1]:
 						seenPrefix[1] = true
 						line = line[4:]
 						report.IgnoreStats.Folded++
-					} else if strings.HasPrefix(line, "(?d)") && !seenPrefix[2] {
+					case strings.HasPrefix(line, "(?d)") && !seenPrefix[2]:
 						seenPrefix[2] = true
 						line = line[4:]
 						report.IgnoreStats.Deletable++
-					} else {
+					default:
 						seenPrefix[0] = false
 						seenPrefix[1] = false
 						seenPrefix[2] = false
-						break
+						break loop
 					}
 				}

@@ -1227,9 +1232,10 @@ func (m *model) ClusterConfig(conn protocol.Connection, cm *protocol.ClusterConf
 	for _, folder := range cm.Folders {
 		info := &clusterConfigDeviceInfo{}
 		for _, dev := range folder.Devices {
-			if dev.ID == m.id {
+			switch dev.ID {
+			case m.id:
 				info.local = dev
-			} else if dev.ID == deviceID {
+			case deviceID:
 				info.remote = dev
 			}
 			if info.local.ID != protocol.EmptyDeviceID && info.remote.ID != protocol.EmptyDeviceID {
@@ -1451,7 +1457,7 @@ func (m *model) ccHandleFolders(folders []protocol.Folder, deviceCfg config.Devi
 			sameError := false
 			m.mut.Lock()
 			if devs, ok := m.folderEncryptionFailures[folder.ID]; ok {
-				sameError = devs[deviceID] == err
+				sameError = devs[deviceID] == err //nolint:errorlint
 			} else {
 				m.folderEncryptionFailures[folder.ID] = make(map[protocol.DeviceID]error)
 			}
@@ -1461,7 +1467,8 @@ func (m *model) ccHandleFolders(folders []protocol.Folder, deviceCfg config.Devi
 			if sameError {
 				l.Debugln(msg)
 			} else {
-				if rerr, ok := err.(*redactedError); ok {
+				var rerr *redactedError
+				if errors.As(err, &rerr) {
 					err = rerr.redacted
 				}
 				m.evLogger.Log(events.Failure, err.Error())
@@ -1641,8 +1648,7 @@ func (m *model) sendClusterConfig(ids []protocol.DeviceID) {
 	// Generating cluster-configs acquires the mutex.
 	for _, conn := range ccConns {
 		cm, passwords := m.generateClusterConfig(conn.DeviceID())
-		conn.SetFolderPasswords(passwords)
-		go conn.ClusterConfig(cm)
+		go conn.ClusterConfig(cm, passwords)
 	}
 }

@@ -2016,7 +2022,7 @@ func (m *model) Request(conn protocol.Connection, req *protocol.Request) (out pr

 	// The requestResponse releases the bytes to the buffer pool and the
 	// limiters when its Close method is called.
-	res := newLimitedRequestResponse(int(req.Size), limiter, m.globalRequestLimiter)
+	res := newLimitedRequestResponse(req.Size, limiter, m.globalRequestLimiter)

 	defer func() {
 		// Close it ourselves if it isn't returned due to an error
@@ -2062,16 +2068,17 @@ func (m *model) Request(conn protocol.Connection, req *protocol.Request) (out pr
 	}

 	n, err := readOffsetIntoBuf(folderFs, req.Name, req.Offset, res.data)
-	if fs.IsNotExist(err) {
+	switch {
+	case fs.IsNotExist(err):
 		l.Debugf("%v REQ(in) file doesn't exist: %s: %q / %q o=%d s=%d", m, deviceID.Short(), req.Folder, req.Name, req.Offset, req.Size)
 		return nil, protocol.ErrNoSuchFile
-	} else if err == io.EOF {
+	case errors.Is(err, io.EOF):
 		// Read beyond end of file. This might indicate a problem, or it
 		// might be a short block that gets padded when read for encrypted
 		// folders. We ignore the error and let the hash validation in the
 		// next step take care of it, by only hashing the part we actually
 		// managed to read.
-	} else if err != nil {
+	case err != nil:
 		l.Debugf("%v REQ(in) failed reading file (%v): %s: %q / %q o=%d s=%d", m, err, deviceID.Short(), req.Folder, req.Name, req.Offset, req.Size)
 		return nil, protocol.ErrGeneric
 	}
@@ -2231,13 +2238,13 @@ func (m *model) SetIgnores(folder string, content []string) error {

 func (m *model) setIgnores(cfg config.FolderConfiguration, content []string) error {
 	err := cfg.CheckPath()
-	if err == config.ErrPathMissing {
+	if errors.Is(err, config.ErrPathMissing) {
 		if err = cfg.CreateRoot(); err != nil {
 			return fmt.Errorf("failed to create folder root: %w", err)
 		}
 		err = cfg.CheckPath()
 	}
-	if err != nil && err != config.ErrMarkerMissing {
+	if err != nil && !errors.Is(err, config.ErrMarkerMissing) {
 		return err
 	}

@@ -2357,8 +2364,14 @@ func (m *model) scheduleConnectionPromotion() {
 // be called after adding new connections, and after closing a primary
 // device connection.
 func (m *model) promoteConnections() {
+	// Slice of actions to take on connections after releasing the main
+	// mutex. We do this so that we do not perform blocking network actions
+	// inside the loop, and also to avoid a possible deadlock with calling
+	// Start() on connections that are already executing a Close() with a
+	// callback into the model...
+	var postLockActions []func()
+
 	m.mut.Lock()
-	defer m.mut.Unlock()

 	for deviceID, connIDs := range m.deviceConnIDs {
 		cm, passwords := m.generateClusterConfigRLocked(deviceID)
@@ -2371,11 +2384,12 @@ func (m *model) promoteConnections() {
 			// on where we get ClusterConfigs from the peer.)
 			conn := m.connections[connIDs[0]]
 			l.Debugf("Promoting connection to %s at %s", deviceID.Short(), conn)
-			if conn.Statistics().StartedAt.IsZero() {
-				conn.SetFolderPasswords(passwords)
-				conn.Start()
-			}
-			conn.ClusterConfig(cm)
+			postLockActions = append(postLockActions, func() {
+				if conn.Statistics().StartedAt.IsZero() {
+					conn.Start()
+				}
+				conn.ClusterConfig(cm, passwords)
+			})
 			m.promotedConnID[deviceID] = connIDs[0]
 		}

