diff --git a/.cargo/config.toml b/.cargo/config.toml
index 287f441b..ff9da012 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,8 +1,17 @@
 [target.aarch64-unknown-linux-gnu]
 linker = "aarch64-linux-gnu-gcc"
 
+# mips{,el}-unknown-linux-gnu: the old glibc in the cross-toolchain lacks the
+# `getrandom()` wrapper symbol that getrandom 0.3's default backend calls, so we
+# select getrandom's `custom` backend (implemented via the raw SYS_getrandom
+# syscall in privaxy's lib.rs). musl MIPS uses getrandom's weak-fallback backend
+# and needs no override.
+[target.mips-unknown-linux-gnu]
+rustflags = ["--cfg", "getrandom_backend=\"custom\""]
+
 [target.mipsel-unknown-linux-gnu]
 linker = "mipsel-linux-gnu-gcc"
+rustflags = ["--cfg", "getrandom_backend=\"custom\""]
 
 [target.mipsel-unknown-linux-musl]
 linker = "mipsel-linux-musl-gcc"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41320fa7..91b69069 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,97 @@
 # Changelog
 
+## Unreleased
+
+- The PAC route now also answers at `/wpad.dat`, so DNS-based WPAD
+  auto-discovery (`http://wpad.<search domain>/wpad.dat`) can point straight
+  at Privaxy without needing a rewrite in a fronting reverse proxy.
+- New `network.gui_url` setting: full base URL of the web GUI as reachable by
+  clients, e.g. `gui_url = "http://proxy.example.lan"` when the GUI sits
+  behind a reverse proxy. Used verbatim for links back to the GUI on proxy
+  error pages (the "exclude this host" button), winning over `listen_url` and
+  the bound/dialed address. Fixes the exclude link pointing at an unreachable
+  container IP when Privaxy runs behind Docker NAT with the GUI fronted by a
+  reverse proxy on a different port. Editable from Settings → General
+  (network section) as "GUI URL"; must start with `http://` or `https://`
+  (validated in both the form and the API), and clearing the field unsets it.
+  Older API clients that omit the field keep the stored value.
+- Fix PAC rendering of CIDR bypass rules entered as `subnet/22`: the GUI
+  stores the bare prefix length, which was emitted verbatim into
+  `isInNet(host, subnet, "22")` — an invalid mask for standard PAC engines,
+  so those DIRECT rules silently never matched. Prefix lengths are now
+  converted to dotted-decimal masks at render time (already-dotted masks are
+  passed through), fixing existing configs without rewriting them.
+- Failing filter lists are now surfaced in the web UI
+  - Filter lists that fail to download or stop serving valid rules (moved
+    URL, HTML error page, empty list) used to fail silently in the background
+    updater. Settings → Filters now shows a warning panel listing each
+    failing list with its error, last attempt time and consecutive failure
+    count, and offers per-entry **Edit** (fix the URL, title or category in a
+    prefilled modal) and **Remove** actions. The panel is hidden while every
+    list is healthy. Failures are tracked in memory (keyed by the filter's
+    file name) and reconciled on configuration changes, so disabling or
+    removing a list clears its entry.
+  - Editing validates the new URL the same way adding a filter does (must
+    serve a `text/plain` list with parseable rules) and keeps the entry's
+    enabled state; a URL already used by another filter is rejected with a
+    `409`.
+  - A periodic refresh no longer aborts the remaining lists when one list
+    fails to download: each list is now updated independently and failures
+    are recorded per list.
+  - New authenticated API routes: `GET /api/filters/failures` and
+    `PATCH /api/filters`. `/api/filters` routes now match the exact path
+    only, so stray sub-paths 404 instead of hitting the collection handlers.
+- User-added filter lists can be edited and removed from the Filters page
+  - Each user-added list row now has an edit (pencil) button opening a modal
+    to rename the list, change its category or URL, or delete it. Built-in
+    lists shipped with the package show no edit button and the API refuses to
+    edit (`PATCH`) or remove (`DELETE`) them with a `403` — they can only be
+    enabled/disabled. The failures panel follows the same rule: a failing
+    built-in list offers a **Disable** action instead of Edit/Remove.
+  - `GET /api/filters` responses now include each filter's `url` and an
+    `is_default` flag, and `GET /api/filters/failures` entries carry
+    `is_default` too.
+- Dependency upgrade to latest versions (semver-aware; pre-releases such as
+  `argon2 0.6.0-rc` and `tera 2.0.0-alpha` were intentionally not adopted).
+  - Server HTTP/TLS stack: `hyper 0.14 → 1`, `http 0.2 → 1` (now via
+    `hyper-util` + `http-body-util`), `rustls 0.21 → 0.23`,
+    `tokio-rustls 0.24 → 0.26`, `hyper-rustls 0.24 → 0.27`,
+    `reqwest 0.11 → 0.13`, `warp 0.3 → 0.4`. The whole TLS stack is pinned to
+    the `ring` crypto provider so the MIPS/musl cross builds keep working
+    (`aws-lc-rs` needs a C toolchain). A `ring` `CryptoProvider` is installed
+    once at startup, as rustls 0.23 requires.
+  - warp 0.4 dropped its built-in TLS and graceful-shutdown server, so the web
+    GUI is now served through `hyper-util` with optional `tokio-rustls`
+    termination; WebSocket live feeds continue to work via connection upgrades.
+  - Frontend: `yew 0.19 → 0.23`, `yew-router 0.16 → 0.20`, `gloo-*` bumped,
+    `web-sys`/`wasm-bindgen` refreshed, and the deprecated `reqwasm` replaced
+    with `gloo-net`.
+  - Other majors: `thiserror 1 → 2`, `toml 0.8 → 1`, `dirs 5 → 6`.
+  - Behavior is unchanged; a set of characterization tests was added first to
+    lock the proxy's CSP/request-type/upgrade logic, the TOML config
+    round-trip, and CA-signed cert/server-config assembly.
+- One-click exclusion of hosts that break under TLS interception
+  - The proxy's 502 error page now names the failing host and offers an
+    "Exclude this host" button. The button is a plain link to the web UI's new
+    `/exclude?host=…` confirm page, so it rides the existing session auth:
+    logged-in admins get a one-click confirm, everyone else lands on the login
+    page first (the URL survives login). Values substituted into the error
+    page are now HTML-escaped and the link's host is percent-encoded
+    (previously the error reason was inserted unescaped).
+  - The web UI address on the error page is derived from `network.listen_url`
+    when set, otherwise from the bind address — falling back to the IP the
+    client actually dialed when binding `0.0.0.0`.
+  - New "Recent TLS interception failures" panel on Settings → Exclusions:
+    clients that abort the interception handshake (typically certificate
+    pinning — e.g. banking apps, RCS messaging) can never be shown an error
+    page, so the proxy now records those hosts (deduplicated,
+    most-recent-first, capped at 100, in memory) and the panel offers
+    per-host **Exclude** and **Ignore** actions. Ignored hosts persist in the
+    config (`ignored_tls_failures`) and survive restarts; existing config
+    files without the field keep working.
+  - New authenticated API routes: `GET /api/tls-failures` and
+    `POST /api/tls-failures/ignore`.
+
 ## v0.7.1
 
 - Fix WebSocket / protocol-upgrade connections hanging
diff --git a/Cargo.lock b/Cargo.lock
index 14db423b..0c26f8ec 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10,10 +10,10 @@ checksum = "db6fe7702c798519299bcbe011ff6f1dc9e3aedc1f3171178cddf71e1736bf95"
 dependencies = [
  "addr",
  "arrayvec",
- "base64 0.22.1",
- "bitflags 2.11.1",
+ "base64",
+ "bitflags 2.13.0",
  "flatbuffers",
- "idna 1.1.0",
+ "idna",
  "itertools",
  "memchr",
  "percent-encoding",
@@ -23,7 +23,7 @@ dependencies = [
  "seahash",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
  "url",
 ]
 
@@ -38,25 +38,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "addr2line"
-version = "0.21.0"
+name = "adler2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "ahash"
-version = "0.8.11"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -66,9 +57,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
 dependencies = [
  "memchr",
 ]
@@ -88,18 +79,6 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
-[[package]]
-name = "allocator-api2"
-version = "0.2.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
-
-[[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -111,9 +90,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.14"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -126,36 +105,37 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.7"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.4"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a64c907d4e79225ac72e2a354c9ce84d50ebb4586dee56c82b3ee73004f537f5"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.3"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
- "windows-sys 0.52.0",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -172,34 +152,32 @@ dependencies = [
 
 [[package]]
 name = "arrayvec"
-version = "0.7.4"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
 
 [[package]]
 name = "async-compression"
-version = "0.4.11"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd066d0b4ef8ecb03a55319dc13aa6910616d0f44008a045bb1835af830abff5"
+checksum = "e79b3f8a79cccc2898f31920fc69f304859b3bd567490f75ebf51ae1c792a9ac"
 dependencies = [
- "brotli",
- "flate2",
- "futures-core",
+ "compression-codecs",
+ "compression-core",
  "futures-io",
- "memchr",
  "pin-project-lite",
  "tokio",
 ]
 
 [[package]]
 name = "async-trait"
-version = "0.1.80"
+version = "0.1.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6fa2087f2753a7da8cc1c0dbfcf89579dd57458e36769de5ac750b4671737ca"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -210,30 +188,9 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
-
-[[package]]
-name = "backtrace"
-version = "0.3.71"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
-dependencies = [
- "addr2line",
- "cc",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
-]
-
-[[package]]
-name = "base64"
-version = "0.21.7"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "base64"
@@ -247,6 +204,15 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -255,9 +221,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.11.1"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 dependencies = [
  "serde_core",
 ]
@@ -280,17 +246,11 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "boolinator"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfa8873f51c92e232f9bac4065cddef41b714152812bfc5f7672ba16d6ef8cd9"
-
 [[package]]
 name = "brotli"
-version = "6.0.0"
+version = "8.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74f7971dbd9326d58187408ab83117d8ac1bb9c17b085fdacd1cf2f598719b6b"
+checksum = "8119e4516436f5708bbc474a9d395bf12f1b5395e93a92a56e647ac3388c8610"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -299,14 +259,23 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "4.0.0"
+version = "5.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6221fe77a248b9117d431ad93761222e1cf8ff282d9d1d5d9f53d6299a1cf76"
+checksum = "5962523e1b92ce1b5e793d9169b9943eece10d39f62550bc04bb605d75b94924"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
 ]
 
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
 [[package]]
 name = "bstr"
 version = "1.12.1"
@@ -319,9 +288,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.16.0"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "byteorder"
@@ -331,42 +300,73 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.6.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
-version = "1.0.98"
+version = "1.2.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41c270e7540d725e65ac7f1b212ac8ce349719624d7bcff99f8e2e488e8cf03f"
+checksum = "dad887fd958be91b5098c0248def011f4523ab786cd411be668777e55063501f"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "chrono"
-version = "0.4.38"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
- "android-tzdata",
  "iana-time-zone",
  "js-sys",
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets 0.52.5",
+ "windows-link",
 ]
 
 [[package]]
 name = "colorchoice"
-version = "1.0.1"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "compression-codecs"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
+dependencies = [
+ "brotli",
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
+checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
 
 [[package]]
 name = "console_error_panic_hook"
@@ -386,9 +386,9 @@ checksum = "6245d59a3e82a7fc217c5828a6692dbc6dfb63a0c8c90495621f7b9d79704a0e"
 
 [[package]]
 name = "core-foundation"
-version = "0.9.4"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -396,33 +396,33 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.12"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.13"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -448,15 +448,15 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.20"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
  "typenum",
@@ -486,14 +486,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
 dependencies = [
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "darling"
-version = "0.20.9"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83b2eb4d90d12bdda5ed17de686c2acb4c57914f8f921b8da7e112b5a36f3fe1"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -501,56 +501,55 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.20.9"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622687fe0bac72a04e5599029151f5796111b90f1baaa9b544d807a5e31cd120"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
 dependencies = [
- "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.20.9"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "733cabb43482b1a1b53eee8583c2b9e8684d592215ea83efd305dd31bc2f0178"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "data-encoding"
-version = "2.6.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
 [[package]]
 name = "deranged"
-version = "0.3.11"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
  "powerfmt",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "derive_more"
-version = "0.99.17"
+version = "0.99.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb810d30a7c1953f91334de7244731fc3f3c10d7fe163338a35b9f640960321"
+checksum = "6edb4b64a43d977b8e99788fe3a04d483834fba1215a7e02caa415b626497f7f"
 dependencies = [
  "convert_case",
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 1.0.109",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -566,71 +565,77 @@ dependencies = [
 
 [[package]]
 name = "dirs"
-version = "5.0.1"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
 dependencies = [
  "dirs-sys",
 ]
 
 [[package]]
 name = "dirs-sys"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
 dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "dtoa"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcbb2bf8e87535c23f7a8a321e364ce21462d0ff10cb6407820e8e96dfff6653"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
 
 [[package]]
 name = "dtoa-short"
-version = "0.3.4"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbaceec3c6e4211c79e7b1800fb9680527106beb2f9c51904a3210c03a448c74"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
 dependencies = [
  "dtoa",
 ]
 
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
 [[package]]
 name = "either"
-version = "1.12.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.34"
+version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "env_filter"
-version = "0.1.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a009aa4810eb158359dda09d0c87378e4bbb89b5a801f016885a4707ba24f7ea"
+checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
 dependencies = [
  "log",
  "regex",
@@ -638,39 +643,33 @@ dependencies = [
 
 [[package]]
 name = "env_logger"
-version = "0.11.3"
+version = "0.11.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38b35839ba51819680ba087cd351788c9a3c476841207e0b8cee0b04722343b9"
+checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
 dependencies = [
  "anstream",
  "anstyle",
  "env_filter",
- "humantime",
+ "jiff",
  "log",
 ]
 
 [[package]]
 name = "equivalent"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
-version = "0.3.9"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "fastrand"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
-
 [[package]]
 name = "filterlists-api"
 version = "0.1.0"
@@ -678,27 +677,33 @@ dependencies = [
  "async-trait",
  "readonly",
  "reqwasm",
- "reqwest 0.12.4",
+ "reqwest",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
 [[package]]
 name = "flatbuffers"
 version = "25.12.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "rustc_version",
 ]
 
 [[package]]
 name = "flate2"
-version = "1.0.30"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -727,18 +732,18 @@ checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
 dependencies = [
  "percent-encoding",
 ]
 
 [[package]]
 name = "futures"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -751,9 +756,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -761,15 +766,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -778,38 +783,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
 
 [[package]]
 name = "futures-task"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-util"
-version = "0.3.30"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -819,7 +824,6 @@ dependencies = [
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -855,20 +859,28 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.15"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
-name = "gimli"
-version = "0.28.1"
+name = "getrandom"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+]
 
 [[package]]
 name = "globset"
@@ -889,34 +901,37 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf760ebf69878d9fd8f110c89703d90ce35095324d1f1edcb595c63945ee757"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "ignore",
  "walkdir",
 ]
 
 [[package]]
 name = "gloo"
-version = "0.4.2"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23947965eee55e3e97a5cd142dd4c10631cc349b48cecca0ed230fd296f568cd"
+checksum = "d15282ece24eaf4bd338d73ef580c6714c8615155c4190c781290ee3fa0fd372"
 dependencies = [
  "gloo-console",
  "gloo-dialogs",
  "gloo-events",
  "gloo-file",
+ "gloo-history",
+ "gloo-net 0.5.0",
  "gloo-render",
  "gloo-storage",
- "gloo-timers",
- "gloo-utils",
+ "gloo-timers 0.3.0",
+ "gloo-utils 0.2.0",
+ "gloo-worker",
 ]
 
 [[package]]
 name = "gloo-console"
-version = "0.2.3"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b7ce3c05debe147233596904981848862b068862e9ec3e34be446077190d3f"
+checksum = "2a17868f56b4a24f677b17c8cb69958385102fa879418052d60b50bc1727e261"
 dependencies = [
- "gloo-utils",
+ "gloo-utils 0.2.0",
  "js-sys",
  "serde",
  "wasm-bindgen",
@@ -925,9 +940,9 @@ dependencies = [
 
 [[package]]
 name = "gloo-dialogs"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67062364ac72d27f08445a46cab428188e2e224ec9e37efdba48ae8c289002e6"
+checksum = "bf4748e10122b01435750ff530095b1217cf6546173459448b83913ebe7815df"
 dependencies = [
  "wasm-bindgen",
  "web-sys",
@@ -935,9 +950,9 @@ dependencies = [
 
 [[package]]
 name = "gloo-events"
-version = "0.1.2"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68b107f8abed8105e4182de63845afcc7b69c098b7852a813ea7462a320992fc"
+checksum = "27c26fb45f7c385ba980f5fa87ac677e363949e065a083722697ef1b2cc91e41"
 dependencies = [
  "wasm-bindgen",
  "web-sys",
@@ -945,9 +960,9 @@ dependencies = [
 
 [[package]]
 name = "gloo-file"
-version = "0.2.3"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d5564e570a38b43d78bdc063374a0c3098c4f0d64005b12f9bbe87e869b6d7"
+checksum = "97563d71863fb2824b2e974e754a81d19c4a7ec47b09ced8a0e6656b6d54bd1f"
 dependencies = [
  "futures-channel",
  "gloo-events",
@@ -956,6 +971,23 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "gloo-history"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "903f432be5ba34427eac5e16048ef65604a82061fe93789f2212afc73d8617d6"
+dependencies = [
+ "getrandom 0.2.17",
+ "gloo-events",
+ "gloo-utils 0.2.0",
+ "serde",
+ "serde-wasm-bindgen",
+ "serde_urlencoded",
+ "thiserror 1.0.69",
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "gloo-net"
 version = "0.1.0"
@@ -965,12 +997,54 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-sink",
- "gloo-utils",
+ "gloo-utils 0.1.7",
+ "js-sys",
+ "pin-project",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "gloo-net"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43aaa242d1239a8822c15c645f02166398da4f8b5c4bae795c1f5b44e9eee173"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-sink",
+ "gloo-utils 0.2.0",
+ "http 0.2.12",
+ "js-sys",
+ "pin-project",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "gloo-net"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c06f627b1a58ca3d42b45d6104bf1e1a03799df472df00988b6ba21accc10580"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-sink",
+ "gloo-utils 0.2.0",
+ "http 1.4.2",
  "js-sys",
  "pin-project",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
@@ -978,9 +1052,9 @@ dependencies = [
 
 [[package]]
 name = "gloo-render"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fd9306aef67cfd4449823aadcd14e3958e0800aa2183955a309112a84ec7764"
+checksum = "56008b6744713a8e8d98ac3dcb7d06543d5662358c9c805b4ce2167ad4649833"
 dependencies = [
  "wasm-bindgen",
  "web-sys",
@@ -988,24 +1062,36 @@ dependencies = [
 
 [[package]]
 name = "gloo-storage"
-version = "0.2.2"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d6ab60bf5dbfd6f0ed1f7843da31b41010515c745735c970e821945ca91e480"
+checksum = "fbc8031e8c92758af912f9bc08fbbadd3c6f3cfcbf6b64cdf3d6a81f0139277a"
 dependencies = [
- "gloo-utils",
+ "gloo-utils 0.2.0",
  "js-sys",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
  "wasm-bindgen",
  "web-sys",
 ]
 
 [[package]]
 name = "gloo-timers"
-version = "0.2.6"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "gloo-timers"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b995a66bb87bebce9a0f4a95aed01daca4872c050bfcb21653361c03bc35e5c"
+checksum = "482ce8a491a501da4cd806bd190275363d674f2845005c6ddbd5d3e1dd54495d"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1027,37 +1113,75 @@ dependencies = [
 ]
 
 [[package]]
-name = "h2"
-version = "0.3.26"
+name = "gloo-utils"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
+checksum = "0b5555354113b18c547c1d3a98fbf7fb32a9ff4f6fa112ce823a21641a0ba3aa"
 dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap 2.2.6",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
+ "js-sys",
+ "serde",
+ "serde_json",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "gloo-utils"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4202275d95a142fa209a1e35e91c250a710c5600731372cd3464a39ed01573d6"
+dependencies = [
+ "js-sys",
+ "serde",
+ "serde_json",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "gloo-worker"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "085f262d7604911c8150162529cefab3782e91adb20202e8658f7275d2aefe5d"
+dependencies = [
+ "bincode",
+ "futures",
+ "gloo-utils 0.2.0",
+ "gloo-worker-macros",
+ "js-sys",
+ "pinned",
+ "serde",
+ "thiserror 1.0.69",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "gloo-worker-macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "956caa58d4857bc9941749d55e4bd3000032d8212762586fa5705632967140e7"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "h2"
-version = "0.4.5"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa82e28a107a8cc405f0839610bdc9b15f1e25ec7d696aa5cf173edbcb1486ab"
+checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
 dependencies = [
  "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.1.0",
- "indexmap 2.2.6",
+ "http 1.4.2",
+ "indexmap 2.14.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -1081,24 +1205,26 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.14.5"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
- "allocator-api2",
-]
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 
 [[package]]
-name = "headers"
-version = "0.3.9"
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "headers"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
+checksum = "b3314d5adb5d94bcdf56771f2e50dbbc80bb4bdf88967526706205ac9eff24eb"
 dependencies = [
- "base64 0.21.7",
+ "base64",
  "bytes",
  "headers-core",
- "http 0.2.12",
+ "http 1.4.2",
  "httpdate",
  "mime",
  "sha1",
@@ -1106,18 +1232,18 @@ dependencies = [
 
 [[package]]
 name = "headers-core"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429"
+checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
 dependencies = [
- "http 0.2.12",
+ "http 1.4.2",
 ]
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.9"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
 [[package]]
 name = "hex"
@@ -1142,59 +1268,47 @@ checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
 dependencies = [
  "bytes",
  "fnv",
- "itoa 1.0.11",
+ "itoa 1.0.18",
 ]
 
 [[package]]
 name = "http"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
-dependencies = [
- "bytes",
- "fnv",
- "itoa 1.0.11",
-]
-
-[[package]]
-name = "http-body"
-version = "0.4.6"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
 dependencies = [
  "bytes",
- "http 0.2.12",
- "pin-project-lite",
+ "itoa 1.0.18",
 ]
 
 [[package]]
 name = "http-body"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.1.0",
+ "http 1.4.2",
 ]
 
 [[package]]
 name = "http-body-util"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
- "futures-util",
- "http 1.1.0",
- "http-body 1.0.0",
+ "futures-core",
+ "http 1.4.2",
+ "http-body",
  "pin-project-lite",
 ]
 
 [[package]]
 name = "httparse"
-version = "1.8.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "httpdate"
@@ -1202,50 +1316,22 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
-[[package]]
-name = "humantime"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
-
 [[package]]
 name = "hyper"
-version = "0.14.29"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f361cde2f109281a220d4307746cdfd5ee3f410da58a70377762396775634b33"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "futures-channel",
  "futures-core",
- "futures-util",
- "h2 0.3.26",
- "http 0.2.12",
- "http-body 0.4.6",
+ "h2",
+ "http 1.4.2",
+ "http-body",
  "httparse",
  "httpdate",
- "itoa 1.0.11",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
-[[package]]
-name = "hyper"
-version = "1.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe575dd17d0862a9a33781c8c4696a55c320909004a67a00fb286ba8b1bc496d"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-util",
- "h2 0.4.5",
- "http 1.1.0",
- "http-body 1.0.0",
- "httparse",
- "itoa 1.0.11",
+ "itoa 1.0.18",
  "pin-project-lite",
  "smallvec",
  "tokio",
@@ -1254,79 +1340,55 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.24.2"
+version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "futures-util",
- "http 0.2.12",
- "hyper 0.14.29",
+ "http 1.4.2",
+ "hyper",
+ "hyper-util",
  "log",
- "rustls 0.21.12",
+ "rustls",
  "rustls-native-certs",
  "tokio",
- "tokio-rustls 0.24.1",
-]
-
-[[package]]
-name = "hyper-tls"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
-dependencies = [
- "bytes",
- "hyper 0.14.29",
- "native-tls",
- "tokio",
- "tokio-native-tls",
-]
-
-[[package]]
-name = "hyper-tls"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
-dependencies = [
- "bytes",
- "http-body-util",
- "hyper 1.3.1",
- "hyper-util",
- "native-tls",
- "tokio",
- "tokio-native-tls",
+ "tokio-rustls",
  "tower-service",
 ]
 
 [[package]]
 name = "hyper-util"
-version = "0.1.5"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b875924a60b96e5d7b9ae7b066540b1dd1cbd90d1828f54c92e02a283351c56"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
+ "base64",
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.0",
- "hyper 1.3.1",
+ "http 1.4.2",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
  "pin-project-lite",
- "socket2",
+ "socket2 0.6.4",
  "tokio",
- "tower",
  "tower-service",
  "tracing",
 ]
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.60"
+version = "0.1.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
  "iana-time-zone-haiku",
  "js-sys",
+ "log",
  "wasm-bindgen",
  "windows-core",
 ]
@@ -1428,16 +1490,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
-[[package]]
-name = "idna"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -1461,9 +1513,9 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.25"
+version = "0.4.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3d782a365a015e0f5c04902246139249abf769125006fbe7649e2ee88169b4a"
+checksum = "b915661dd01db3f05050265b2477bcc6527b3792388e2749b41623cc592be67d"
 dependencies = [
  "crossbeam-deque",
  "globset",
@@ -1475,20 +1527,40 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "implicit-clone"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1689b939ee35e3a075b0834b5672efd43aec8a6e81a1c6002b76a5ca2f211ae0"
+dependencies = [
+ "implicit-clone-derive",
+ "indexmap 2.14.0",
+]
+
+[[package]]
+name = "implicit-clone-derive"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "699c1b6d335e63d0ba5c1e1c7f647371ce989c3bcbe1f7ed2b85fa56e3bd1a21"
+dependencies = [
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "include_dir"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18762faeff7122e89e0857b02f7ce6fcc0d101d5e9ad2ad7846cc01d61b7f19e"
+checksum = "923d117408f1e49d914f1a379a309cffe4f18c05cf4e3d12e613a15fc81bd0dd"
 dependencies = [
  "include_dir_macros",
 ]
 
 [[package]]
 name = "include_dir_macros"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b139284b5cf57ecfa712bcc66950bb635b31aff41c188e8a4cfc758eca374a3f"
+checksum = "7cab85a7ed0bd5f0e76d93846e0147172bed2e2d3f859bcc33a8d9699cad1a75"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1507,26 +1579,27 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.6"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.5",
+ "hashbrown 0.17.1",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "ipnet"
-version = "2.9.0"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "is_terminal_polyfill"
-version = "1.70.0"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
 [[package]]
 name = "itertools"
@@ -1545,24 +1618,99 @@ checksum = "b71991ff56294aa922b450139ee08b3bfc70982c6b2c7562771375cf73542dd4"
 
 [[package]]
 name = "itoa"
-version = "1.0.11"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jiff"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4603d3033e49e2b0e31229fcab20a5d40089c607d975cd9c80551dc69eed9102"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "782d32378dddf207193ac91cefb848ad41abb58195c95168e1291227a0832b47"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.117",
+]
 
 [[package]]
 name = "js-sys"
-version = "0.3.69"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
+checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
 dependencies = [
+ "cfg-if",
+ "futures-util",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "lazy_static"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "lazycell"
@@ -1572,26 +1720,19 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libredox"
-version = "0.1.3"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
 dependencies = [
- "bitflags 2.11.1",
  "libc",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
-
 [[package]]
 name = "litemap"
 version = "0.8.2"
@@ -1600,19 +1741,18 @@ checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
 [[package]]
 name = "lock_api"
-version = "0.4.12"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
 dependencies = [
- "autocfg",
  "scopeguard",
 ]
 
 [[package]]
 name = "log"
-version = "0.4.21"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
 
 [[package]]
 name = "lol_html"
@@ -1620,7 +1760,7 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4629ff9c2deeb7aad9b2d0f379fc41937a02f3b739f007732c46af40339dee5"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "cfg-if",
  "cssparser",
  "encoding_rs",
@@ -1630,7 +1770,7 @@ dependencies = [
  "memchr",
  "mime",
  "selectors",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -1641,9 +1781,9 @@ checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "memchr"
-version = "2.7.2"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
 
 [[package]]
 name = "mime"
@@ -1653,9 +1793,9 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "mime_guess"
-version = "2.0.4"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4192263c238a5f0d0c6bfd21f336a313a4ce1c450542449ca191bb657b4642ef"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
 dependencies = [
  "mime",
  "unicase",
@@ -1663,58 +1803,23 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.3"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87dfd01fe195c66b572b37921ad8803d010623c0aca821bea2302239d155cdae"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
- "adler",
+ "adler2",
+ "simd-adler32",
 ]
 
 [[package]]
 name = "mio"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
-dependencies = [
- "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "multer"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01acbdc23469fd8fe07ab135923371d5f5a422fbf9c522158677c8eb15bc51c2"
-dependencies = [
- "bytes",
- "encoding_rs",
- "futures-util",
- "http 0.2.12",
- "httparse",
- "log",
- "memchr",
- "mime",
- "spin",
- "version_check",
-]
-
-[[package]]
-name = "native-tls"
-version = "0.2.11"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
 dependencies = [
- "lazy_static",
  "libc",
- "log",
- "openssl",
- "openssl-probe",
- "openssl-sys",
- "schannel",
- "security-framework",
- "security-framework-sys",
- "tempfile",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1725,9 +1830,9 @@ checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
 
 [[package]]
 name = "num-conv"
-version = "0.1.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-format"
@@ -1736,7 +1841,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a652d9771a63711fd3c3deb670acfbe5c30a4072e664d7a3bf5a9e1056ac72c3"
 dependencies = [
  "arrayvec",
- "itoa 1.0.11",
+ "itoa 1.0.18",
 ]
 
 [[package]]
@@ -1750,40 +1855,36 @@ dependencies = [
 
 [[package]]
 name = "num_cpus"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
 dependencies = [
  "hermit-abi",
  "libc",
 ]
 
 [[package]]
-name = "object"
-version = "0.32.2"
+name = "once_cell"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
-dependencies = [
- "memchr",
-]
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
-name = "once_cell"
-version = "1.19.0"
+name = "once_cell_polyfill"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "openssl"
-version = "0.10.64"
+version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "cfg-if",
  "foreign-types",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -1796,29 +1897,29 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "openssl-probe"
-version = "0.1.5"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-src"
-version = "300.3.0+3.3.0"
+version = "300.6.1+3.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eba8804a1c5765b18c4b3f907e6897ebabeedebc9830e1a0046c4a4cf44663e1"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
 dependencies = [
  "cc",
 ]
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.102"
+version = "0.9.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
@@ -1835,9 +1936,9 @@ checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
 [[package]]
 name = "parking_lot"
-version = "0.12.3"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -1845,15 +1946,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.10"
+version = "0.9.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-targets 0.52.5",
+ "windows-link",
 ]
 
 [[package]]
@@ -1869,9 +1970,9 @@ dependencies = [
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.1"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
@@ -1903,7 +2004,7 @@ dependencies = [
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1972,41 +2073,61 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.1.5"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.5"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.14"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
-name = "pin-utils"
+name = "pinned"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+checksum = "a829027bd95e54cfe13e3e258a1ae7b645960553fb82b75ff852c29688ee595b"
+dependencies = [
+ "futures",
+ "rustversion",
+ "thiserror 1.0.69",
+]
 
 [[package]]
 name = "pkg-config"
-version = "0.3.30"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
 
 [[package]]
 name = "potential_utf"
@@ -2025,9 +2146,12 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.17"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
 
 [[package]]
 name = "precomputed-hash"
@@ -2035,6 +2159,16 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "privaxy"
 version = "0.7.1"
@@ -2042,7 +2176,8 @@ dependencies = [
  "adblock",
  "argon2",
  "async-compression",
- "base64 0.22.1",
+ "base64",
+ "bytes",
  "chrono",
  "crossbeam-channel",
  "dirs",
@@ -2050,30 +2185,36 @@ dependencies = [
  "filterlists-api",
  "futures",
  "futures-util",
+ "getrandom 0.3.4",
  "hex",
  "hmac",
- "http 0.2.12",
- "hyper 0.14.29",
+ "http 1.4.2",
+ "http-body-util",
+ "hyper",
  "hyper-rustls",
+ "hyper-util",
  "include_dir",
  "lazy_static",
+ "libc",
  "log",
  "lol_html",
  "mime_guess",
  "once_cell",
  "openssl",
  "regex",
- "reqwest 0.11.27",
- "rustls 0.21.12",
+ "reqwest",
+ "rustls",
  "serde",
  "serde-tuple-vec-map",
  "serde_json",
  "serde_with",
  "sha2",
+ "socket2 0.5.10",
  "tera",
- "thiserror",
+ "thiserror 2.0.18",
  "tokio",
- "tokio-rustls 0.24.1",
+ "tokio-rustls",
+ "tokio-stream",
  "tokio-util",
  "toml",
  "uluru",
@@ -2082,6 +2223,16 @@ dependencies = [
  "wildmatch",
 ]
 
