[GH-ISSUE #6592] iOS signup fails: emailVerificationToken is JSON-double-quoted causing “Error decoding JWT” in /identity/accounts/register/finish #19246

Closed
opened 2026-04-25 21:45:33 -05:00 by GiteaMirror · 6 comments
Owner

Originally created by @p-boenisch on GitHub (Dec 25, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6592

Prerequisites

Vaultwarden Support String

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.34.3
  • Web-vault version: v2025.7.0
  • OS/Arch: linux/x86_64
  • Running within a container: true (Base: Debian)
  • Database type: SQLite
  • Database version: 3.50.2
  • Uses config.json: true
  • Uses a reverse proxy: false
  • Internet access: true
  • Internet access via a proxy: false
  • DNS Check: true
  • Browser/Server Time Check: true
  • Server/NTP Time Check: true
  • Domain Configuration Check: false
  • HTTPS Check: true
  • Websocket Check: true
  • HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN

Config:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "***************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*******************",
  "domain_origin": "*****://*******************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": true,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "***************************",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": "******************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "***************************",
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

v1.34.3

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

OPNSsense HAProxy 3.0.12-21a355d

Host/Server Operating System

Linux

Operating System Version

iOS 18.5

Clients

iOS

Client Version

2025.12.0 (2787)

Steps To Reproduce

  1. Enable signups (signups_allowed=true).
  2. In Bitwarden iOS, set the self-hosted URL and try to create a new account.
  3. iOS calls /identity/accounts/register/send-verification-email successfully (200).
  4. iOS then calls /identity/accounts/register/finish and Vaultwarden returns 400 with Error decoding JWT.

Expected Result

iOS signup should succeed.

Actual Result

Signup fails at /identity/accounts/register/finish with Error decoding JWT.

Logs

Capturing the request body of `/identity/accounts/register/finish` shows that `emailVerificationToken` is *double-quoted* (JSON string literal inside a JSON string), e.g.:


{
  "emailVerificationToken": "\"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...\"",
  ...
}

Screenshots or Videos

No response

Additional Context

No response

Originally created by @p-boenisch on GitHub (Dec 25, 2025). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6592 ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.34.3 * Web-vault version: v2025.7.0 * OS/Arch: linux/x86_64 * Running within a container: true (Base: Debian) * Database type: SQLite * Database version: 3.50.2 * Uses config.json: true * Uses a reverse proxy: false * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: false * HTTPS Check: true * Websocket Check: true * HTTP Response Checks: true ### Config & Details (Generated via diagnostics page) <details><summary>Show Config & Details</summary> **Environment settings which are overridden:** DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN **Config:** ```json { "_duo_akey": null, "_enable_duo": true, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_max_conns": 10, "database_timeout": 30, "database_url": "***************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://*******************", "domain_origin": "*****://*******************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 600000, "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": true, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "***************************", "smtp_from_name": "Vaultwarden", "smtp_host": "******************", "smtp_password": "***", "smtp_port": 587, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": "***************************", "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details> ### Vaultwarden Build Version v1.34.3 ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy OPNSsense HAProxy 3.0.12-21a355d ### Host/Server Operating System Linux ### Operating System Version iOS 18.5 ### Clients iOS ### Client Version 2025.12.0 (2787) ### Steps To Reproduce 1. Enable signups (`signups_allowed=true`). 2. In Bitwarden iOS, set the self-hosted URL and try to create a new account. 3. iOS calls `/identity/accounts/register/send-verification-email` successfully (200). 4. iOS then calls `/identity/accounts/register/finish` and Vaultwarden returns 400 with `Error decoding JWT`. ### Expected Result iOS signup should succeed. ### Actual Result Signup fails at `/identity/accounts/register/finish` with `Error decoding JWT`. ### Logs ```text Capturing the request body of `/identity/accounts/register/finish` shows that `emailVerificationToken` is *double-quoted* (JSON string literal inside a JSON string), e.g.: { "emailVerificationToken": "\"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...\"", ... } ``` ### Screenshots or Videos _No response_ ### Additional Context _No response_
GiteaMirror added the bug label 2026-04-25 21:45:33 -05:00
Author
Owner

@BlackDex commented on GitHub (Jan 4, 2026):

Try v1.35.1 and see if that solves the issue, there were some changes in the JWT token stuff if I'm correct.