@@ -2384,12 +2398,19 @@ func (m *model) promoteConnections() {
 		for _, connID := range connIDs[1:] {
 			conn := m.connections[connID]
 			if conn.Statistics().StartedAt.IsZero() {
-				conn.SetFolderPasswords(passwords)
-				conn.Start()
-				conn.ClusterConfig(&protocol.ClusterConfig{Secondary: true})
+				postLockActions = append(postLockActions, func() {
+					conn.Start()
+					conn.ClusterConfig(&protocol.ClusterConfig{Secondary: true}, passwords)
+				})
 			}
 		}
 	}
+
+	m.mut.Unlock()
+
+	for _, action := range postLockActions {
+		action()
+	}
 }

 func (m *model) DownloadProgress(conn protocol.Connection, p *protocol.DownloadProgress) error {
@@ -2485,7 +2506,6 @@ func (m *model) ScanFolders() map[string]error {
 	wg := sync.NewWaitGroup()
 	wg.Add(len(folders))
 	for _, folder := range folders {
-		folder := folder
 		go func() {
 			err := m.ScanFolder(folder)
 			if err != nil {
@@ -2664,7 +2684,7 @@ func (m *model) WatchError(folder string) error {
 	runner, _ := m.folderRunners.Get(folder)
 	m.mut.RUnlock()
 	if err != nil {
-		return nil // If the folder isn't running, there's no error to report.
+		return nil //nolint:nilerr // If the folder isn't running, there's no error to report.
 	}
 	return runner.WatchError()
 }
@@ -2731,7 +2751,7 @@ func (m *model) GlobalDirectoryTree(folder, prefix string, levels int, dirsOnly
 	prefix = osutil.NativeFilename(prefix)

 	if prefix != "" && !strings.HasSuffix(prefix, sep) {
-		prefix = prefix + sep
+		prefix += sep
 	}

 	for f, err := range itererr.Zip(m.sdb.AllGlobalFilesPrefix(folder, prefix)) {
@@ -2740,7 +2760,7 @@ func (m *model) GlobalDirectoryTree(folder, prefix string, levels int, dirsOnly
 		}

 		// Don't include the prefix itself.
-		if f.Invalid || f.Deleted || strings.HasPrefix(prefix, f.Name) {
+		if f.IsInvalid() || f.Deleted || strings.HasPrefix(prefix, f.Name) {
 			continue
 		}

@@ -3443,8 +3463,8 @@ type updatedPendingFolder struct {
 // redactPathError checks if the error is actually a os.PathError, and if yes
 // returns a redactedError with the path removed.
 func redactPathError(err error) (error, bool) {
-	perr, ok := err.(*os.PathError)
-	if !ok {
+	var perr *os.PathError
+	if !errors.As(err, &perr) {
 		return nil, false
 	}
 	return &redactedError{
@@ -2968,7 +2968,7 @@ func TestConnCloseOnRestart(t *testing.T) {
 	nw := &testutil.NoopRW{}
 	ci := &protocolmocks.ConnectionInfo{}
 	ci.ConnectionIDReturns(srand.String(16))
-	m.AddConnection(protocol.NewConnection(device1, br, nw, testutil.NoopCloser{}, m, ci, protocol.CompressionNever, nil, m.keyGen), protocol.Hello{})
+	m.AddConnection(protocol.NewConnection(device1, br, nw, testutil.NoopCloser{}, m, ci, protocol.CompressionNever, m.keyGen), protocol.Hello{})
 	m.mut.RLock()
 	if len(m.closed) != 1 {
 		t.Fatalf("Expected just one conn (len(m.closed) == %v)", len(m.closed))
@@ -3498,6 +3498,7 @@ func TestScanDeletedROChangedOnSR(t *testing.T) {
 	}
 	// A remote must have the file, otherwise the deletion below is
 	// automatically resolved as not a ro-changed item.
+	file.LocalFlags = 0 // clear as we're skipping the code path where it would otherwise be cleared naturally
 	must(t, m.IndexUpdate(conn, &protocol.IndexUpdate{Folder: fcfg.ID, Files: []protocol.FileInfo{file}}))

 	must(t, ffs.Remove(name))
@@ -3535,11 +3536,11 @@ func testConfigChangeTriggersClusterConfigs(t *testing.T, expectFirst, expectSec
 	cc1 := make(chan struct{}, 1)
 	cc2 := make(chan struct{}, 1)
 	fc1 := newFakeConnection(device1, m)
-	fc1.ClusterConfigCalls(func(_ *protocol.ClusterConfig) {
+	fc1.ClusterConfigCalls(func(_ *protocol.ClusterConfig, _ map[string]string) {
 		cc1 <- struct{}{}
 	})
 	fc2 := newFakeConnection(device2, m)
-	fc2.ClusterConfigCalls(func(_ *protocol.ClusterConfig) {
+	fc2.ClusterConfigCalls(func(_ *protocol.ClusterConfig, _ map[string]string) {
 		cc2 <- struct{}{}
 	})
 	m.AddConnection(fc1, protocol.Hello{})
@@ -3609,7 +3610,7 @@ func TestIssue6961(t *testing.T) {
 	// Remote, valid and existing file
 	must(t, m.Index(conn1, &protocol.Index{Folder: fcfg.ID, Files: []protocol.FileInfo{{Name: name, Version: version, Sequence: 1}}}))
 	// Remote, invalid (receive-only) and existing file
-	must(t, m.Index(conn2, &protocol.Index{Folder: fcfg.ID, Files: []protocol.FileInfo{{Name: name, RawInvalid: true, Sequence: 1}}}))
+	must(t, m.Index(conn2, &protocol.Index{Folder: fcfg.ID, Files: []protocol.FileInfo{{Name: name, LocalFlags: protocol.FlagLocalRemoteInvalid, Sequence: 1}}}))
 	// Create a local file
 	if fd, err := tfs.OpenFile(name, fs.OptCreate, 0o666); err != nil {
 		t.Fatal(err)
@@ -3635,7 +3636,7 @@ func TestIssue6961(t *testing.T) {
 	m.ScanFolders()

 	// Drop the remote index, add some other file.
-	must(t, m.Index(conn2, &protocol.Index{Folder: fcfg.ID, Files: []protocol.FileInfo{{Name: "bar", RawInvalid: true, Sequence: 1}}}))
+	must(t, m.Index(conn2, &protocol.Index{Folder: fcfg.ID, Files: []protocol.FileInfo{{Name: "bar", LocalFlags: protocol.FlagLocalRemoteInvalid, Sequence: 1}}}))

 	// Pause and unpause folder to create new db.FileSet and thus recalculate everything
 	pauseFolder(t, wcfg, fcfg.ID, true)
@@ -1236,7 +1236,7 @@ func TestRequestIndexSenderClusterConfigBeforeStart(t *testing.T) {
 		}
 		return nil
 	})
-	fc.ClusterConfigCalls(func(cc *protocol.ClusterConfig) {
+	fc.ClusterConfigCalls(func(cc *protocol.ClusterConfig, _ map[string]string) {
 		select {
 		case ccChan <- cc:
 		case <-done:
@@ -384,7 +384,7 @@ func writeEncryptionTrailer(file protocol.FileInfo, writer io.WriterAt) (int64,
 	if err != nil {
 		return 0, err
 	}
-	binary.BigEndian.PutUint32(bs[n:], uint32(n))
+	binary.BigEndian.PutUint32(bs[n:], uint32(n)) //nolint:gosec
 	bs = bs[:n+4]

 	if _, err := writer.WriteAt(bs, wireFile.Size); err != nil {
@@ -257,7 +257,7 @@ func (s *Service) verifyExistingLocked(ctx context.Context, mapping *Mapping, na
 			// extAddrs either contains one IPv4 address, or possibly several
 			// IPv6 addresses all using the same port.  Therefore the first
 			// entry always has the external port.
-			responseAddrs, err := s.tryNATDevice(ctx, nat, mapping.address, extAddrs[0].Port, leaseTime)
+			responseAddrs, err := s.tryNATDevice(ctx, nat, mapping.address, extAddrs[0].Port, mapping.protocol, leaseTime)
 			if err != nil {
 				l.Infof("Failed to renew %s -> %v open port on %s: %s", mapping, extAddrs, id, err)
 				mapping.removeAddressLocked(id)
@@ -309,7 +309,7 @@ func (s *Service) acquireNewLocked(ctx context.Context, mapping *Mapping, nats m
 			continue
 		}