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit",
+]
+
 [[package]]
 name = "proc-macro-error"
 version = "1.0.4"
@@ -2114,18 +2265,18 @@ checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.84"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec96c6a92621310b51366f1e28d05ef11489516e93be030060e5fc12024a49d6"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "psl"
-version = "2.1.40"
+version = "2.1.213"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c13bff377588788655a4707bed4c2c1a5ff8dc169617f616ca3d0fdd56100baf"
+checksum = "04e78830163eebdf905adb55ba26ba9b3ba554b08bd84c2fbe3b643c8addf22c"
 dependencies = [
  "psl-types",
 ]
@@ -2145,6 +2296,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "rand"
 version = "0.7.3"
@@ -2161,13 +2318,12 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
- "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -2182,12 +2338,12 @@ dependencies = [
 
 [[package]]
 name = "rand_chacha"
-version = "0.3.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -2205,12 +2361,21 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.15",
+ "getrandom 0.2.17",
 ]
 
 [[package]]
-name = "rand_hc"
-version = "0.2.0"
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
 dependencies = [
@@ -2228,40 +2393,60 @@ dependencies = [
 
 [[package]]
 name = "readonly"
-version = "0.2.12"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a25d631e41bfb5fdcde1d4e2215f62f7f0afa3ff11e26563765bd6ea1d229aeb"
+checksum = "f2a62d85ed81ca5305dc544bd42c8804c5060b78ffa5ad3c64b0fb6a8c13d062"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.1"
+version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.4.5"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
- "getrandom 0.2.15",
+ "getrandom 0.2.17",
  "libredox",
- "thiserror",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2282,9 +2467,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "reqwasm"
@@ -2292,109 +2477,61 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05b89870d729c501fa7a68c43bf4d938bbb3a8c156d333d90faa0e8b3e3212fb"
 dependencies = [
- "gloo-net",
+ "gloo-net 0.1.0",
 ]
 
 [[package]]
 name = "reqwest"
-version = "0.11.27"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
- "async-compression",
- "base64 0.21.7",
+ "base64",
  "bytes",
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2 0.3.26",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.29",
+ "h2",
+ "http 1.4.2",
+ "http-body",
+ "http-body-util",
+ "hyper",
  "hyper-rustls",
- "hyper-tls 0.5.0",
- "ipnet",
+ "hyper-util",
  "js-sys",
  "log",
  "mime",
- "native-tls",
- "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls 0.21.12",
- "rustls-pemfile 1.0.4",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
  "serde",
  "serde_json",
- "serde_urlencoded",
  "sync_wrapper",
- "system-configuration",
  "tokio",
- "tokio-native-tls",
- "tokio-rustls 0.24.1",
+ "tokio-rustls",
  "tokio-util",
+ "tower",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots",
- "winreg 0.50.0",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "encoding_rs",
- "futures-core",
- "futures-util",
- "h2 0.4.5",
- "http 1.1.0",
- "http-body 1.0.0",
- "http-body-util",
- "hyper 1.3.1",
- "hyper-tls 0.6.0",
- "hyper-util",
- "ipnet",
- "js-sys",
- "log",
- "mime",
- "native-tls",
- "once_cell",
- "percent-encoding",
- "pin-project-lite",
- "rustls-pemfile 2.1.2",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "system-configuration",
- "tokio",
- "tokio-native-tls",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "winreg 0.52.0",
 ]
 
 [[package]]
 name = "ring"
-version = "0.17.8"
+version = "0.17.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom 0.2.15",
+ "getrandom 0.2.17",
  "libc",
- "spin",
  "untrusted",
  "windows-sys 0.52.0",
 ]
@@ -2405,12 +2542,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "afab94fb28594581f62d981211a9a4d53cc8130bbcbbb89a0440d9b8e81a7746"
 
-[[package]]
-name = "rustc-demangle"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
-
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -2419,115 +2550,98 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustc_version"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
-dependencies = [
- "bitflags 2.11.1",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "rustls"
-version = "0.21.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
-dependencies = [
- "log",
- "ring",
- "rustls-webpki 0.101.7",
- "sct",
-]
-
 [[package]]
 name = "rustls"
-version = "0.22.4"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
  "log",
+ "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.102.4",
+ "rustls-webpki",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.6.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
  "openssl-probe",
- "rustls-pemfile 1.0.4",
+ "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
 
 [[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
+name = "rustls-pki-types"
+version = "1.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
 dependencies = [
- "base64 0.21.7",
+ "zeroize",
 ]
 
 [[package]]
-name = "rustls-pemfile"
-version = "2.1.2"
+name = "rustls-platform-verifier"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
- "base64 0.22.1",
- "rustls-pki-types",
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "rustls-pki-types"
-version = "1.7.0"
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "976295e77ce332211c0d24d92c0e83e50f5c5f046d11082cea19f3df13a3562d"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.101.7"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring",
+ "rustls-pki-types",
  "untrusted",
 ]
 
 [[package]]
-name = "rustls-webpki"
-version = "0.102.4"
+name = "rustversion"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff448f7e92e913c4b7d4c6d8e4540a1724b319b4152b8aef6d4cf8339712b33e"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.18"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "same-file"
@@ -2540,40 +2654,48 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.23"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "scoped-tls"
-version = "1.0.1"
+name = "schemars"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
 
 [[package]]
-name = "scoped-tls-hkt"
-version = "0.1.4"
+name = "schemars"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ddc765d3410d9f6c6ca071bf0b67f6b01e3ec4595dc3892f02677e75819dddc"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
 
 [[package]]
-name = "scopeguard"
-version = "1.2.0"
+name = "scoped-tls"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
 
 [[package]]
-name = "sct"
-version = "0.7.1"
+name = "scopeguard"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "seahash"
@@ -2583,11 +2705,11 @@ checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
 [[package]]
 name = "security-framework"
-version = "2.11.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -2596,9 +2718,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.11.0"
+version = "2.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "317936bbbd05227752583946b9e66d7ce3b489f84e11a94a510b4437fef407d7"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -2626,9 +2748,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.23"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "serde"
@@ -2651,11 +2773,10 @@ dependencies = [
 
 [[package]]
 name = "serde-wasm-bindgen"
-version = "0.3.1"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "618365e8e586c22123d692b72a7d791d5ee697817b65a218cdf12a98870af0f7"
+checksum = "8302e169f0eddcc139c70f139d19d6467353af16f9fce27e8c30158036a1e16b"
 dependencies = [
- "fnv",
  "js-sys",
  "serde",
  "wasm-bindgen",
@@ -2678,7 +2799,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2687,7 +2808,7 @@ version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
- "itoa 1.0.11",
+ "itoa 1.0.18",
  "memchr",
  "serde",
  "serde_core",
@@ -2696,11 +2817,11 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.6"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79e674e01f999af37c49f70a6ede167a8a60b2503e56c5599532a65baa5969a0"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2710,24 +2831,26 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
 dependencies = [
  "form_urlencoded",
- "itoa 1.0.11",
+ "itoa 1.0.18",
  "ryu",
  "serde",
 ]
 
 [[package]]
 name = "serde_with"
-version = "3.8.1"
+version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ad483d2ab0149d5a5ebcd9972a3852711e0153d863bf5a5d0391d28883c4a20"
+checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c"
 dependencies = [
- "base64 0.22.1",
+ "base64",
+ "bs58",
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.2.6",
- "serde",
- "serde_derive",
+ "indexmap 2.14.0",
+ "schemars 0.9.0",
+ "schemars 1.2.1",
+ "serde_core",
  "serde_json",
  "serde_with_macros",
  "time",
@@ -2735,14 +2858,14 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.8.1"
+version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65569b702f41443e8bc8bbb1c5779bd0450bbe723b56198980e80ec45780bce2"
+checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
 dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2768,24 +2891,53 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.10.8"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures",
  "digest",
 ]
 
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.2"
+version = "1.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
 dependencies = [
+ "errno",
  "libc",
 ]
 
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
 [[package]]
 name = "siphasher"
 version = "0.3.11"
@@ -2794,40 +2946,41 @@ checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
 
 [[package]]
 name = "slab"
-version = "0.4.9"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.13.2"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "socket2"
-version = "0.5.7"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
 ]
 
 [[package]]
-name = "spin"
-version = "0.9.8"
+name = "socket2"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
 
 [[package]]
 name = "stable_deref_trait"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "strsim"
@@ -2837,9 +2990,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "subtle"
-version = "2.5.0"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
@@ -2854,9 +3007,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.87"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2865,9 +3018,12 @@ dependencies = [
 
 [[package]]
 name = "sync_wrapper"
-version = "0.1.2"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
 
 [[package]]
 name = "synstructure"
@@ -2877,40 +3033,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
-]
-
-[[package]]
-name = "system-configuration"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
-dependencies = [
- "cfg-if",
- "fastrand",
- "rustix",
- "windows-sys 0.52.0",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2937,50 +3060,70 @@ checksum = "8eaa81235c7058867fa8c0e7314f33dcce9c215f535d1913822a2b3f5e289f3c"
 
 [[package]]
 name = "thiserror"
-version = "1.0.61"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
- "thiserror-impl",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.61"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.36"
+version = "0.3.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
- "itoa 1.0.11",
+ "itoa 1.0.18",
  "num-conv",
  "powerfmt",
- "serde",
+ "serde_core",
  "time-core",
  "time-macros",
 ]
 
 [[package]]
 name = "time-core"
-version = "0.1.2"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 
 [[package]]
 name = "time-macros"
-version = "0.2.18"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
 dependencies = [
  "num-conv",
  "time-core",
@@ -2998,9 +3141,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.6.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -3013,70 +3156,58 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.37.0"
+version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
- "backtrace",
  "bytes",
  "libc",
  "mio",
- "num_cpus",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.4",
  "tokio-macros",
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.2.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
-]
-
-[[package]]
-name = "tokio-native-tls"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
-dependencies = [
- "native-tls",
- "tokio",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.24.1"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.21.12",
+ "rustls",
  "tokio",
 ]
 
 [[package]]
-name = "tokio-rustls"
-version = "0.25.0"
+name = "tokio-stream"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
 dependencies = [
- "rustls 0.22.4",
- "rustls-pki-types",
+ "futures-core",
+ "pin-project-lite",
  "tokio",
 ]
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.21.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c83b561d025642014097b66e6c1bb422783339e0909e4429cde4749d1990bc38"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
 dependencies = [
  "futures-util",
  "log",
@@ -3086,98 +3217,172 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.11"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-io",
  "futures-sink",
  "futures-util",
- "hashbrown 0.14.5",
+ "hashbrown 0.15.5",
  "pin-project-lite",
  "slab",
  "tokio",
 ]
 
+[[package]]
+name = "tokise"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba44a1b36f42a95bd21b5e4acc1468547f75a73e7cf619312408d1f74c7fb687"
+dependencies = [
+ "futures",
+ "gloo",
+ "num_cpus",
+ "once_cell",
+ "pin-project",
+ "pinned",
+ "tokio",
+ "tokio-stream",
+ "wasm-bindgen-futures",
+]
+
 [[package]]
 name = "toml"
-version = "0.8.13"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4e43f8cc456c9704c851ae29c67e17ef65d2c30017c17a9765b89c382dc8bba"
+checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
 dependencies = [
- "serde",
+ "indexmap 2.14.0",
+ "serde_core",
  "serde_spanned",
- "toml_datetime",
- "toml_edit",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 1.0.3",
 ]
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.6"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4badfd56924ae69bcc9039335b2e017639ce3f9b001c393c1b2d1ef846ce2cbf"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.13"
+version = "0.19.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c127785850e8c20836d49732ae6abfa47616e60bf9d9f57c43c250361a9db96c"
+checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
 dependencies = [
- "indexmap 2.2.6",
- "serde",
- "serde_spanned",
- "toml_datetime",
- "winnow",
+ "indexmap 2.14.0",
+ "toml_datetime 0.6.11",
+ "winnow 0.5.40",
 ]
 
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow 1.0.3",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
+
 [[package]]
 name = "tower"
-version = "0.4.13"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
- "pin-project",
  "pin-project-lite",
+ "sync_wrapper",
  "tokio",
  "tower-layer",
  "tower-service",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "async-compression",
+ "bitflags 2.13.0",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http 1.4.2",
+ "http-body",
+ "http-body-util",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
 [[package]]
 name = "tower-layer"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
 
 [[package]]
 name = "tower-service"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.40"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "log",
  "pin-project-lite",
+ "tracing-attributes",
  "tracing-core",
 ]
 
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "tracing-core"
-version = "0.1.32"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
 ]
@@ -3190,28 +3395,25 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "tungstenite"
-version = "0.21.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
 dependencies = [
- "byteorder",
  "bytes",
  "data-encoding",
- "http 1.1.0",
+ "http 1.4.2",
  "httparse",
  "log",
- "rand 0.8.5",
+ "rand 0.9.4",
  "sha1",
- "thiserror",
- "url",
- "utf-8",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "typenum"
-version = "1.17.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "ucd-trie"
@@ -3230,39 +3432,21 @@ dependencies = [
 
 [[package]]
 name = "unicase"
-version = "2.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7d2d4dafb69621809a81864c9c1b864479e1235c0dd4e199924b9742439ed89"
-dependencies = [
- "version_check",
-]
-
-[[package]]
-name = "unicode-bidi"
-version = "0.3.15"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
-dependencies = [
- "tinyvec",
-]
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.13.2"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "untrusted"
@@ -3272,20 +3456,21 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.0"
+version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
 dependencies = [
  "form_urlencoded",
- "idna 0.5.0",
+ "idna",
  "percent-encoding",
+ "serde",
 ]
 
 [[package]]
-name = "utf-8"
-version = "0.7.6"
+name = "urlencoding"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
 [[package]]
 name = "utf8_iter"
@@ -3295,9 +3480,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "utf8parse"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "vcpkg"
@@ -3307,9 +3492,9 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
 [[package]]
 name = "version_check"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "walkdir"
@@ -3332,29 +3517,28 @@ dependencies = [
 
 [[package]]
 name = "warp"
-version = "0.3.7"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4378d202ff965b011c64817db11d5829506d3404edeadb61f190d111da3f231c"
+checksum = "c0a808122a8a77eecdabaefd88ddb1913c4be5ea1465399f63ba64c7aa705fea"
 dependencies = [
  "bytes",
- "futures-channel",
  "futures-util",
  "headers",
- "http 0.2.12",
- "hyper 0.14.29",
+ "http 1.4.2",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
  "log",
  "mime",
  "mime_guess",
- "multer",
  "percent-encoding",
  "pin-project",
- "rustls-pemfile 2.1.2",
  "scoped-tls",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "tokio",
- "tokio-rustls 0.25.0",
  "tokio-tungstenite",
  "tokio-util",
  "tower-service",
@@ -3369,54 +3553,49 @@ checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
-name = "wasm-bindgen"
-version = "0.2.92"
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
- "cfg-if",
- "serde",
- "serde_json",
- "wasm-bindgen-macro",
+ "wit-bindgen",
 ]
 
 [[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.92"
+name = "wasm-bindgen"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
 dependencies = [
- "bumpalo",
- "log",
+ "cfg-if",
  "once_cell",
- "proc-macro2",
- "quote",
- "syn 2.0.87",
+ "rustversion",
+ "serde",
+ "serde_json",
+ "wasm-bindgen-macro",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.42"
+version = "0.4.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76bc14366121efc8dbb487ab05bcc9d346b3b5ec0eaa76e46594cabbe51762c0"
+checksum = "503b14d284f2c8dac03b819967e155ea753f573586193b2b2c95990cb5d69280"
 dependencies = [
- "cfg-if",
  "js-sys",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.92"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3424,22 +3603,25 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.92"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
 dependencies = [
+ "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
- "wasm-bindgen-backend",
+ "syn 2.0.117",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.92"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
+dependencies = [
+ "unicode-ident",
+]
 
 [[package]]
 name = "wasm-logger"
@@ -3454,9 +3636,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-streams"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b65dc4c90b63b118468cf747d8bf3566c1913ef60be765b5730ead9e0a3ba129"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
 dependencies = [
  "futures-util",
  "js-sys",
@@ -3467,9 +3649,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.69"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
+checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3481,18 +3663,18 @@ version = "0.1.0"
 dependencies = [
  "filterlists-api",
  "futures",
- "gloo-timers",
- "gloo-utils",
+ "gloo-net 0.6.0",
+ "gloo-timers 0.4.0",
+ "gloo-utils 0.3.0",
  "log",
  "num-format",
  "readonly",
  "regex",
- "reqwasm",
  "serde",
  "serde-tuple-vec-map",
  "serde_json",
  "serde_with",
- "thiserror",
+ "thiserror 2.0.18",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
@@ -3503,16 +3685,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "webpki-roots"
-version = "0.25.4"
+name = "webpki-root-certs"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+dependencies = [
+ "rustls-pki-types",
+]
 
 [[package]]
 name = "wildmatch"
-version = "2.3.4"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3928939971918220fed093266b809d1ee4ec6c1a2d72692ff6876898f3b16c19"
+checksum = "29333c3ea1ba8b17211763463ff24ee84e41c78224c16b001cd907e663a38c68"
 
 [[package]]
 name = "winapi-util"
@@ -3520,185 +3705,170 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "windows-core"
-version = "0.52.0"
+version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
- "windows-targets 0.52.5",
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
 ]
 
 [[package]]
-name = "windows-sys"
-version = "0.48.0"
+name = "windows-implement"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
- "windows-targets 0.48.5",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
-name = "windows-sys"
-version = "0.52.0"
+name = "windows-interface"
+version = "0.59.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
- "windows-targets 0.52.5",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
-name = "windows-targets"
-version = "0.48.5"
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
+ "windows-link",
 ]
 
 [[package]]
-name = "windows-targets"
-version = "0.52.5"
+name = "windows-strings"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.5",
- "windows_aarch64_msvc 0.52.5",
- "windows_i686_gnu 0.52.5",
- "windows_i686_gnullvm",
- "windows_i686_msvc 0.52.5",
- "windows_x86_64_gnu 0.52.5",
- "windows_x86_64_gnullvm 0.52.5",
- "windows_x86_64_msvc 0.52.5",
+ "windows-link",
 ]
 
 [[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
+name = "windows-sys"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
 
 [[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.5"
+name = "windows-sys"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
 
 [[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
+name = "windows-targets"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
 
 [[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.5"
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
+name = "windows_aarch64_msvc"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.6.9"
+version = "0.5.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86c949fede1d13936a99f14fafd3e76fd642b556dd2ce96287fbe2e0151bfac6"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
-name = "winreg"
-version = "0.50.0"
+name = "winnow"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
-dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
-]
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
 
 [[package]]
-name = "winreg"
-version = "0.52.0"
+name = "wit-bindgen"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
-dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
-]
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
@@ -3708,17 +3878,23 @@ checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "yew"
-version = "0.19.3"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a1ccb53e57d3f7d847338cf5758befa811cabe207df07f543c06f502f9998cd"
+checksum = "2c154fadfa97eabdd3f3b79345ceeb9c05ee8f13f76d3d881d17fba618bf558d"
 dependencies = [
  "console_error_panic_hook",
+ "futures",
  "gloo",
- "gloo-utils",
- "indexmap 1.9.3",
+ "implicit-clone",
+ "indexmap 2.14.0",
  "js-sys",
- "scoped-tls-hkt",
+ "rustversion",
+ "serde",
  "slab",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokise",
+ "tracing",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
@@ -3727,32 +3903,31 @@ dependencies = [
 
 [[package]]
 name = "yew-macro"
-version = "0.19.3"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fab79082b556d768d6e21811869c761893f0450e1d550a67892b9bce303b7bb"
+checksum = "c08b883d84a035f57519d057f65a2a07ae25f1884ad485e1a9a523c9d880c1ad"
 dependencies = [
- "boolinator",
- "lazy_static",
+ "prettyplease",
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "rustversion",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "yew-router"
-version = "0.16.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "155804f6f3aa309f596d5c3fa14486a94e7756f1edd7634569949e401d5099f2"
+checksum = "870bd2a1aa6d608c0c789c122654e25f4927bb6bfe344cc0da3b630ac3c73260"
 dependencies = [
  "gloo",
- "gloo-utils",
  "js-sys",
  "route-recognizer",
  "serde",
- "serde-wasm-bindgen",
  "serde_urlencoded",
- "thiserror",
+ "tracing",
+ "urlencoding",
  "wasm-bindgen",
  "web-sys",
  "yew",
@@ -3761,20 +3936,20 @@ dependencies = [
 
 [[package]]
 name = "yew-router-macro"
-version = "0.16.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39049d193b52eaad4ffc80916bf08806d142c90b5edcebd527644de438a7e19a"
+checksum = "8399f1d134ab8e69abc7cded19f114621d520bd9c79c5a0f34091bf664d7325b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "yoke"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -3789,28 +3964,28 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.7.34"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae87e3fcd617500e5d106f0380cf7b77f3c6092aae37191433159dda23cfb087"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.34"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -3830,15 +4005,15 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
  "synstructure",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
 [[package]]
 name = "zerotrie"
@@ -3870,7 +4045,7 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.117",
 ]
 
 [[package]]
diff --git a/filterlists-api/Cargo.toml b/filterlists-api/Cargo.toml
index 597307d7..1d27720c 100644
--- a/filterlists-api/Cargo.toml
+++ b/filterlists-api/Cargo.toml
@@ -11,10 +11,13 @@ path = "src/lib.rs"
 readonly = "0.2.12"
 serde = { version = "1.0.203", features = ["derive"] }
 serde_json = "1.0.117"
-reqwest = { version = "0.12.4", features = ["json"], optional = true }
+reqwest = { version = "0.13", default-features = false, features = [
+    "json",
+    "rustls-no-provider",
+], optional = true }
 reqwasm = { version = "0.5.0", optional = true }
 async-trait = "0.1.80"
-thiserror = "1.0.61"
+thiserror = "2"
 
 [features]
 default = []
diff --git a/filterlists-api/src/dtypes.rs b/filterlists-api/src/dtypes.rs
index 56f3e19e..375208ef 100644
--- a/filterlists-api/src/dtypes.rs
+++ b/filterlists-api/src/dtypes.rs
@@ -210,7 +210,7 @@ pub struct FilterTag {
 }
 
 #[derive(Serialize, Deserialize, PartialEq, Clone, Debug, Error)]
-#[error("{r#type} error ({status}): {title} {trace_id}")]
+#[error("{type} error ({status}): {title} {trace_id}")]
 #[serde(rename_all = "camelCase")]
 #[readonly::make]
 pub struct FilterListAPIError {
diff --git a/filterlists-api/src/get.rs b/filterlists-api/src/get.rs
index 713edb21..3ac5cf1e 100644
--- a/filterlists-api/src/get.rs
+++ b/filterlists-api/src/get.rs
@@ -42,7 +42,6 @@ if_wasm! {
 }
 
 if_reqwest! {
-    use reqwest;
     use serde::de::DeserializeOwned;
 
     pub(crate) async fn _get<T>(url: &str) -> Result<T, FilterListError>
diff --git a/privaxy/Cargo.toml b/privaxy/Cargo.toml
index d183e25c..dc2a7a56 100644
--- a/privaxy/Cargo.toml
+++ b/privaxy/Cargo.toml
@@ -51,38 +51,69 @@ name = "privaxy"
 path = "src/server/lib.rs"
 
 [dependencies]
-hyper = { version = "0.14.29", features = ["full"] }
+hyper = { version = "1", features = ["full"] }
+hyper-util = { version = "0.1", features = [
+  "client-legacy",
+  "server-auto",
+  "server-graceful",
+  "service",
+  "tokio",
+  "http1",
+  "http2",
+] }
+http-body-util = "0.1"
 tokio = { version = "1.22.0", features = ["full"] }
 serde_json = "1.0.89"
-toml = "0.8.13"
+toml = "1"
 serde = { version = "1.0.148", features = ["derive"] }
 tokio-util = { version = "0.7.4", features = ["full"] }
+tokio-stream = "0.1"
+bytes = "1"
+socket2 = "0.5"
 adblock = { version = "0.12.5" }
 openssl = { version = "0.10.43", features = ["vendored"] }
 include_dir = "0.7.3"
 chrono = { version = "0.4.23", features = ["serde"] }
-rustls = { version = "0.21.12" }
+rustls = { version = "0.23", default-features = false, features = [
+  "ring",
+  "logging",
+  "std",
+  "tls12",
+] }
 futures-util = "0.3.25"
 wildmatch = "2.1.1"
-http = "0.2.12"
+http = "1"
 mime_guess = "2.0.4"
-tokio-rustls = "0.24.1"
-hyper-rustls = { version = "0.24.2", features = ["http1", "http2"] }
+tokio-rustls = { version = "0.26", default-features = false, features = [
+  "ring",
+  "logging",
+  "tls12",
+] }
+hyper-rustls = { version = "0.27", default-features = false, features = [
+  "http1",
+  "http2",
+  "ring",
+  "native-tokio",
+  "tls12",
+  "logging",
+] }
 log = "0.4.17"
-env_logger = "0.11.3"
-uluru = "3.0.0"
+env_logger = "0.11.10"
+uluru = "3.1.0"
 regex = "1.7.0"
 lazy_static = "1.4.0"
 lol_html = "1.2.1"
 crossbeam-channel = "0.5.6"
-thiserror = "1.0.37"
+thiserror = "2"
 url = "2.3.1"
 futures = "0.3.25"
-dirs = "5.0.1"
-async-compression = { version = "0.4.11", features = ["futures-io", "gzip"] }
-reqwest = { version = "0.11.27", features = [
+dirs = "6"
+async-compression = { version = "0.4.42", features = ["futures-io", "gzip"] }
+reqwest = { version = "0.13", default-features = false, features = [
+  "charset",
+  "http2",
   "stream",
-  "rustls-tls",
+  "rustls-no-provider",
   "gzip",
   "deflate",
   "json",
@@ -91,11 +122,22 @@ reqwest = { version = "0.11.27", features = [
 once_cell = "1.16.0"
 serde-tuple-vec-map = "1.0.1"
 base64 = "0.22.1"
-warp = { version = "0.3.7", features = ["tls"] }
+warp = { version = "0.4", features = ["server", "websocket"] }
 sha2 = "0.10.8"
 hex = "0.4.3"
-serde_with = "3.8.1"
-tera = { version = "1.20", default-features = false }
-argon2 = "0.5"
+serde_with = "3.21"
+tera = { version = "1", default-features = false }
+argon2 = { version = "0.5", features = ["std"] }
 hmac = "0.12"
-filterlists-api = { path = "../filterlists-api", features = ["reqwest"] }
\ No newline at end of file
+filterlists-api = { path = "../filterlists-api", features = ["reqwest"] }
+
+# getrandom 0.3 (pulled in via warp -> tokio-tungstenite -> rand) selects a
+# backend that calls the libc `getrandom()` wrapper on mips{,el}-unknown-linux-gnu,
+# but the MIPS cross-toolchain's pre-2.25 glibc doesn't export it, so the binary
+# fails to link. For just these targets we switch getrandom to its `custom`
+# backend (`.cargo/config.toml`) and implement it via the raw SYS_getrandom
+# syscall in `lib.rs`. These deps exist only to name `getrandom::Error` and call
+# `libc::syscall` from that backend.
+[target.'cfg(all(target_os = "linux", target_arch = "mips", target_env = "gnu"))'.dependencies]
+getrandom = "0.3"
+libc = "0.2"
\ No newline at end of file
diff --git a/privaxy/src/resources/error.html b/privaxy/src/resources/error.html
index e9201ebe..03e73090 100644
--- a/privaxy/src/resources/error.html
+++ b/privaxy/src/resources/error.html
@@ -13,6 +13,7 @@ <h1 class="text-4xl font-extrabold text-gray-900 tracking-tight sm:text-5xl">Bad
                             Reason:
                         <div class="font-mono bg-gray-100 rounded-md">#{request_error_reason}#</div>
                         </p>
+                        #{exclude_section}#
                     </div>
                 </div>
             </main>
diff --git a/privaxy/src/resources/head.html b/privaxy/src/resources/head.html
index be9f6179..36ba11db 100644
--- a/privaxy/src/resources/head.html
+++ b/privaxy/src/resources/head.html
@@ -609,6 +609,33 @@
             outline-style: solid;
         }
 
+        .mt-4 {
+            margin-top: 1rem;
+        }
+
+        .inline-block {
+            display: inline-block;
+        }
+
+        .py-2 {
+            padding-top: 0.5rem;
+            padding-bottom: 0.5rem;
+        }
+
+        .bg-blue-600 {
+            --tw-bg-opacity: 1;
+            background-color: rgb(37 99 235 / var(--tw-bg-opacity));
+        }
+
+        .text-white {
+            --tw-text-opacity: 1;
+            color: rgb(255 255 255 / var(--tw-text-opacity));
+        }
+
+        .font-medium {
+            font-weight: 500;
+        }
+
         @media (min-width: 640px) {
             .sm\:ml-6 {
                 margin-left: 1.5rem;
diff --git a/privaxy/src/server/blocker_utils.rs b/privaxy/src/server/blocker_utils.rs
index 283b4bb8..4fed9049 100644
--- a/privaxy/src/server/blocker_utils.rs
+++ b/privaxy/src/server/blocker_utils.rs
@@ -6,21 +6,24 @@ use once_cell::sync::Lazy;
 use regex::Regex;
 use serde::Deserialize;
 
+#[allow(dead_code)]
 static TOP_COMMENT_RE: Lazy<Regex> = Lazy::new(|| Regex::new(r#"^/\*[\S\s]+?\n\*/\s*"#).unwrap());
+#[allow(dead_code)]
 static NON_EMPTY_LINE_RE: Lazy<Regex> = Lazy::new(|| Regex::new(r#"\S"#).unwrap());
 
 /// Represents a single entry of the `Map` from uBlock Origin's `redirect-resources.js`.
 ///
 /// - `name` is the name of a resource, corresponding to its path in the `web_accessible_resources`
-/// directory
+///   directory
 ///
 /// - `alias` is a list of optional additional names that can be used to reference the resource
 ///
 /// - `data` is either `"text"` or `"blob"`, but is currently unused in `adblock-rust`. Within
-/// uBlock Origin, it's used to prevent text files from being encoded in base64 in a data URL.
+///   uBlock Origin, it's used to prevent text files from being encoded in base64 in a data URL.
 pub struct ResourceProperties {
     pub name: String,
     pub alias: Vec<String>,
+    #[allow(dead_code)]
     pub data: Option<String>,
 }
 use base64::{engine::general_purpose, Engine};
@@ -125,6 +128,7 @@ pub fn read_redirectable_resource_mapping(mapfile_data: &str) -> Vec<ResourcePro
 
 /// Reads data from a file in the form of uBlock Origin's `scriptlets.js` file and produces
 /// templatable scriptlets for use in cosmetic filtering.
+#[allow(dead_code)]
 pub fn read_template_resources(scriptlets_data: &str) -> Vec<Resource> {
     let mut resources = Vec::new();
 
diff --git a/privaxy/src/server/cert.rs b/privaxy/src/server/cert.rs
index fc8c2e87..0c83d58b 100644
--- a/privaxy/src/server/cert.rs
+++ b/privaxy/src/server/cert.rs
@@ -13,7 +13,8 @@ use openssl::{
         X509NameBuilder, X509Ref, X509Req, X509ReqBuilder, X509,
     },
 };
-use rustls::{Certificate, PrivateKey, ServerConfig};
+use rustls::pki_types::{CertificateDer, PrivateKeyDer};
+use rustls::ServerConfig;
 use std::time::{SystemTime, UNIX_EPOCH};
 use std::{str::FromStr, sync::Arc};
 use tokio::sync::Mutex;
@@ -38,17 +39,19 @@ impl SignedWithCaCert {
             Self::build_ca_signed_cert(&ca_certificate, &ca_private_key, &authority, &private_key);
 
         let certs = vec![
-            Certificate(x509.to_der().unwrap()),
-            Certificate(ca_certificate.to_der().unwrap()),
+            CertificateDer::from(x509.to_der().unwrap()),
+            CertificateDer::from(ca_certificate.to_der().unwrap()),
         ];
 
