DefGuard · moubctez · May 18, 2026 · May 12, 2026 · May 13, 2026 · May 14, 2026
diff --git a/.github/workflows/build-macos.yaml b/.github/workflows/build-macos.yaml
@@ -11,6 +11,9 @@ on:
     tags:
       - v*.*.*
 
+env:
+  SQLX_OFFLINE: "1"
+
 jobs:
   build-macos:
     runs-on:
@@ -38,18 +41,23 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26
 
       - uses: pnpm/action-setup@v6
         with:
           cache: true
-          version: 10
+          version: 11
 
       # Change to '--frozen-lockfile' once this gets fixed:
       # https://github.com/pnpm/action-setup/issues/40
       - name: Install Node dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Install Node dependencies for New UI
+        run: |
+          cd new-ui
+          pnpm install --no-frozen-lockfile
+
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -63,6 +71,11 @@ jobs:
       - name: Unlock keychain
         run: security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" login.keychain
 
+      - name: Build new UI
+        run: |
+          cd new-ui
+          pnpm build
+
       - name: Build app
         uses: tauri-apps/tauri-action@v0
         env:

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -30,34 +30,41 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26
 
       - uses: pnpm/action-setup@v6
         with:
-          version: 10
+          cache: true
+          version: 11
           run_install: false
 
       - name: Get pnpm store directory
         shell: bash
         run: |
           echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
 
-      - name: Setup pnpm cache
-        uses: actions/cache@v5
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-lint-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-lint-store-
-
       # Change to '--frozen-lockfile' once this gets fixed:
       # https://github.com/pnpm/action-setup/issues/40
       - name: Install Node dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Install Node dependencies for new UI
+        run: |
+          cd new-ui
+          pnpm install --no-frozen-lockfile
+
       - name: Run Biome and Prettier Lint
         run: pnpm lint
 
-      # TODO: Restore when it works again: https://github.com/pnpm/pnpm/issues/11265
-      # - name: Audit
-      #   run: pnpm audit --prod
+      - name: Audit
+        run: pnpm audit --prod
+
+      - name: Run Biome and Prettier Lint for new UI
+        run: |
+          cd new-ui
+          pnpm lint
+
+      - name: Audit new UI
+        run: |
+          cd new-ui
+          pnpm audit --prod
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -62,11 +62,12 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v6
         with:
-          version: 10
+          cache: true
+          version: 11
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26
 
       - name: Get pnpm store directory
         run: |
@@ -78,26 +79,29 @@ jobs:
           echo Version: $VERSION
           echo "VERSION=$VERSION" >> ${GITHUB_ENV}
           echo "DEFGUARD_CLIENT_BUILD_VERSION=${GITHUB_REF_NAME#v}" >> ${GITHUB_ENV}
-      - uses: actions/cache@v5
-        name: Setup pnpm cache
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-build-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-build-store-
 
       # Change to '--frozen-lockfile' once this gets fixed:
       # https://github.com/pnpm/action-setup/issues/40
       - name: Install Node dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Install Node dependencies for new UI
+        run: |
+          cd new-ui
+          pnpm install --no-frozen-lockfile
+
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install dependencies
         run: |
           apt-get install -y build-essential libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm
 
+      - name: Build new UI
+        run: |
+          cd new-ui
+          pnpm build
+
       - name: Build packages
         uses: tauri-apps/tauri-action@v0.5.23
         env:
@@ -166,31 +170,29 @@ jobs:
           echo "DEFGUARD_CLIENT_BUILD_VERSION=${GITHUB_REF_NAME#v}" >> ${GITHUB_ENV}
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26
 
       - uses: pnpm/action-setup@v6
         with:
-          version: 10
+          cache: true
+          version: 11
           run_install: false
 
       - name: Get pnpm store directory
         shell: bash
         run: |
           echo "STORE_PATH=$(pnpm store path --silent)" >> ${GITHUB_ENV}
 
-      - name: Setup pnpm cache
-        uses: actions/cache@v5
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-build-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-build-store-
-
       # Change to '--frozen-lockfile' once this gets fixed:
       # https://github.com/pnpm/action-setup/issues/40
       - name: Install Node dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Install Node dependencies for new UI
+        run: |
+          cd new-ui
+          pnpm install --no-frozen-lockfile
+
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@stable
 
@@ -199,6 +201,11 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm
 
+      - name: Build new UI
+        run: |
+          cd new-ui
+          pnpm build
+
       - name: Build packages
         uses: tauri-apps/tauri-action@v0.5.23 # .24 seems broken, TODO: update when fixed
         env:
@@ -343,21 +350,14 @@ jobs:
   #         echo "VERSION=$env:VERSION" >> $env:GITHUB_ENV
   #     - uses: actions/setup-node@v6
   #       with:
-  #         node-version: 25
+  #         node-version: 26
   #     - uses: pnpm/action-setup@v6
   #       with:
-  #         version: 10
+  #         version: 11
   #         run_install: false
   #     - name: Get pnpm store directory
   #       shell: bash
   #       run: echo "STORE_PATH=$(pnpm store path --silent)" >> ${GITHUB_ENV}
-  #     - uses: actions/cache@v5
-  #       name: Setup pnpm cache
-  #       with:
-  #         path: ${{ env.STORE_PATH }}
-  #         key: ${{ runner.os }}-pnpm-build-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-  #         restore-keys: |
-  #           ${{ runner.os }}-pnpm-build-store-
   #     - name: Install deps
   #       run: pnpm install --frozen-lockfile
   #     - uses: dtolnay/rust-toolchain@stable