-		addrs, err := s.tryNATDevice(ctx, nat, mapping.address, 0, leaseTime)
+		addrs, err := s.tryNATDevice(ctx, nat, mapping.address, 0, mapping.protocol, leaseTime)
 		if err != nil {
 			l.Infof("Failed to acquire %s open port on %s: %s", mapping, id, err)
 			continue
@@ -325,14 +325,14 @@ func (s *Service) acquireNewLocked(ctx context.Context, mapping *Mapping, nats m

 // tryNATDevice tries to acquire a port mapping for the given internal address to
 // the given external port. If external port is 0, picks a pseudo-random port.
-func (s *Service) tryNATDevice(ctx context.Context, natd Device, intAddr Address, extPort int, leaseTime time.Duration) ([]Address, error) {
+func (s *Service) tryNATDevice(ctx context.Context, natd Device, intAddr Address, extPort int, protocol Protocol, leaseTime time.Duration) ([]Address, error) {
 	var err error
 	var port int
 	// For IPv6, we just try to create the pinhole. If it fails, nothing can be done (probably no IGDv2 support).
 	// If it already exists, the relevant UPnP standard requires that the gateway recognizes this and updates the lease time.
 	// Since we usually have a global unicast IPv6 address so no conflicting mappings, we just request the port we're running on
 	if natd.SupportsIPVersion(IPv6Only) {
-		ipaddrs, err := natd.AddPinhole(ctx, TCP, intAddr, leaseTime)
+		ipaddrs, err := natd.AddPinhole(ctx, protocol, intAddr, leaseTime)
 		var addrs []Address
 		for _, ipaddr := range ipaddrs {
 			addrs = append(addrs, Address{
@@ -354,7 +354,7 @@ func (s *Service) tryNATDevice(ctx context.Context, natd Device, intAddr Address
 	if extPort != 0 {
 		// First try renewing our existing mapping, if we have one.
 		name := fmt.Sprintf("syncthing-%d", extPort)
-		port, err = natd.AddPortMapping(ctx, TCP, intAddr.Port, extPort, name, leaseTime)
+		port, err = natd.AddPortMapping(ctx, protocol, intAddr.Port, extPort, name, leaseTime)
 		if err == nil {
 			extPort = port
 			goto findIP
@@ -372,7 +372,7 @@ func (s *Service) tryNATDevice(ctx context.Context, natd Device, intAddr Address
 		// Then try up to ten random ports.
 		extPort = 1024 + predictableRand.Intn(65535-1024)
 		name := fmt.Sprintf("syncthing-%d", extPort)
-		port, err = natd.AddPortMapping(ctx, TCP, intAddr.Port, extPort, name, leaseTime)
+		port, err = natd.AddPortMapping(ctx, protocol, intAddr.Port, extPort, name, leaseTime)
 		if err == nil {
 			extPort = port
 			goto findIP
@@ -64,14 +64,14 @@ func benchmarkRequestsTLS(b *testing.B, conn0, conn1 net.Conn) {

 func benchmarkRequestsConnPair(b *testing.B, conn0, conn1 net.Conn) {
 	// Start up Connections on them
-	c0 := NewConnection(LocalDeviceID, conn0, conn0, testutil.NoopCloser{}, new(fakeModel), new(mockedConnectionInfo), CompressionMetadata, nil, testKeyGen)
+	c0 := NewConnection(LocalDeviceID, conn0, conn0, testutil.NoopCloser{}, new(fakeModel), new(mockedConnectionInfo), CompressionMetadata, testKeyGen)
 	c0.Start()
-	c1 := NewConnection(LocalDeviceID, conn1, conn1, testutil.NoopCloser{}, new(fakeModel), new(mockedConnectionInfo), CompressionMetadata, nil, testKeyGen)
+	c1 := NewConnection(LocalDeviceID, conn1, conn1, testutil.NoopCloser{}, new(fakeModel), new(mockedConnectionInfo), CompressionMetadata, testKeyGen)
 	c1.Start()

 	// Satisfy the assertions in the protocol by sending an initial cluster config
-	c0.ClusterConfig(&ClusterConfig{})
-	c1.ClusterConfig(&ClusterConfig{})
+	c0.ClusterConfig(&ClusterConfig{}, nil)
+	c1.ClusterConfig(&ClusterConfig{}, nil)

 	// Report some useful stats and reset the timer for the actual test
 	b.ReportAllocs()
@@ -17,26 +17,33 @@ import (
 	"github.com/syncthing/syncthing/lib/build"
 )

+type FlagLocal uint32
+
 // FileInfo.LocalFlags flags
 const (
-	FlagLocalUnsupported = 1 << 0 // 1: The kind is unsupported, e.g. symlinks on Windows
-	FlagLocalIgnored     = 1 << 1 // 2: Matches local ignore patterns
-	FlagLocalMustRescan  = 1 << 2 // 4: Doesn't match content on disk, must be rechecked fully
-	FlagLocalReceiveOnly = 1 << 3 // 8: Change detected on receive only folder
-	FlagLocalGlobal      = 1 << 4 // 16: This is the global file version
-	FlagLocalNeeded      = 1 << 5 // 32: We need this file
+	FlagLocalUnsupported   FlagLocal = 1 << 0 // 1: The kind is unsupported, e.g. symlinks on Windows
+	FlagLocalIgnored       FlagLocal = 1 << 1 // 2: Matches local ignore patterns
+	FlagLocalMustRescan    FlagLocal = 1 << 2 // 4: Doesn't match content on disk, must be rechecked fully
+	FlagLocalReceiveOnly   FlagLocal = 1 << 3 // 8: Change detected on receive only folder
+	FlagLocalGlobal        FlagLocal = 1 << 4 // 16: This is the global file version
+	FlagLocalNeeded        FlagLocal = 1 << 5 // 32: We need this file
+	FlagLocalRemoteInvalid FlagLocal = 1 << 6 // 64: The remote marked this as invalid

-	// Flags that should result in the Invalid bit on outgoing updates
-	LocalInvalidFlags = FlagLocalUnsupported | FlagLocalIgnored | FlagLocalMustRescan | FlagLocalReceiveOnly
+	// Flags that should result in the Invalid bit on outgoing updates (or had it on ingoing ones)
+	LocalInvalidFlags = FlagLocalUnsupported | FlagLocalIgnored | FlagLocalMustRescan | FlagLocalReceiveOnly | FlagLocalRemoteInvalid

 	// Flags that should result in a file being in conflict with its
 	// successor, due to us not having an up to date picture of its state on
 	// disk.
 	LocalConflictFlags = FlagLocalUnsupported | FlagLocalIgnored | FlagLocalReceiveOnly

-	LocalAllFlags = FlagLocalUnsupported | FlagLocalIgnored | FlagLocalMustRescan | FlagLocalReceiveOnly | FlagLocalGlobal | FlagLocalNeeded
+	LocalAllFlags = FlagLocalUnsupported | FlagLocalIgnored | FlagLocalMustRescan | FlagLocalReceiveOnly | FlagLocalGlobal | FlagLocalNeeded | FlagLocalRemoteInvalid
 )