+        // rustls 0.23 folded the cipher-suite / kx-group / protocol-version
+        // selection into safe defaults on `ServerConfig::builder()`, so the
+        // explicit `with_safe_default_*` chain is gone. The crypto provider
+        // (ring) is installed once as the process default at startup.
+        let private_key =
+            PrivateKeyDer::try_from(private_key.private_key_to_der().unwrap()).unwrap();
         let server_configuration = ServerConfig::builder()
-            .with_safe_default_cipher_suites()
-            .with_safe_default_kx_groups()
-            .with_safe_default_protocol_versions()
-            .unwrap()
             .with_no_client_auth()
-            .with_single_cert(certs, PrivateKey(private_key.private_key_to_der().unwrap()))
+            .with_single_cert(certs, private_key)
             .unwrap();
 
         Self {
@@ -117,6 +120,7 @@ impl SignedWithCaCert {
             // patch NotValidBefore
             // try_into() coerces to the platform's time_t (i64 on 64-bit
             // targets, i32 on 32-bit MIPS glibc) instead of a hardcoded cast.
+            #[allow(clippy::useless_conversion)]
             Asn1Time::from_unix((since_epoch.as_secs() as i64 - 60).try_into().unwrap()).unwrap()
         };
         cert_builder.set_not_before(&not_before).unwrap();
@@ -238,3 +242,29 @@ impl CertCache {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use openssl::rsa::Rsa;
+
+    /// Building a leaf certificate signed by the CA and assembling its rustls
+    /// `ServerConfig` must succeed without panicking. Post-upgrade to rustls
+    /// 0.23 this also exercises that a `CryptoProvider` is installed before the
+    /// `ServerConfig` builder runs.
+    #[test]
+    fn builds_ca_signed_server_config() {
+        // rustls 0.23 requires a process-default CryptoProvider before any
+        // `ServerConfig::builder()`; production installs this once at startup.
+        let _ = rustls::crypto::ring::default_provider().install_default();
+
+        let (ca_certificate, ca_private_key) = crate::ca::make_ca_certificate();
+        let leaf_key = PKey::from_rsa(Rsa::generate(2048).unwrap()).unwrap();
+        let authority = Authority::from_static("example.com");
+
+        let signed =
+            SignedWithCaCert::new(authority.clone(), leaf_key, ca_certificate, ca_private_key);
+
+        assert_eq!(signed.authority, authority);
+    }
+}
diff --git a/privaxy/src/server/configuration/auth.rs b/privaxy/src/server/configuration/auth.rs
index 8dbf5579..a24c1b8a 100644
--- a/privaxy/src/server/configuration/auth.rs
+++ b/privaxy/src/server/configuration/auth.rs
@@ -4,7 +4,7 @@ use argon2::Argon2;
 use openssl::rand::rand_bytes;
 use serde::{Deserialize, Serialize};
 
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq, Default)]
 pub struct Auth {
     #[serde(default)]
     pub username: Option<String>,
@@ -16,17 +16,6 @@ pub struct Auth {
     pub session_signing_key: String,
 }
 
-impl Default for Auth {
-    fn default() -> Self {
-        Self {
-            username: None,
-            password_hash: None,
-            api_key: String::new(),
-            session_signing_key: String::new(),
-        }
-    }
-}
-
 impl Auth {
     pub fn new_initialized() -> Self {
         Self {
diff --git a/privaxy/src/server/configuration/filter.rs b/privaxy/src/server/configuration/filter.rs
index da51d152..62f0cf12 100644
--- a/privaxy/src/server/configuration/filter.rs
+++ b/privaxy/src/server/configuration/filter.rs
@@ -1,5 +1,6 @@
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
+use std::collections::BTreeSet;
 use std::env;
 use std::path::PathBuf;
 use tokio::fs;
@@ -18,17 +19,17 @@ pub enum FilterGroup {
     Social,
 }
 
-impl ToString for FilterGroup {
-    fn to_string(&self) -> String {
-        match self {
+impl std::fmt::Display for FilterGroup {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let name = match self {
             FilterGroup::Default => "default",
             FilterGroup::Regional => "regional",
             FilterGroup::Ads => "ads",
             FilterGroup::Privacy => "privacy",
             FilterGroup::Malware => "malware",
             FilterGroup::Social => "social",
-        }
-        .to_string()
+        };
+        write!(f, "{name}")
     }
 }
 
@@ -44,7 +45,7 @@ pub struct DefaultFilter {
 }
 
 #[serde_as]
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+#[derive(Clone, Deserialize, Serialize, PartialEq, Eq)]
 pub struct Filter {
     /// If the filter is enabled
     pub enabled: bool,
@@ -62,6 +63,12 @@ pub struct Filter {
 #[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
 pub struct DefaultFilters(Vec<DefaultFilter>);
 
+impl Default for DefaultFilters {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl DefaultFilters {
     pub fn new() -> Self {
         let mut filters = Vec::new();
@@ -78,6 +85,16 @@ impl DefaultFilters {
         self.0.clone()
     }
 
+    /// File names (derived from the URLs) of the filter lists shipped with
+    /// the package. Configuration entries matching one of these are built-in:
+    /// they can be enabled or disabled, but not edited or removed.
+    pub fn file_names(&self) -> BTreeSet<String> {
+        self.0
+            .iter()
+            .map(|filter| filter.file_name.clone())
+            .collect()
+    }
+
     fn parse_filter(
         url: &'static str,
         title: &'static str,
@@ -284,6 +301,34 @@ impl Filter {
     }
 }
 
+impl std::fmt::Display for Filter {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "Filter {{ enabled: {}, title: {}, group: {}, file_name: {}, url: {} }}",
+            self.enabled,
+            self.title,
+            self.group,
+            self.file_name,
+            self.url.as_str()
+        )
+    }
+}
+
+impl std::fmt::Debug for Filter {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "Filter {{ enabled: {}, title: {}, group: {}, file_name: {}, url: {} }}",
+            self.enabled,
+            self.title,
+            self.group,
+            self.file_name,
+            self.url.as_str()
+        )
+    }
+}
+
 impl From<DefaultFilter> for Filter {
     fn from(default_filter: DefaultFilter) -> Self {
         Self {
@@ -384,30 +429,36 @@ fn get_filter_directory() -> PathBuf {
         // Assume home directory
         Err(_) => PathBuf::from(FILTERS_DIRECTORY_NAME),
     };
-    return super::get_base_directory().unwrap().join(filter_dir);
+    super::get_base_directory().unwrap().join(filter_dir)
 }
 
 pub(crate) async fn get_filters_content(
     configuration: &mut super::Configuration,
     http_client: &reqwest::Client,
+    filter_failure_store: &super::FilterFailureStore,
 ) -> Vec<String> {
     let mut filters = Vec::new();
-    let mut futures = vec![];
 
-    for filter in configuration.get_enabled_filters() {
-        let future = filter.get_contents(http_client);
-        futures.push(future);
-    }
+    let futures = configuration.get_enabled_filters().map(|filter| {
+        let http_client = http_client.clone();
+        async move {
+            let result = filter.get_contents(&http_client).await;
+            (filter, result)
+        }
+    });
 
     let results = futures::future::join_all(futures).await;
-    for result in results {
+    for (filter, result) in results {
         match result {
             Ok(filter_content) => filters.push(filter_content),
             // A fetch failure here includes a filter whose URL has stopped serving a
-            // `text/plain` list (see `validate_filter_content_type`); we warn and drop it from
-            // the engine rather than aborting the whole rebuild.
+            // `text/plain` list (see `validate_filter_content_type`); we record it for the
+            // web UI and drop it from the engine rather than aborting the whole rebuild.
+            // No entry is cleared on success: a filter can load fine from its on-disk
+            // copy while its URL is still failing to update.
             Err(err) => {
-                log::warn!("Dropping filter that could not be loaded: {err:?}")
+                log::warn!("Dropping filter that could not be loaded: {err:?}");
+                filter_failure_store.record(filter, &err.to_string());
             }
         }
     }
@@ -418,3 +469,24 @@ pub(crate) async fn get_filters_content(
     filters.dedup();
     filters
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The `is_default` API check identifies built-in lists by file name, so
+    /// every default filter's file name must stay derived from its URL and
+    /// the set must not silently collapse through duplicates.
+    #[test]
+    fn default_filter_file_names_are_derived_from_urls() {
+        let defaults = DefaultFilters::new();
+        let list = defaults.list();
+        let file_names = defaults.file_names();
+
+        assert!(!list.is_empty());
+        assert_eq!(file_names.len(), list.len());
+        for filter in list {
+            assert_eq!(filter.file_name, calc_filter_filename(filter.url.as_str()));
+        }
+    }
+}
diff --git a/privaxy/src/server/configuration/filter_failures.rs b/privaxy/src/server/configuration/filter_failures.rs
new file mode 100644
index 00000000..919516b1
--- /dev/null
+++ b/privaxy/src/server/configuration/filter_failures.rs
@@ -0,0 +1,184 @@
+//! In-memory record of filter lists that failed to download or validate.
+//!
+//! Filter lists are refreshed in the background (periodically and on
+//! configuration changes), so a list whose URL went stale fails silently from
+//! the operator's point of view. The updater records those failures here; the
+//! web GUI surfaces them via `GET /api/filters/failures` so the operator can
+//! edit the entry's URL or remove it.
+
+use super::filter::{Filter, FilterGroup};
+use chrono::{DateTime, Utc};
+use serde::Serialize;
+use std::sync::{Arc, Mutex};
+
+/// A single failing filter list, most recent failure details included.
+#[derive(Debug, Clone, Serialize)]
+pub struct FilterFailureEntry {
+    /// Local file name of the filter; stable identifier tying the entry to
+    /// the configuration entry it describes.
+    pub file_name: String,
+    /// Title of the filter, for display.
+    pub title: String,
+    /// Remote URL the download failed for.
+    pub url: String,
+    /// Group of the filter.
+    pub group: FilterGroup,
+    /// The last download/validation error, verbatim.
+    pub last_error: String,
+    /// When the filter last failed to update (RFC 3339 via chrono's serde).
+    pub last_seen: DateTime<Utc>,
+    /// How many consecutive failed update attempts have been observed.
+    pub count: u64,
+}
+
+/// Cheaply-cloneable shared store of filter update failures. Lock scopes are
+/// short and never held across an await point. The store is inherently
+/// bounded: entries only exist for filters present in the configuration.
+#[derive(Debug, Clone, Default)]
+pub struct FilterFailureStore(Arc<Mutex<Vec<FilterFailureEntry>>>);
+
+impl FilterFailureStore {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Record a failed update attempt for `filter`, deduplicating by file
+    /// name: an already-failing filter is bumped to the front with its
+    /// counter incremented and failure details refreshed.
+    pub fn record(&self, filter: &Filter, error: &str) {
+        let mut entries = self.0.lock().unwrap();
+
+        let last_seen = Utc::now();
+        let count = match entries
+            .iter()
+            .position(|entry| entry.file_name == filter.file_name)
+        {
+            Some(index) => entries.remove(index).count + 1,
+            None => 1,
+        };
+
+        entries.insert(
+            0,
+            FilterFailureEntry {
+                file_name: filter.file_name.clone(),
+                title: filter.title.clone(),
+                url: filter.url.to_string(),
+                group: filter.group,
+                last_error: error.to_string(),
+                last_seen,
+                count,
+            },
+        );
+    }
+
+    /// Drop the entry for `file_name`, if any. Called after a successful
+    /// update and after the operator edits or removes the filter.
+    pub fn clear(&self, file_name: &str) {
+        self.0
+            .lock()
+            .unwrap()
+            .retain(|entry| entry.file_name != file_name);
+    }
+
+    /// Snapshot of the tracked failures, most recently failed first.
+    pub fn entries(&self) -> Vec<FilterFailureEntry> {
+        self.0.lock().unwrap().clone()
+    }
+
+    /// Reconcile the store with a freshly-applied configuration: drop entries
+    /// whose filter no longer exists or was disabled, and refresh the display
+    /// metadata of the ones that remain (a title or group edit keeps the same
+    /// file name).
+    pub fn sync_with_filters(&self, filters: &[Filter]) {
+        let mut entries = self.0.lock().unwrap();
+        entries.retain_mut(|entry| {
+            match filters
+                .iter()
+                .find(|filter| filter.enabled && filter.file_name == entry.file_name)
+            {
+                Some(filter) => {
+                    entry.title = filter.title.clone();
+                    entry.url = filter.url.to_string();
+                    entry.group = filter.group;
+                    true
+                }
+                None => false,
+            }
+        });
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use url::Url;
+
+    fn make_filter(file_name: &str, title: &str, enabled: bool) -> Filter {
+        Filter {
+            enabled,
+            title: title.to_string(),
+            group: FilterGroup::Ads,
+            file_name: file_name.to_string(),
+            url: Url::parse("https://example.com/list.txt").unwrap(),
+        }
+    }
+
+    #[test]
+    fn record_dedupes_by_file_name_and_bumps_count() {
+        let store = FilterFailureStore::new();
+        let filter = make_filter("abc.txt", "Some list", true);
+
+        store.record(&filter, "first error");
+        store.record(&filter, "second error");
+
+        let entries = store.entries();
+        assert_eq!(entries.len(), 1);
+        let entry = &entries[0];
+        assert_eq!(entry.file_name, "abc.txt");
+        assert_eq!(entry.count, 2);
+        assert_eq!(entry.last_error, "second error");
+    }
+
+    #[test]
+    fn record_moves_repeated_filter_to_front() {
+        let store = FilterFailureStore::new();
+        store.record(&make_filter("a.txt", "A", true), "error");
+        store.record(&make_filter("b.txt", "B", true), "error");
+        store.record(&make_filter("a.txt", "A", true), "error");
+
+        let file_names: Vec<String> = store
+            .entries()
+            .into_iter()
+            .map(|entry| entry.file_name)
+            .collect();
+        assert_eq!(file_names, vec!["a.txt", "b.txt"]);
+    }
+
+    #[test]
+    fn clear_drops_entry() {
+        let store = FilterFailureStore::new();
+        store.record(&make_filter("a.txt", "A", true), "error");
+
+        store.clear("a.txt");
+        assert!(store.entries().is_empty());
+    }
+
+    #[test]
+    fn sync_with_filters_prunes_removed_and_disabled_filters() {
+        let store = FilterFailureStore::new();
+        store.record(&make_filter("removed.txt", "Removed", true), "error");
+        store.record(&make_filter("disabled.txt", "Disabled", true), "error");
+        store.record(&make_filter("kept.txt", "Old title", true), "error");
+
+        store.sync_with_filters(&[
+            make_filter("disabled.txt", "Disabled", false),
+            make_filter("kept.txt", "New title", true),
+        ]);
+
+        let entries = store.entries();
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].file_name, "kept.txt");
+        // Metadata is refreshed from the configuration entry.
+        assert_eq!(entries[0].title, "New title");
+    }
+}
diff --git a/privaxy/src/server/configuration/mod.rs b/privaxy/src/server/configuration/mod.rs
index 99315ef0..123971fd 100644
--- a/privaxy/src/server/configuration/mod.rs
+++ b/privaxy/src/server/configuration/mod.rs
@@ -5,18 +5,21 @@ use tokio::fs;
 mod auth;
 mod ca;
 mod filter;
+mod filter_failures;
 mod network;
 mod updater;
 pub use auth::*;
 pub use ca::*;
 pub use filter::*;
-use futures::future::try_join_all;
+pub use filter_failures::*;
+use futures::future::join_all;
 pub use network::*;
 use std::env;
 use std::path::{Path, PathBuf};
 pub use updater::*;
 
 use crate::proxy::exclusions::recommended_exclusions;
+use crate::proxy::tls_failures::TlsFailureStore;
 pub(crate) type ConfigurationResult<T> = Result<T, ConfigurationError>;
 pub(crate) const FILTERS_UPDATE_AFTER: Duration = Duration::from_secs(60 * 60 * 24); // 24h
 
@@ -55,6 +58,11 @@ pub enum ConfigurationError {
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
 pub struct Configuration {
     pub exclusions: BTreeSet<String>,
+    /// Hosts the operator chose to hide from the TLS-failure report in the
+    /// web UI. Absent from configuration files written before this feature
+    /// existed, hence the serde default.
+    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
+    pub ignored_tls_failures: BTreeSet<String>,
     pub custom_filters: Vec<String>,
     pub ca: Ca,
     pub network: NetworkConfig,
@@ -210,8 +218,26 @@ impl Configuration {
 
         self.save().await?;
 
-        local_exclusion_store
-            .replace_exclusions(Vec::from_iter(self.exclusions.clone().into_iter()));
+        local_exclusion_store.replace_exclusions(Vec::from_iter(self.exclusions.clone()));
+
+        Ok(())
+    }
+
+    /// Persist `host` into the ignored TLS-failure list and update the
+    /// in-memory store immediately, so the report reflects the change without
+    /// a reload.
+    pub async fn ignore_tls_failure(
+        &mut self,
+        host: &str,
+        tls_failure_store: TlsFailureStore,
+    ) -> ConfigurationResult<()> {
+        let host = host.trim();
+
+        self.ignored_tls_failures.insert(host.to_string());
+
+        self.save().await?;
+
+        tls_failure_store.ignore(host);
 
         Ok(())
     }
@@ -238,23 +264,38 @@ impl Configuration {
         self.filters.iter_mut().filter(|f| f.enabled)
     }
 
+    /// Refresh every enabled filter from its URL. Per-filter failures are
+    /// expected here (remote lists go stale or move); they are recorded in
+    /// `filter_failure_store` for the web UI and logged, while the remaining
+    /// filters keep updating.
     pub async fn update_filters(
         &mut self,
         http_client: reqwest::Client,
-    ) -> ConfigurationResult<()> {
+        filter_failure_store: &FilterFailureStore,
+    ) {
         log::debug!("Updating filters");
 
-        let futures = self.filters.iter_mut().filter_map(|filter| {
-            if filter.enabled {
-                Some(filter.update(&http_client))
-            } else {
-                None
+        let futures = self
+            .filters
+            .iter_mut()
+            .filter(|filter| filter.enabled)
+            .map(|filter| {
+                let http_client = http_client.clone();
+                async move {
+                    let result = filter.update(&http_client).await;
+                    (filter, result)
+                }
+            });
+
+        for (filter, result) in join_all(futures).await {
+            match result {
+                Ok(_) => filter_failure_store.clear(&filter.file_name),
+                Err(err) => {
+                    log::error!("Failed to update filter '{}': {err}", filter.title);
+                    filter_failure_store.record(filter, &err.to_string());
+                }
             }
-        });
-
-        try_join_all(futures).await?;
-
-        Ok(())
+        }
     }
 
     pub async fn add_filter(
@@ -282,6 +323,30 @@ impl Configuration {
         }
     }
 
+    /// Replace the filter identified by `old_file_name` with `filter`,
+    /// keeping its enabled status. The replacement is validated the same way
+    /// an added filter is: its URL must serve a parseable filter list.
+    pub async fn replace_filter(
+        &mut self,
+        old_file_name: &str,
+        filter: &mut Filter,
+        http_client: &reqwest::Client,
+    ) -> ConfigurationResult<()> {
+        let index = self
+            .filters
+            .iter()
+            .position(|existing| existing.file_name == old_file_name)
+            .ok_or_else(|| {
+                ConfigurationError::FilterError(format!("no filter with file name {old_file_name}"))
+            })?;
+
+        filter.enabled = self.filters[index].enabled;
+        filter.update(http_client).await?;
+        self.filters[index] = filter.clone();
+
+        Ok(())
+    }
+
     pub async fn set_network_settings(
         &mut self,
         network_config: &NetworkConfig,
@@ -335,6 +400,7 @@ impl Configuration {
                 tls_cert_path: None,
                 tls_key_path: None,
                 listen_url: None,
+                gui_url: None,
                 pac_enabled: false,
                 pac_proxy_host: None,
                 pac_direct_ips: Vec::new(),
@@ -347,6 +413,7 @@ impl Configuration {
                     .iter()
                     .map(|entry| entry.to_string()),
             ),
+            ignored_tls_failures: BTreeSet::new(),
             custom_filters: Vec::new(),
             auth: Auth::new_initialized(),
             debug: DebugConfig::default(),
@@ -369,3 +436,71 @@ fn get_base_directory() -> ConfigurationResult<PathBuf> {
         false => Err(ConfigurationError::DirectoryNotFound),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A freshly generated default configuration must survive a
+    /// `to_string_pretty` -> `from_str` round-trip unchanged. This guards the
+    /// TOML (de)serialization behavior across the toml crate upgrade.
+    #[tokio::test]
+    async fn configuration_toml_round_trips() {
+        let configuration = Configuration::new_default()
+            .await
+            .expect("default configuration");
+
+        let serialized = toml::to_string_pretty(&configuration).expect("serialize");
+        let deserialized: Configuration = toml::from_str(&serialized).expect("deserialize");
+
+        assert_eq!(configuration, deserialized);
+    }
+
+    /// Configuration files written before the TLS-failure ignore list existed
+    /// carry no `ignored_tls_failures` key; they must keep parsing, yielding
+    /// an empty set (serde default). The empty set is also omitted on save so
+    /// untouched configurations stay byte-identical.
+    #[tokio::test]
+    async fn configuration_without_ignored_tls_failures_parses() {
+        let configuration = Configuration::new_default()
+            .await
+            .expect("default configuration");
+
+        let serialized = toml::to_string_pretty(&configuration).expect("serialize");
+        assert!(
+            !serialized.contains("ignored_tls_failures"),
+            "empty ignore set must be omitted from the serialized configuration"
+        );
+
+        let deserialized: Configuration = toml::from_str(&serialized).expect("deserialize");
+        assert!(deserialized.ignored_tls_failures.is_empty());
+    }
+
+    /// A populated ignore list survives a TOML round-trip unchanged.
+    #[tokio::test]
+    async fn configuration_round_trips_ignored_tls_failures() {
+        let mut configuration = Configuration::new_default()
+            .await
+            .expect("default configuration");
+        configuration.ignored_tls_failures = BTreeSet::from([
+            "pinned.example.com".to_string(),
+            "other.example.org".to_string(),
+        ]);
+
+        let serialized = toml::to_string_pretty(&configuration).expect("serialize");
+        let deserialized: Configuration = toml::from_str(&serialized).expect("deserialize");
+
+        assert_eq!(configuration, deserialized);
+    }
+
+    /// Blank lines and surrounding whitespace are stripped when turning the
+    /// textarea contents into the stored list.
+    #[test]
+    fn deserialize_lines_trims_and_drops_blanks() {
+        let parsed: Vec<String> = Configuration::deserialize_lines("  a \n\n b\n   \nc\n");
+        assert_eq!(
+            parsed,
+            vec!["a".to_string(), "b".to_string(), "c".to_string()]
+        );
+    }
+}
diff --git a/privaxy/src/server/configuration/network.rs b/privaxy/src/server/configuration/network.rs
index 41334e2c..72c31f02 100644
--- a/privaxy/src/server/configuration/network.rs
+++ b/privaxy/src/server/configuration/network.rs
@@ -48,6 +48,13 @@ pub struct NetworkConfig {
     /// URL to listen on. Only used when TLS is enabled.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub listen_url: Option<String>,
+    /// Full base URL of the web GUI as reachable by proxied clients
+    /// (e.g. `http://proxy.example.lan` when fronted by a reverse proxy).
+    /// Used verbatim for links back to the GUI on proxy error pages,
+    /// winning over `listen_url` and any bound/dialed address. Include a
+    /// port if the GUI is not on the URL scheme's default port.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub gui_url: Option<String>,
     /// Serve a proxy auto-config (PAC) file at `/proxy.pac`.
     #[serde(default)]
     pub pac_enabled: bool,
@@ -122,6 +129,8 @@ pub enum NetworkConfigError {
     WebPortError(String),
     #[error("port collision: {0}")]
     PortCollisionError(String),
+    #[error("GUI URL error: {0}")]
+    GuiUrlError(String),
     #[error("failed to read TLS certificate: {0}")]
     TlsCertError(String),
     #[error("failed to read TLS certificate key: {0}")]
@@ -159,6 +168,15 @@ impl NetworkConfig {
             )
             .into());
         };
+        if let Some(gui_url) = &self.gui_url {
+            let trimmed = gui_url.trim();
+            if !(trimmed.starts_with("http://") || trimmed.starts_with("https://")) {
+                return Err(NetworkConfigError::GuiUrlError(
+                    "GUI URL must start with http:// or https://".to_string(),
+                )
+                .into());
+            }
+        };
         Ok(())
     }
 
@@ -251,7 +269,7 @@ impl NetworkConfig {
             Ok(cert) => Ok(cert),
             Err(err) => {
                 log::error!("Failed to read TLS certificate: {err}");
-                return Err(err);
+                Err(err)
             }
         }
     }
@@ -298,7 +316,7 @@ impl NetworkConfig {
         };
 
         let renew_threshold = Asn1Time::days_from_now(30)?;
-        let needs_renewal = cert.not_after() <= &renew_threshold;
+        let needs_renewal = cert.not_after() <= renew_threshold;
         if !needs_renewal {
             return Ok(cert);
         }
@@ -382,6 +400,7 @@ fn build_ca_signed_cert(
         // patch NotValidBefore
         // try_into() coerces to the platform's time_t (i64 on 64-bit targets,
         // i32 on 32-bit MIPS glibc) instead of a hardcoded cast.
+        #[allow(clippy::useless_conversion)]
         Asn1Time::from_unix((since_epoch.as_secs() as i64 - 60).try_into().unwrap()).unwrap()
     };
     cert_builder.set_not_before(&not_before).unwrap();
@@ -405,7 +424,7 @@ fn build_ca_signed_cert(
         )
         .unwrap();
     let subject_alternative_name = SubjectAlternativeName::new()
-        .ip(bind_addr.as_str().into())
+        .ip(bind_addr.as_str())
         .build(&cert_builder.x509v3_context(Some(ca_cert), None))
         .unwrap();
 
diff --git a/privaxy/src/server/configuration/updater.rs b/privaxy/src/server/configuration/updater.rs
index a715dc9d..4d2428a9 100644
--- a/privaxy/src/server/configuration/updater.rs
+++ b/privaxy/src/server/configuration/updater.rs
@@ -1,3 +1,4 @@
+use super::FilterFailureStore;
 use crate::blocker::AdblockRequester;
 use futures::future::{AbortHandle, Abortable};
 
@@ -10,6 +11,7 @@ pub struct ConfigurationUpdater {
     pub tx: Sender<super::Configuration>,
     http_client: reqwest::Client,
     adblock_requester: AdblockRequester,
+    filter_failure_store: FilterFailureStore,
 }
 
 impl ConfigurationUpdater {
@@ -17,6 +19,7 @@ impl ConfigurationUpdater {
         configuration: super::Configuration,
         http_client: reqwest::Client,
         adblock_requester: AdblockRequester,
+        filter_failure_store: FilterFailureStore,
         tx_rx: Option<(
             sync::mpsc::Sender<super::Configuration>,
             sync::mpsc::Receiver<super::Configuration>,
@@ -31,6 +34,7 @@ impl ConfigurationUpdater {
 
         let http_client_clone = http_client.clone();
         let adblock_requester_clone = adblock_requester.clone();
+        let filter_failure_store_clone = filter_failure_store.clone();
 
         let filters_updater = Abortable::new(
             async move {
@@ -38,6 +42,7 @@ impl ConfigurationUpdater {
                     configuration,
                     adblock_requester_clone,
                     http_client_clone.clone(),
+                    filter_failure_store_clone,
                 )
                 .await
             },
@@ -52,10 +57,11 @@ impl ConfigurationUpdater {
             tx,
             http_client,
             adblock_requester,
+            filter_failure_store,
         }
     }
 
-    pub(crate) fn start(mut self: Self) {
+    pub(crate) fn start(mut self) {
         tokio::spawn(async move {
             loop {
                 let mut configuration = self.rx.recv().await.unwrap();
@@ -64,12 +70,22 @@ impl ConfigurationUpdater {
                 // clone and racing to replace the engine on its own timer.
                 self.filters_updater_abort_handle.abort();
 
-                let filters =
-                    super::filter::get_filters_content(&mut configuration, &self.http_client).await;
+                // Failure entries for filters that were removed or disabled
+                // by this configuration change are no longer actionable.
+                self.filter_failure_store
+                    .sync_with_filters(&configuration.filters);
+
+                let filters = super::filter::get_filters_content(
+                    &mut configuration,
+                    &self.http_client,
+                    &self.filter_failure_store,
+                )
+                .await;
                 self.adblock_requester.replace_engine(filters).await;
 
                 let adblock_requester_clone = self.adblock_requester.clone();
                 let http_client_clone = self.http_client.clone();
+                let filter_failure_store_clone = self.filter_failure_store.clone();
 
                 let (abort_handle, abort_registration) = AbortHandle::new_pair();
                 self.filters_updater_abort_handle = abort_handle;
@@ -80,6 +96,7 @@ impl ConfigurationUpdater {
                             configuration,
                             adblock_requester_clone,
                             http_client_clone,
+                            filter_failure_store_clone,
                         )
                         .await;
                     },
@@ -95,18 +112,23 @@ impl ConfigurationUpdater {
         mut configuration: super::Configuration,
         adblock_requester: AdblockRequester,
         http_client: reqwest::Client,
+        filter_failure_store: FilterFailureStore,
     ) {
         loop {
             tokio::time::sleep(super::FILTERS_UPDATE_AFTER).await;
 
-            if let Err(err) = configuration.update_filters(http_client.clone()).await {
-                log::error!("An error occured while trying to update filters: {:?}", err);
-            }
+            configuration
+                .update_filters(http_client.clone(), &filter_failure_store)
+                .await;
 
             // We don't bother diffing the filters as replacing the engine is very cheap and
             // filters are not updated often enough that the cost would matter.
-            let filters =
-                super::filter::get_filters_content(&mut configuration, &http_client).await;
+            let filters = super::filter::get_filters_content(
+                &mut configuration,
+                &http_client,
+                &filter_failure_store,
+            )
+            .await;
             adblock_requester.replace_engine(filters).await;
 
             log::info!("Updated filters");
diff --git a/privaxy/src/server/lib.rs b/privaxy/src/server/lib.rs
index 9a87fe86..91b1f353 100644
--- a/privaxy/src/server/lib.rs
+++ b/privaxy/src/server/lib.rs
@@ -1,14 +1,17 @@
 use crate::blocker::AdblockRequester;
-use crate::configuration::NetworkConfig;
+use crate::configuration::{FilterFailureStore, NetworkConfig};
 use crate::proxy::exclusions::LocalExclusionStore;
 use crate::web_gui::events::Event;
-use hyper::server::conn::AddrStream;
-use hyper::service::{make_service_fn, service_fn};
-use hyper::{Client, Server};
+use hyper::service::service_fn;
+use hyper_util::client::legacy::Client;
+use hyper_util::rt::{TokioExecutor, TokioIo};
+use hyper_util::server::conn::auto;
+use hyper_util::server::graceful::GracefulShutdown;
 use include_dir::{include_dir, Dir};
 use proxy::exclusions;
+use proxy::serve::UpgradeClient;
+use proxy::tls_failures::TlsFailureStore;
 use reqwest::redirect::Policy;
-use std::convert::Infallible;
 use std::env;
 use std::net::IpAddr;
 use std::net::SocketAddr;
@@ -16,6 +19,7 @@ use std::str::FromStr;
 use std::sync::Arc;
 use std::thread;
 use std::time::Duration;
+use tokio::net::TcpListener;
 use tokio::signal::unix::{signal, SignalKind};
 use tokio::sync::broadcast;
 use tokio::sync::Notify;
@@ -32,6 +36,53 @@ mod web_gui;
 
 pub const WEBAPP_FRONTEND_DIR: Dir<'_> = include_dir!("web_frontend/dist");
 