<!-- gh-comment-id:3708504478 --> @BlackDex commented on GitHub (Jan 4, 2026): Try v1.35.1 and see if that solves the issue, there were some changes in the JWT token stuff if I'm correct.
Author
Owner

@stefan0xC commented on GitHub (Jan 5, 2026):

I think this(?) error is also reproducible on Android:

Stacktrace:
kotlinx.serialization.json.internal.JsonDecodingException: Cannot read Json element because of unexpected end of the input at path: $
JSON input: 
	qv.i.d(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:32)
	qv.i.e(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:35)
	d7.i.m(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:61)
	d7.i.n(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:13)
	ag.g.m(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:225)
	qv.s.h(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:12)
	pv.u.deserialize(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:5)
	qv.s.u(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:266)
	pv.c.a(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:29)
	m7.d.q(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:34)
	lw.a0.c(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:54)
	h7.a.F(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:5)
	wv.k.run(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:57)
	java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1154)
	java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:652)
	java.lang.Thread.run(Thread.java:1563)

Version: 2025.12.0 (21003)
Device: 📱 motorola moto e13 🤖 13@33 📦 prod
CI: 🧱 commit: bitwarden/android/release/2025.12-rc40@f02b374e989600a8458d2884abd2526244241c8a
💻 build source: bitwarden/android/actions/runs/19830126705/attempts/1

Running latest testing (1.35.1-bf37657c).

btw: I have SMTP configured so I get the mail with the signup link and can finish the registration that way. But if you don't have mail configured I think that this will fail. (I can test that later.)

edit: after looking into it a bit I think this issue is caused because we return 200 with no body bf37657c08/src/api/identity.rs (L960) and don't return status::NoContent (204 No Content) - have not tested if this fixes the error in android but since this is the behavior of the bitwarden server I think it should. - so this is likely unrelated to the iOS error.
update: yep, on Android signing up (if it's allowed and verification is not required) just works, so I can't reproduce the reported error like I initially thought.

<!-- gh-comment-id:3709484614 --> @stefan0xC commented on GitHub (Jan 5, 2026): I think this(?) error is also reproducible on Android: ``` Stacktrace: kotlinx.serialization.json.internal.JsonDecodingException: Cannot read Json element because of unexpected end of the input at path: $ JSON input: qv.i.d(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:32) qv.i.e(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:35) d7.i.m(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:61) d7.i.n(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:13) ag.g.m(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:225) qv.s.h(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:12) pv.u.deserialize(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:5) qv.s.u(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:266) pv.c.a(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:29) m7.d.q(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:34) lw.a0.c(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:54) h7.a.F(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:5) wv.k.run(r8-map-id-6e0d54dbf80b43643d03c60b2d562368818cf40d2e8b08efa58fc01f9d016d8a:57) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1154) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:652) java.lang.Thread.run(Thread.java:1563) Version: 2025.12.0 (21003) Device: 📱 motorola moto e13 🤖 13@33 📦 prod CI: 🧱 commit: bitwarden/android/release/2025.12-rc40@f02b374e989600a8458d2884abd2526244241c8a 💻 build source: bitwarden/android/actions/runs/19830126705/attempts/1 ``` Running latest `testing` (1.35.1-bf37657c). btw: I have SMTP configured so I get the mail with the signup link and can finish the registration that way. But if you don't have mail configured I think that this will fail. (I can test that later.) edit: after looking into it a bit I think this issue is caused because we return 200 with no body https://github.com/dani-garcia/vaultwarden/blob/bf37657c08aa3dd8b9c871d15d00c3a7bbcc756c/src/api/identity.rs#L960 and don't return [status::NoContent (`204 No Content`)](https://docs.rs/rocket/latest/rocket/response/status/struct.NoContent.html) - have not tested if this fixes the error in android but since [this is the behavior of the bitwarden server](https://github.com/bitwarden/server/blob/e9d53c0c6b9c81bfc4a638ff63083af41cea9c3e/src/Identity/Controllers/AccountsController.cs#L124) I think it should. - so this is likely unrelated to the iOS error. update: yep, on Android signing up (if it's allowed and verification is not required) just works, so I can't reproduce the reported error like I initially thought.
Author
Owner