+func (f FlagLocal) IsInvalid() bool {
+	return f&LocalInvalidFlags != 0
+}
+
 // BlockSizes is the list of valid block sizes, from min to max
 var BlockSizes []int

@@ -82,7 +89,9 @@ type FileInfo struct {
 	// host only. It is not part of the protocol, doesn't get sent or
 	// received (we make sure to zero it), nonetheless we need it on our
 	// struct and to be able to serialize it to/from the database.
-	LocalFlags uint32
+	// It does carry the info to decide if the file is invalid, which is part of
+	// the protocol.
+	LocalFlags FlagLocal

 	// The version_hash is an implementation detail and not part of the wire
 	// format.
@@ -97,7 +106,6 @@ type FileInfo struct {
 	EncryptionTrailerSize int

 	Deleted       bool
-	RawInvalid    bool
 	NoPermissions bool

 	truncated bool // was created from a truncated file info without blocks
@@ -128,11 +136,11 @@ func (f *FileInfo) ToWire(withInternalFields bool) *bep.FileInfo {
 		BlockSize:     f.RawBlockSize,
 		Platform:      f.Platform.toWire(),
 		Deleted:       f.Deleted,
-		Invalid:       f.RawInvalid,
+		Invalid:       f.IsInvalid(),
 		NoPermissions: f.NoPermissions,
 	}
 	if withInternalFields {
-		w.LocalFlags = f.LocalFlags
+		w.LocalFlags = uint32(f.LocalFlags)
 		w.VersionHash = f.VersionHash
 		w.InodeChangeNs = f.InodeChangeNs
 		w.EncryptionTrailerSize = int32(f.EncryptionTrailerSize)
@@ -207,6 +215,10 @@ type FileInfoWithoutBlocks interface {
 }

 func fileInfoFromWireWithBlocks(w FileInfoWithoutBlocks, blocks []BlockInfo) FileInfo {
+	var localFlags FlagLocal
+	if w.GetInvalid() {
+		localFlags = FlagLocalRemoteInvalid
+	}
 	return FileInfo{
 		Name:          w.GetName(),
 		Size:          w.GetSize(),
@@ -224,14 +236,14 @@ func fileInfoFromWireWithBlocks(w FileInfoWithoutBlocks, blocks []BlockInfo) Fil
 		RawBlockSize:  w.GetBlockSize(),
 		Platform:      platformDataFromWire(w.GetPlatform()),
 		Deleted:       w.GetDeleted(),
-		RawInvalid:    w.GetInvalid(),
+		LocalFlags:    localFlags,
 		NoPermissions: w.GetNoPermissions(),
 	}
 }

 func FileInfoFromDB(w *bep.FileInfo) FileInfo {
 	f := FileInfoFromWire(w)
-	f.LocalFlags = w.LocalFlags
+	f.LocalFlags = FlagLocal(w.LocalFlags)
 	f.VersionHash = w.VersionHash
 	f.InodeChangeNs = w.InodeChangeNs
 	f.EncryptionTrailerSize = int(w.EncryptionTrailerSize)
@@ -240,7 +252,7 @@ func FileInfoFromDB(w *bep.FileInfo) FileInfo {

 func FileInfoFromDBTruncated(w FileInfoWithoutBlocks) FileInfo {
 	f := fileInfoFromWireWithBlocks(w, nil)
-	f.LocalFlags = w.GetLocalFlags()
+	f.LocalFlags = FlagLocal(w.GetLocalFlags())
 	f.VersionHash = w.GetVersionHash()
 	f.InodeChangeNs = w.GetInodeChangeNs()
 	f.EncryptionTrailerSize = int(w.GetEncryptionTrailerSize())
@@ -252,13 +264,13 @@ func (f FileInfo) String() string {
 	switch f.Type {
 	case FileInfoTypeDirectory:
 		return fmt.Sprintf("Directory{Name:%q, Sequence:%d, Permissions:0%o, ModTime:%v, Version:%v, VersionHash:%x, Deleted:%v, Invalid:%v, LocalFlags:0x%x, NoPermissions:%v, Platform:%v, InodeChangeTime:%v}",
-			f.Name, f.Sequence, f.Permissions, f.ModTime(), f.Version, f.VersionHash, f.Deleted, f.RawInvalid, f.LocalFlags, f.NoPermissions, f.Platform, f.InodeChangeTime())
+			f.Name, f.Sequence, f.Permissions, f.ModTime(), f.Version, f.VersionHash, f.Deleted, f.IsInvalid(), f.LocalFlags, f.NoPermissions, f.Platform, f.InodeChangeTime())
 	case FileInfoTypeFile:
 		return fmt.Sprintf("File{Name:%q, Sequence:%d, Permissions:0%o, ModTime:%v, Version:%v, VersionHash:%x, Length:%d, Deleted:%v, Invalid:%v, LocalFlags:0x%x, NoPermissions:%v, BlockSize:%d, NumBlocks:%d, BlocksHash:%x, Platform:%v, InodeChangeTime:%v}",
-			f.Name, f.Sequence, f.Permissions, f.ModTime(), f.Version, f.VersionHash, f.Size, f.Deleted, f.RawInvalid, f.LocalFlags, f.NoPermissions, f.RawBlockSize, len(f.Blocks), f.BlocksHash, f.Platform, f.InodeChangeTime())
+			f.Name, f.Sequence, f.Permissions, f.ModTime(), f.Version, f.VersionHash, f.Size, f.Deleted, f.IsInvalid(), f.LocalFlags, f.NoPermissions, f.RawBlockSize, len(f.Blocks), f.BlocksHash, f.Platform, f.InodeChangeTime())
 	case FileInfoTypeSymlink, FileInfoTypeSymlinkDirectory, FileInfoTypeSymlinkFile:
 		return fmt.Sprintf("Symlink{Name:%q, Type:%v, Sequence:%d, Version:%v, VersionHash:%x, Deleted:%v, Invalid:%v, LocalFlags:0x%x, NoPermissions:%v, SymlinkTarget:%q, Platform:%v, InodeChangeTime:%v}",
-			f.Name, f.Type, f.Sequence, f.Version, f.VersionHash, f.Deleted, f.RawInvalid, f.LocalFlags, f.NoPermissions, f.SymlinkTarget, f.Platform, f.InodeChangeTime())
+			f.Name, f.Type, f.Sequence, f.Version, f.VersionHash, f.Deleted, f.IsInvalid(), f.LocalFlags, f.NoPermissions, f.SymlinkTarget, f.Platform, f.InodeChangeTime())
 	default:
 		panic("mystery file type detected")
 	}
@@ -269,7 +281,7 @@ func (f FileInfo) IsDeleted() bool {
 }

 func (f FileInfo) IsInvalid() bool {
-	return f.RawInvalid || f.LocalFlags&LocalInvalidFlags != 0
+	return f.LocalFlags.IsInvalid()
 }

 func (f FileInfo) IsUnsupported() bool {
@@ -342,7 +354,7 @@ func (f FileInfo) FileName() string {
 	return f.Name
 }