+/// Custom `getrandom` backend for the `mips{,el}-unknown-linux-gnu` cross
+/// targets.
+///
+/// getrandom 0.3's default Linux backend for these targets calls the libc
+/// `getrandom()` wrapper, which the cross-toolchain's pre-2.25 glibc does not
+/// export — so the binary fails to link (`undefined reference to getrandom`).
+/// We point getrandom at its `custom` backend for these triples (see
+/// `.cargo/config.toml`) and service it here with the raw `SYS_getrandom`
+/// syscall. The syscall is independent of the libc version, so the resulting
+/// binary still runs on the old-glibc routers we target; pre-3.17 kernels that
+/// lack the syscall fall back to `/dev/urandom`, matching getrandom 0.2's old
+/// behavior. musl MIPS and every non-MIPS target keep getrandom's stock
+/// backend and never reach this code.
+#[cfg(all(target_os = "linux", target_arch = "mips", target_env = "gnu"))]
+#[no_mangle]
+unsafe extern "Rust" fn __getrandom_v03_custom(
+    dest: *mut u8,
+    len: usize,
+) -> Result<(), getrandom::Error> {
+    let mut filled = 0usize;
+    while filled < len {
+        let ret = libc::syscall(libc::SYS_getrandom, dest.add(filled), len - filled, 0u32);
+        if ret < 0 {
+            match std::io::Error::last_os_error().raw_os_error() {
+                // Interrupted before any bytes were read; retry.
+                Some(libc::EINTR) => continue,
+                // Kernel predates getrandom(2) (pre-3.17): use /dev/urandom.
+                Some(libc::ENOSYS) => return urandom_fallback(dest, len),
+                _ => return Err(getrandom::Error::UNEXPECTED),
+            }
+        }
+        filled += ret as usize;
+    }
+    Ok(())
+}
+
+#[cfg(all(target_os = "linux", target_arch = "mips", target_env = "gnu"))]
+unsafe fn urandom_fallback(dest: *mut u8, len: usize) -> Result<(), getrandom::Error> {
+    use std::io::Read;
+
+    let buf = std::slice::from_raw_parts_mut(dest, len);
+    let mut file = std::fs::File::open("/dev/urandom").map_err(|_| getrandom::Error::UNEXPECTED)?;
+    file.read_exact(buf)
+        .map_err(|_| getrandom::Error::UNEXPECTED)?;
+    Ok(())
+}
+
 #[derive(Debug)]
 pub struct PrivaxyServer {
     pub ca_certificate_pem: String,
@@ -40,6 +91,8 @@ pub struct PrivaxyServer {
     pub blocking_disabled_store: blocker::BlockingDisabledStore,
     pub statistics: statistics::Statistics,
     pub local_exclusion_store: exclusions::LocalExclusionStore,
+    pub tls_failure_store: TlsFailureStore,
+    pub filter_failure_store: FilterFailureStore,
     // A Sender is required to subscribe to broadcasted messages
     pub requests_broadcast_sender: broadcast::Sender<Event>,
 }
@@ -79,6 +132,13 @@ async fn handle_signals() -> (Arc<Notify>, Arc<Notify>) {
 }
 
 pub async fn start_privaxy() -> PrivaxyServer {
+    // rustls 0.23 no longer bakes in a crypto provider: a process-wide default
+    // must be installed before any TLS config is built (the proxy's per-host
+    // certs, the upstream HTTPS connector, the reqwest client, and the web GUI
+    // TLS listener all rely on it). We pin the `ring` provider so the tier-3
+    // MIPS/musl cross builds keep working (aws-lc-rs needs a C toolchain).
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
     // Install the global logger first so every subsequent record is both
     // written to stderr and made available to the `/api/logs` stream. The
     // configured level is applied once the configuration is read below.
@@ -101,7 +161,6 @@ pub async fn start_privaxy() -> PrivaxyServer {
         // additionally fails fast on unreachable hosts.
         .connect_timeout(Duration::from_secs(10))
         .pool_idle_timeout(Duration::from_secs(30))
-        .tcp_keepalive(Duration::from_secs(60))
         // h2-heavy origins multiplex every subresource over a
         // single connection whose flow-control window defaults to a small,
         // shared 64 KB. When we drain one stream's body slowly (the browser
@@ -131,7 +190,7 @@ pub async fn start_privaxy() -> PrivaxyServer {
     log_handle.set_level(configuration.debug.log_level.to_level_filter());
 
     let local_exclusion_store =
-        LocalExclusionStore::new(Vec::from_iter(configuration.exclusions.clone().into_iter()));
+        LocalExclusionStore::new(Vec::from_iter(configuration.exclusions.clone()));
     let local_exclusion_store_clone = local_exclusion_store.clone();
 
     let ca_certificate = match configuration.ca.get_ca_certificate().await {
@@ -157,6 +216,12 @@ pub async fn start_privaxy() -> PrivaxyServer {
     let statistics = statistics::Statistics::new();
     let statistics_clone = statistics.clone();
 
+    let tls_failure_store = TlsFailureStore::new(configuration.ignored_tls_failures.clone());
+    let tls_failure_store_clone = tls_failure_store.clone();
+
+    let filter_failure_store = FilterFailureStore::new();
+    let filter_failure_store_clone = filter_failure_store.clone();
+
     let (broadcast_tx, _broadcast_rx) = broadcast::channel(32);
     let broadcast_tx_clone = broadcast_tx.clone();
 
@@ -173,6 +238,7 @@ pub async fn start_privaxy() -> PrivaxyServer {
         configuration.clone(),
         client.clone(),
         blocker_requester.clone(),
+        filter_failure_store.clone(),
         None,
     )
     .await;
@@ -188,6 +254,8 @@ pub async fn start_privaxy() -> PrivaxyServer {
 
     let block_disable_ref = blocking_disabled_store.clone();
     let local_exclusion_store_ref = local_exclusion_store.clone();
+    let tls_failure_store_ref = tls_failure_store.clone();
+    let filter_failure_store_ref = filter_failure_store.clone();
     let stats_clone = statistics.clone();
     let configuration_updater_tx_ref = configuration_updater_tx.clone();
     let configuration_save_lock_ref = configuration_save_lock.clone();
@@ -203,6 +271,8 @@ pub async fn start_privaxy() -> PrivaxyServer {
             privaxy_frontend(
                 broadcast_tx_ref.clone(),
                 local_exclusion_store_ref.clone(),
+                tls_failure_store_ref.clone(),
+                filter_failure_store_ref.clone(),
                 stats_clone.clone(),
                 block_disable_ref.clone(),
                 configuration_updater_tx_ref.clone(),
@@ -230,6 +300,7 @@ pub async fn start_privaxy() -> PrivaxyServer {
     tokio::spawn(async move {
         let notify_reload_backend = notify_reload_clone.clone();
         let cfg_lock_backend = configuration_save_lock_ref.clone();
+        let mut local_exclusion_store = local_exclusion_store;
         let mut rt_cert_cache =
             cert::CertCache::new(ca_certificate.clone(), ca_private_key.clone());
         let mut rt_ca_certificate = ca_certificate;
@@ -242,11 +313,19 @@ pub async fn start_privaxy() -> PrivaxyServer {
                 broadcast_tx.clone(),
                 statistics.clone(),
                 local_exclusion_store.clone(),
+                tls_failure_store.clone(),
                 cfg_lock_backend.clone(),
                 notify_reload_backend.clone(),
             )
             .await;
             let cfg = read_configuration(&cfg_lock_backend).await;
+            // The exclusion store is only otherwise mutated by the web UI
+            // route; without this refresh, exclusions edited in the
+            // configuration file never take effect on SIGHUP reload.
+            local_exclusion_store.replace_exclusions(Vec::from_iter(cfg.exclusions.clone()));
+            // Same for the TLS-failure ignore set: pick up hand-edited
+            // `ignored_tls_failures` entries on SIGHUP reload.
+            tls_failure_store.set_ignored(cfg.ignored_tls_failures.clone());
             let ca_cert = cfg.ca.get_ca_certificate().await.unwrap();
             let ca_key = cfg.ca.get_ca_private_key().await.unwrap();
             if !ca_key.public_eq(&rt_ca_certificate.public_key().unwrap()) {
@@ -262,13 +341,18 @@ pub async fn start_privaxy() -> PrivaxyServer {
         blocking_disabled_store: blocking_disabled_store_clone,
         statistics: statistics_clone,
         local_exclusion_store: local_exclusion_store_clone,
+        tls_failure_store: tls_failure_store_clone,
+        filter_failure_store: filter_failure_store_clone,
         requests_broadcast_sender: broadcast_tx_clone,
     }
 }
 
+#[allow(clippy::too_many_arguments)]
 async fn privaxy_frontend(
     broadcast_tx: tokio::sync::broadcast::Sender<Event>,
     local_exclusion_store: LocalExclusionStore,
+    tls_failure_store: TlsFailureStore,
+    filter_failure_store: FilterFailureStore,
     statistics: statistics::Statistics,
     block_disable_ref: blocker::BlockingDisabledStore,
     configuration_updater_tx: tokio::sync::mpsc::Sender<configuration::Configuration>,
@@ -283,10 +367,11 @@ async fn privaxy_frontend(
         &configuration_updater_tx,
         &configuration_save_lock,
         &local_exclusion_store,
+        &tls_failure_store,
+        &filter_failure_store,
         notify_reload.clone(),
         log_handle.clone(),
     );
-    let frontend_server = warp::serve(frontend);
     let config = read_configuration(&configuration_save_lock).await;
     let ip = env_or_config_ip(&config.network).await;
     let web_api_server_addr = SocketAddr::from((ip, config.network.web_port));
@@ -311,32 +396,135 @@ async fn privaxy_frontend(
                 panic!("Failed to read or create TLS key: {err}");
             }
         };
+        let server_config = web_tls_server_config(&tls_cert, &tls_key);
         tokio::spawn(async move {
-            let (_, task) = frontend_server
-                .tls()
-                .cert(tls_cert.to_pem().unwrap())
-                .key(tls_key.private_key_to_pem_pkcs8().unwrap())
-                .bind_with_graceful_shutdown(web_api_server_addr, async move {
+            serve_frontend(
+                frontend,
+                web_api_server_addr,
+                Some(server_config),
+                async move {
                     notify_reload.clone().notified().await;
-                });
-            log::info!("Web server available at https://{web_api_server_addr}/");
-            log::info!("API server available at https://{web_api_server_addr}/api");
-
-            task.await;
+                },
+            )
+            .await;
         });
     } else {
         tokio::spawn(async move {
-            let (_, task) =
-                frontend_server.bind_with_graceful_shutdown(web_api_server_addr, async move {
-                    let _ = notify_reload.clone().notified().await;
-                });
-            log::info!("Web server available at http://{web_api_server_addr}/");
-            log::info!("API server available at http://{web_api_server_addr}/api");
-            task.await
+            serve_frontend(frontend, web_api_server_addr, None, async move {
+                let _ = notify_reload.clone().notified().await;
+            })
+            .await;
         });
     }
 }
 
+/// Build a rustls `ServerConfig` for the web GUI from the OpenSSL-generated
+/// TLS leaf certificate and key. warp 0.4 dropped its built-in `.tls()`
+/// support, so the HTTPS web GUI now terminates TLS via `tokio-rustls` and is
+/// served through hyper-util (see `serve_frontend_tls`).
+fn web_tls_server_config(
+    cert: &openssl::x509::X509,
+    key: &openssl::pkey::PKeyRef<openssl::pkey::Private>,
+) -> rustls::ServerConfig {
+    use rustls::pki_types::{CertificateDer, PrivateKeyDer};
+
+    let certs = vec![CertificateDer::from(cert.to_der().unwrap())];
+    let key = PrivateKeyDer::try_from(key.private_key_to_der().unwrap()).unwrap();
+    rustls::ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(certs, key)
+        .expect("valid web GUI TLS certificate/key")
+}
+
+/// Serve the warp frontend filter, optionally over TLS. warp 0.4 dropped both
+/// its built-in `.tls()` support and the high-level graceful-shutdown server,
+/// so we accept connections ourselves, optionally terminate TLS with
+/// `tokio-rustls`, and drive each connection with hyper-util's auto builder
+/// (HTTP/1+2, with upgrade support so the WebSocket-based live feeds keep
+/// working).
+async fn serve_frontend<F, S>(
+    frontend: F,
+    addr: SocketAddr,
+    tls_config: Option<rustls::ServerConfig>,
+    shutdown: S,
+) where
+    F: warp::Filter + Clone + Send + Sync + 'static,
+    F::Extract: warp::reply::Reply,
+    S: std::future::Future<Output = ()> + Send + 'static,
+{
+    use tokio_rustls::TlsAcceptor;
+
+    let listener = match TcpListener::bind(addr).await {
+        Ok(listener) => listener,
+        Err(err) => {
+            log::error!("Unable to bind web GUI to {}: {}", addr, err);
+            return;
+        }
+    };
+    let scheme = if tls_config.is_some() {
+        "https"
+    } else {
+        "http"
+    };
+    log::info!("Web server available at {scheme}://{addr}/");
+    log::info!("API server available at {scheme}://{addr}/api");
+
+    let tls_acceptor = tls_config.map(|config| TlsAcceptor::from(Arc::new(config)));
+    let warp_service = warp::service(frontend);
+    let graceful = GracefulShutdown::new();
+
+    tokio::pin!(shutdown);
+
+    loop {
+        tokio::select! {
+            accepted = listener.accept() => {
+                let (stream, _peer) = match accepted {
+                    Ok(pair) => pair,
+                    Err(err) => {
+                        log::warn!("Failed to accept web GUI connection: {}", err);
+                        continue;
+                    }
+                };
+                let tls_acceptor = tls_acceptor.clone();
+                let hyper_service =
+                    hyper_util::service::TowerToHyperService::new(warp_service.clone());
+                let watcher = graceful.watcher();
+                tokio::spawn(async move {
+                    let builder = auto::Builder::new(TokioExecutor::new());
+                    match tls_acceptor {
+                        Some(tls_acceptor) => {
+                            let tls_stream = match tls_acceptor.accept(stream).await {
+                                Ok(tls_stream) => tls_stream,
+                                Err(err) => {
+                                    log::debug!("Web GUI TLS handshake failed: {}", err);
+                                    return;
+                                }
+                            };
+                            let connection = builder.serve_connection_with_upgrades(
+                                TokioIo::new(tls_stream),
+                                hyper_service,
+                            );
+                            let _ = watcher.watch(connection.into_owned()).await;
+                        }
+                        None => {
+                            let connection = builder.serve_connection_with_upgrades(
+                                TokioIo::new(stream),
+                                hyper_service,
+                            );
+                            let _ = watcher.watch(connection.into_owned()).await;
+                        }
+                    }
+                });
+            }
+            _ = &mut shutdown => {
+                break;
+            }
+        }
+    }
+
+    graceful.shutdown().await;
+}
+
 async fn read_configuration(
     configuration_save_lock: &Arc<tokio::sync::Mutex<()>>,
 ) -> configuration::Configuration {
@@ -354,6 +542,75 @@ async fn env_or_config_ip(network_config: &NetworkConfig) -> IpAddr {
     }
 }
 
+/// Bracket IPv6 addresses so they are usable as the host part of a URL.
+fn format_ip_host(ip: IpAddr) -> String {
+    match ip {
+        IpAddr::V4(ip) => ip.to_string(),
+        IpAddr::V6(ip) => format!("[{ip}]"),
+    }
+}
+
+/// Where the web GUI can be reached from a proxied client's point of view.
+/// Used to build links back to the GUI (e.g. the "Exclude this host" button on
+/// proxy error pages). When the GUI listens on an unspecified address and no
+/// FQDN is configured, the host is only known per connection — from the local
+/// address the client dialed — hence `base_url` taking it as a parameter.
+#[derive(Debug, Clone)]
+pub(crate) struct WebGuiUrl {
+    /// Operator-declared full base URL, used verbatim when set. This is the
+    /// only variant that can express a reverse-proxied GUI (different port,
+    /// or a host the server never sees, e.g. behind Docker NAT).
+    override_url: Option<String>,
+    scheme: &'static str,
+    configured_host: Option<String>,
+    web_port: u16,
+}
+
+impl WebGuiUrl {
+    async fn from_network_config(network: &NetworkConfig) -> Self {
+        let override_url = network
+            .gui_url
+            .as_ref()
+            .map(|url| url.trim().trim_end_matches('/').to_string())
+            .filter(|url| !url.is_empty());
+        let scheme = if network.tls { "https" } else { "http" };
+        let configured_host = match network.listen_url.clone() {
+            // An operator-declared FQDN wins over any bound address.
+            Some(listen_url) => Some(listen_url),
+            None => {
+                let ip = env_or_config_ip(network).await;
+                if ip.is_unspecified() {
+                    None
+                } else {
+                    Some(format_ip_host(ip))
+                }
+            }
+        };
+
+        Self {
+            override_url,
+            scheme,
+            configured_host,
+            web_port: network.web_port,
+        }
+    }
+
+    fn base_url(&self, dialed_ip: Option<IpAddr>) -> Option<String> {
+        if let Some(url) = &self.override_url {
+            return Some(url.clone());
+        }
+        let host = match &self.configured_host {
+            Some(host) => host.clone(),
+            None => format_ip_host(dialed_ip?),
+        };
+        let scheme = self.scheme;
+        let web_port = self.web_port;
+
+        Some(format!("{scheme}://{host}:{web_port}"))
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
 async fn privaxy_backend(
     client: reqwest::Client,
     cert_cache: cert::CertCache,
@@ -361,6 +618,7 @@ async fn privaxy_backend(
     broadcast_tx: broadcast::Sender<Event>,
     statistics: statistics::Statistics,
     local_exclusion_store: LocalExclusionStore,
+    tls_failure_store: TlsFailureStore,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
     notify_reload: Arc<tokio::sync::Notify>,
 ) {
@@ -368,18 +626,20 @@ async fn privaxy_backend(
     // connect timeout and OS-level keepalive, an upgrade can hang on a pooled
     // keep-alive connection the remote has silently dropped, surfacing as
     // "upgrade expected but not completed".
-    let mut http_connector = hyper::client::HttpConnector::new();
+    let mut http_connector = hyper_util::client::legacy::connect::HttpConnector::new();
     http_connector.enforce_http(false);
     http_connector.set_connect_timeout(Some(Duration::from_secs(10)));
     http_connector.set_keepalive(Some(Duration::from_secs(60)));
 
     let https_connector = hyper_rustls::HttpsConnectorBuilder::new()
         .with_native_roots()
+        .expect("failed to load native root certificates")
         .https_or_http()
         .enable_http1()
         .wrap_connector(http_connector);
     let config = read_configuration(&configuration_save_lock).await;
     let network_config = &config.network;
+    let web_gui_url = WebGuiUrl::from_network_config(network_config).await;
     let doh_config = network_config.doh.clone();
     // Read once per (re)start; the backend loop re-runs this on reload, so
     // toggling the setting in the UI takes effect after its notify_reload.
@@ -392,54 +652,161 @@ async fn privaxy_backend(
     // An upgraded connection is consumed by the tunnel anyway, so idle pooling
     // buys nothing and only risks reusing a stale connection under a long-lived
     // WebSocket — disable it.
-    let hyper_client = Client::builder()
+    let hyper_client: UpgradeClient = Client::builder(TokioExecutor::new())
         .pool_max_idle_per_host(0)
         .build(https_connector);
 
-    let make_service = make_service_fn(move |conn: &AddrStream| {
-        let client_ip_address = conn.remote_addr().ip();
-
-        let client = client.clone();
-        let hyper_client = hyper_client.clone();
-        let cert_cache = cert_cache.clone();
-        let blocker_requester = blocker_requester.clone();
-        let broadcast_tx = broadcast_tx.clone();
-        let statistics = statistics.clone();
-        let local_exclusion_store = local_exclusion_store.clone();
-        let doh_config = doh_config.clone();
-
-        async move {
-            Ok::<_, Infallible>(service_fn(move |req| {
-                proxy::serve_mitm_session(
-                    blocker_requester.clone(),
-                    hyper_client.clone(),
-                    client.clone(),
-                    req,
-                    cert_cache.clone(),
-                    broadcast_tx.clone(),
-                    statistics.clone(),
-                    client_ip_address,
-                    local_exclusion_store.clone(),
-                    doh_config.clone(),
-                    scriptlet_debug_logging,
-                )
-            }))
-        }
-    });
-
     let ip = env_or_config_ip(network_config).await;
     let proxy_server_addr = SocketAddr::from((ip, network_config.proxy_port));
 
-    let server = Server::bind(&proxy_server_addr)
-        .http1_preserve_header_case(true)
-        .http1_title_case_headers(true)
-        .tcp_keepalive(Some(Duration::from_secs(600)))
-        .serve(make_service)
-        .with_graceful_shutdown(async move {
-            log::info!("Proxy available at http://{}", proxy_server_addr);
-            let _ = notify_reload.clone().notified().await;
-            log::info!("Stopping Privaxy proxy");
-        });
+    // hyper 1.0 removed the high-level `Server`; we accept connections by hand
+    // and drive each one with hyper-util's auto (HTTP/1+2) builder. The old
+    // `Server::tcp_keepalive`/`http1_*` knobs are reproduced below.
+    let listener = match TcpListener::bind(proxy_server_addr).await {
+        Ok(listener) => listener,
+        Err(err) => {
+            log::error!("Unable to bind proxy to {}: {}", proxy_server_addr, err);
+            return;
+        }
+    };
+    log::info!("Proxy available at http://{}", proxy_server_addr);
+
+    let mut builder = auto::Builder::new(TokioExecutor::new());
+    builder
+        .http1()
+        .preserve_header_case(true)
+        .title_case_headers(true);
+    let graceful = GracefulShutdown::new();
+
+    let shutdown = async move {
+        let _ = notify_reload.clone().notified().await;
+        log::info!("Stopping Privaxy proxy");
+    };
+    tokio::pin!(shutdown);
+
+    loop {
+        tokio::select! {
+            accepted = listener.accept() => {
+                let (stream, peer_addr) = match accepted {
+                    Ok(pair) => pair,
+                    Err(err) => {
+                        log::warn!("Failed to accept proxy connection: {}", err);
+                        continue;
+                    }
+                };
+
+                // Reproduce the old `Server::tcp_keepalive(600s)`: enable
+                // OS-level keepalive on each accepted socket.
+                let _ = socket2::SockRef::from(&stream).set_tcp_keepalive(
+                    &socket2::TcpKeepalive::new().with_time(Duration::from_secs(600)),
+                );
+
+                let client_ip_address = peer_addr.ip();
+                let client = client.clone();
+                let hyper_client = hyper_client.clone();
+                let cert_cache = cert_cache.clone();
+                let blocker_requester = blocker_requester.clone();
+                let broadcast_tx = broadcast_tx.clone();
+                let statistics = statistics.clone();
+                let local_exclusion_store = local_exclusion_store.clone();
+                let tls_failure_store = tls_failure_store.clone();
+                let doh_config = doh_config.clone();
+                // The address the client dialed to reach the proxy is the best
+                // guess for a GUI host when none is configured; it must be read
+                // before the stream is consumed by the connection below.
+                let gui_base_url =
+                    web_gui_url.base_url(stream.local_addr().ok().map(|addr| addr.ip()));
+
+                let service = service_fn(move |req| {
+                    proxy::serve_mitm_session(
+                        blocker_requester.clone(),
+                        hyper_client.clone(),
+                        client.clone(),
+                        req,
+                        cert_cache.clone(),
+                        broadcast_tx.clone(),
+                        statistics.clone(),
+                        client_ip_address,
+                        local_exclusion_store.clone(),
+                        doh_config.clone(),
+                        scriptlet_debug_logging,
+                        tls_failure_store.clone(),
+                        gui_base_url.clone(),
+                    )
+                });
+
+                let connection = builder
+                    .serve_connection_with_upgrades(TokioIo::new(stream), service);
+                let watched = graceful.watch(connection.into_owned());
+                tokio::spawn(async move {
+                    let _ = watched.await;
+                });
+            }
+            _ = &mut shutdown => {
+                break;
+            }
+        }
+    }
+
+    graceful.shutdown().await;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn gui_url(configured_host: Option<&str>, tls: bool) -> WebGuiUrl {
+        WebGuiUrl {
+            override_url: None,
+            scheme: if tls { "https" } else { "http" },
+            configured_host: configured_host.map(str::to_string),
+            web_port: 8200,
+        }
+    }
+
+    #[test]
+    fn base_url_prefers_override_url_over_everything() {
+        let mut url = gui_url(Some("privaxy.lan"), false);
+        url.override_url = Some("http://proxy.lan".to_string());
+        assert_eq!(
+            url.base_url(Some("172.17.0.2".parse().unwrap())),
+            Some("http://proxy.lan".to_string())
+        );
+    }
+
+    #[test]
+    fn base_url_prefers_configured_host_over_dialed_ip() {
+        let url = gui_url(Some("privaxy.lan"), false);
+        assert_eq!(
+            url.base_url(Some("192.168.1.2".parse().unwrap())),
+            Some("http://privaxy.lan:8200".to_string())
+        );
+    }
 
-    let _ = server.await;
+    #[test]
+    fn base_url_falls_back_to_dialed_ip_and_brackets_ipv6() {
+        let url = gui_url(None, false);
+        assert_eq!(
+            url.base_url(Some("192.168.1.2".parse().unwrap())),
+            Some("http://192.168.1.2:8200".to_string())
+        );
+        assert_eq!(
+            url.base_url(Some("fd00::1".parse().unwrap())),
+            Some("http://[fd00::1]:8200".to_string())
+        );
+    }
+
+    #[test]
+    fn base_url_is_none_without_any_host() {
+        assert_eq!(gui_url(None, false).base_url(None), None);
+    }
+
+    #[test]
+    fn base_url_uses_https_scheme_when_tls_enabled() {
+        let url = gui_url(Some("privaxy.lan"), true);
+        assert_eq!(
+            url.base_url(None),
+            Some("https://privaxy.lan:8200".to_string())
+        );
+    }
 }
diff --git a/privaxy/src/server/logging.rs b/privaxy/src/server/logging.rs
index 877fda78..71564bf6 100644
--- a/privaxy/src/server/logging.rs
+++ b/privaxy/src/server/logging.rs
@@ -44,21 +44,17 @@ const DEPENDENCY_DEFAULT_LEVEL: LevelFilter = LevelFilter::Warn;
 /// from the web UI. Mirrors `log::LevelFilter` but owns its serialized form.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
 #[serde(rename_all = "lowercase")]
+#[derive(Default)]
 pub enum LogLevel {
     Off,
     Error,
     Warn,
+    #[default]
     Info,
     Debug,
     Trace,
 }
 
-impl Default for LogLevel {
-    fn default() -> Self {
-        Self::Info
-    }
-}
-
 impl LogLevel {
     pub fn to_level_filter(self) -> LevelFilter {
         match self {
diff --git a/privaxy/src/server/proxy/exclusions.rs b/privaxy/src/server/proxy/exclusions.rs
index 3bbd39c7..f6e76717 100644
--- a/privaxy/src/server/proxy/exclusions.rs
+++ b/privaxy/src/server/proxy/exclusions.rs
@@ -32,53 +32,53 @@ impl WildMatchCollection {
 
 lazy_static! {
     static ref DEFAULT_EXCLUSIONS: WildMatchCollection = {
-        let mut exclusions = Vec::new();
-
         // Apple service exclusions, as defined in : https://support.apple.com/en-us/HT210060
         // > Apple services will fail any connection that uses
         // > HTTPS Interception (SSL Inspection). If the HTTPS traffic
         // > traverses a web proxy, disable HTTPS Interception for the hosts
         // > listed in this article.
-        exclusions.push(String::from("*.apple.com"));
-        exclusions.push(String::from("static.ips.apple.com"));
-        exclusions.push(String::from("*.push.apple.com"));
-        exclusions.push(String::from("setup.icloud.com"));
-        exclusions.push(String::from("*.business.apple.com"));
-        exclusions.push(String::from("*.school.apple.com"));
-        exclusions.push(String::from("upload.appleschoolcontent.com"));
-        exclusions.push(String::from("ws-ee-maidsvc.icloud.com"));
-        exclusions.push(String::from("itunes.com"));
-        exclusions.push(String::from("appldnld.apple.com.edgesuite.net"));
-        exclusions.push(String::from("*.itunes.apple.com"));
-        exclusions.push(String::from("updates-http.cdn-apple.com"));
-        exclusions.push(String::from("updates.cdn-apple.com"));
-        exclusions.push(String::from("*.apps.apple.com"));
-        exclusions.push(String::from("*.mzstatic.com"));
-        exclusions.push(String::from("*.appattest.apple.com"));
-        exclusions.push(String::from("doh.dns.apple.com"));
-        exclusions.push(String::from("appleid.cdn-apple.com"));
-        exclusions.push(String::from("*.apple-cloudkit.com"));
-        exclusions.push(String::from("*.apple-livephotoskit.com"));
-        exclusions.push(String::from("*.apzones.com"));
-        exclusions.push(String::from("*.cdn-apple.com"));
-        exclusions.push(String::from("*.gc.apple.com"));
-        exclusions.push(String::from("*.icloud.com"));
-        exclusions.push(String::from("*.icloud.com.cn"));
-        exclusions.push(String::from("*.icloud.apple.com"));
-        exclusions.push(String::from("*.icloud-content.com"));
-        exclusions.push(String::from("*.iwork.apple.com"));
-        exclusions.push(String::from("mask.icloud.com"));
-        exclusions.push(String::from("mask-h2.icloud.com"));
-        exclusions.push(String::from("mask-api.icloud.com"));
-        exclusions.push(String::from("devimages-cdn.apple.com"));
-        exclusions.push(String::from("download.developer.apple.com"));
+        let exclusions = vec![
+            String::from("*.apple.com"),
+            String::from("static.ips.apple.com"),
+            String::from("*.push.apple.com"),
+            String::from("setup.icloud.com"),
+            String::from("*.business.apple.com"),
+            String::from("*.school.apple.com"),
+            String::from("upload.appleschoolcontent.com"),
+            String::from("ws-ee-maidsvc.icloud.com"),
+            String::from("itunes.com"),
+            String::from("appldnld.apple.com.edgesuite.net"),
+            String::from("*.itunes.apple.com"),
+            String::from("updates-http.cdn-apple.com"),
+            String::from("updates.cdn-apple.com"),
+            String::from("*.apps.apple.com"),
+            String::from("*.mzstatic.com"),
+            String::from("*.appattest.apple.com"),
+            String::from("doh.dns.apple.com"),
+            String::from("appleid.cdn-apple.com"),
+            String::from("*.apple-cloudkit.com"),
+            String::from("*.apple-livephotoskit.com"),
+            String::from("*.apzones.com"),
+            String::from("*.cdn-apple.com"),
+            String::from("*.gc.apple.com"),
+            String::from("*.icloud.com"),
+            String::from("*.icloud.com.cn"),
+            String::from("*.icloud.apple.com"),
+            String::from("*.icloud-content.com"),
+            String::from("*.iwork.apple.com"),
+            String::from("mask.icloud.com"),
+            String::from("mask-h2.icloud.com"),
+            String::from("mask-api.icloud.com"),
+            String::from("devimages-cdn.apple.com"),
+            String::from("download.developer.apple.com"),
+        ];
 
         WildMatchCollection::new(exclusions)
     };
 }
 
 /// Hosts the maintainer has observed to use certificate pinning, HSTS preload
-/// + strict TLS, or otherwise break under MITM interception. Exposed to the
+/// plus strict TLS, or otherwise break under MITM interception. Exposed to the
 /// web UI via the "Reset to defaults" button so users can opt in by populating
 /// their own exclusions list. These are NOT applied automatically — see
 /// `DEFAULT_EXCLUSIONS` above for the always-on Apple safety net.
@@ -204,6 +204,21 @@ pub fn recommended_exclusions() -> &'static [&'static str] {
         "ctldl.windowsupdate.com",
         "crl.microsoft.com",
         "clientconfig.passport.net",
+        // RCS messaging via Google Jibe (Apple and Google Messages clients).
+        // The clients certificate-pin, and connections arrive with a
+        // parenthesized service selector in the CONNECT authority
+        // (`rbm.goog(smsft):443`) that the proxy strips before matching.
+        "rbm.goog",
+        "*.rbm.goog",
+        "telephony.goog",
+        "*.telephony.goog",
+        "jibe.google.com",
+        "*.jibe.google.com",
+        "jibemobile.com",
+        "*.jibemobile.com",
+        "messages.google.com",
+        "rcs.telephony.goog",
+        "*.rcs.telephony.goog",
         // Google client config (used by Chrome / browser cert pinning)
         "clients1.google.com",
         "clients2.google.com",
diff --git a/privaxy/src/server/proxy/html_rewriter.rs b/privaxy/src/server/proxy/html_rewriter.rs
index 70b33f24..551c6cea 100644
--- a/privaxy/src/server/proxy/html_rewriter.rs
+++ b/privaxy/src/server/proxy/html_rewriter.rs
@@ -1,6 +1,8 @@
+use super::BodySender;
 use crate::{blocker::AdblockRequester, statistics::Statistics};
+use bytes::Bytes;
 use crossbeam_channel::Receiver;
-use hyper::body::Bytes;
+use hyper::body::Frame;
 use lol_html::html_content::ContentType;
 use lol_html::{element, HtmlRewriter, Settings};
 use regex::Regex;
@@ -23,7 +25,7 @@ pub struct Rewriter {
     url: String,
     adblock_requester: AdblockRequester,
     receiver: Receiver<Bytes>,
-    body_sender: hyper::body::Sender,
+    body_sender: BodySender,
     statistics: Statistics,
     internal_body_channel: InternalBodyChannel,
     csp_nonce: String,
@@ -48,11 +50,12 @@ pub struct Rewriter {
 const PROCEDURAL_COSMETICS_SHIM: &str = include_str!("../../resources/procedural_cosmetics.js");
 
 impl Rewriter {
+    #[allow(clippy::too_many_arguments)]
     pub(crate) fn new(
         url: String,
         adblock_requester: AdblockRequester,
         receiver: Receiver<Bytes>,
-        body_sender: hyper::body::Sender,
+        body_sender: BodySender,
         statistics: Statistics,
         csp_nonce: String,
         injected_script: Option<String>,
@@ -251,13 +254,13 @@ impl Rewriter {
 
     async fn write_body(
         mut receiver: mpsc::UnboundedReceiver<(Bytes, Option<AdblockProperties>)>,
-        mut body_sender: hyper::body::Sender,
+        body_sender: BodySender,
         adblock_requester: AdblockRequester,
         statistics: Statistics,
         csp_nonce: String,
     ) {
         while let Some((bytes, adblock_properties)) = receiver.recv().await {
-            if let Err(_err) = body_sender.send_data(bytes).await {
+            if let Err(_err) = body_sender.send(Ok(Frame::data(bytes))).await {
                 break;
             }
             if let Some(adblock_properties) = adblock_properties {
@@ -312,7 +315,7 @@ impl Rewriter {
 
                 let bytes = Bytes::copy_from_slice(to_append_to_response.as_bytes());
 