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -20,6 +20,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  SQLX_OFFLINE: "1"
   # sccache
   SCCACHE_GHA_ENABLED: "true"
   RUSTC_WRAPPER: "sccache"

diff --git a/.trivyignore.yaml b/.trivyignore.yaml
@@ -1,4 +1,4 @@
 vulnerabilities:
   - id: GHSA-wrw7-89jp-8q8g
-    expired_at: 2026-05-16
+    expired_at: 2026-06-16
     statement: 'glib is a transitive dependency of Tauri which we cannot update ourselves. Waiting for tauri to finish migration to gtk4-rs: https://github.com/tauri-apps/tauri/issues/12563'
diff --git a/.typesafe-i18n.json b/.typesafe-i18n.json
@@ -1,4 +1,4 @@
 {
    "adapter": "react",
-   "$schema": "https://unpkg.com/typesafe-i18n@5.26.2/schema/typesafe-i18n.json"
+   "$schema": "https://unpkg.com/typesafe-i18n@5.27.1/schema/typesafe-i18n.json"
 }
diff --git a/biome.json b/biome.json
@@ -9,6 +9,7 @@
     "ignoreUnknown": false,
     "includes": [
       "src/**",
+      "!new-ui",
       "!src/i18n/*.ts",
       "!src/i18n/*.tsx",
       "!src/i18n/i18n-util",

diff --git a/justfile b/justfile
@@ -0,0 +1,13 @@
+set shell := ["powershell.exe", "-c"]
+
+dev:
+    npx concurrently \
+        -n "NEW,OLD,TAURI" \
+        "cd new-ui && pnpm dev" \
+        "pnpm dev" \
+        "cargo tauri dev"
+
+build:
+    cd new-ui; pnpm build
+    pnpm build
+    cargo tauri build --config .\src-tauri\tauri.local.conf.json
diff --git a/new-ui/.gitignore b/new-ui/.gitignore
@@ -0,0 +1,24 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
diff --git a/new-ui/.nvmrc b/new-ui/.nvmrc
@@ -0,0 +1 @@
+v25
diff --git a/new-ui/.prettierignore b/new-ui/.prettierignore
@@ -0,0 +1,3 @@
+/src/**/*.tsx
+/src/**/*.ts
+/src/**/*.js
diff --git a/new-ui/.prettierrc b/new-ui/.prettierrc
@@ -0,0 +1,8 @@
+{
+  "semi": true,
+  "tabWidth": 2,
+  "singleQuote": true,
+  "useTabs": false,
+  "printWidth": 90,
+  "endOfLine": "lf"
+}
diff --git a/new-ui/.stylelintrc.json b/new-ui/.stylelintrc.json
@@ -0,0 +1,10 @@
+{
+  "extends": ["stylelint-config-standard-scss"],
+  "plugins": ["stylelint-scss"],
+  "rules": {
+    "at-rule-no-unknown": null,
+    "scss/at-rule-no-unknown": true,
+    "custom-property-empty-line-before": null,
+    "value-keyword-case": null
+  }
+}
diff --git a/new-ui/README.md b/new-ui/README.md
@@ -0,0 +1,73 @@
+# React + TypeScript + Vite
+
+This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
+
+Currently, two official plugins are available:
+
+- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Oxc](https://oxc.rs)
+- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/)
+
+## React Compiler
+
+The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
+
+## Expanding the ESLint configuration
+
+If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
+
+```js
+export default defineConfig([
+  globalIgnores(['dist']),
+  {
+    files: ['**/*.{ts,tsx}'],
+    extends: [
+      // Other configs...
+
+      // Remove tseslint.configs.recommended and replace with this
+      tseslint.configs.recommendedTypeChecked,
+      // Alternatively, use this for stricter rules
+      tseslint.configs.strictTypeChecked,
+      // Optionally, add this for stylistic rules
+      tseslint.configs.stylisticTypeChecked,
+
+      // Other configs...
+    ],
+    languageOptions: {
+      parserOptions: {
+        project: ['./tsconfig.node.json', './tsconfig.app.json'],
+        tsconfigRootDir: import.meta.dirname,
+      },
+      // other options...
+    },
+  },
+])
+```
+
+You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
+
+```js
+// eslint.config.js
+import reactX from 'eslint-plugin-react-x'
+import reactDom from 'eslint-plugin-react-dom'
+
+export default defineConfig([
+  globalIgnores(['dist']),
+  {
+    files: ['**/*.{ts,tsx}'],
+    extends: [
+      // Other configs...
+      // Enable lint rules for React
+      reactX.configs['recommended-typescript'],
+      // Enable lint rules for React DOM
+      reactDom.configs.recommended,
+    ],
+    languageOptions: {
+      parserOptions: {
+        project: ['./tsconfig.node.json', './tsconfig.app.json'],
+        tsconfigRootDir: import.meta.dirname,
+      },
+      // other options...
+    },
+  },
+])
+```