-func (f FileInfo) FileLocalFlags() uint32 {
+func (f FileInfo) FileLocalFlags() FlagLocal {
 	return f.LocalFlags
 }

@@ -386,7 +398,7 @@ type FileInfoComparison struct {
 	ModTimeWindow   time.Duration
 	IgnorePerms     bool
 	IgnoreBlocks    bool
-	IgnoreFlags     uint32
+	IgnoreFlags     FlagLocal
 	IgnoreOwnership bool
 	IgnoreXattrs    bool
 }
@@ -533,8 +545,7 @@ func (f *FileInfo) SetDeleted(by ShortID) {
 	f.setNoContent()
 }

-func (f *FileInfo) setLocalFlags(flags uint32) {
-	f.RawInvalid = false
+func (f *FileInfo) setLocalFlags(flags FlagLocal) {
 	f.LocalFlags = flags
 	f.setNoContent()
 }
@@ -847,9 +858,13 @@ func unixOwnershipEqual(a, b *UnixData) bool {
 	if a == nil || b == nil {
 		return false
 	}
-	ownerEqual := a.OwnerName == "" || b.OwnerName == "" || a.OwnerName == b.OwnerName
-	groupEqual := a.GroupName == "" || b.GroupName == "" || a.GroupName == b.GroupName
-	return a.UID == b.UID && a.GID == b.GID && ownerEqual && groupEqual
+	if a.UID == b.UID && a.GID == b.GID {
+		return true
+	}
+	if a.OwnerName == b.OwnerName && a.GroupName == b.GroupName {
+		return true
+	}
+	return false
 }

 func windowsOwnershipEqual(a, b *WindowsData) bool {
@@ -45,7 +45,7 @@ func TestIsEquivalent(t *testing.T) {
 		b         FileInfo
 		ignPerms  *bool // nil means should not matter, we'll test both variants
 		ignBlocks *bool
-		ignFlags  uint32
+		ignFlags  FlagLocal
 		eq        bool
 	}
 	cases := []testCase{
@@ -75,8 +75,8 @@ func TestIsEquivalent(t *testing.T) {
 			eq: false,
 		},
 		{
-			a:  FileInfo{RawInvalid: false},
-			b:  FileInfo{RawInvalid: true},
+			a:  FileInfo{LocalFlags: 0},
+			b:  FileInfo{LocalFlags: FlagLocalRemoteInvalid},
 			eq: false,
 		},
 		{
@@ -100,8 +100,8 @@ func TestIsEquivalent(t *testing.T) {
 			eq: false,
 		},
 		{
-			a:  FileInfo{RawInvalid: true},
-			b:  FileInfo{RawInvalid: true},
+			a:  FileInfo{LocalFlags: FlagLocalRemoteInvalid},
+			b:  FileInfo{LocalFlags: FlagLocalRemoteInvalid},
 			eq: true,
 		},
 		{
@@ -110,7 +110,7 @@ func TestIsEquivalent(t *testing.T) {
 			eq: true,
 		},
 		{
-			a:  FileInfo{RawInvalid: true},
+			a:  FileInfo{LocalFlags: FlagLocalRemoteInvalid},
 			b:  FileInfo{LocalFlags: FlagLocalUnsupported},
 			eq: true,
 		},
@@ -196,6 +196,42 @@ func TestIsEquivalent(t *testing.T) {
 			b:  FileInfo{Type: FileInfoTypeFile, SymlinkTarget: []byte("b")},
 			eq: true,
 		},
+		// Unix Ownership should be the same
+		{
+			a:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "A", GroupName: "A", UID: 1000, GID: 1000}}},
+			b:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "A", GroupName: "A", UID: 1000, GID: 1000}}},
+			eq: true,
+		},
+		// ... but matching ID is enough
+		{
+			a:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "A", GroupName: "A", UID: 1000, GID: 1000}}},
+			b:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "B", GroupName: "B", UID: 1000, GID: 1000}}},
+			eq: true,
+		},
+		// ... or matching name
+		{
+			a:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "A", GroupName: "A", UID: 1000, GID: 1000}}},
+			b:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "A", GroupName: "A", UID: 1001, GID: 1001}}},
+			eq: true,
+		},
+		// ... or empty name
+		{
+			a:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "A", GroupName: "A", UID: 1000, GID: 1000}}},
+			b:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "", GroupName: "", UID: 1000, GID: 1000}}},
+			eq: true,
+		},
+		// ... but not different ownership
+		{
+			a:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "A", GroupName: "A", UID: 1000, GID: 1000}}},
+			b:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "B", GroupName: "B", UID: 1001, GID: 1001}}},
+			eq: false,
+		},
+		// or missing ownership
+		{
+			a:  FileInfo{Platform: PlatformData{Unix: &UnixData{OwnerName: "A", GroupName: "A", UID: 1000, GID: 1000}}},
+			b:  FileInfo{Platform: PlatformData{}},
+			eq: false,
+		},
 	}

 	if build.IsWindows {
@@ -15,7 +15,7 @@ func TestWinsConflict(t *testing.T) {
 		// The first should always win over the second
 		{{ModifiedS: 42}, {ModifiedS: 41}},
 		{{ModifiedS: 41}, {ModifiedS: 42, Deleted: true}},
-		{{Deleted: true}, {ModifiedS: 10, RawInvalid: true}},
+		{{Deleted: true}, {ModifiedS: 10, LocalFlags: FlagLocalRemoteInvalid}},
 		{{ModifiedS: 41, Version: Vector{Counters: []Counter{{ID: 42, Value: 2}, {ID: 43, Value: 1}}}}, {ModifiedS: 41, Version: Vector{Counters: []Counter{{ID: 42, Value: 1}, {ID: 43, Value: 2}}}}},
 	}

@@ -50,10 +50,10 @@ type encryptedModel struct {
 	keyGen     *KeyGenerator
 }

-func newEncryptedModel(model rawModel, folderKeys *folderKeyRegistry, keyGen *KeyGenerator) encryptedModel {
+func newEncryptedModel(model rawModel, keyGen *KeyGenerator) encryptedModel {
 	return encryptedModel{
 		model:      model,
-		folderKeys: folderKeys,
+		folderKeys: newFolderKeyRegistry(),
 		keyGen:     keyGen,
 	}
 }
@@ -187,10 +187,6 @@ func (e encryptedConnection) Start() {
 	e.conn.Start()
 }

-func (e encryptedConnection) SetFolderPasswords(passwords map[string]string) {
-	e.folderKeys.setPasswords(passwords)
-}
-
 func (e encryptedConnection) DeviceID() DeviceID {
 	return e.conn.DeviceID()
 }
@@ -262,8 +258,9 @@ func (e encryptedConnection) DownloadProgress(ctx context.Context, dp *DownloadP
 	// No need to send these
 }