-                if let Err(_err) = body_sender.send_data(bytes).await {
+                if let Err(_err) = body_sender.send(Ok(Frame::data(bytes))).await {
                     break;
                 }
             }
diff --git a/privaxy/src/server/proxy/mitm.rs b/privaxy/src/server/proxy/mitm.rs
index 0733e1c3..8e532ed5 100644
--- a/privaxy/src/server/proxy/mitm.rs
+++ b/privaxy/src/server/proxy/mitm.rs
@@ -1,14 +1,17 @@
-use super::{exclusions::LocalExclusionStore, serve::serve};
+use super::serve::UpgradeClient;
+use super::tls_failures::TlsFailureStore;
+use super::{empty_body, exclusions::LocalExclusionStore, serve::serve, ProxyBody};
 use crate::{
     blocker::AdblockRequester, cert::CertCache, configuration::DohConfig, statistics::Statistics,
     Event,
 };
 use http::uri::{Authority, Scheme};
-use hyper::{
-    client::HttpConnector, http, server::conn::Http, service::service_fn, upgrade::Upgraded, Body,
-    Method, Request, Response,
-};
-use hyper_rustls::HttpsConnector;
+use http::{Method, Request, Response};
+use hyper::body::Incoming;
+use hyper::service::service_fn;
+use hyper::upgrade::Upgraded;
+use hyper_util::rt::{TokioExecutor, TokioIo};
+use hyper_util::server::conn::auto;
 use std::{net::IpAddr, sync::Arc};
 use tokio::{
     io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt},
@@ -20,9 +23,9 @@ use tokio_rustls::TlsAcceptor;
 #[allow(clippy::too_many_arguments)]
 pub(crate) async fn serve_mitm_session(
     adblock_requester: AdblockRequester,
-    hyper_client: hyper::Client<HttpsConnector<HttpConnector>>,
+    hyper_client: UpgradeClient,
     client: reqwest::Client,
-    req: Request<Body>,
+    req: Request<Incoming>,
     cert_cache: CertCache,
     broadcast_tx: broadcast::Sender<Event>,
     statistics: Statistics,
@@ -30,11 +33,13 @@ pub(crate) async fn serve_mitm_session(
     local_exclusion_store: LocalExclusionStore,
     doh_config: DohConfig,
     scriptlet_debug_logging: bool,
-) -> Result<Response<Body>, hyper::Error> {
-    let authority = match req.uri().authority().cloned() {
+    tls_failure_store: TlsFailureStore,
+    gui_base_url: Option<String>,
+) -> Result<Response<ProxyBody>, hyper::Error> {
+    let raw_authority = match req.uri().authority().cloned() {
         Some(authority) => authority,
         None => {
-            let mut response = Response::new(Body::empty());
+            let mut response = Response::new(empty_body());
             *response.status_mut() = http::StatusCode::BAD_REQUEST;
 
             log::warn!("Received a request without proper authority, sending bad request");
@@ -43,6 +48,14 @@ pub(crate) async fn serve_mitm_session(
         }
     };
 
+    // Apple's RCS client tunnels to Google's Jibe backend with a service
+    // selector embedded in the CONNECT authority — `CONNECT rbm.goog(smsft):443`.
+    // The parenthetical is not part of the DNS name, so everything operational
+    // (cert minting, exclusion matching, tunneling, outbound requests) works on
+    // the sanitized authority; the raw one is kept for logging and for
+    // exclusion entries that match the literal client-sent host.
+    let authority = sanitize_authority(&raw_authority);
+
     if Method::CONNECT == req.method() {
         // Received an HTTP request like:
         // ```
@@ -53,30 +66,51 @@ pub(crate) async fn serve_mitm_session(
         //
         // When HTTP method is CONNECT we should return an empty body
         // then we can eventually upgrade the connection and talk a new protocol.
+        //
+        // Excluded hosts are blind-tunneled and never see our interception
+        // cert, so minting one would only delay the CONNECT response (cert
+        // signing is expensive on low-powered machines).
         let server_configuration =
-            Arc::new(cert_cache.get(authority.clone()).await.server_configuration);
+            if is_authority_excluded(&local_exclusion_store, &authority, &raw_authority) {
+                None
+            } else {
+                Some(Arc::new(
+                    cert_cache.get(authority.clone()).await.server_configuration,
+                ))
+            };
 
         tokio::task::spawn(async move {
             match hyper::upgrade::on(req).await {
-                Ok(mut upgraded) => {
-                    let is_host_blacklisted = local_exclusion_store.contains(authority.host());
+                Ok(upgraded) => {
+                    // hyper 1.0's `Upgraded` exposes hyper's own IO traits;
+                    // `TokioIo` bridges it to tokio's `AsyncRead`/`AsyncWrite`
+                    // (needed both for blind tunneling and the TLS acceptor).
+                    let mut upgraded = TokioIo::new(upgraded);
 
-                    if is_host_blacklisted {
-                        let _result = tunnel(&mut upgraded, &authority).await;
+                    let server_configuration = match server_configuration {
+                        Some(server_configuration) => server_configuration,
+                        None => {
+                            // Connect failures are logged inside `tunnel`;
+                            // errors surfaced while piping an established
+                            // tunnel are routine (resets, aborts) and stay
+                            // quiet.
+                            let _result = tunnel(&mut upgraded, &authority, &raw_authority).await;
 
-                        return;
-                    }
-
-                    let http = Http::new();
+                            return;
+                        }
+                    };
 
                     match TlsAcceptor::from(server_configuration)
                         .accept(upgraded)
                         .await
                     {
                         Ok(tls_stream) => {
-                            let _result = http
-                                .serve_connection(
-                                    tls_stream,
+                            // hyper 1.0 dropped the all-in-one `Http` server
+                            // type; `hyper-util`'s auto builder negotiates
+                            // HTTP/1 vs HTTP/2 and carries upgrade support.
+                            let _result = auto::Builder::new(TokioExecutor::new())
+                                .serve_connection_with_upgrades(
+                                    TokioIo::new(tls_stream),
                                     service_fn(move |req| {
                                         serve(
                                             adblock_requester.clone(),
@@ -90,10 +124,10 @@ pub(crate) async fn serve_mitm_session(
                                             client_ip_address,
                                             doh_config.clone(),
                                             scriptlet_debug_logging,
+                                            gui_base_url.clone(),
                                         )
                                     }),
                                 )
-                                .with_upgrades()
                                 .await;
                         }
                         // Couldn't perform the tls handshake, they may only support TLS features that we don't or
@@ -101,8 +135,28 @@ pub(crate) async fn serve_mitm_session(
                         // tunnel them instead of trying to perform MITM.
                         // No blocking will be able to be performed.
                         Err(error) => {
+                            // The client never completed a TLS session with
+                            // us, so it can never be shown an error page —
+                            // record the failure so the web GUI can surface
+                            // it instead.
+                            tls_failure_store.record(
+                                authority.host(),
+                                &error.to_string(),
+                                error.kind() == std::io::ErrorKind::UnexpectedEof,
+                            );
+                            // UnexpectedEof is the signature of a client that
+                            // saw our interception cert and hung up (pinning),
+                            // hence the exclusion hint. Other handshake
+                            // failures are surfaced too — a silent death here
+                            // makes broken hosts undiagnosable.
                             if error.kind() == std::io::ErrorKind::UnexpectedEof {
-                                log::warn!("Unable to perform handshake for host: {}. Consider excluding it from blocking. The service may not tolerate TLS interception.", authority);
+                                log::warn!("Unable to perform handshake for host: {}. Consider excluding it from blocking. The service may not tolerate TLS interception.", raw_authority);
+                            } else {
+                                log::warn!(
+                                    "TLS interception handshake failed for host {}: {}",
+                                    raw_authority,
+                                    error
+                                );
                             }
                         }
                     }
@@ -111,8 +165,8 @@ pub(crate) async fn serve_mitm_session(
             }
         });
 
-        Ok(Response::new(Body::empty()))
-    } else if local_exclusion_store.contains(authority.host())
+        Ok(Response::new(empty_body()))
+    } else if is_authority_excluded(&local_exclusion_store, &authority, &raw_authority)
         && req.headers().contains_key(http::header::UPGRADE)
     {
         // An excluded host performing a protocol upgrade over plain HTTP — e.g.
@@ -153,6 +207,7 @@ pub(crate) async fn serve_mitm_session(
             client_ip_address,
             doh_config,
             scriptlet_debug_logging,
+            gui_base_url,
         )
         .await
     }
@@ -187,9 +242,9 @@ fn is_opaque_upgrade(headers: &http::HeaderMap) -> bool {
 ///
 /// thank you, wechat, for making this necessary
 async fn tunnel_http_upgrade(
-    req: Request<Body>,
+    req: Request<Incoming>,
     authority: Authority,
-) -> Result<Response<Body>, hyper::Error> {
+) -> Result<Response<ProxyBody>, hyper::Error> {
     // Build the origin-form request head before `req` is moved into the task.
     let path = req
         .uri()
@@ -218,7 +273,7 @@ async fn tunnel_http_upgrade(
         }
     });
 
-    let mut response = Response::new(Body::empty());
+    let mut response = Response::new(empty_body());
     *response.status_mut() = http::StatusCode::SWITCHING_PROTOCOLS;
     response.headers_mut().insert(
         http::header::CONNECTION,
@@ -235,7 +290,7 @@ async fn tunnel_http_upgrade(
 /// Upstream half of `tunnel_http_upgrade`: wait for the client upgrade, connect
 /// to the origin, replay the request head, strip the origin's `101`, then pipe.
 async fn bridge_http_upgrade(
-    req: Request<Body>,
+    req: Request<Incoming>,
     head: String,
     authority: &Authority,
 ) -> std::io::Result<()> {
@@ -243,9 +298,11 @@ async fn bridge_http_upgrade(
     // Proxied `http://` authorities carry no port; default to 80.
     let port = authority.port_u16().unwrap_or(80);
 
-    let mut client = hyper::upgrade::on(req)
+    let upgraded = hyper::upgrade::on(req)
         .await
-        .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?;
+        .map_err(std::io::Error::other)?;
+    // `TokioIo` bridges hyper 1.0's `Upgraded` to tokio's IO traits.
+    let mut client = TokioIo::new(upgraded);
     let mut upstream = TcpStream::connect((host, port)).await?;
     upstream.write_all(head.as_bytes()).await?;
 
@@ -284,12 +341,101 @@ async fn read_past_response_headers(stream: &mut TcpStream) -> std::io::Result<V
     }
 }
 
-async fn tunnel(upgraded: &mut Upgraded, authority: &Authority) -> std::io::Result<()> {
-    let mut server = TcpStream::connect(authority.to_string()).await?;
+/// Blind-tunnel an excluded CONNECT host: dial the (sanitized) authority and
+/// pipe bytes both ways. DNS resolution and TCP connect failures are logged at
+/// warn level — the client only ever sees its tunnel close, so without a log
+/// line these failures are invisible.
+async fn tunnel(
+    upgraded: &mut TokioIo<Upgraded>,
+    authority: &Authority,
+    raw_authority: &Authority,
+) -> std::io::Result<()> {
+    let mut server = match TcpStream::connect(authority.to_string()).await {
+        Ok(server) => server,
+        Err(error) => {
+            if authority == raw_authority {
+                log::warn!("Unable to open tunnel to {}: {}", authority, error);
+            } else {
+                log::warn!(
+                    "Unable to open tunnel to {} (client requested {}): {}",
+                    authority,
+                    raw_authority,
+                    error
+                );
+            }
+            return Err(error);
+        }
+    };
 
     log::debug!("Started tunneling host: {}", authority);
 
-    pipe(upgraded, &mut server).await
+    // Byte counts and lifetime make tunnel health diagnosable from logs: a
+    // tunnel that closes quickly having received 0 bytes from upstream means
+    // the server (or client) rejected the conversation, which is otherwise
+    // indistinguishable from a working tunnel.
+    let started_at = std::time::Instant::now();
+    match tokio::io::copy_bidirectional(upgraded, &mut server).await {
+        Ok((bytes_to_server, bytes_to_client)) => {
+            log::debug!(
+                "Tunnel to {} closed after {:?}: {} bytes sent, {} bytes received",
+                authority,
+                started_at.elapsed(),
+                bytes_to_server,
+                bytes_to_client
+            );
+            Ok(())
+        }
+        Err(error) => {
+            log::debug!(
+                "Tunnel to {} ended with error after {:?}: {}",
+                authority,
+                started_at.elapsed(),
+                error
+            );
+            Err(error)
+        }
+    }
+}
+
+/// Strip a trailing parenthesized service selector from an authority's host.
+///
+/// Apple's RCS client tunnels to Google's Jibe backend using CONNECT
+/// authorities like `rbm.goog(smsft):443` (also seen on other Google RCS
+/// hosts, e.g. under `telephony.goog`). The parenthetical selects a service
+/// but is not part of the DNS name, so resolving or dialing the authority
+/// verbatim fails. Returns the authority with the selector removed, or the
+/// original authority when there is no trailing selector or stripping it
+/// would not leave a valid authority. Plain `host:port`, bracketed IPv6
+/// literals, and hosts with non-trailing parentheses pass through unchanged.
+fn sanitize_authority(authority: &Authority) -> Authority {
+    let host = authority.host();
+    if !host.ends_with(')') {
+        return authority.clone();
+    }
+    let stripped_host = match host.find('(') {
+        Some(open_paren) => &host[..open_paren],
+        None => return authority.clone(),
+    };
+    if stripped_host.is_empty() {
+        return authority.clone();
+    }
+    let candidate = match authority.port_u16() {
+        Some(port) => format!("{stripped_host}:{port}"),
+        None => stripped_host.to_string(),
+    };
+    candidate.parse().unwrap_or_else(|_| authority.clone())
+}
+
+/// An authority is excluded when its sanitized host matches the exclusion
+/// list, or — for authorities that carried a service selector — when the raw
+/// client-sent host matches a literal exclusion entry.
+fn is_authority_excluded(
+    exclusions: &LocalExclusionStore,
+    authority: &Authority,
+    raw_authority: &Authority,
+) -> bool {
+    exclusions.contains(authority.host())
+        || (raw_authority.host() != authority.host() && exclusions.contains(raw_authority.host()))
 }
 
 /// Pipe two duplex streams in both directions until either side closes.
@@ -301,3 +447,106 @@ where
     tokio::io::copy_bidirectional(a, b).await?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn upgrade_headers(value: &str) -> http::HeaderMap {
+        let mut map = http::HeaderMap::new();
+        map.insert(
+            http::header::UPGRADE,
+            http::HeaderValue::from_str(value).unwrap(),
+        );
+        map
+    }
+
+    #[test]
+    fn websocket_and_h2c_are_not_opaque() {
+        assert!(!is_opaque_upgrade(&upgrade_headers("websocket")));
+        assert!(!is_opaque_upgrade(&upgrade_headers("WebSocket")));
+        assert!(!is_opaque_upgrade(&upgrade_headers("h2c")));
+        // A bridgeable token among others still counts as non-opaque.
+        assert!(!is_opaque_upgrade(&upgrade_headers("foo, websocket")));
+    }
+
+    #[test]
+    fn unknown_protocols_are_opaque() {
+        // e.g. WeChat's MMTLS long-link.
+        assert!(is_opaque_upgrade(&upgrade_headers("mmtls")));
+        assert!(is_opaque_upgrade(&upgrade_headers("tls/1.2, foo")));
+    }
+
+    #[test]
+    fn absent_upgrade_header_is_not_opaque() {
+        assert!(!is_opaque_upgrade(&http::HeaderMap::new()));
+    }
+
+    fn authority(value: &str) -> Authority {
+        value.parse().unwrap()
+    }
+
+    #[test]
+    fn connect_authority_with_service_selector_parses_and_sanitizes() {
+        // Apple's RCS client sends e.g. `CONNECT rbm.goog(smsft):443` — the
+        // parenthetical must survive http's authority parsing (it does: parens
+        // are RFC 3986 sub-delims) and then be stripped by sanitization.
+        let raw = authority("rbm.goog(smsft):443");
+        assert_eq!(raw.host(), "rbm.goog(smsft)");
+        assert_eq!(raw.port_u16(), Some(443));
+
+        // `tunnel` dials `TcpStream::connect(authority.to_string())`, so this
+        // rendering is exactly the address the tunnel connects to.
+        assert_eq!(sanitize_authority(&raw).to_string(), "rbm.goog:443");
+    }
+
+    #[test]
+    fn sanitize_authority_strips_selector_generically() {
+        assert_eq!(
+            sanitize_authority(&authority("eu.telephony.goog(smsft):443")).to_string(),
+            "eu.telephony.goog:443"
+        );
+        // Portless authorities keep working.
+        assert_eq!(
+            sanitize_authority(&authority("rbm.goog(smsft)")).to_string(),
+            "rbm.goog"
+        );
+    }
+
+    #[test]
+    fn sanitize_authority_leaves_normal_authorities_untouched() {
+        for value in [
+            "example.com:443",
+            "example.com",
+            "127.0.0.1:8443",
+            "[::1]:443",
+            // A parenthetical that is not a trailing selector.
+            "weird(host).example.com:443",
+            // Unbalanced or empty variants stay as-is rather than guessing.
+            "rbm.goog):443",
+            "(smsft):443",
+        ] {
+            let raw = authority(value);
+            assert_eq!(sanitize_authority(&raw), raw, "{value}");
+        }
+    }
+
+    #[test]
+    fn exclusion_matching_tolerates_service_selector() {
+        let raw = authority("rbm.goog(smsft):443");
+        let sanitized = sanitize_authority(&raw);
+
+        let exact = LocalExclusionStore::new(vec![String::from("rbm.goog")]);
+        assert!(is_authority_excluded(&exact, &sanitized, &raw));
+
+        let wildcard = LocalExclusionStore::new(vec![String::from("*.goog")]);
+        assert!(is_authority_excluded(&wildcard, &sanitized, &raw));
+
+        // An entry matching the literal client-sent host keeps working.
+        let literal = LocalExclusionStore::new(vec![String::from("rbm.goog(smsft)")]);
+        assert!(is_authority_excluded(&literal, &sanitized, &raw));
+
+        let unrelated = LocalExclusionStore::new(vec![String::from("example.com")]);
+        assert!(!is_authority_excluded(&unrelated, &sanitized, &raw));
+    }
+}
diff --git a/privaxy/src/server/proxy/mod.rs b/privaxy/src/server/proxy/mod.rs
index 99e2ec32..09a60221 100644
--- a/privaxy/src/server/proxy/mod.rs
+++ b/privaxy/src/server/proxy/mod.rs
@@ -4,3 +4,51 @@ pub(crate) mod serve;
 pub(crate) use mitm::serve_mitm_session;
 pub(crate) mod exclusions;
 pub(crate) mod html_rewriter;
+pub(crate) mod tls_failures;
+
+use bytes::Bytes;
+use http_body_util::{combinators::BoxBody, BodyExt, Empty, Full, StreamBody};
+use hyper::body::Frame;
+use tokio_stream::wrappers::ReceiverStream;
+
+/// Response body type used throughout the proxy. hyper 1.0 removed the built-in
+/// `hyper::Body`, so we standardize on a boxed body of `Bytes` with an
+/// `io::Error` error type (the channel/stream bodies below can surface IO
+/// errors; the static bodies never do).
+pub(crate) type ProxyBody = BoxBody<Bytes, std::io::Error>;
+
+/// Sending half of a streaming response body. Replaces `hyper::body::Sender`
+/// (removed in hyper 1.0). Sending `Err` when the receiver has been dropped
+/// signals the producer to stop, matching the old `Sender::send_data`
+/// back-pressure/abort semantics. The bounded capacity preserves the
+/// back-pressure the old channel body provided.
+pub(crate) type BodySender = tokio::sync::mpsc::Sender<Result<Frame<Bytes>, std::io::Error>>;
+
+/// hyper 1.0 replacement for `hyper::Body::channel()`: returns a sender plus a
+/// streaming body fed by it.
+pub(crate) fn body_channel() -> (BodySender, ProxyBody) {
+    let (tx, rx) = tokio::sync::mpsc::channel::<Result<Frame<Bytes>, std::io::Error>>(32);
+    let body = StreamBody::new(ReceiverStream::new(rx)).boxed();
+    (tx, body)
+}
+
+/// An empty response body (replaces `hyper::Body::empty()`).
+pub(crate) fn empty_body() -> ProxyBody {
+    Empty::<Bytes>::new()
+        .map_err(|never| match never {})
+        .boxed()
+}
+
+/// A fully-buffered response body (replaces `hyper::Body::from(..)`).
+pub(crate) fn full_body<B: Into<Bytes>>(chunk: B) -> ProxyBody {
+    Full::new(chunk.into())
+        .map_err(|never| match never {})
+        .boxed()
+}
+
+/// Box an upstream `hyper::body::Incoming` into our `ProxyBody`, mapping
+/// hyper's body error onto `io::Error` (used when forwarding an upstream
+/// response through unchanged).
+pub(crate) fn boxed_incoming(incoming: hyper::body::Incoming) -> ProxyBody {
+    incoming.map_err(std::io::Error::other).boxed()
+}
diff --git a/privaxy/src/server/proxy/serve.rs b/privaxy/src/server/proxy/serve.rs
index 5ad3064e..42536c44 100644
--- a/privaxy/src/server/proxy/serve.rs
+++ b/privaxy/src/server/proxy/serve.rs
@@ -1,20 +1,38 @@
 use super::doh::{self, DohAction};
 use super::html_rewriter::Rewriter;
+use super::{body_channel, boxed_incoming, empty_body, full_body, BodySender, ProxyBody};
 use crate::blocker::AdblockRequester;
 use crate::configuration::DohConfig;
 use crate::statistics::Statistics;
 use crate::web_gui::events::Event;
 use adblock::blocker::BlockerResult;
 use base64::Engine;
+use bytes::Bytes;
+use futures::TryStreamExt;
 use http::uri::{Authority, Scheme};
-use http::{HeaderMap, HeaderValue, StatusCode, Uri};
-use hyper::body::Bytes;
-use hyper::client::HttpConnector;
-use hyper::{http, Body, Request, Response};
+use http::{HeaderMap, HeaderValue, Request, Response, StatusCode, Uri};
+use http_body_util::BodyStream;
+use hyper::body::{Frame, Incoming};
 use hyper_rustls::HttpsConnector;
+use hyper_util::client::legacy::connect::HttpConnector;
+use hyper_util::client::legacy::Client as HyperClient;
+use hyper_util::rt::TokioIo;
 use std::net::IpAddr;
 use tokio::sync::broadcast;
 
+/// Type of the hyper client used for upgrade tunneling (websockets, etc.).
+pub(crate) type UpgradeClient = HyperClient<HttpsConnector<HttpConnector>, ProxyBody>;
+
+/// Adapt an incoming request body into a `reqwest::Body`, preserving streaming
+/// (hyper 1.0 + reqwest 0.13 no longer share a body type, so we bridge via a
+/// `Bytes` stream). Trailer frames are dropped — proxied request bodies don't
+/// carry meaningful trailers.
+fn incoming_to_reqwest_body(incoming: Incoming) -> reqwest::Body {
+    let stream =
+        BodyStream::new(incoming).try_filter_map(|frame| async move { Ok(frame.into_data().ok()) });
+    reqwest::Body::wrap_stream(stream)
+}
+
 // Only *enforcing* CSP headers are augmented. Report-only headers
 // (`content-security-policy-report-only`) are deliberately left untouched:
 // they never block our injected script/style, so augmenting them buys nothing,
@@ -123,7 +141,7 @@ fn augment_csp_value(value: &str, nonce: &str) -> String {
     // that case our injected tag is already allowed by `'unsafe-inline'`,
     // and the nonce attribute on it is a harmless no-op, so we skip.
     fn needs_nonce(directive: &str) -> bool {
-        !(has_unsafe_inline(directive) && !has_nonce_or_hash(directive))
+        !has_unsafe_inline(directive) || has_nonce_or_hash(directive)
     }
     fn append_to(directives: &mut [String], name: &str, nonce_source: &str) {
         for d in directives.iter_mut() {
@@ -248,8 +266,8 @@ fn url_for_matching(uri: &Uri) -> String {
 #[allow(clippy::too_many_arguments)]
 pub(crate) async fn serve(
     adblock_requester: AdblockRequester,
-    request: Request<Body>,
-    hyper_client: hyper::Client<HttpsConnector<HttpConnector>>,
+    request: Request<Incoming>,
+    hyper_client: UpgradeClient,
     client: reqwest::Client,
     authority: Authority,
     scheme: Scheme,
@@ -258,7 +276,8 @@ pub(crate) async fn serve(
     client_ip_address: IpAddr,
     doh_config: DohConfig,
     scriptlet_debug_logging: bool,
-) -> Result<Response<Body>, hyper::Error> {
+    gui_base_url: Option<String>,
+) -> Result<Response<ProxyBody>, hyper::Error> {
     let scheme_string = scheme.to_string();
 
     let uri = match http::uri::Builder::new()
@@ -283,7 +302,7 @@ pub(crate) async fn serve(
     let (mut parts, body) = request.into_parts();
     parts.uri = uri.clone();
 
-    let (sender, new_body) = Body::channel();
+    let (sender, new_body) = body_channel();
 
     let req = Request::from_parts(parts, body);
 
@@ -403,14 +422,22 @@ pub(crate) async fn serve(
     let mut response = match client
         .request(req.method().clone(), outbound_url)
         .headers(request_headers)
-        .body(req.into_body())
+        .body(incoming_to_reqwest_body(req.into_body()))
         .send()
         .await
     {
         Ok(response) => response,
         Err(err) => {
-            log::error!("Failed to send request: {}", err.to_string());
-            return Ok(get_informative_error_response(&err.to_string()));
+            log::error!("Failed to send request: {}", err);
+            // `authority` was moved into the uri builder above; the host of
+            // the rebuilt `uri` is the same portless hostname.
+            let failing_host = uri.host();
+            let exclude_url = build_exclude_url(failing_host, gui_base_url.as_deref());
+            return Ok(get_informative_error_response(
+                &err.to_string(),
+                failing_host,
+                exclude_url.as_deref(),
+            ));
         }
     };
 
@@ -495,21 +522,87 @@ pub(crate) async fn serve(
     Ok(new_response)
 }
 
-fn get_informative_error_response(reason: &str) -> Response<Body> {
+/// Minimal HTML escaping for text interpolated into the proxy's error page.
+/// The failure reason comes from reqwest and can embed attacker-influenced
+/// URLs; the failing host is client-controlled.
+fn escape_html(s: &str) -> String {
+    let mut escaped = String::with_capacity(s.len());
+    for character in s.chars() {
+        match character {
+            '&' => escaped.push_str("&amp;"),
+            '<' => escaped.push_str("&lt;"),
+            '>' => escaped.push_str("&gt;"),
+            '"' => escaped.push_str("&quot;"),
+            '\'' => escaped.push_str("&#39;"),
+            _ => escaped.push(character),
+        }
+    }
+    escaped
+}
+
+/// The web GUI link that pre-fills the exclusion flow for the failing host,
+/// when both the host and a reachable GUI base URL are known. The host is
+/// percent-encoded into the `host` query parameter.
+fn build_exclude_url(failing_host: Option<&str>, gui_base_url: Option<&str>) -> Option<String> {
+    match (failing_host, gui_base_url) {
+        (Some(host), Some(base)) => Some(format!(
+            "{base}/exclude?host={}",
+            url::form_urlencoded::byte_serialize(host.as_bytes()).collect::<String>()
+        )),
+        _ => None,
+    }
+}
+
+/// Markup substituted for `#{exclude_section}#` in the error page: the failing
+/// host, plus an "Exclude this host" link when the GUI is reachable. Empty
+/// when the failing host is unknown.
+fn build_exclude_section(failing_host: Option<&str>, exclude_url: Option<&str>) -> String {
+    let host = match failing_host {
+        Some(host) => host,
+        None => return String::new(),
+    };
+
+    let mut section = format!(
+        "<p class=\"mt-1 text-base text-gray-500\">Failing host: \
+         <span class=\"font-mono bg-gray-100 rounded-md\">{}</span></p>",
+        escape_html(host)
+    );
+    if let Some(exclude_url) = exclude_url {
+        // `exclude_url` is percent-encoded by construction; escaping it again
+        // hardens the attribute against any future construction change.
+        section.push_str(&format!(
+            "<a href=\"{}\" class=\"mt-4 inline-block rounded-md bg-blue-600 px-4 py-2 \
+             text-white font-medium\">Exclude this host</a>",
+            escape_html(exclude_url)
+        ));
+    }
+
+    section
+}
+
+fn get_informative_error_response(
+    reason: &str,
+    failing_host: Option<&str>,
+    exclude_url: Option<&str>,
+) -> Response<ProxyBody> {
     let mut response_body = String::from(include_str!("../../resources/head.html"));
-    response_body +=
-        &include_str!("../../resources/error.html").replace("#{request_error_reason}#", reason);
+    response_body += &include_str!("../../resources/error.html")
+        .replace("#{request_error_reason}#", &escape_html(reason))
+        .replace(
+            "#{exclude_section}#",
+            &build_exclude_section(failing_host, exclude_url),
+        );
 
-    let mut response = Response::new(Body::from(response_body));
+    let mut response = Response::new(full_body(response_body));
     *response.status_mut() = http::StatusCode::BAD_GATEWAY;
 
     response
 }
 
-fn get_blocked_by_privaxy_response(blocker_result: BlockerResult) -> Response<Body> {
+fn get_blocked_by_privaxy_response(blocker_result: BlockerResult) -> Response<ProxyBody> {
     // We don't redirect to network urls due to security concerns.
     if let Some(resource) = blocker_result.redirect {
-        let response = Response::new(Body::from(resource));
+        let response = Response::new(full_body(resource));
 
         return response;
     }
@@ -523,23 +616,23 @@ fn get_blocked_by_privaxy_response(blocker_result: BlockerResult) -> Response<Bo
     response_body += &include_str!("../../resources/blocked_by_privaxy.html")
         .replace("#{matching_filter}#", &filter_information);
 
-    let mut response = Response::new(Body::from(response_body));
+    let mut response = Response::new(full_body(response_body));
     *response.status_mut() = http::StatusCode::FORBIDDEN;
 
     response
 }
 
-fn get_empty_response(status_code: http::StatusCode) -> Response<Body> {
-    let mut response = Response::new(Body::empty());
+fn get_empty_response(status_code: http::StatusCode) -> Response<ProxyBody> {
+    let mut response = Response::new(empty_body());
     *response.status_mut() = status_code;
 
     response
 }
 
-async fn write_proxied_body(mut response: reqwest::Response, mut sender: hyper::body::Sender) {
+async fn write_proxied_body(mut response: reqwest::Response, sender: BodySender) {
     while let Ok(Some(chunk)) = response.chunk().await {
         // The other end is broken, let's abort immediately.
-        if let Err(_err) = sender.send_data(chunk).await {
+        if let Err(_err) = sender.send(Ok(Frame::data(chunk))).await {
             break;
         }
     }
@@ -548,23 +641,26 @@ async fn write_proxied_body(mut response: reqwest::Response, mut sender: hyper::
 /// When we receive a request to perform an upgrade, we need to initiate a bidirectional tunnel.
 /// We upgrade the request towards the target server, towards the proxy end and we connect both through a duplex stream.
 async fn perform_two_ends_upgrade(
-    request: Request<Body>,
+    request: Request<Incoming>,
     uri: Uri,
-    hyper_client: hyper::Client<HttpsConnector<HttpConnector>>,
-) -> Response<Body> {
+    hyper_client: UpgradeClient,
+) -> Response<ProxyBody> {
     let (mut duplex_client, mut duplex_server) = tokio::io::duplex(32);
 