@BlackDex commented on GitHub (Jan 5, 2026):

Resolved via #6665

<!-- gh-comment-id:3711688267 --> @BlackDex commented on GitHub (Jan 5, 2026): Resolved via #6665
Author
Owner

@stefan0xC commented on GitHub (Jan 5, 2026):

@BlackDex the PR just resolved the issue I've noticed. I can't reproduce the initially reported error with iOS (or check if it still occurs) because I don't have an iPhone but that should be if you have not set up mail or don't require email verification, i.e. the opposite of what I had encountered. It might already be resolved but that would not be through my change because you would get a Token bf37657c08/src/api/identity.rs (L962-L964)

<!-- gh-comment-id:3711703030 --> @stefan0xC commented on GitHub (Jan 5, 2026): @BlackDex the PR just resolved the issue I've noticed. I can't reproduce the initially reported error with iOS (or check if it still occurs) because I don't have an iPhone but that should be if you have not set up mail or don't require email verification, i.e. the opposite of what I had encountered. It might already be resolved but that would not be through my change because you would get a Token https://github.com/dani-garcia/vaultwarden/blob/bf37657c08aa3dd8b9c871d15d00c3a7bbcc756c/src/api/identity.rs#L962-L964
Author
Owner

@Nicholas-Ho commented on GitHub (Feb 22, 2026):

The error with the iOS client is still present in the current latest (v1.35.3). The error I am getting is Error decoding JWT: Invalid Byte(0, 34) during initial signup when trying to hit the /identity/accounts/register/finish. Haven't had the chance to capture the request itself but it seems to be the same error found by @p-boenisch

This is unrelated to the error identified by @stefan0xC and is not solved by PR #6665. @BlackDex could we reopen this issue?

Edit: raising slight differences in my setup, mainly the use of a Caddy reverse proxy, set up as per the wiki example

<!-- gh-comment-id:3941106135 --> @Nicholas-Ho commented on GitHub (Feb 22, 2026): The error with the iOS client is still present in the current latest (v1.35.3). The error I am getting is `Error decoding JWT: Invalid Byte(0, 34)` during initial signup when trying to hit the `/identity/accounts/register/finish`. Haven't had the chance to capture the request itself but it seems to be the same error found by @p-boenisch This is unrelated to the error identified by @stefan0xC and is not solved by PR #6665. @BlackDex could we reopen this issue? Edit: raising slight differences in my setup, mainly the use of a Caddy reverse proxy, set up as per the wiki example
Author
Owner

@BlackDex commented on GitHub (Feb 22, 2026):

Please try to use the Flight Recorder first, and see what the actual error is before opening a new issue.
Also, for most client side item we suggest to start a discussion first instead of an issue and provide detailed information like the Support String, and if possible the output of the Flight Recorder during this error.

<!-- gh-comment-id:3941119826 --> @BlackDex commented on GitHub (Feb 22, 2026): Please try to use the Flight Recorder first, and see what the actual error is before opening a new issue. Also, for most client side item we suggest to start a discussion first instead of an issue and provide detailed information like the Support String, and if possible the output of the Flight Recorder during this error.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#19246