-func (e encryptedConnection) ClusterConfig(config *ClusterConfig) {
-	e.conn.ClusterConfig(config)
+func (e encryptedConnection) ClusterConfig(config *ClusterConfig, passwords map[string]string) {
+	e.folderKeys.setPasswords(e.keyGen, passwords)
+	e.conn.ClusterConfig(config, passwords)
 }

 func (e encryptedConnection) Close(err error) {
@@ -360,11 +357,13 @@ func encryptFileInfo(keyGen *KeyGenerator, fi FileInfo, folderKey *[keySize]byte
 		Permissions: 0o644,
 		ModifiedS:   1234567890, // Sat Feb 14 00:31:30 CET 2009
 		Deleted:     fi.Deleted,
-		RawInvalid:  fi.IsInvalid(),
 		Version:     version,
 		Sequence:    fi.Sequence,
 		Encrypted:   encryptedFI,
 	}
+	if fi.IsInvalid() {
+		enc.LocalFlags = FlagLocalRemoteInvalid
+	}
 	if typ == FileInfoTypeFile {
 		enc.Size = offset // new total file size
 		enc.Blocks = blocks
@@ -680,15 +679,13 @@ func IsEncryptedParent(pathComponents []string) bool {
 }

 type folderKeyRegistry struct {
-	keyGen *KeyGenerator
-	keys   map[string]*[keySize]byte // folder ID -> key
-	mut    sync.RWMutex
+	keys map[string]*[keySize]byte // folder ID -> key
+	mut  sync.RWMutex
 }

-func newFolderKeyRegistry(keyGen *KeyGenerator, passwords map[string]string) *folderKeyRegistry {
+func newFolderKeyRegistry() *folderKeyRegistry {
 	return &folderKeyRegistry{
-		keyGen: keyGen,
-		keys:   keysFromPasswords(keyGen, passwords),
+		keys: make(map[string]*[keySize]byte),
 	}
 }

@@ -699,8 +696,8 @@ func (r *folderKeyRegistry) get(folder string) (*[keySize]byte, bool) {
 	return key, ok
 }