     // Captured for log context; `uri` is moved into `new_request` below.
     let request_uri = uri.to_string();
 
-    let mut new_request = Request::new(Body::empty());
+    let mut new_request = Request::new(empty_body());
     *new_request.headers_mut() = request.headers().clone();
     *new_request.uri_mut() = uri;
 
     let client_uri = request_uri.clone();
     tokio::spawn(async move {
         match hyper::upgrade::on(request).await {
-            Ok(mut upgraded_client) => {
+            Ok(upgraded_client) => {
+                // hyper 1.0's `Upgraded` speaks hyper's own IO traits, so wrap
+                // it in `TokioIo` to bridge to tokio's `AsyncRead`/`AsyncWrite`.
+                let mut upgraded_client = TokioIo::new(upgraded_client);
                 let _result =
                     tokio::io::copy_bidirectional(&mut upgraded_client, &mut duplex_client).await;
             }
@@ -601,14 +697,15 @@ async fn perform_two_ends_upgrade(
             request_uri,
             response.status()
         );
-        return response;
+        return response.map(boxed_incoming);
     }
 
     let mut new_response = get_empty_response(StatusCode::SWITCHING_PROTOCOLS);
     *new_response.headers_mut() = response.headers().clone();
 
     match hyper::upgrade::on(response).await {
-        Ok(mut upgraded_server) => {
+        Ok(upgraded_server) => {
+            let mut upgraded_server = TokioIo::new(upgraded_server);
             tokio::spawn(async move {
                 let _result =
                     tokio::io::copy_bidirectional(&mut upgraded_server, &mut duplex_server).await;
@@ -625,3 +722,165 @@ async fn perform_two_ends_upgrade(
 
     new_response
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use http::{HeaderMap, HeaderValue, Uri};
+
+    fn headers(pairs: &[(&str, &str)]) -> HeaderMap {
+        let mut map = HeaderMap::new();
+        for (name, value) in pairs {
+            let header_name = http::header::HeaderName::from_bytes(name.as_bytes()).unwrap();
+            map.insert(header_name, HeaderValue::from_str(value).unwrap());
+        }
+        map
+    }
+
+    #[test]
+    fn request_type_from_sec_fetch_dest() {
+        let cases = [
+            ("document", "document"),
+            ("frame", "sub_frame"),
+            ("iframe", "sub_frame"),
+            ("script", "script"),
+            ("serviceworker", "script"),
+            ("worker", "script"),
+            ("style", "stylesheet"),
+            ("image", "image"),
+            ("font", "font"),
+            ("audio", "media"),
+            ("video", "media"),
+            ("object", "object"),
+            ("embed", "object"),
+            ("report", "ping"),
+            ("empty", "xmlhttprequest"),
+            ("something-unknown", "other"),
+        ];
+        for (dest, expected) in cases {
+            let h = headers(&[("sec-fetch-dest", dest)]);
+            assert_eq!(
+                request_type_from_headers(&h),
+                expected,
+                "sec-fetch-dest: {dest}"
+            );
+        }
+    }
+
+    #[test]
+    fn request_type_falls_back_to_accept() {
+        assert_eq!(
+            request_type_from_headers(&headers(&[("accept", "text/html,*/*")])),
+            "document"
+        );
+        assert_eq!(
+            request_type_from_headers(&headers(&[("accept", "text/css")])),
+            "stylesheet"
+        );
+        assert_eq!(
+            request_type_from_headers(&headers(&[("accept", "image/png")])),
+            "image"
+        );
+        assert_eq!(
+            request_type_from_headers(&headers(&[("accept", "application/javascript")])),
+            "script"
+        );
+        assert_eq!(
+            request_type_from_headers(&headers(&[("accept", "application/octet-stream")])),
+            "other"
+        );
+        // No usable headers at all.
+        assert_eq!(request_type_from_headers(&HeaderMap::new()), "other");
+    }
+
+    #[test]
+    fn url_for_matching_strips_default_ports() {
+        let strip = |s: &str| url_for_matching(&s.parse::<Uri>().unwrap());
+        assert_eq!(
+            strip("https://example.com:443/a/b"),
+            "https://example.com/a/b"
+        );
+        assert_eq!(strip("http://example.com:80/a"), "http://example.com/a");
+        // Non-default ports are preserved.
+        assert_eq!(
+            strip("https://example.com:8443/a"),
+            "https://example.com:8443/a"
+        );
+        // Missing path defaults to "/".
+        assert_eq!(strip("https://example.com:443"), "https://example.com/");
+    }
+
+    #[test]
+    fn csp_nonce_has_expected_shape() {
+        let nonce = generate_csp_nonce();
+        // 16 bytes -> 22 url-safe base64 chars, no padding.
+        assert_eq!(nonce.len(), 22);
+        assert!(!nonce.contains('='));
+        assert!(nonce
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_'));
+    }
+
+    #[test]
+    fn csp_appends_nonce_to_script_src() {
+        // script-src gets the nonce directly; with no style-src present, the
+        // style path falls back to default-src and adds the nonce there too.
+        let out = augment_csp_value("default-src 'self'; script-src 'self'", "abc");
+        assert_eq!(
+            out,
+            "default-src 'self' 'nonce-abc'; script-src 'self' 'nonce-abc'"
+        );
+    }
+
+    #[test]
+    fn csp_falls_back_to_default_src() {
+        let out = augment_csp_value("default-src 'self'", "abc");
+        assert_eq!(out, "default-src 'self' 'nonce-abc'");
+    }
+
+    #[test]
+    fn csp_skips_when_unsafe_inline_without_nonce() {
+        // Appending a nonce would silently break the site's own inline scripts,
+        // so the value must be left untouched.
+        let out = augment_csp_value("script-src 'self' 'unsafe-inline'", "abc");
+        assert_eq!(out, "script-src 'self' 'unsafe-inline'");
+    }
+
+    #[test]
+    fn csp_drops_trusted_types_directives() {
+        let out = augment_csp_value(
+            "default-src 'self'; require-trusted-types-for 'script'; trusted-types foo",
+            "abc",
+        );
+        assert!(!out.contains("trusted-types"));
+        assert!(out.contains("'nonce-abc'"));
+    }
+
+    #[test]
+    fn exclude_section_escapes_hostile_host() {
+        let section = build_exclude_section(Some("<script>alert(1)</script>"), None);
+        assert!(section.contains("&lt;script&gt;alert(1)&lt;/script&gt;"));
+        assert!(!section.contains("<script>"));
+    }
+
+    #[test]
+    fn exclude_url_percent_encodes_host() {
+        let exclude_url = build_exclude_url(Some("foo/bar?baz&qux"), Some("http://gui.lan:8200"));
+        assert_eq!(
+            exclude_url.as_deref(),
+            Some("http://gui.lan:8200/exclude?host=foo%2Fbar%3Fbaz%26qux")
+        );
+    }
+
+    #[test]
+    fn exclude_section_has_no_link_without_gui_url() {
+        assert_eq!(build_exclude_url(Some("example.com"), None), None);
+
+        let section = build_exclude_section(Some("example.com"), None);
+        assert!(section.contains("Failing host"));
+        assert!(!section.contains("<a "));
+
+        // Without a failing host there is nothing to render at all.
+        assert_eq!(build_exclude_section(None, None), "");
+    }
+}
diff --git a/privaxy/src/server/proxy/tls_failures.rs b/privaxy/src/server/proxy/tls_failures.rs
new file mode 100644
index 00000000..0ef09bb0
--- /dev/null
+++ b/privaxy/src/server/proxy/tls_failures.rs
@@ -0,0 +1,288 @@
+//! Bounded in-memory record of TLS interception handshake failures.
+//!
+//! Certificate-pinning clients abort our MITM handshake before any HTTP
+//! exchange happens, so they can never be shown an error page. The proxy
+//! records those failures here instead; the web GUI surfaces them via
+//! `GET /api/tls-failures` so the operator can exclude (or ignore) the hosts.
+
+use chrono::{DateTime, Utc};
+use serde::Serialize;
+use std::collections::BTreeSet;
+use std::sync::{Arc, Mutex};
+
+/// Maximum number of distinct failing hosts kept in memory. Older hosts are
+/// evicted first once the bound is reached.
+const MAX_TRACKED_FAILURES: usize = 100;
+
+/// A single failing host, most recent failure details included.
+#[derive(Debug, Clone, Serialize)]
+pub struct TlsFailureEntry {
+    /// Sanitized, portless hostname the client tried to CONNECT to.
+    pub host: String,
+    /// When the host last failed a handshake (RFC 3339 via chrono's serde).
+    pub last_seen: DateTime<Utc>,
+    /// How many handshake failures have been observed for this host.
+    pub count: u64,
+    /// Whether the last failure looked like certificate pinning (the client
+    /// saw our interception certificate and hung up).
+    pub likely_pinning: bool,
+    /// The last handshake error, verbatim.
+    pub last_error: String,
+}
+
+#[derive(Debug)]
+struct Inner {
+    /// Most-recent-first list of failing hosts, bounded by
+    /// `MAX_TRACKED_FAILURES`.
+    entries: Vec<TlsFailureEntry>,
+    /// Hosts the operator chose to hide from the report; persisted in the
+    /// configuration as `ignored_tls_failures`.
+    ignored: BTreeSet<String>,
+}
+
+/// Cheaply-cloneable shared store of TLS interception failures. Lock scopes
+/// are short and never held across an await point.
+#[derive(Debug, Clone)]
+pub struct TlsFailureStore(Arc<Mutex<Inner>>);
+
+impl TlsFailureStore {
+    pub fn new(ignored: BTreeSet<String>) -> Self {
+        Self(Arc::new(Mutex::new(Inner {
+            entries: Vec::new(),
+            ignored,
+        })))
+    }
+
+    /// Record a handshake failure for `host`, deduplicating by host: a host
+    /// already present is bumped to the front with its counter incremented
+    /// and failure details refreshed. Ignored hosts are not recorded. Hosts
+    /// are lowercased on the way in — DNS names are case-insensitive and the
+    /// exclusion store matches lowercased hosts, so the store must too.
+    pub fn record(&self, host: &str, error: &str, likely_pinning: bool) {
+        let host = host.to_lowercase();
+        let mut inner = self.0.lock().unwrap();
+
+        if inner.ignored.contains(&host) {
+            return;
+        }
+
+        let last_seen = Utc::now();
+        match inner.entries.iter().position(|entry| entry.host == host) {
+            Some(index) => {
+                let mut entry = inner.entries.remove(index);
+                entry.count += 1;
+                entry.last_seen = last_seen;
+                entry.last_error = error.to_string();
+                entry.likely_pinning = likely_pinning;
+                inner.entries.insert(0, entry);
+            }
+            None => {
+                inner.entries.insert(
+                    0,
+                    TlsFailureEntry {
+                        host,
+                        last_seen,
+                        count: 1,
+                        likely_pinning,
+                        last_error: error.to_string(),
+                    },
+                );
+                inner.entries.truncate(MAX_TRACKED_FAILURES);
+            }
+        }
+    }
+
+    /// Snapshot of the tracked failures, most recent first.
+    pub fn entries(&self) -> Vec<TlsFailureEntry> {
+        self.0.lock().unwrap().entries.clone()
+    }
+
+    /// Hide `host` from the report: drop any tracked entry and suppress
+    /// future `record` calls for it. Lowercased like `record`.
+    pub fn ignore(&self, host: &str) {
+        let host = host.to_lowercase();
+        let mut inner = self.0.lock().unwrap();
+        inner.entries.retain(|entry| entry.host != host);
+        inner.ignored.insert(host);
+    }
+
+    /// Replace the ignore set wholesale (used when configuration is reloaded
+    /// on SIGHUP), pruning entries the new set covers. Values are lowercased
+    /// so hand-edited configuration entries match regardless of case.
+    pub fn set_ignored(&self, ignored: BTreeSet<String>) {
+        let ignored: BTreeSet<String> = ignored
+            .into_iter()
+            .map(|host| host.trim().to_lowercase())
+            .collect();
+        let mut inner = self.0.lock().unwrap();
+        inner.entries.retain(|entry| !ignored.contains(&entry.host));
+        inner.ignored = ignored;
+    }
+}
+
+/// Normalize an operator-supplied host for the ignore list: trim, lowercase,
+/// and strip a trailing `:port` (both `host:1234` and `[v6]:1234` forms) so
+/// the value matches the portless hosts the store records. Returns `None`
+/// when nothing host-shaped remains (empty input, internal whitespace, or a
+/// bare `:port`).
+pub fn normalize_ignored_host(raw: &str) -> Option<String> {
+    let trimmed = raw.trim().to_lowercase();
+    if trimmed.is_empty() || trimmed.chars().any(char::is_whitespace) {
+        return None;
+    }
+
+    let host = match trimmed.rsplit_once(':') {
+        Some((head, port))
+            if !port.is_empty()
+                && port.chars().all(|c| c.is_ascii_digit())
+                // Only strip when what precedes the colon is not itself a
+                // bare IPv6 address: bracketed literals end with `]`, and a
+                // hostname/IPv4 head contains no further colon.
+                && (head.ends_with(']') || !head.contains(':')) =>
+        {
+            head.to_string()
+        }
+        _ => trimmed,
+    };
+
+    if host.is_empty() {
+        None
+    } else {
+        Some(host)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn record_dedupes_by_host_and_bumps_count() {
+        let store = TlsFailureStore::new(BTreeSet::new());
+        store.record("pinned.example.com", "first error", false);
+        store.record("pinned.example.com", "second error", true);
+
+        let entries = store.entries();
+        assert_eq!(entries.len(), 1);
+        let entry = &entries[0];
+        assert_eq!(entry.host, "pinned.example.com");
+        assert_eq!(entry.count, 2);
+        assert!(entry.likely_pinning);
+        assert_eq!(entry.last_error, "second error");
+    }
+
+    #[test]
+    fn record_moves_repeated_host_to_front() {
+        let store = TlsFailureStore::new(BTreeSet::new());
+        store.record("a.example.com", "error", false);
+        store.record("b.example.com", "error", false);
+        store.record("a.example.com", "error", false);
+
+        let hosts: Vec<String> = store
+            .entries()
+            .into_iter()
+            .map(|entry| entry.host)
+            .collect();
+        assert_eq!(hosts, vec!["a.example.com", "b.example.com"]);
+    }
+
+    #[test]
+    fn store_is_bounded_and_evicts_oldest() {
+        let store = TlsFailureStore::new(BTreeSet::new());
+        for index in 0..=MAX_TRACKED_FAILURES {
+            store.record(&format!("host-{index}.example.com"), "error", false);
+        }
+
+        let entries = store.entries();
+        assert_eq!(entries.len(), MAX_TRACKED_FAILURES);
+        assert_eq!(
+            entries[0].host,
+            format!("host-{MAX_TRACKED_FAILURES}.example.com")
+        );
+        // The very first (oldest) host was evicted.
+        assert!(entries
+            .iter()
+            .all(|entry| entry.host != "host-0.example.com"));
+    }
+
+    #[test]
+    fn ignore_drops_existing_entry_and_suppresses_future_records() {
+        let store = TlsFailureStore::new(BTreeSet::new());
+        store.record("pinned.example.com", "error", true);
+
+        store.ignore("pinned.example.com");
+        assert!(store.entries().is_empty());
+
+        store.record("pinned.example.com", "error", true);
+        assert!(store.entries().is_empty());
+    }
+
+    #[test]
+    fn record_and_ignore_are_case_insensitive() {
+        let store = TlsFailureStore::new(BTreeSet::new());
+        store.record("PINNED.Example.com", "error", true);
+        store.record("pinned.example.com", "error", true);
+
+        let entries = store.entries();
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].host, "pinned.example.com");
+        assert_eq!(entries[0].count, 2);
+
+        store.ignore("Pinned.EXAMPLE.com");
+        assert!(store.entries().is_empty());
+        store.record("pinned.example.com", "error", true);
+        assert!(store.entries().is_empty());
+    }
+
+    #[test]
+    fn normalize_ignored_host_shapes() {
+        assert_eq!(
+            normalize_ignored_host("  Pinned.Example.com  "),
+            Some("pinned.example.com".to_string())
+        );
+        assert_eq!(
+            normalize_ignored_host("pinned.example.com:443"),
+            Some("pinned.example.com".to_string())
+        );
+        assert_eq!(
+            normalize_ignored_host("[::1]:443"),
+            Some("[::1]".to_string())
+        );
+        // A bare IPv6 address must not have its last group eaten as a port.
+        assert_eq!(normalize_ignored_host("::1"), Some("::1".to_string()));
+        // Non-numeric suffixes are not ports.
+        assert_eq!(
+            normalize_ignored_host("svc:name"),
+            Some("svc:name".to_string())
+        );
+        assert_eq!(normalize_ignored_host(""), None);
+        assert_eq!(normalize_ignored_host("   "), None);
+        assert_eq!(normalize_ignored_host(":443"), None);
+        assert_eq!(normalize_ignored_host("two words"), None);
+    }
+
+    #[test]
+    fn set_ignored_prunes_newly_ignored_entries() {
+        let store = TlsFailureStore::new(BTreeSet::new());
+        store.record("a.example.com", "error", false);
+        store.record("b.example.com", "error", false);
+
+        store.set_ignored(BTreeSet::from(["a.example.com".to_string()]));
+
+        let hosts: Vec<String> = store
+            .entries()
+            .into_iter()
+            .map(|entry| entry.host)
+            .collect();
+        assert_eq!(hosts, vec!["b.example.com"]);
+
+        // The replaced set also suppresses future records.
+        store.record("a.example.com", "error", false);
+        let hosts: Vec<String> = store
+            .entries()
+            .into_iter()
+            .map(|entry| entry.host)
+            .collect();
+        assert_eq!(hosts, vec!["b.example.com"]);
+    }
+}
diff --git a/privaxy/src/server/statistics.rs b/privaxy/src/server/statistics.rs
index 1517abbf..d0654257 100644
--- a/privaxy/src/server/statistics.rs
+++ b/privaxy/src/server/statistics.rs
@@ -93,7 +93,6 @@ impl Statistics {
                 let mut top_blocked_paths_iterator = top_blocked_paths.iter();
 
                 let mut top_blocked_paths = (0..=ENTRIES_PER_STATISTICS_TABLE)
-                    .into_iter()
                     .filter_map(|_| {
                         let (path, count) = top_blocked_paths_iterator.next()?;
 
@@ -101,7 +100,7 @@ impl Statistics {
                     })
                     .collect::<Vec<_>>();
 
-                top_blocked_paths.sort_by(|a, b| b.1.cmp(&a.1));
+                top_blocked_paths.sort_by_key(|entry| std::cmp::Reverse(entry.1));
 
                 top_blocked_paths
             },
@@ -117,7 +116,7 @@ impl Statistics {
                     })
                     .collect::<Vec<_>>();
 
-                top_clients.sort_by(|a, b| b.1.cmp(&a.1));
+                top_clients.sort_by_key(|entry| std::cmp::Reverse(entry.1));
 
                 top_clients
             },
diff --git a/privaxy/src/server/web_gui/auth/session.rs b/privaxy/src/server/web_gui/auth/session.rs
index 377b8e29..0b784f2e 100644
--- a/privaxy/src/server/web_gui/auth/session.rs
+++ b/privaxy/src/server/web_gui/auth/session.rs
@@ -73,9 +73,8 @@ fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
 
 pub fn extract_session_cookie(cookie_header: &str) -> Option<String> {
     cookie_header.split(';').map(str::trim).find_map(|crumb| {
-        let mut parts = crumb.splitn(2, '=');
-        let name = parts.next()?;
-        let value = parts.next()?;
+        let (name, value) = crumb.split_once('=')?;
+
         if name == COOKIE_NAME {
             Some(value.to_string())
         } else {
diff --git a/privaxy/src/server/web_gui/exclusions.rs b/privaxy/src/server/web_gui/exclusions.rs
index 3e93442e..f1072f53 100644
--- a/privaxy/src/server/web_gui/exclusions.rs
+++ b/privaxy/src/server/web_gui/exclusions.rs
@@ -1,14 +1,23 @@
-use super::get_error_response;
+use super::{get_error_response, get_unprocessable_response};
 use crate::{
     configuration::Configuration,
     proxy::exclusions::{recommended_exclusions, LocalExclusionStore},
 };
+use serde::Serialize;
 use std::{convert::Infallible, sync::Arc};
 use tokio::sync::mpsc::Sender;
 use warp::filters::BoxedFilter;
 use warp::http::StatusCode;
 use warp::Filter as RouteFilter;
 
+/// The body is a single JSON-encoded hostname; anything bigger is junk.
+const ADD_BODY_LIMIT_BYTES: u64 = 4 * 1024;
+
+#[derive(Debug, Serialize)]
+struct AddExclusionResponse {
+    added: bool,
+}
+
 async fn get_default_exclusions() -> Result<Box<dyn warp::Reply>, Infallible> {
     let defaults = recommended_exclusions().join("\n");
     Ok(Box::new(warp::reply::json(&defaults)))
@@ -23,7 +32,7 @@ async fn get_exclusions() -> Result<Box<dyn warp::Reply>, Infallible> {
         }
     };
 
-    let exclusions = Vec::from_iter(configuration.exclusions.into_iter()).join("\n");
+    let exclusions = Vec::from_iter(configuration.exclusions).join("\n");
 
     Ok(Box::new(warp::reply::json(&exclusions)))
 }
@@ -59,6 +68,58 @@ async fn put_exclusions(
     Ok(Box::new(StatusCode::ACCEPTED))
 }
 
+/// Atomically add a single exclusion. Unlike `put_exclusions` (which replaces
+/// the whole list from a client-held snapshot), the read-modify-write happens
+/// entirely server-side under the save lock, so concurrent adds cannot lose
+/// each other's entries.
+async fn post_add_exclusion(
+    host: String,
+    configuration_updater_sender: Sender<Configuration>,
+    configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
+    local_exclusions_store: LocalExclusionStore,
+) -> Result<Box<dyn warp::Reply>, Infallible> {
+    let host = host.trim().to_string();
+    if host.is_empty() || host.chars().any(char::is_whitespace) {
+        return Ok(Box::new(get_unprocessable_response("not a valid hostname")));
+    }
+
+    let _guard = configuration_save_lock.lock().await;
+
+    let mut configuration = match Configuration::read_from_home().await {
+        Ok(configuration) => configuration,
+        Err(err) => {
+            log::error!("Failed to add exclusion: {err}");
+            return Ok(Box::new(get_error_response(err)));
+        }
+    };
+
+    if configuration.exclusions.contains(&host) {
+        return Ok(Box::new(warp::reply::json(&AddExclusionResponse {
+            added: false,
+        })));
+    }
+
+    // Reuse the whole-list write path so validation, persistence and the
+    // exclusion-store refresh stay in one place.
+    let mut exclusions = Vec::from_iter(configuration.exclusions.iter().cloned());
+    exclusions.push(host);
+    if let Err(err) = configuration
+        .set_exclusions(&exclusions.join("\n"), local_exclusions_store)
+        .await
+    {
+        return Ok(Box::new(get_error_response(err)));
+    }
+
+    configuration_updater_sender
+        .send(configuration.clone())
+        .await
+        .unwrap();
+
+    Ok(Box::new(warp::reply::json(&AddExclusionResponse {
+        added: true,
+    })))
+}
+
 pub fn create_routes(
     configuration_updater_sender: Sender<Configuration>,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
@@ -82,8 +143,26 @@ pub fn create_routes(
         .and(super::with_configuration_save_lock(
             configuration_save_lock.clone(),
         ))
-        .and(super::with_local_exclusions_store(local_exclusions_store))
+        .and(super::with_local_exclusions_store(
+            local_exclusions_store.clone(),
+        ))
         .and_then(self::put_exclusions);
 
-    defaults_route.or(root_get).or(root_put).boxed()
+    let add_post = warp::path("add")
+        .and(warp::path::end())
+        .and(warp::post())
+        .and(warp::body::content_length_limit(ADD_BODY_LIMIT_BYTES))
+        .and(warp::body::json::<String>())
+        .and(super::with_configuration_updater_sender(
+            configuration_updater_sender,
+        ))
+        .and(super::with_configuration_save_lock(configuration_save_lock))
+        .and(super::with_local_exclusions_store(local_exclusions_store))
+        .and_then(self::post_add_exclusion);
+
+    defaults_route
+        .or(root_get)
+        .or(root_put)
+        .or(add_post)
+        .boxed()
 }
diff --git a/privaxy/src/server/web_gui/filterlists.rs b/privaxy/src/server/web_gui/filterlists.rs
index 8a30180c..90aabb5f 100644
--- a/privaxy/src/server/web_gui/filterlists.rs
+++ b/privaxy/src/server/web_gui/filterlists.rs
@@ -1,4 +1,3 @@
-use filterlists_api;
 use warp::Filter as RouteFilter;
 
 use std::convert::Infallible;
diff --git a/privaxy/src/server/web_gui/filters.rs b/privaxy/src/server/web_gui/filters.rs
index 89d095ed..3f702303 100644
--- a/privaxy/src/server/web_gui/filters.rs
+++ b/privaxy/src/server/web_gui/filters.rs
@@ -1,9 +1,10 @@
 use super::get_error_response;
 use crate::configuration::{
-    calc_filter_filename, Configuration, ConfigurationError, Filter, FilterGroup,
+    calc_filter_filename, Configuration, ConfigurationError, DefaultFilters, Filter,
+    FilterFailureEntry, FilterFailureStore, FilterGroup,
 };
 use crate::web_gui::ApiError;
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 use serde_with::{serde_as, DisplayFromStr};
 
 use std::{convert::Infallible, sync::Arc};
@@ -29,6 +30,41 @@ pub struct FilterRequest {
     pub url: Url,
 }
 
+/// A configuration filter as served to the web UI, annotated with whether it
+/// is one of the built-in lists shipped with the package (those can only be
+/// enabled/disabled, never edited or removed).
+#[derive(Debug, Serialize)]
+struct FilterResponse {
+    enabled: bool,
+    title: String,
+    group: FilterGroup,
+    file_name: String,
+    url: String,
+    is_default: bool,
+}
+
+/// A filter failure as served to the web UI; `is_default` tells the frontend
+/// to offer disabling instead of editing/removing.
+#[derive(Debug, Serialize)]
+struct FilterFailureResponse {
+    #[serde(flatten)]
+    entry: FilterFailureEntry,
+    is_default: bool,
+}
+
+#[serde_as]
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+pub struct UpdateFilterRequest {
+    /// File name of the configuration entry being edited; the stable
+    /// identifier, since the URL (and therefore the derived file name) may be
+    /// exactly what the edit changes.
+    pub old_file_name: String,
+    pub title: String,
+    pub group: FilterGroup,
+    #[serde_as(as = "DisplayFromStr")]
+    pub url: Url,
+}
+
 async fn change_filter_status(
     filter_status_change_request: Vec<FilterStatusChangeRequest>,
     configuration_updater_sender: Sender<Configuration>,
@@ -73,7 +109,19 @@ async fn get_filters_configuration() -> Result<impl warp::Reply, Infallible> {
         }
     };
 
-    let filters = configuration.filters;
+    let default_file_names = DefaultFilters::new().file_names();
+    let filters: Vec<FilterResponse> = configuration
+        .filters
+        .iter()
+        .map(|filter| FilterResponse {
+            enabled: filter.enabled,
+            title: filter.title.clone(),
+            group: filter.group,
+            file_name: filter.file_name.clone(),
+            url: filter.url.to_string(),
+            is_default: default_file_names.contains(&filter.file_name),
+        })
+        .collect();
     log::debug!("Filters: {:?}", filters);
     Ok(Response::builder()
         .header(http::header::CONTENT_TYPE, "application/json")
@@ -173,6 +221,7 @@ async fn delete_filter(
     filter_request: FilterRequest,
     configuration_updater_sender: Sender<Configuration>,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
+    filter_failure_store: FilterFailureStore,
 ) -> Result<impl warp::Reply, Infallible> {
     let _guard = configuration_save_lock.lock().await;
 
@@ -184,6 +233,27 @@ async fn delete_filter(
         }
     };
 
+    let deleted_file_names: Vec<String> = configuration
+        .filters
+        .iter()
+        .filter(|filter| filter.url == filter_request.url)
+        .map(|filter| filter.file_name.clone())
+        .collect();
+
+    let default_file_names = DefaultFilters::new().file_names();
+    if deleted_file_names
+        .iter()
+        .any(|file_name| default_file_names.contains(file_name))
+    {
+        log::warn!(
+            "Refusing to remove built-in filter list {}",
+            filter_request.url
+        );
+        return Ok(super::get_forbidden_response(
+            "Built-in filter lists cannot be removed. Disable them instead.",
+        ));
+    }
+
     let mut new_configuration = configuration.clone();
     new_configuration
         .filters
@@ -201,20 +271,155 @@ async fn delete_filter(
         log::error!("Failed to send updated configuration: {err}");
         return Ok(get_error_response(err));
     }
+
+    // A deleted filter can no longer fail to update; drop it from the
+    // failure report immediately rather than waiting for the updater to
+    // reconcile.
+    for file_name in deleted_file_names {
+        filter_failure_store.clear(&file_name);
+    }
+
     Ok(Response::builder()
         .status(http::StatusCode::NO_CONTENT)
         .body("".to_string())
         .unwrap())
 }
 
+async fn update_filter(
+    update_request: UpdateFilterRequest,
+    http_client: reqwest::Client,
+    configuration_updater_sender: Sender<Configuration>,
+    configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
+    filter_failure_store: FilterFailureStore,
+) -> Result<impl warp::Reply, Infallible> {
+    if DefaultFilters::new()
+        .file_names()
+        .contains(&update_request.old_file_name)
+    {
+        log::warn!(
+            "Refusing to edit built-in filter list {}",
+            update_request.old_file_name
+        );
+        return Ok(super::get_forbidden_response(
+            "Built-in filter lists cannot be edited. Disable them instead.",
+        ));
+    }
+
+    let _guard = configuration_save_lock.lock().await;
+
+    let mut configuration = match Configuration::read_from_home().await {
+        Ok(configuration) => configuration,
+        Err(err) => {
+            log::error!("Failed to read configuration: {err}");
+            return Ok(get_error_response(err));
+        }
+    };
+
+    if configuration.filters.iter().any(|filter| {
+        filter.file_name != update_request.old_file_name && filter.url == update_request.url
+    }) {
+        log::warn!("Filter with URL {} already exists", update_request.url);
+        return Ok(Response::builder()
+            .status(http::StatusCode::CONFLICT)
+            .header(http::header::CONTENT_TYPE, "application/json")
+            .body(
+                serde_json::to_string(&ApiError {
+                    error: format!("Filter with URL {} already exists", update_request.url),
+                })
+                .unwrap(),
+            )
+            .unwrap());
+    }
+
+    // `enabled` is a placeholder here; `replace_filter` carries over the
+    // enabled status of the entry being replaced.
+    let mut new_filter = Filter {
+        enabled: true,
+        title: update_request.title.clone(),
+        group: update_request.group,
+        file_name: calc_filter_filename(update_request.url.as_ref()),
+        url: update_request.url.clone(),
+    };
+
+    if let Err(err) = configuration
+        .replace_filter(&update_request.old_file_name, &mut new_filter, &http_client)
+        .await
+    {
+        let message = match err {
+            ConfigurationError::FilterValidationError(message)
+            | ConfigurationError::FilterError(message) => message,
+            ConfigurationError::UnableToRetrieveDefaultFilters(err) => {
+                format!("Failed to fetch the filter list: {err}")
+            }
+            err => {
+                log::error!("Failed to update filter: {err}");
+                return Ok(get_error_response(err));
+            }
+        };
+        log::warn!("Rejected filter edit: {message}");
+        return Ok(Response::builder()
+            .status(http::StatusCode::UNPROCESSABLE_ENTITY)
+            .header(http::header::CONTENT_TYPE, "application/json")
+            .body(serde_json::to_string(&ApiError { error: message }).unwrap())
+            .unwrap());
+    }
+
+    if let Err(err) = configuration.save().await {
+        log::error!("Failed to save configuration: {err}");
+        return Ok(get_error_response(err));
+    }
+
+    if let Err(err) = configuration_updater_sender
+        .send(configuration.clone())
+        .await
+    {
+        log::error!("Failed to send updated configuration: {err}");
+        return Ok(get_error_response(err));
+    }
+
+    // The replacement was just validated against its URL, so the old entry's
+    // failure record is resolved regardless of whether the URL changed.
+    filter_failure_store.clear(&update_request.old_file_name);
+
+    Ok(Response::builder()
+        .status(http::StatusCode::OK)
+        .body("".to_string())
+        .unwrap())
+}
+
+async fn get_filter_failures(
+    filter_failure_store: FilterFailureStore,
+) -> Result<impl warp::Reply, Infallible> {
+    let default_file_names = DefaultFilters::new().file_names();
+    let failures: Vec<FilterFailureResponse> = filter_failure_store
+        .entries()
+        .into_iter()
+        .map(|entry| FilterFailureResponse {
+            is_default: default_file_names.contains(&entry.file_name),
+            entry,
+        })
+        .collect();
+    Ok(warp::reply::json(&failures))
+}
+
 pub(super) fn create_routes(
     configuration_updater_sender: Sender<Configuration>,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
     http_client: reqwest::Client,
+    filter_failure_store: FilterFailureStore,
 ) -> BoxedFilter<(impl warp::Reply,)> {
-    warp::get()
-        .and_then(self::get_filters_configuration)
-        .or(warp::put()
+    let failures_route = warp::path("failures")
+        .and(warp::path::end())
+        .and(warp::get())
+        .and(super::with_arc(filter_failure_store.clone()))
+        .and_then(self::get_filter_failures);
+
+    failures_route
+        .or(warp::path::end()
+            .and(warp::get())
+            .and_then(self::get_filters_configuration))
+        .or(warp::path::end()
+            .and(warp::put())
             .and(warp::body::json())
             .and(super::with_configuration_updater_sender(
                 configuration_updater_sender.clone(),
@@ -223,7 +428,8 @@ pub(super) fn create_routes(
                 configuration_save_lock.clone(),
             ))
             .and_then(self::change_filter_status))
-        .or(warp::post()
+        .or(warp::path::end()
+            .and(warp::post())
             .and(warp::body::json())
             .and(super::with_http_client(http_client.clone()))
             .and(super::with_configuration_updater_sender(
@@ -233,14 +439,26 @@ pub(super) fn create_routes(
                 configuration_save_lock.clone(),
             ))
             .and_then(self::add_filter))
-        .or(warp::delete()
+        .or(warp::path::end()
+            .and(warp::patch())
             .and(warp::body::json())
+            .and(super::with_http_client(http_client))
             .and(super::with_configuration_updater_sender(
                 configuration_updater_sender.clone(),
             ))
             .and(super::with_configuration_save_lock(
                 configuration_save_lock.clone(),
             ))
+            .and(super::with_arc(filter_failure_store.clone()))
+            .and_then(self::update_filter))
+        .or(warp::path::end()
+            .and(warp::delete())
+            .and(warp::body::json())
+            .and(super::with_configuration_updater_sender(
+                configuration_updater_sender,
+            ))
+            .and(super::with_configuration_save_lock(configuration_save_lock))
+            .and(super::with_arc(filter_failure_store))
             .and_then(self::delete_filter))
         .boxed()
 }
diff --git a/privaxy/src/server/web_gui/mod.rs b/privaxy/src/server/web_gui/mod.rs
index 0c0cb0c2..65586d38 100644
--- a/privaxy/src/server/web_gui/mod.rs
+++ b/privaxy/src/server/web_gui/mod.rs
@@ -1,5 +1,7 @@
+use crate::configuration::FilterFailureStore;
 use crate::logging::LogHandle;
 use crate::proxy::exclusions::LocalExclusionStore;
+use crate::proxy::tls_failures::TlsFailureStore;
 use crate::statistics::Statistics;
 use crate::WEBAPP_FRONTEND_DIR;
 use crate::{blocker::BlockingDisabledStore, configuration::Configuration};
@@ -23,11 +25,13 @@ pub(crate) mod logs;
 mod pac;
 pub(crate) mod settings;
 pub(crate) mod statistics;
+pub(crate) mod tls_failures;
 
 #[derive(Debug, Serialize)]
 pub(crate) struct ApiError {
     error: String,
 }
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn get_frontend(
     events_sender: broadcast::Sender<events::Event>,
     statistics: Statistics,
@@ -35,6 +39,8 @@ pub(crate) fn get_frontend(
     configuration_updater_sender: &Sender<Configuration>,
     configuration_save_lock: &Arc<tokio::sync::Mutex<()>>,
     local_exclusions_store: &LocalExclusionStore,
+    tls_failure_store: &TlsFailureStore,
+    filter_failure_store: &FilterFailureStore,
     notify_reload: Arc<Notify>,
     log_handle: LogHandle,
 ) -> BoxedFilter<(impl warp::Reply,)> {
@@ -42,7 +48,7 @@ pub(crate) fn get_frontend(
 
     let cors = warp::cors()
         .allow_any_origin()
-        .allow_methods(vec!["GET", "PUT", "POST", "DELETE"])
+        .allow_methods(vec!["GET", "PUT", "POST", "PATCH", "DELETE"])
         .allow_headers(vec![
             http::header::CONTENT_TYPE,
             http::header::CONTENT_LENGTH,
@@ -58,6 +64,8 @@ pub(crate) fn get_frontend(
         configuration_updater_sender,
         configuration_save_lock,
         local_exclusions_store,
+        tls_failure_store,
+        filter_failure_store,
         http_client,
         notify_reload,
         log_handle,
@@ -72,7 +80,7 @@ pub(crate) fn get_frontend(
         .boxed()
 }
 
-pub(self) fn with_arc<T: Clone + Send + Sync + 'static>(
+fn with_arc<T: Clone + Send + Sync + 'static>(
     value: T,
 ) -> impl Filter<Extract = (T,), Error = std::convert::Infallible> + Clone {
     warp::any().map(move || value.clone())
@@ -101,6 +109,7 @@ fn create_static_routes() -> BoxedFilter<(impl warp::Reply,)> {
         .boxed()
 }
 
+#[allow(clippy::too_many_arguments)]
 fn create_api_routes(
     events_sender: broadcast::Sender<events::Event>,
     statistics: Statistics,
@@ -108,6 +117,8 @@ fn create_api_routes(
     configuration_updater_sender: &Sender<Configuration>,
     configuration_save_lock: &Arc<tokio::sync::Mutex<()>>,
     local_exclusions_store: &LocalExclusionStore,
+    tls_failure_store: &TlsFailureStore,
+    filter_failure_store: &FilterFailureStore,
     http_client: reqwest::Client,
     notify_reload: Arc<Notify>,
     log_handle: LogHandle,
@@ -155,6 +166,7 @@ fn create_api_routes(
                 configuration_updater_sender.clone(),
                 configuration_save_lock.clone(),
                 http_client.clone(),
+                filter_failure_store.clone(),
             ));
 
     let custom_filters_route =
@@ -190,6 +202,15 @@ fn create_api_routes(
             blocking_disabled_store.clone(),
         ));
 
+    let tls_failures_route =
+        warp::path("tls-failures")
+            .and(require_auth.clone())
+            .and(tls_failures::create_routes(
+                tls_failure_store.clone(),
+                local_exclusions_store.clone(),
+                configuration_save_lock.clone(),
+            ));
+
     let options_route = warp::options().map(|| "");
 
     let filterlists_route = warp::path("filterlists")
@@ -209,6 +230,7 @@ fn create_api_routes(
         .or(custom_filters_route)
         .or(exclusions_route)
         .or(blocking_enabled_route)
+        .or(tls_failures_route)
         .or(settings_route)
         .or(options_route)
         .or(filterlists_route)
@@ -269,19 +291,19 @@ fn with_blocking_disabled_store(
     warp::any().map(move || blocking_disabled.clone())
 }
 
-pub(self) fn with_configuration_updater_sender(
+fn with_configuration_updater_sender(
     sender: Sender<Configuration>,
 ) -> impl Filter<Extract = (Sender<Configuration>,), Error = std::convert::Infallible> + Clone {
     warp::any().map(move || sender.clone())
 }
 
-pub(self) fn with_http_client(
+fn with_http_client(
     http_client: reqwest::Client,
 ) -> impl Filter<Extract = (reqwest::Client,), Error = std::convert::Infallible> + Clone {
     warp::any().map(move || http_client.clone())
 }
 
-pub(self) fn with_notify_reload(
+fn with_notify_reload(
     notify_reload: Arc<Notify>,
 ) -> impl Filter<Extract = (Arc<Notify>,), Error = std::convert::Infallible> + Clone {
     warp::any().map(move || notify_reload.clone())
@@ -300,3 +322,33 @@ pub(crate) fn get_error_response(err: impl std::error::Error) -> Response<String
         )
         .unwrap()
 }
+
+/// JSON 422 for requests whose body was well-formed but semantically invalid
+/// (e.g. a value that is not a hostname).
+pub(crate) fn get_unprocessable_response(message: &str) -> Response<String> {
+    Response::builder()
+        .status(http::StatusCode::UNPROCESSABLE_ENTITY)
+        .header(http::header::CONTENT_TYPE, "application/json")
+        .body(
+            serde_json::to_string(&ApiError {
+                error: message.to_string(),
+            })
+            .unwrap(),
+        )
+        .unwrap()
+}
+
+/// JSON 403 for operations the API refuses regardless of authentication
+/// (e.g. editing a built-in filter list).
+pub(crate) fn get_forbidden_response(message: &str) -> Response<String> {
+    Response::builder()
+        .status(http::StatusCode::FORBIDDEN)
+        .header(http::header::CONTENT_TYPE, "application/json")
+        .body(
+            serde_json::to_string(&ApiError {
+                error: message.to_string(),
+            })
+            .unwrap(),
+        )
+        .unwrap()
+}
diff --git a/privaxy/src/server/web_gui/pac.rs b/privaxy/src/server/web_gui/pac.rs
index 46c3d31c..a7f5cd57 100644
--- a/privaxy/src/server/web_gui/pac.rs
+++ b/privaxy/src/server/web_gui/pac.rs
@@ -26,6 +26,8 @@ pub(crate) fn create_routes(configuration_save_lock: Arc<Mutex<()>>) -> BoxedFil
     let tera = Arc::new(tera);
 
     warp::path!("proxy.pac")
+        .or(warp::path!("wpad.dat"))
+        .unify()
         .and(warp::get())
         .and(super::with_arc(tera))
         .and(super::with_configuration_save_lock(configuration_save_lock))
@@ -55,10 +57,17 @@ async fn render_pac(
         .clone()
         .unwrap_or_else(|| format!("{}:{}", cfg.network.bind_addr, cfg.network.proxy_port));
 
+    let cidrs = cfg
+        .network
+        .pac_direct_cidrs
+        .iter()
+        .map(|(subnet, netmask)| (subnet.clone(), normalize_netmask(netmask)))
+        .collect();
+
     let ctx_data = PacContext {
         proxy_host: &proxy_host,
         ips: &cfg.network.pac_direct_ips,
-        cidrs: &cfg.network.pac_direct_cidrs,
+        cidrs: &cidrs,
         fqdns: &cfg.network.pac_direct_fqdns,
     };
 
@@ -78,6 +87,24 @@ async fn render_pac(
         .unwrap())
 }
 
+/// `isInNet` only understands dotted-decimal masks, but the GUI accepts
+/// `subnet/22`-style CIDR input and stores the bare prefix length, so a
+/// prefix length is converted here at render time. Anything that is not a
+/// prefix length (already-dotted masks in particular) passes through as-is.
+fn normalize_netmask(netmask: &str) -> String {
+    match netmask.parse::<u8>() {
+        Ok(prefix) if prefix <= 32 => {
+            let bits = if prefix == 0 {
+                0
+            } else {
+                u32::MAX << (32 - u32::from(prefix))
+            };
+            std::net::Ipv4Addr::from(bits).to_string()
+        }
+        _ => netmask.to_string(),
+    }
+}
+
 fn not_found_response() -> Response<String> {
     Response::builder()
         .status(http::StatusCode::NOT_FOUND)
@@ -85,3 +112,28 @@ fn not_found_response() -> Response<String> {
         .body(String::new())
         .unwrap()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::normalize_netmask;
+
+    #[test]
+    fn prefix_lengths_become_dotted_masks() {
+        assert_eq!(normalize_netmask("0"), "0.0.0.0");
+        assert_eq!(normalize_netmask("8"), "255.0.0.0");
+        assert_eq!(normalize_netmask("12"), "255.240.0.0");
+        assert_eq!(normalize_netmask("20"), "255.255.240.0");
+        assert_eq!(normalize_netmask("22"), "255.255.252.0");
+        assert_eq!(normalize_netmask("26"), "255.255.255.192");
+        assert_eq!(normalize_netmask("28"), "255.255.255.240");
+        assert_eq!(normalize_netmask("32"), "255.255.255.255");
+    }
+
+    #[test]
+    fn dotted_masks_and_junk_pass_through() {
+        assert_eq!(normalize_netmask("255.255.252.0"), "255.255.252.0");
+        assert_eq!(normalize_netmask("33"), "33");
+        assert_eq!(normalize_netmask(""), "");
+        assert_eq!(normalize_netmask("garbage"), "garbage");
+    }
+}
diff --git a/privaxy/src/server/web_gui/settings/ca_certificate.rs b/privaxy/src/server/web_gui/settings/ca_certificate.rs
index 0313e216..634fcb57 100644
--- a/privaxy/src/server/web_gui/settings/ca_certificate.rs
+++ b/privaxy/src/server/web_gui/settings/ca_certificate.rs
@@ -68,7 +68,7 @@ async fn put_ca_certificates(
     ca_cert_struct: Ca,
     configuration_updater_sender: Sender<Configuration>,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
-    notify_reload: Arc<Notify>,
+    _notify_reload: Arc<Notify>,
 ) -> Result<Box<dyn warp::Reply>, Infallible> {
     let _guard = configuration_save_lock.lock().await;
 
diff --git a/privaxy/src/server/web_gui/settings/network.rs b/privaxy/src/server/web_gui/settings/network.rs
index 8e0d3c8a..6858dfe4 100644
--- a/privaxy/src/server/web_gui/settings/network.rs
+++ b/privaxy/src/server/web_gui/settings/network.rs
@@ -1,5 +1,4 @@
 use super::get_error_response;
-use crate::configuration;
 use crate::configuration::{DohConfig, NetworkConfig};
 use crate::web_gui::with_configuration_save_lock;
 use crate::web_gui::with_configuration_updater_sender;
@@ -31,6 +30,11 @@ pub struct NetworkConfigRequest {
     /// case the current configuration is preserved.
     #[serde(default)]
     pub doh: Option<DohConfig>,
+    /// Full base URL of the web GUI as reachable by clients. Omitted by older
+    /// clients, in which case the current configuration is preserved; an
+    /// empty string clears the setting.
+    #[serde(default)]
+    pub gui_url: Option<String>,
 }
 
 impl From<NetworkConfigRequest> for NetworkConfig {
@@ -43,6 +47,7 @@ impl From<NetworkConfigRequest> for NetworkConfig {
             tls_cert_path: None,
             tls_key_path: None,
             listen_url: None,
+            gui_url: None,
             pac_enabled: false,
             pac_proxy_host: None,
             pac_direct_ips: Vec::new(),
@@ -82,11 +87,23 @@ async fn put_network_settings(
 
     drop(lock);
     let requested_doh = network_settings.doh.clone();
+    let requested_gui_url = network_settings.gui_url.clone();
     let mut net_cfg: NetworkConfig = network_settings.into();
     let current_cfg = configuration.network.clone();
     net_cfg.tls_cert_path = current_cfg.tls_cert_path;
     net_cfg.tls_key_path = current_cfg.tls_key_path;
     net_cfg.listen_url = current_cfg.listen_url;
+    net_cfg.gui_url = match requested_gui_url {
+        None => current_cfg.gui_url,
+        Some(url) => {
+            let trimmed = url.trim().trim_end_matches('/');
+            if trimmed.is_empty() {
+                None
+            } else {
+                Some(trimmed.to_string())
+            }
+        }
+    };
     net_cfg.pac_enabled = current_cfg.pac_enabled;
     net_cfg.pac_proxy_host = current_cfg.pac_proxy_host;
     net_cfg.pac_direct_ips = current_cfg.pac_direct_ips;
diff --git a/privaxy/src/server/web_gui/statistics.rs b/privaxy/src/server/web_gui/statistics.rs
index b296b457..a50870c6 100644
--- a/privaxy/src/server/web_gui/statistics.rs
+++ b/privaxy/src/server/web_gui/statistics.rs
@@ -1,5 +1,4 @@
 use futures::{SinkExt, StreamExt};
-use log;
 use std::time::Duration;
 use tokio::time::sleep;
 use warp::ws::{Message, WebSocket};
diff --git a/privaxy/src/server/web_gui/tls_failures.rs b/privaxy/src/server/web_gui/tls_failures.rs
new file mode 100644
index 00000000..e7f4f077
--- /dev/null
+++ b/privaxy/src/server/web_gui/tls_failures.rs
@@ -0,0 +1,102 @@
+use super::{get_error_response, get_unprocessable_response};
+use crate::configuration::Configuration;
+use crate::proxy::exclusions::LocalExclusionStore;
+use crate::proxy::tls_failures::{normalize_ignored_host, TlsFailureEntry, TlsFailureStore};
+use std::{convert::Infallible, sync::Arc};
+use warp::filters::BoxedFilter;
+use warp::http::StatusCode;
+use warp::Filter as RouteFilter;
+
+/// Ceiling on the persisted ignore list — it lives in the TOML configuration,
+/// which is rewritten wholesale on every save, so it must not grow unbounded.
+const MAX_IGNORED_TLS_FAILURES: usize = 1_000;
+
+/// The body is a single JSON-encoded hostname; anything bigger is junk.
+const IGNORE_BODY_LIMIT_BYTES: u64 = 4 * 1024;
+
+async fn get_tls_failures(
+    tls_failure_store: TlsFailureStore,
+    local_exclusions_store: LocalExclusionStore,
+) -> Result<Box<dyn warp::Reply>, Infallible> {
+    // The store already omits ignored hosts; additionally omit hosts the
+    // exclusion list now covers (their failures predate the exclusion, or the
+    // client re-dialed before the exclusion took effect).
+    let entries: Vec<TlsFailureEntry> = tls_failure_store
+        .entries()
+        .into_iter()
+        .filter(|entry| !local_exclusions_store.contains(&entry.host))
+        .collect();
+
+    Ok(Box::new(warp::reply::json(&entries)))
+}
+
+async fn post_ignore_tls_failure(
+    host: String,
+    tls_failure_store: TlsFailureStore,
+    configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
+) -> Result<Box<dyn warp::Reply>, Infallible> {
+    // Normalize to the portless lowercase shape the store records; reject
+    // anything that is not host-shaped instead of persisting a dead entry
+    // that could never match.
+    let host = match normalize_ignored_host(&host) {
+        Some(host) => host,
+        None => {
+            return Ok(Box::new(get_unprocessable_response("not a valid hostname")));
+        }
+    };
+
+    let _guard = configuration_save_lock.lock().await;
+
+    let mut configuration = match Configuration::read_from_home().await {
+        Ok(configuration) => configuration,
+        Err(err) => {
+            log::error!("Failed to ignore TLS failure: {err}");
+            return Ok(Box::new(get_error_response(err)));
+        }
+    };
+
+    if configuration.ignored_tls_failures.len() >= MAX_IGNORED_TLS_FAILURES
+        && !configuration.ignored_tls_failures.contains(&host)
+    {
+        return Ok(Box::new(get_unprocessable_response(
+            "ignore list is full; prune ignored_tls_failures in the configuration",
+        )));
+    }
+
+    if let Err(err) = configuration
+        .ignore_tls_failure(&host, tls_failure_store)
+        .await
+    {
+        return Ok(Box::new(get_error_response(err)));
+    }
+
+    // Deliberately no `configuration_updater_sender` send here: nothing
+    // downstream (blocker, proxy loops) consumes the ignore list, and the
+    // in-memory store was already updated by `ignore_tls_failure`, so a
+    // reload notification would be pure churn.
+
+    Ok(Box::new(StatusCode::ACCEPTED))
+}
+
+pub(super) fn create_routes(
+    tls_failure_store: TlsFailureStore,
+    local_exclusions_store: LocalExclusionStore,
+    configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
+) -> BoxedFilter<(impl warp::Reply,)> {
+    let root_get = warp::path::end()
+        .and(warp::get())
+        .and(super::with_arc(tls_failure_store.clone()))
+        .and(super::with_arc(local_exclusions_store))
+        .and_then(self::get_tls_failures);
+
+    let ignore_post = warp::path("ignore")
+        .and(warp::path::end())
+        .and(warp::post())
+        .and(warp::body::content_length_limit(IGNORE_BODY_LIMIT_BYTES))
+        .and(warp::body::json::<String>())
+        .and(super::with_arc(tls_failure_store))
+        .and(super::with_arc(configuration_save_lock))
+        .and_then(self::post_ignore_tls_failure);
+
+    root_get.or(ignore_post).boxed()
+}
diff --git a/web_frontend/.cargo/config.toml b/web_frontend/.cargo/config.toml
new file mode 100644
index 00000000..435ed755
--- /dev/null
+++ b/web_frontend/.cargo/config.toml
@@ -0,0 +1,2 @@
+[build]
+target = "wasm32-unknown-unknown"
\ No newline at end of file
diff --git a/web_frontend/Cargo.toml b/web_frontend/Cargo.toml
index e04961ce..5b3dca84 100644
--- a/web_frontend/Cargo.toml
+++ b/web_frontend/Cargo.toml
@@ -5,24 +5,24 @@ edition = "2021"
 
 
 [dependencies]
-yew = "0.19.3"
-yew-router = "0.16.0"
+yew = { version = "0.23", features = ["csr"] }
+yew-router = "0.20"
 serde_json = "1.0.81"
 num-format = "0.4.0"
 serde = { version = "1.0.137", features = ["derive"] }
-gloo-utils = "0.1.3"
-wasm-bindgen = "0.2.80"
-wasm-bindgen-futures = "0.4.30"
+gloo-utils = "0.3"
+wasm-bindgen = "0.2.125"
+wasm-bindgen-futures = "0.4"
 futures = "0.3.21"
 log = "0.4.17"
 wasm-logger = "0.2.0"
-gloo-timers = { version = "0.2.4", features = ["futures"] }
+gloo-timers = { version = "0.4", features = ["futures"] }
 serde-tuple-vec-map = "1.0.1"
-web-sys = { version = "0.3.69", features = ["InputEvent",  "InputEventInit", "HtmlSelectElement", "Window", "Location", "Clipboard", "Navigator", "SubmitEvent", "KeyboardEvent"]}
-reqwasm = "0.5.0"
+web-sys = { version = "0.3.77", features = ["InputEvent",  "InputEventInit", "HtmlSelectElement", "Window", "Location", "Clipboard", "Navigator", "SubmitEvent", "KeyboardEvent"]}
+gloo-net = "0.6"
 serde_with = "3.8.1"
 url = "2.5.0"
 readonly = "0.2.12"
-thiserror = "1.0.61"
+thiserror = "2"
 filterlists-api = { path = "../filterlists-api" }
 regex = "1.10.5"
diff --git a/web_frontend/src/account.rs b/web_frontend/src/account.rs
index 082d83cb..280547c6 100644
--- a/web_frontend/src/account.rs
+++ b/web_frontend/src/account.rs
@@ -1,7 +1,7 @@
-use reqwasm::http::Request;
+use gloo_net::http::Request;
 use serde::{Deserialize, Serialize};
 use wasm_bindgen_futures::spawn_local;
-use web_sys::{FocusEvent, HtmlInputElement};
+use web_sys::{HtmlInputElement, SubmitEvent};
 use yew::prelude::*;
 use yew::{html, Callback, Component, Context, Html};
 
@@ -137,6 +137,7 @@ impl Component for AccountSettings {
                     match Request::post("/api/auth/change-password")
                         .header("Content-Type", "application/json")
                         .body(serde_json::to_string(&payload).unwrap())
+                        .unwrap()
                         .send()
                         .await
                     {
@@ -225,7 +226,7 @@ impl Component for AccountSettings {
             let input: HtmlInputElement = e.target_unchecked_into();
             Message::UpdateConfirmPassword(input.value())
         });
-        let on_submit = link.callback(|e: FocusEvent| {
+        let on_submit = link.callback(|e: SubmitEvent| {
             e.prevent_default();
             Message::SubmitPasswordChange
         });
@@ -327,7 +328,7 @@ fn password_field(
     }
 }
 
-async fn parse_error(response: reqwasm::http::Response) -> String {
+async fn parse_error(response: gloo_net::http::Response) -> String {
     #[derive(Deserialize)]
     struct ApiError {
         error: String,
diff --git a/web_frontend/src/auth.rs b/web_frontend/src/auth.rs
index 9502657b..21f60c3f 100644
--- a/web_frontend/src/auth.rs
+++ b/web_frontend/src/auth.rs
@@ -1,7 +1,7 @@
-use reqwasm::http::Request;
+use gloo_net::http::Request;
 use serde::{Deserialize, Serialize};
 use wasm_bindgen_futures::spawn_local;
-use web_sys::{FocusEvent, HtmlInputElement};
+use web_sys::{HtmlInputElement, SubmitEvent};
 use yew::prelude::*;
 use yew::{html, Callback, Children, Component, Context, Html, Properties};
 
@@ -38,6 +38,7 @@ pub enum GateMessage {
     StatusLoadFailed,
     SetupCompleted(String),
     LoginCompleted(String),
+    #[allow(dead_code)]
     LogoutCompleted,
 }
 
@@ -133,6 +134,7 @@ async fn fetch_status() -> Option<AuthStatus> {
     response.json::<AuthStatus>().await.ok()
 }
 
+#[allow(dead_code)]
 pub async fn post_logout() -> bool {
     Request::post("/api/auth/logout")
         .send()
@@ -207,6 +209,7 @@ impl Component for LoginPage {
                     match Request::post("/api/auth/login")
                         .header("Content-Type", "application/json")
                         .body(serde_json::to_string(&payload).unwrap())
+                        .unwrap()
                         .send()
                         .await
                     {
@@ -242,7 +245,7 @@ impl Component for LoginPage {
             let input: HtmlInputElement = e.target_unchecked_into();
             LoginMessage::UpdatePassword(input.value())
         });
-        let on_submit = link.callback(|e: FocusEvent| {
+        let on_submit = link.callback(|e: SubmitEvent| {
             e.prevent_default();
             LoginMessage::Submit
         });
@@ -338,6 +341,7 @@ impl Component for SetupPage {
                     match Request::post("/api/auth/setup")
                         .header("Content-Type", "application/json")
                         .body(serde_json::to_string(&payload).unwrap())
+                        .unwrap()
                         .send()
                         .await
                     {
@@ -377,7 +381,7 @@ impl Component for SetupPage {
             let input: HtmlInputElement = e.target_unchecked_into();
             SetupMessage::UpdateConfirm(input.value())
         });
-        let on_submit = link.callback(|e: FocusEvent| {
+        let on_submit = link.callback(|e: SubmitEvent| {
             e.prevent_default();
             SetupMessage::Submit
         });
@@ -404,7 +408,7 @@ impl Component for SetupPage {
     }
 }
 
-async fn parse_error_message(response: reqwasm::http::Response) -> String {
+async fn parse_error_message(response: gloo_net::http::Response) -> String {
     #[derive(Deserialize)]
     struct ApiError {
         error: String,
@@ -416,7 +420,7 @@ async fn parse_error_message(response: reqwasm::http::Response) -> String {
     }
 }
 
-fn render_card(title: &str, content: Html) -> Html {
+pub(crate) fn render_card(title: &str, content: Html) -> Html {
     html! {
         <div class="min-h-screen flex items-center justify-center bg-gray-100 px-4">
             <div class="max-w-md w-full bg-white rounded-lg shadow p-8">
diff --git a/web_frontend/src/blocking_enabled.rs b/web_frontend/src/blocking_enabled.rs
index 6818a538..41ef1ac4 100644
--- a/web_frontend/src/blocking_enabled.rs
+++ b/web_frontend/src/blocking_enabled.rs
@@ -1,4 +1,4 @@
-use reqwasm::http::Request;
+use gloo_net::http::Request;
 use wasm_bindgen_futures::spawn_local;
 use yew::{classes, html, Component, Context, Html};
 
@@ -44,7 +44,7 @@ impl Component for BlockingEnabled {
             Message::EnableBlocking => {
                 self.button_state = ButtonState::Loading;
 
-                let request = base_request.body("true");
+                let request = base_request.body("true").unwrap();
 
                 spawn_local(async move {
                     match request.send().await {
@@ -60,7 +60,7 @@ impl Component for BlockingEnabled {
             Message::DisableBlocking => {
                 self.button_state = ButtonState::Loading;
 
-                let request = base_request.body("false");
+                let request = base_request.body("false").unwrap();
 
                 spawn_local(async move {
                     if let Ok(response) = request.send().await {
diff --git a/web_frontend/src/button.rs b/web_frontend/src/button.rs
index eed16c0b..f1eadbbc 100644
--- a/web_frontend/src/button.rs
+++ b/web_frontend/src/button.rs
@@ -1,7 +1,7 @@
 use web_sys::MouseEvent;
 use yew::{classes, html, Callback, Classes, Component, Context, Html, Properties};
 
-pub const BASE_BUTTON_CSS: [&'static str; 20] = [
+pub const BASE_BUTTON_CSS: [&str; 20] = [
     "inline-flex",
     "items-center",
     "justify-center",
@@ -62,6 +62,7 @@ pub struct Props {
     pub color: ButtonColor,
     pub button_text: String,
     pub onclick: Callback<MouseEvent>,
+    #[prop_or_default]
     pub children: Option<Html>,
 }
 