-func (r *folderKeyRegistry) setPasswords(passwords map[string]string) {
+func (r *folderKeyRegistry) setPasswords(keyGen *KeyGenerator, passwords map[string]string) {
 	r.mut.Lock()
-	r.keys = keysFromPasswords(r.keyGen, passwords)
+	r.keys = keysFromPasswords(keyGen, passwords)
 	r.mut.Unlock()
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jakob BorgandGitHub	c5a29b5b26	fix(model): don't clobber local flags when receiving index (#10190 )	2025-06-20 07:08:06 +00:00
Marcus B SpencerandGitHub	4c64843d60	feat(connections, nat): add UDP portmapping/pinhole for QUIC (fixes #7403 ) (#10171 ) Fixes #7403. Tested by enabling UPnP on the router, and checking on the router page that the external ports of the UDP mappings match what is shown in the logs and the internal ports matching the QUIC listening port.	2025-06-20 04:24:45 +00:00
Jakob Borg	b4ff96d754	chore(model): log folder removal Relevant to #10189, #8416	2025-06-18 19:33:41 +02:00
Jakob Borg	21c5ac2161	chore: remove bad comment in authors script Closes #10185	2025-06-17 12:27:12 +02:00
tomasz1986andGitHub	6fc0b41f97	feat(gui): add option to limit bandwidth in LAN to Settings (ref #10046 ) (#10182 ) gui: Add option to limit bandwidth in LAN to Settings (ref #10046) Currently, the option to limit bandwidth in LAN is available only via the Advanced Configuration, which makes it difficult to discover by new users, who are confused why their bandwidth limits are not working. For this reason, make the option easily discoverable by adding it directly to Connections in the normal Settings in the Web GUI. Ref: https://github.com/syncthing/syncthing/issues/10046 https://github.com/syncthing/syncthing/issues/2046 https://github.com/syncthing/syncthing/issues/2569 https://forum.syncthing.net/t/upload-rate-not-work/19025 https://forum.syncthing.net/t/rate-limits-dont-work-over-lan-in-v1-20-1/18521 Signed-off-by: Tomasz Wilczyński <twilczynski@naver.com> ### Screenshots ![image](https://github.com/user-attachments/assets/bd38b3ab-a053-4992-ba86-7fb8b3ba09d9) Signed-off-by: Tomasz Wilczyński <twilczynski@naver.com>	2025-06-17 09:46:38 +02:00
yparitcher GitHub Jakob Borg	0b0b2143ed	fix(protocol): slightly loosen/correct ownership comparison criteria (fixes #9879 ) (#10176 ) Only Require either matching UID & GID OR matching Names. If the 2 devices have a different Name => UID mapping, they can never be totaly equal. Therefore when syncing we try matching the Name and fall back to the UID. However when scanning for changes we currently require both the Name & UID to match. This leads to forever having out of sync files back and forth, or local additions when receive only. This patch does not change the sending behavoir. It only change what we decide is equal for exisiting files with mismapped Name => UID, The added testcases show the change: Test 1,5,6 are the same as current. Test 2,3 Are what change with this patch (from false to true). Test 4 is a subset of test 2 they is currently special cased as true, which does not chnage. Co-authored-by: Jakob Borg <jakob@kastelo.net>	2025-06-16 15:12:33 +00:00
Jakob BorgandGitHub	af64140c61	fix(model): avoid flashing "Sync Waiting" unnecessarily (#10181 )	2025-06-16 12:53:02 +02:00
Syncthing Release Automation	1c68062231	chore(gui, man, authors): update docs, translations, and contributors	2025-06-16 04:00:36 +00:00
Jakob Borg	4d92855d76	build: release job needs full checkout with tags	2025-06-15 10:37:37 +02:00
Jakob Borg	1c6f542cb7	build: use proper ref for build action	2025-06-15 10:21:03 +02:00
Jakob Borg	b28066c85d	build: use access token to trigger release builds	2025-06-15 10:14:13 +02:00
Simon FreiandGitHub	71c8a2c36f	fix(db): remove invalid member from FileMetadata (#10180 )	2025-06-15 09:12:25 +02:00
Simon FreiandGitHub	e4ab7b4ff3	fix(watchaggregator): properly handle sub-second watch durations (fixes #9927 ) (#10179 ) I'll let Audrius words from the ticket explain this :) > I'm a bit lost, time.Duration is an int64, yet watcher delay is float, > anything sub 1s gets rounded down to 0, so you just end up going into an > infinite loop. https://github.com/syncthing/syncthing/issues/9927#issuecomment-2967736106	2025-06-14 00:16:22 +02:00
Simon Frei GitHub Jakob Borg	8b978d4712	chore: add migration for remote invalid local flag (#10174 ) Follow to resp. migration for the change in this commit: `7b319111d3` --------- Co-authored-by: Jakob Borg <jakob@kastelo.net>	2025-06-13 21:28:07 +00:00
Simon FreiandGitHub	7b319111d3	fix: track invalid files in LocalFlags to fix global count (#10170 ) Move the "invalid" bit to a local flag, making it easier to track in counts etc.	2025-06-13 07:33:31 +02:00
Simon FreiandGitHub	cb7cea93a2	chore(model): remove redundant removal of internal fields in indexsender (#10173 ) While it doesn't hurt, it's unnecessary since the big protobuf modernisation, that also introduced types separate from the generated ones for internal use. Those fields are already dropped when converting to the wire in protocol.	2025-06-12 22:08:21 +00:00
Jakob Borg	20257faf54	build: compat entry for Go 1.25	2025-06-11 22:40:20 +02:00
ardevdandGitHub	c14abebd68	refactor(syncthing): use named constant for SIGHUP (#10168 )	2025-06-09 20:31:01 +00:00
ardevdandGitHub	b1a1a90045	chore(syncthing): ensure response body is closed in upgrade request (#10169 )	2025-06-09 22:10:17 +02:00
Jakob BorgandGitHub	8afc9855f2	feat: use Ed25519 keys for sync connections (#10162 ) This updates our key generation to use Ed25519 keys/certificates for sync connections. Certificates for browser use remain ECDSA for wider compatibility. Ed25519 is more modern and has fewer concerns for the future than the ECDSA curves we used previously. It is supported from Go 1.13 and forwards, which is Syncthing 1.3.0 (October 2019).	2025-06-09 05:48:01 +00:00
Marcus B Spencer GitHub Jakob Borg	4215058911	fix(gui): don't show dial errors for paused devices (fixes #10166 ) (#10167 ) ### Purpose Fixes the problem where paused devices show errors from dials from previous disconnections (#10166). ### Testing Tested manually by reproducing using the steps in the mentioned issue. ### Screenshots Before: ![dial errors](https://github.com/user-attachments/assets/c12a5566-beb2-4b27-9fcb-5a6d1397028d) After: ![no dial errors](https://github.com/user-attachments/assets/7a31e1e6-243a-4b15-b3a1-cf226b58abe0) Co-authored-by: Jakob Borg <jakob@kastelo.net>	2025-06-09 05:38:07 +00:00
Jakob Borg	9fb1a18dbf	fix(strelaypoolsrv): trivial error handling fix	2025-06-09 07:25:31 +02:00
Ross Smith IIandGitHub	064213ceb8	fix(fs): check for unsupported error on modern Windows (fixes #10164 ) (#10165 ) ### Purpose Locally, on Windows 11, and on the windows-2025 GitHub runner (go 1.23 and 1.24), the `TestCopyRange` test is failing with `The request is not supported.` On windows-2022 and windows-2019: ```go err == syscall.ENOTSUP ``` worked, but on Windows 11 and windows-2025, we need: ```go errors.Is(err, errors.ErrUnsupported) ``` ### Testing Tested on Windows 11, windows-2019, windows-2022, and [windows-2025](https://github.com/rasa/syncthing/actions/runs/15525123437/job/43703630634#step:7:2811).	2025-06-09 07:20:46 +02:00
Syncthing Release Automation	0211251b34	chore(gui, man, authors): update docs, translations, and contributors	2025-06-09 04:00:17 +00:00
Jakob BorgandGitHub	1903da569b	build: explicitly trigger build after pushing release tag (#10160 ) Because just pushing the tag with a non-Actions token doesn't suffice, apparently	2025-06-07 14:22:39 +00:00
Jakob BorgandGitHub	b6a7beca1f	build: build both Debian armel and armhf (though they are the same for us) (#10159 ) Current "arm" is wrong	2025-06-07 16:04:28 +02:00
Jakob Borg	7b83e7403e	build: limit golangci-lint to pull requests Since all the existing code isn't clean	2025-06-07 15:04:30 +02:00
Jakob Borg	1915a470e9	chore: update AUTHORS	2025-06-07 14:31:58 +02:00
Jakob Borg	0b100296e1	Merge branch 'v2' * v2: (62 commits) build: add dependency for next-version script docs: add release note mention of platforms no longer built build: streamline gathering of facts, checkouts (#10158) build: more resilient pushes to releases chore(etc): add option dash to upstart config chore(fs): linter complaints chore(model): the easier linter complaints chore(internal): linter complaints chore(sqlite): linter complaints build: allow v2 into APT candidate channel docs: link to Docker image, APT, in release notes build: refactor builds for forks/PRs build: use same GitHub token for releases as for translation etc pushes refactor(sqlite): move deleted flag into logical order in schema feat(config): enable multiple connections by default (#10151) docs: mention subcommands in release notes, use for all 2.0 releases docs: adjust release notes for v2.0.0 docs: add relnotes for v2.0.0 build: upgrade setup-zig action (#10134) fix(versioner): correct fs creation in test ...	2025-06-07 14:18:48 +02:00
Jakob Borg	e6ed3acf5f	build: add dependency for next-version script	2025-06-07 14:18:12 +02:00
Jakob Borg	9f95bf3573	docs: add release note mention of platforms no longer built	2025-06-07 13:35:21 +02:00
Jakob Borg	b05ece0681	build: more resilient pushes to releases	2025-06-07 13:18:58 +02:00
Jakob BorgandGitHub	5381178c46	build: streamline gathering of facts, checkouts (#10158 )	2025-06-07 13:11:52 +02:00
Jakob Borg	e7f4f8306c	Merge branch 'main' into v2 * main: build: more resilient pushes to releases	2025-06-07 09:35:00 +02:00
Jakob Borg	9922a3abd9	build: more resilient pushes to releases	2025-06-07 09:34:49 +02:00
Jakob Borg	40ab668a73	chore(etc): add option dash to upstart config	2025-06-07 08:20:48 +02:00
Jakob Borg	10d20c4800	chore(fs): linter complaints	2025-06-06 13:45:44 +02:00
Jakob Borg	700bb75016	chore(model): the easier linter complaints	2025-06-06 13:45:44 +02:00
Jakob Borg	e25de22705	chore(internal): linter complaints	2025-06-06 13:45:44 +02:00
Jakob Borg	ef6d561c66	chore(sqlite): linter complaints	2025-06-06 13:45:44 +02:00
Jakob Borg	3c92999406	build: allow v2 into APT candidate channel	2025-06-06 11:00:55 +02:00
Jakob Borg	e61b8a1ae8	docs: link to Docker image, APT, in release notes	2025-06-05 19:21:01 +02:00
Jakob Borg	706409d2f3	Merge branch 'main' into v2 * main: docs: link to Docker image, APT, in release notes build: also create relaysrv and discosrv releases fix(stupgrades): return latest stable & pre for each major fix(syncthing): avoid writing panic log to nil fd (#10154)	2025-06-05 19:19:34 +02:00
Jakob Borg	e9133ef82b	docs: link to Docker image, APT, in release notes	2025-06-05 19:19:05 +02:00
Jakob Borg	67ba20d777	build: also create relaysrv and discosrv releases	2025-06-05 19:19:05 +02:00
Jakob Borg	21da0d7890	fix(stupgrades): return latest stable & pre for each major	2025-06-05 19:19:05 +02:00
ardevd GitHub Jakob Borg	ebbe57d0ab	fix(syncthing): avoid writing panic log to nil fd (#10154 ) ### Purpose This change fixes a logical bug in the panic log writing where we could end up writing to a uninitialized file descriptor. On the very first iteration, `panicFd` is nil. We enter the if `panicFd == nil { … }` block, check for “panic:” or “fatal error:”, and if neither matches, we skip instantiating `panicFd` altogether. However, immediately after, still within `if panicFd == nil { … }`, we call `panicFd.WriteString("Panic at ...")`. But `panicFd` would in this case be `nil`, which will cause a run‐time panic. It's not clear to me why panicFd is only initialized if the lines start with "panic:" or "fatal error:" so I've left that logic untouched. With this change we at least avoid the risk of writing to a nil filedescriptor. ## Authorship Your name and email will be added automatically to the AUTHORS file based on the commit metadata. --------- Co-authored-by: Jakob Borg <jakob@kastelo.net>	2025-06-03 07:39:21 +02:00
Jakob Borg	9cf8fca03f	Merge branch 'main' into v2 * main: chore: copyright in next-version script	2025-06-02 20:42:16 +02:00
Jakob Borg	f4abc71dcc	chore: copyright in next-version script	2025-06-02 20:41:42 +02:00
Jakob Borg	2712f566ab	Merge branch 'main' into v2 * main: build: include "v" prefix in version tags...	2025-06-02 20:00:00 +02:00
Jakob Borg	8aa02da93a	build: include "v" prefix in version tags...	2025-06-02 19:59:45 +02:00
Jakob Borg	ac3f390afa	Merge branch 'main' into v2 * main: build: use own script instead of svu chore(gui, man, authors): update docs, translations, and contributors	2025-06-02 19:50:34 +02:00
Jakob Borg	0e560486db	build: use own script instead of svu We use a slightly different handling of features between prereleases.	2025-06-02 19:49:23 +02:00
Syncthing Release Automation	57d413099d	chore(gui, man, authors): update docs, translations, and contributors	2025-06-02 05:24:58 +00:00
Jakob Borg	8d37e8f307	Merge branch 'main' into v2 * main: feat(config): expose folder and device info as metrics (fixes #9519) (#10148) chore: add issue types to GitHub issue templates build: remove schedule from PR metadata job chore(protocol): only allow enc. password changes on cluster config (#10145) chore(protocol): don't start connection routines a second time (#10146)	2025-05-31 17:10:00 +02:00
Jakob BorgandGitHub	1fdf07933c	feat(config): expose folder and device info as metrics (fixes #9519 ) (#10148 ) Tihs makes it easier to use metrics based on device and folder labels, names, and other attributes. Other metrics which are based on folder or device ID can be joined with these info metrics to enrich their label sets. ``` # HELP syncthing_config_device_info Provides additional information labels on devices # TYPE syncthing_config_device_info gauge syncthing_config_device_info{device="I6KAH76-66SLLLB-5PFXSOA-UFJCDZC-YAOMLEK-CP2GB32-BV5RQST-3PSROAU",introducer="false",name="s1",paused="false",untrusted="false"} 1 # HELP syncthing_config_folder_info Provides additional information labels on folders # TYPE syncthing_config_folder_info gauge syncthing_config_folder_info{folder="default",label="The default folder",path="s2",paused="false",type="sendreceive"} 1 ``` With this you can e.g. query for ``` syncthing_connections_active * on(device) group_left syncthing_config_device_info ``` Fixes #9519 Closes #10074 Closes #10147	2025-05-31 17:09:23 +02:00
Jakob Borg	d49df1e44c	build: refactor builds for forks/PRs Make sure as much as possible runs for forks and PRs as well, while keeping the release specific stuff out of the way.	2025-05-31 09:52:27 +02:00
Jakob Borg	50480f6ccb	build: use same GitHub token for releases as for translation etc pushes	2025-05-31 08:50:42 +02:00
Jakob Borg	15f693d93c	refactor(sqlite): move deleted flag into logical order in schema	2025-05-31 08:39:11 +02:00
Jakob BorgandGitHub	8e934a8c69	feat(config): enable multiple connections by default (#10151 ) This changes the default number of connections from one to three (one metadata + two data connections). This should give some advantages of multiple connections, while also not being an overwhelming change for larger installations. (Though those may need to tweak their settings anyway, as always.)	2025-05-30 22:04:55 +02:00
Jakob Borg	c50678618f	chore: add issue types to GitHub issue templates	2025-05-30 11:57:27 +02:00
Jakob Borg	8094b459e4	build: remove schedule from PR metadata job It shouldn't have touched non-PR issues, but it did	2025-05-30 11:57:27 +02:00
Simon Frei GitHub Jakob Borg	6765867a2e	chore(protocol): only allow enc. password changes on cluster config (#10145 ) In practice we already always call SetPassword and ClusterConfig together. However it's not just "sensible" to do that, it's required: If the passwords change, the remote device needs to know about that to check that the enc. setup is valid/consistent (e.g. tokens match, folder-type is appropriate, ...). And with the passwords set later, there's no point in adding them as part of creating a new connection. This is a "followup" (if one can call it that 4 years later :) ) to resp. fix for the following commit: `924b96856f` Co-authored-by: Jakob Borg <jakob@kastelo.net>	2025-05-30 09:52:47 +02:00
Simon FreiandGitHub	4fb8ee6a6f	chore(protocol): don't start connection routines a second time (#10146 )	2025-05-30 06:28:42 +00:00
Jakob Borg	79bac43800	Merge branch 'main' into v2 * main: build: properly propagate build tags to Debian build (#10144) fix(protocol): avoid deadlock with concurrent connection start and close (#10140) build: add labeler workflow for PRs (#10143) build(deps): update our notify package from upstream (#10142) build(deps): update dependencies (#10141) docs: general notes about v2 coming (#10135)	2025-05-29 17:10:03 +02:00
Jakob BorgandGitHub	674834ccf4	build: properly propagate build tags to Debian build (#10144 ) Previously all were ignored except noupgrade which was hard coded...	2025-05-29 15:06:57 +00:00
Jakob BorgandGitHub	3bd2bff23b	fix(protocol): avoid deadlock with concurrent connection start and close (#10140 )	2025-05-29 14:56:58 +00:00
Jakob BorgandGitHub	40660c5fb7	build: add labeler workflow for PRs (#10143 ) Use labels to categorise release notes	2025-05-29 10:04:08 +02:00
Jakob BorgandGitHub	d940d094a1	build(deps): update our notify package from upstream (#10142 )	2025-05-28 15:04:24 +00:00
Jakob BorgandGitHub	9d67727989	build(deps): update dependencies (#10141 )	2025-05-28 13:52:08 +00:00
Jakob BorgandGitHub	6f51700a7f	docs: general notes about v2 coming (#10135 ) This adds a file that will be prepended to release notes (tag messages, GitHub releases, forum posts) for v1 releases. I'd like there to be something there to flag that things are going to change.	2025-05-27 10:01:04 +02:00
Jakob Borg	43d33dbeb5	docs: mention subcommands in release notes, use for all 2.0 releases	2025-05-27 08:16:09 +02:00
Jakob Borg	bb91f53641	Merge branch 'main' into v2 * main: refactor: use slices package for sorting (#10136) build: handle multiple general release notes build: no need to build on the branches that just trigger tags	2025-05-26 21:40:54 +02:00
Marcel MeyerandGitHub	598915193a	refactor: use slices package for sorting (#10136 ) Few more complicated usages of the sort packages are left. ### Purpose Make progress towards replacing the sort package with slices package.	2025-05-26 20:37:49 +02:00
Jakob Borg	905e5ec07f	build: handle multiple general release notes	2025-05-26 16:27:23 +02:00
Jakob Borg	5945a8c5bd	docs: adjust release notes for v2.0.0	2025-05-26 15:27:53 +02:00
Jakob Borg	4075b886d0	build: no need to build on the branches that just trigger tags	2025-05-26 15:21:21 +02:00