@@ -114,10 +115,10 @@ macro_rules! save_button {
     ($callback:expr) => {
         html! {
             <div class="mt-5">
-            <crate::button::PrivaxyButton
-                state={crate::button::ButtonState::Enabled}
+            <$crate::button::PrivaxyButton
+                state={$crate::button::ButtonState::Enabled}
                 onclick={$callback}
-                color={crate::button::ButtonColor::Green}
+                color={$crate::button::ButtonColor::Green}
                 button_text={"Save changes".to_string()}
                 children={Some(html!{
                     <svg xmlns="http://www.w3.org/2000/svg" class="-ml-0.5 mr-2 h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
@@ -131,10 +132,10 @@ macro_rules! save_button {
     ($callback:expr, $enabled:expr) => {
         html! {
             <div class="mt-5">
-            <crate::button::PrivaxyButton
+            <$crate::button::PrivaxyButton
                 state={$enabled}
                 onclick={$callback}
-                color={crate::button::ButtonColor::Green}
+                color={$crate::button::ButtonColor::Green}
                 button_text={"Save changes".to_string()}
                 children={Some(html!{
                     <svg xmlns="http://www.w3.org/2000/svg" class="-ml-0.5 mr-2 h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
@@ -148,7 +149,7 @@ macro_rules! save_button {
     ($callback:expr, $text:expr) => {
         html! {
             <div class="mt-5">
-            <crate::button::PrivaxyButton
+            <$crate::button::PrivaxyButton
                 state={ButtonState::Enabled}
                 onclick={$callback}
                 color={ButtonColor::Green}
diff --git a/web_frontend/src/dashboard.rs b/web_frontend/src/dashboard.rs
index 260aa96a..290d4167 100644
--- a/web_frontend/src/dashboard.rs
+++ b/web_frontend/src/dashboard.rs
@@ -1,9 +1,9 @@
 use crate::blocking_enabled::BlockingEnabled;
 use futures::future::{AbortHandle, Abortable};
 use futures::StreamExt;
+use gloo_net::websocket::futures::WebSocket;
 use gloo_timers::future::TimeoutFuture;
 use num_format::{Locale, ToFormattedString};
-use reqwasm::websocket::futures::WebSocket;
 use serde::Deserialize;
 use std::io::Cursor;
 use wasm_bindgen_futures::spawn_local;
@@ -53,7 +53,7 @@ impl Component for Dashboard {
                         match result {
                             Ok(msg) => {
                                 let message = match msg {
-                                    reqwasm::websocket::Message::Text(s) => {
+                                    gloo_net::websocket::Message::Text(s) => {
                                         let cursor = Cursor::new(s.as_bytes());
                                         let mut deserializer =
                                             serde_json::Deserializer::from_reader(cursor)
@@ -74,7 +74,7 @@ impl Component for Dashboard {
                                             }
                                         }
                                     }
-                                    reqwasm::websocket::Message::Bytes(_) => unreachable!(),
+                                    gloo_net::websocket::Message::Bytes(_) => unreachable!(),
                                 };
                                 message_callback.emit(message);
                             }
diff --git a/web_frontend/src/debug.rs b/web_frontend/src/debug.rs
index 8dea556b..438c5526 100644
--- a/web_frontend/src/debug.rs
+++ b/web_frontend/src/debug.rs
@@ -1,5 +1,5 @@
 use crate::logs::LogStream;
-use reqwasm::http::Request;
+use gloo_net::http::Request;
 use serde::{Deserialize, Serialize};
 use wasm_bindgen_futures::spawn_local;
 use web_sys::{HtmlInputElement, HtmlSelectElement};
@@ -229,6 +229,7 @@ impl DebugSettingsPage {
             match Request::put("/api/settings/debug")
                 .header("Content-Type", "application/json")
                 .body(body)
+                .unwrap()
                 .send()
                 .await
             {
diff --git a/web_frontend/src/exclude.rs b/web_frontend/src/exclude.rs
new file mode 100644
index 00000000..0f96bf50
--- /dev/null
+++ b/web_frontend/src/exclude.rs
@@ -0,0 +1,269 @@
+use crate::auth::render_card;
+use crate::button::{ButtonColor, ButtonState, PrivaxyButton};
+use crate::{failure_banner, success_banner, ApiError, Route};
+use gloo_net::http::Request;
+use serde::Deserialize;
+use wasm_bindgen_futures::spawn_local;
+use yew::{html, Component, Context, Html};
+use yew_router::prelude::*;
+
+const EXCLUSIONS_ADD_URL: &str = "/api/exclusions/add";
+
+pub(crate) enum AddOutcome {
+    Added,
+    AlreadyExcluded,
+}
+
+#[derive(Deserialize)]
+struct AddExclusionResponse {
+    added: bool,
+}
+
+/// Adds `host` to the exclusion list; no wildcard prefix is added. The append
+/// happens server-side under the configuration save lock
+/// (`POST /api/exclusions/add`), so concurrent adds — two panel rows, another
+/// browser tab — cannot overwrite each other the way a client-side
+/// GET-modify-PUT could. This is the single write path shared by
+/// [`ExcludePage`] and the TLS failures panel.
+pub(crate) async fn add_exclusion_exact(host: String) -> Result<AddOutcome, ApiError> {
+    let host = host.trim().to_string();
+    if host.is_empty() {
+        return Err(ApiError {
+            error: "No host provided".to_string(),
+        });
+    }
+
+    let request = Request::post(EXCLUSIONS_ADD_URL)
+        .header("Content-Type", "application/json")
+        .body(serde_json::to_string(&host).unwrap())
+        .unwrap();
+    let response = request.send().await.map_err(|err| ApiError {
+        error: format!("{err:?}"),
+    })?;
+    if !response.ok() {
+        return Err(api_error_from_response(response).await);
+    }
+
+    let outcome = response
+        .json::<AddExclusionResponse>()
+        .await
+        .map_err(|err| ApiError {
+            error: format!("{err:?}"),
+        })?;
+    if outcome.added {
+        Ok(AddOutcome::Added)
+    } else {
+        Ok(AddOutcome::AlreadyExcluded)
+    }
+}
+
+async fn api_error_from_response(response: gloo_net::http::Response) -> ApiError {
+    response.json::<ApiError>().await.unwrap_or(ApiError {
+        error: format!("HTTP {}", response.status()),
+    })
+}
+
+#[derive(Deserialize)]
+struct ExcludeQuery {
+    host: String,
+}
+
+#[derive(PartialEq, Eq)]
+enum Status {
+    Confirm,
+    InFlight,
+    AlreadyExcluded,
+    Excluded,
+}
+
+pub enum Message {
+    Submit,
+    ExclusionAdded,
+    HostAlreadyExcluded,
+    ExclusionFailed(ApiError),
+    AcknowledgeSuccess,
+    AcknowledgeError,
+}
+
+pub struct ExcludePage {
+    host: Option<String>,
+    status: Status,
+    show_success: bool,
+    show_error: bool,
+    error_message: String,
+}
+
+impl Component for ExcludePage {
+    type Message = Message;
+    type Properties = ();
+
+    fn create(ctx: &Context<Self>) -> Self {
+        let host = ctx
+            .link()
+            .location()
+            .and_then(|location| location.query::<ExcludeQuery>().ok())
+            .map(|query| query.host.trim().to_string())
+            .filter(|host| !host.is_empty());
+
+        Self {
+            host,
+            status: Status::Confirm,
+            show_success: false,
+            show_error: false,
+            error_message: String::new(),
+        }
+    }
+
+    fn update(&mut self, ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Message::Submit => {
+                if self.status == Status::InFlight {
+                    return false;
+                }
+                let Some(host) = self.host.clone() else {
+                    return false;
+                };
+                self.status = Status::InFlight;
+                self.show_error = false;
+                let link = ctx.link().clone();
+                spawn_local(async move {
+                    match add_exclusion_exact(host).await {
+                        Ok(AddOutcome::Added) => link.send_message(Message::ExclusionAdded),
+                        Ok(AddOutcome::AlreadyExcluded) => {
+                            link.send_message(Message::HostAlreadyExcluded)
+                        }
+                        Err(err) => link.send_message(Message::ExclusionFailed(err)),
+                    }
+                });
+            }
+            Message::ExclusionAdded => {
+                self.status = Status::Excluded;
+                self.show_success = true;
+            }
+            Message::HostAlreadyExcluded => {
+                self.status = Status::AlreadyExcluded;
+            }
+            Message::ExclusionFailed(err) => {
+                self.status = Status::Confirm;
+                self.show_error = true;
+                self.error_message = err.error;
+            }
+            Message::AcknowledgeSuccess => {
+                self.show_success = false;
+            }
+            Message::AcknowledgeError => {
+                self.show_error = false;
+            }
+        }
+        true
+    }
+
+    fn view(&self, ctx: &Context<Self>) -> Html {
+        let Some(host) = self.host.clone() else {
+            return render_card(
+                "Exclude host",
+                html! {
+                    <div class="text-gray-600 text-center">
+                        <p>
+                            {"No host was provided. Open this page from the proxy error page, or append "}
+                            <span class="font-mono bg-gray-100 rounded-md">{"?host=example.com"}</span>
+                            {" to the URL."}
+                        </p>
+                        { back_to_dashboard_link() }
+                    </div>
+                },
+            );
+        };
+
+        match self.status {
+            Status::Confirm | Status::InFlight => {
+                let button_state = if self.status == Status::InFlight {
+                    ButtonState::Loading
+                } else {
+                    ButtonState::Enabled
+                };
+                let onclick = ctx.link().callback(|_| Message::Submit);
+                let failure_banner = if self.show_error {
+                    failure_banner!(
+                        true,
+                        ctx.link().callback(|_| Message::AcknowledgeError),
+                        self.error_message.clone()
+                    )
+                } else {
+                    html! {}
+                };
+
+                render_card(
+                    "Exclude host",
+                    html! {
+                        <>
+                            { failure_banner }
+                            <div class="text-gray-600">
+                                <p>
+                                    {"You are about to exclude "}
+                                    <span class="font-mono bg-gray-100 rounded-md">{ host }</span>
+                                    {" from Privaxy."}
+                                </p>
+                                <p class="mt-2">
+                                    {"This host will bypass TLS interception and filtering."}
+                                </p>
+                            </div>
+                            <div class="mt-6 flex justify-center">
+                                <PrivaxyButton
+                                    state={button_state}
+                                    color={ButtonColor::Green}
+                                    button_text={"Exclude this host".to_string()}
+                                    {onclick} />
+                            </div>
+                        </>
+                    },
+                )
+            }
+            Status::AlreadyExcluded => render_card(
+                "Already excluded",
+                html! {
+                    <div class="text-gray-600 text-center">
+                        <p>
+                            <span class="font-mono bg-gray-100 rounded-md">{ host }</span>
+                            {" is already excluded. No changes were made."}
+                        </p>
+                        { back_to_dashboard_link() }
+                    </div>
+                },
+            ),
+            Status::Excluded => {
+                let success_banner = if self.show_success {
+                    success_banner!(true, ctx.link().callback(|_| Message::AcknowledgeSuccess))
+                } else {
+                    html! {}
+                };
+
+                render_card(
+                    "Host excluded",
+                    html! {
+                        <>
+                            { success_banner }
+                            <div class="text-gray-600 text-center">
+                                <p>
+                                    <span class="font-mono bg-gray-100 rounded-md">{ host }</span>
+                                    {" is now excluded. Privaxy will tunnel it without inspection. Reload the page that failed to load."}
+                                </p>
+                                { back_to_dashboard_link() }
+                            </div>
+                        </>
+                    },
+                )
+            }
+        }
+    }
+}
+
+fn back_to_dashboard_link() -> Html {
+    html! {
+        <div class="mt-6">
+            <Link<Route> classes="font-medium text-blue-600 hover:text-blue-500" to={Route::Dashboard}>
+                {"Back to dashboard"}
+            </Link<Route>>
+        </div>
+    }
+}
diff --git a/web_frontend/src/exclusions_page.rs b/web_frontend/src/exclusions_page.rs
new file mode 100644
index 00000000..90bd8304
--- /dev/null
+++ b/web_frontend/src/exclusions_page.rs
@@ -0,0 +1,65 @@
+use crate::settings_textarea::SettingsTextarea;
+use crate::tls_failures::TlsFailuresPanel;
+use yew::{html, Component, Context, Html};
+
+pub enum Message {
+    HostExcluded(String),
+}
+
+/// Exclusions settings page: the "Recent TLS interception failures" panel on
+/// top of the exclusion list textarea. Hosts excluded from the panel are
+/// passed to the textarea as `merge_lines`, which appends them to its
+/// contents in place — keeping the list current without remounting the
+/// component, so unsaved draft edits survive.
+pub struct ExclusionsPage {
+    excluded_hosts: Vec<String>,
+}
+
+impl Component for ExclusionsPage {
+    type Message = Message;
+    type Properties = ();
+
+    fn create(_ctx: &Context<Self>) -> Self {
+        Self {
+            excluded_hosts: Vec::new(),
+        }
+    }
+
+    fn update(&mut self, _ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Message::HostExcluded(host) => {
+                self.excluded_hosts.push(host);
+                true
+            }
+        }
+    }
+
+    fn view(&self, ctx: &Context<Self>) -> Html {
+        let on_excluded = ctx.link().callback(Message::HostExcluded);
+
+        let resource_url = "/api/exclusions";
+
+        let description = html! {<div class="text-gray-600">
+                <p>
+                    {"Exclusions are hosts or domains that are not passed through the MITM pipeline. "}
+                    {"Excluded entries will be transparently tunneled."}
+                </p>
+                <p class="mt-2">
+                    {"Use "}<span class="font-medium">{"Reset to defaults"}</span>
+                    {" to populate the textarea with a list of commonly cert-pinned hosts. You can then edit it and click Save."}
+                </p>
+            </div>
+        };
+        let textarea_description = "Insert one entry per line";
+        let defaults_url = Some("/api/exclusions/defaults".to_string());
+
+        html! {
+            <>
+                <TlsFailuresPanel {on_excluded} />
+                <div class="mt-8">
+                    <SettingsTextarea h1="Exclusions" {description} input_name="exclusions" {textarea_description} {resource_url} {defaults_url} merge_lines={self.excluded_hosts.clone()} />
+                </div>
+            </>
+        }
+    }
+}
diff --git a/web_frontend/src/filter_edit.rs b/web_frontend/src/filter_edit.rs
new file mode 100644
index 00000000..bf2308f9
--- /dev/null
+++ b/web_frontend/src/filter_edit.rs
@@ -0,0 +1,319 @@
+//! Modal for editing or deleting a configured filter list.
+//!
+//! Shared between the Filters page (per-entry edit button) and the
+//! filter-failures panel. Never rendered for built-in lists — the backend
+//! refuses to edit or remove those.
+
+use crate::button::{ButtonColor, ButtonState, PrivaxyButton};
+use crate::filters::{AddFilterRequest, FilterGroup};
+use crate::{failure_banner, ApiError};
+use gloo_net::http::Request;
+use serde::Serialize;
+use serde_with::{serde_as, DisplayFromStr};
+use url::Url;
+use wasm_bindgen_futures::spawn_local;
+use web_sys::{HtmlInputElement, HtmlSelectElement};
+use yew::prelude::*;
+
+const FILTERS_RESOURCE_URL: &str = "/api/filters";
+
+#[serde_as]
+#[derive(Debug, Clone, Serialize)]
+struct UpdateFilterRequest {
+    old_file_name: String,
+    title: String,
+    group: FilterGroup,
+    #[serde_as(as = "DisplayFromStr")]
+    url: Url,
+}
+
+#[derive(Properties, PartialEq)]
+pub struct Props {
+    /// File name of the entry being edited; identifies it to the backend
+    /// even when the URL (and thus the derived file name) changes.
+    pub file_name: String,
+    pub title: String,
+    pub url: String,
+    pub group: FilterGroup,
+    /// Emitted when the modal is dismissed without a change.
+    pub on_close: Callback<()>,
+    /// Emitted after a successful save or delete; the parent should unmount
+    /// the modal and reload its filter data.
+    pub on_changed: Callback<()>,
+}
+
+pub enum Message {
+    TitleChanged(String),
+    UrlChanged(String),
+    GroupChanged(FilterGroup),
+    Save,
+    Delete,
+    Succeeded,
+    Failed(String),
+    AcknowledgeError,
+}
+
+pub struct FilterEditModal {
+    title: String,
+    url: String,
+    group: FilterGroup,
+    busy: bool,
+    error: Option<String>,
+}
+
+impl FilterEditModal {
+    fn seed_from_props(props: &Props) -> (String, String, FilterGroup) {
+        (props.title.clone(), props.url.clone(), props.group)
+    }
+}
+
+impl Component for FilterEditModal {
+    type Message = Message;
+    type Properties = Props;
+
+    fn create(ctx: &Context<Self>) -> Self {
+        let (title, url, group) = Self::seed_from_props(ctx.props());
+        Self {
+            title,
+            url,
+            group,
+            busy: false,
+            error: None,
+        }
+    }
+
+    fn changed(&mut self, ctx: &Context<Self>, old_props: &Self::Properties) -> bool {
+        // Re-seed the form when the modal is switched to a different entry
+        // without being unmounted in between.
+        if ctx.props().file_name != old_props.file_name {
+            let (title, url, group) = Self::seed_from_props(ctx.props());
+            self.title = title;
+            self.url = url;
+            self.group = group;
+            self.busy = false;
+            self.error = None;
+        }
+        true
+    }
+
+    fn update(&mut self, ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Message::TitleChanged(title) => {
+                self.title = title;
+                true
+            }
+            Message::UrlChanged(url) => {
+                self.url = url;
+                true
+            }
+            Message::GroupChanged(group) => {
+                self.group = group;
+                true
+            }
+            Message::Save => {
+                if self.busy {
+                    return false;
+                }
+                let url = match Url::parse(&self.url) {
+                    Ok(url) => url,
+                    Err(err) => {
+                        self.error = Some(format!("Invalid URL: {err}"));
+                        return true;
+                    }
+                };
+                let request_body = UpdateFilterRequest {
+                    old_file_name: ctx.props().file_name.clone(),
+                    title: if self.title.is_empty() {
+                        self.url.clone()
+                    } else {
+                        self.title.clone()
+                    },
+                    group: self.group,
+                    url,
+                };
+                self.busy = true;
+                self.error = None;
+
+                let link = ctx.link().clone();
+                spawn_local(async move {
+                    let request = Request::patch(FILTERS_RESOURCE_URL)
+                        .header("Content-Type", "application/json")
+                        .body(serde_json::to_string(&request_body).unwrap())
+                        .unwrap();
+                    send_and_report(request.send().await, &link).await;
+                });
+                true
+            }
+            Message::Delete => {
+                if self.busy {
+                    return false;
+                }
+                // Delete by the entry's original URL, not the (possibly
+                // edited) form value.
+                let url = match Url::parse(&ctx.props().url) {
+                    Ok(url) => url,
+                    Err(err) => {
+                        self.error = Some(format!("Invalid URL: {err}"));
+                        return true;
+                    }
+                };
+                let request_body =
+                    AddFilterRequest::new(ctx.props().title.clone(), ctx.props().group, url);
+                self.busy = true;
+                self.error = None;
+
+                let link = ctx.link().clone();
+                spawn_local(async move {
+                    let request = Request::delete(FILTERS_RESOURCE_URL)
+                        .header("Content-Type", "application/json")
+                        .body(serde_json::to_string(&request_body).unwrap())
+                        .unwrap();
+                    send_and_report(request.send().await, &link).await;
+                });
+                true
+            }
+            Message::Succeeded => {
+                self.busy = false;
+                ctx.props().on_changed.emit(());
+                true
+            }
+            Message::Failed(error) => {
+                self.busy = false;
+                self.error = Some(error);
+                true
+            }
+            Message::AcknowledgeError => {
+                self.error = None;
+                true
+            }
+        }
+    }
+
+    fn view(&self, ctx: &Context<Self>) -> Html {
+        let failure_banner = match &self.error {
+            Some(message) => failure_banner!(
+                true,
+                ctx.link().callback(|_| Message::AcknowledgeError),
+                message.clone()
+            ),
+            None => html! {},
+        };
+
+        let group = self.group;
+        let options: Html = FilterGroup::values()
+            .into_iter()
+            .map(|option| {
+                html! {
+                    <option value={option.as_str()} selected={option == group}>
+                        {option.as_str()}
+                    </option>
+                }
+            })
+            .collect();
+
+        let action_state = if self.busy {
+            ButtonState::Loading
+        } else {
+            ButtonState::Enabled
+        };
+        let cancel_state = if self.busy {
+            ButtonState::Disabled
+        } else {
+            ButtonState::Enabled
+        };
+        let on_cancel = {
+            let on_close = ctx.props().on_close.clone();
+            Callback::from(move |_| on_close.emit(()))
+        };
+
+        html! {
+            <div class="fixed inset-0 bg-gray-600 bg-opacity-75 flex items-center justify-center z-50">
+                <div class="bg-white p-6 rounded-lg shadow-lg z-60 w-full max-w-xl">
+                    <div class="flex flex-col space-y-4">
+                        <h3 class="text-lg font-medium text-gray-900">{"Edit filter list"}</h3>
+                        { failure_banner }
+                        <div class="flex items-center">
+                            <div class="w-32">
+                                <label class="font-bold">{"Category"}</label>
+                            </div>
+                            <select class="flex-1 bg-white border border-gray-300 text-gray-700 py-2 px-4 pr-8 rounded leading-tight focus:outline-none focus:bg-white focus:border-gray-500"
+                                onchange={ctx.link().callback(|e: Event| {
+                                    let select = e.target_dyn_into::<HtmlSelectElement>().expect("event target should be a select element");
+                                    let value = select.value();
+                                    Message::GroupChanged(FilterGroup::values().into_iter().find(|group| group.as_str() == value).expect("invalid category"))
+                                })}
+                            >
+                                { options }
+                            </select>
+                        </div>
+                        <div class="flex items-center">
+                            <div class="w-32">
+                                <label class="font-bold">{"Title"}</label>
+                            </div>
+                            <input
+                                type="text"
+                                class="flex-1 bg-white border border-gray-300 text-gray-700 py-2 px-4 rounded leading-tight focus:outline-none focus:bg-white focus:border-gray-500"
+                                value={self.title.clone()}
+                                oninput={ctx.link().callback(|e: InputEvent| {
+                                    let input = e.target_dyn_into::<HtmlInputElement>().expect("event target should be an input element");
+                                    Message::TitleChanged(input.value())
+                                })}
+                            />
+                        </div>
+                        <div class="flex items-center">
+                            <div class="w-32">
+                                <label class="font-bold">{"EasyList URL"}</label>
+                            </div>
+                            <input
+                                type="text"
+                                class="flex-1 bg-white border border-gray-300 text-gray-700 py-2 px-4 rounded leading-tight focus:outline-none focus:bg-white focus:border-gray-500"
+                                value={self.url.clone()}
+                                oninput={ctx.link().callback(|e: InputEvent| {
+                                    let input = e.target_dyn_into::<HtmlInputElement>().expect("event target should be an input element");
+                                    Message::UrlChanged(input.value())
+                                })}
+                            />
+                        </div>
+                        <div class="flex space-x-4">
+                            <PrivaxyButton
+                                state={action_state}
+                                color={ButtonColor::Blue}
+                                button_text={"Save".to_string()}
+                                onclick={ctx.link().callback(|_| Message::Save)} />
+                            <PrivaxyButton
+                                state={cancel_state}
+                                color={ButtonColor::Gray}
+                                button_text={"Cancel".to_string()}
+                                onclick={on_cancel} />
+                            <div class="ml-auto">
+                                <PrivaxyButton
+                                    state={if self.busy { ButtonState::Loading } else { ButtonState::Enabled }}
+                                    color={ButtonColor::Red}
+                                    button_text={"Delete".to_string()}
+                                    onclick={ctx.link().callback(|_| Message::Delete)} />
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        }
+    }
+}
+
+async fn send_and_report(
+    result: Result<gloo_net::http::Response, gloo_net::Error>,
+    link: &yew::html::Scope<FilterEditModal>,
+) {
+    match result {
+        Ok(response) if response.ok() => link.send_message(Message::Succeeded),
+        Ok(response) => {
+            let err = response.json::<ApiError>().await.unwrap_or(ApiError {
+                error: format!("HTTP {}", response.status()),
+            });
+            link.send_message(Message::Failed(err.error));
+        }
+        Err(err) => {
+            link.send_message(Message::Failed(format!("{err:?}")));
+        }
+    }
+}
diff --git a/web_frontend/src/filter_failures.rs b/web_frontend/src/filter_failures.rs
new file mode 100644
index 00000000..71bc6209
--- /dev/null
+++ b/web_frontend/src/filter_failures.rs
@@ -0,0 +1,415 @@
+//! Notification panel for filter lists that fail to download or validate.
+//!
+//! Rendered at the top of the Filters page; hidden while every list is
+//! healthy. Failing user-added lists can be edited (via the shared
+//! [`FilterEditModal`]) or removed in place; built-in lists shipped with the
+//! package can only be disabled.
+
+use crate::button::{ButtonColor, ButtonState, PrivaxyButton};
+use crate::filter_edit::FilterEditModal;
+use crate::filters::{AddFilterRequest, FilterGroup, FilterStatusChangeRequest};
+use crate::{failure_banner, ApiError};
+use gloo_net::http::Request;
+use gloo_timers::callback::Interval;
+use serde::Deserialize;
+use std::collections::HashSet;
+use url::Url;
+use wasm_bindgen_futures::spawn_local;
+use yew::prelude::*;
+
+const FILTER_FAILURES_RESOURCE_URL: &str = "/api/filters/failures";
+const FILTERS_RESOURCE_URL: &str = "/api/filters";
+const REFRESH_INTERVAL_MILLISECONDS: u32 = 30_000;
+
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+pub struct FilterFailure {
+    pub file_name: String,
+    pub title: String,
+    pub url: String,
+    pub group: FilterGroup,
+    pub last_error: String,
+    pub last_seen: String,
+    pub count: u64,
+    pub is_default: bool,
+}
+
+#[derive(Properties, PartialEq)]
+pub struct Props {
+    /// Emitted after a successful edit, removal or disable, so the
+    /// surrounding page can reload its filter list.
+    pub on_changed: Callback<()>,
+}
+
+pub enum Message {
+    Refresh,
+    Loaded(u64, Vec<FilterFailure>),
+    LoadFailed(String),
+    OpenEdit(FilterFailure),
+    CloseEdit,
+    EditCompleted,
+    Remove(String),
+    Disable(String),
+    ActionSucceeded(String),
+    ActionFailed(String, String),
+    AcknowledgeError,
+}
+
+pub struct FilterFailuresPanel {
+    failures: Vec<FilterFailure>,
+    in_flight: HashSet<String>,
+    error_message: Option<String>,
+    editing: Option<FilterFailure>,
+    /// Bumped on every successful edit/removal/disable; a refresh snapshot
+    /// fetched under an older generation is stale (it may still contain the
+    /// acted-on entry) and is dropped instead of resurrecting removed rows.
+    refresh_generation: u64,
+    _refresh_interval: Interval,
+}
+
+impl Component for FilterFailuresPanel {
+    type Message = Message;
+    type Properties = Props;
+
+    fn create(ctx: &Context<Self>) -> Self {
+        ctx.link().send_message(Message::Refresh);
+
+        let link = ctx.link().clone();
+        let refresh_interval = Interval::new(REFRESH_INTERVAL_MILLISECONDS, move || {
+            link.send_message(Message::Refresh)
+        });
+
+        Self {
+            failures: Vec::new(),
+            in_flight: HashSet::new(),
+            error_message: None,
+            editing: None,
+            refresh_generation: 0,
+            _refresh_interval: refresh_interval,
+        }
+    }
+
+    fn update(&mut self, ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Message::Refresh => {
+                let link = ctx.link().clone();
+                let generation = self.refresh_generation;
+                spawn_local(async move {
+                    match Request::get(FILTER_FAILURES_RESOURCE_URL).send().await {
+                        Ok(response) if response.ok() => {
+                            match response.json::<Vec<FilterFailure>>().await {
+                                Ok(failures) => {
+                                    link.send_message(Message::Loaded(generation, failures))
+                                }
+                                Err(err) => {
+                                    link.send_message(Message::LoadFailed(format!("{err:?}")))
+                                }
+                            }
+                        }
+                        Ok(response) => {
+                            link.send_message(Message::LoadFailed(format!(
+                                "HTTP {}",
+                                response.status()
+                            )));
+                        }
+                        Err(err) => {
+                            link.send_message(Message::LoadFailed(format!("{err:?}")));
+                        }
+                    }
+                });
+                false
+            }
+            Message::Loaded(generation, failures) => {
+                if generation != self.refresh_generation {
+                    return false;
+                }
+                self.failures = failures;
+                true
+            }
+            Message::LoadFailed(error) => {
+                // The panel is a notification, not a page of its own; a
+                // failed poll stays quiet instead of alarming the operator.
+                log::error!("Failed to load filter failures: {error}");
+                false
+            }
+            Message::OpenEdit(failure) => {
+                self.editing = Some(failure);
+                true
+            }
+            Message::CloseEdit => {
+                self.editing = None;
+                true
+            }
+            Message::EditCompleted => {
+                if let Some(failure) = self.editing.take() {
+                    self.failures
+                        .retain(|entry| entry.file_name != failure.file_name);
+                    self.refresh_generation += 1;
+                    ctx.props().on_changed.emit(());
+                }
+                true
+            }
+            Message::Remove(file_name) => {
+                let Some(failure) = self
+                    .failures
+                    .iter()
+                    .find(|failure| failure.file_name == file_name)
+                else {
+                    return false;
+                };
+                let url = match Url::parse(&failure.url) {
+                    Ok(url) => url,
+                    Err(err) => {
+                        self.error_message = Some(format!("Invalid URL: {err}"));
+                        return true;
+                    }
+                };
+                let request_body = AddFilterRequest::new(failure.title.clone(), failure.group, url);
+                if !self.in_flight.insert(file_name.clone()) {
+                    return false;
+                }
+
+                let link = ctx.link().clone();
+                spawn_local(async move {
+                    let request = Request::delete(FILTERS_RESOURCE_URL)
+                        .header("Content-Type", "application/json")
+                        .body(serde_json::to_string(&request_body).unwrap())
+                        .unwrap();
+                    report_action(request.send().await, file_name, &link).await;
+                });
+                true
+            }
+            Message::Disable(file_name) => {
+                if !self.in_flight.insert(file_name.clone()) {
+                    return false;
+                }
+                let request_body = vec![FilterStatusChangeRequest::new(file_name.clone(), false)];
+
+                let link = ctx.link().clone();
+                spawn_local(async move {
+                    let request = Request::put(FILTERS_RESOURCE_URL)
+                        .header("Content-Type", "application/json")
+                        .body(serde_json::to_string(&request_body).unwrap())
+                        .unwrap();
+                    report_action(request.send().await, file_name, &link).await;
+                });
+                true
+            }
+            Message::ActionSucceeded(file_name) => {
+                self.in_flight.remove(&file_name);
+                self.failures
+                    .retain(|failure| failure.file_name != file_name);
+                self.refresh_generation += 1;
+                ctx.props().on_changed.emit(());
+                true
+            }
+            Message::ActionFailed(file_name, error) => {
+                self.in_flight.remove(&file_name);
+                self.error_message = Some(error);
+                true
+            }
+            Message::AcknowledgeError => {
+                self.error_message = None;
+                true
+            }
+        }
+    }
+
+    fn view(&self, ctx: &Context<Self>) -> Html {
+        if self.failures.is_empty() {
+            return html! {};
+        }
+
+        let failure_banner = match &self.error_message {
+            Some(message) => failure_banner!(
+                true,
+                ctx.link().callback(|_| Message::AcknowledgeError),
+                message.clone()
+            ),
+            None => html! {},
+        };
+
+        let edit_modal = match &self.editing {
+            Some(failure) => html! {
+                <FilterEditModal
+                    file_name={failure.file_name.clone()}
+                    title={failure.title.clone()}
+                    url={failure.url.clone()}
+                    group={failure.group}
+                    on_close={ctx.link().callback(|_| Message::CloseEdit)}
+                    on_changed={ctx.link().callback(|_| Message::EditCompleted)} />
+            },
+            None => html! {},
+        };
+
+        let rows = self
+            .failures
+            .iter()
+            .map(|failure| self.render_row(ctx, failure));
+
+        let heading = if self.failures.len() == 1 {
+            "A filter list is failing to update".to_string()
+        } else {
+            format!("{} filter lists are failing to update", self.failures.len())
+        };
+
+        html! {
+            <>
+                <div class="mb-8 rounded-md border border-red-300 bg-red-50 p-4">
+                    <div class="flex items-center">
+                        <svg xmlns="http://www.w3.org/2000/svg" class="h-6 w-6 text-red-600" fill="none"
+                            viewBox="0 0 24 24" stroke="currentColor">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+                                d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                        </svg>
+                        <h2 class="ml-2 text-lg font-medium text-red-800">{heading}</h2>
+                    </div>
+                    <p class="mt-2 text-sm text-red-700">
+                        {"These lists could not be downloaded or no longer serve valid filter rules. \
+                          Their previously downloaded rules stay active if a copy exists, but they will not receive updates. \
+                          Edit an entry to fix its URL, or remove it. Built-in lists can only be disabled."}
+                    </p>
+                    { failure_banner }
+                    <div class="mt-4 flex flex-col">
+                        <div class="-my-2 overflow-x-auto sm:-mx-6 lg:-mx-8">
+                            <div class="py-2 align-middle inline-block min-w-full sm:px-6 lg:px-8">
+                                <div class="shadow overflow-hidden border-b border-gray-200 sm:rounded-lg">
+                                    <table class="min-w-full divide-y divide-gray-200">
+                                        <thead class="bg-gray-50">
+                                            <tr>
+                                                <th scope="col"
+                                                    class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                                    {"Filter list"}
+                                                </th>
+                                                <th scope="col"
+                                                    class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                                    {"Error"}
+                                                </th>
+                                                <th scope="col"
+                                                    class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                                    {"Last attempt"}
+                                                </th>
+                                                <th scope="col"
+                                                    class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                                    {"Actions"}
+                                                </th>
+                                            </tr>
+                                        </thead>
+                                        <tbody class="w-full bg-white divide-y divide-gray-200">
+                                            { for rows }
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                { edit_modal }
+            </>
+        }
+    }
+}
+
+impl FilterFailuresPanel {
+    fn render_row(&self, ctx: &Context<Self>, failure: &FilterFailure) -> Html {
+        let is_in_flight = self.in_flight.contains(&failure.file_name);
+        let state = |busy: bool| {
+            if busy {
+                ButtonState::Loading
+            } else {
+                ButtonState::Enabled
+            }
+        };
+
+        let actions = if failure.is_default {
+            // Built-in lists cannot be edited or removed (the backend
+            // refuses); disabling resolves the failure until the package
+            // ships a fixed URL.
+            let on_disable = {
+                let file_name = failure.file_name.clone();
+                ctx.link()
+                    .callback(move |_| Message::Disable(file_name.clone()))
+            };
+            html! {
+                <div class="flex items-center space-x-2"
+                    title="This list is built into Privaxy and cannot be edited or removed.">
+                    <PrivaxyButton
+                        state={state(is_in_flight)}
+                        color={ButtonColor::Gray}
+                        button_text={"Disable".to_string()}
+                        onclick={on_disable} />
+                </div>
+            }
+        } else {
+            let on_edit = {
+                let failure = failure.clone();
+                ctx.link()
+                    .callback(move |_| Message::OpenEdit(failure.clone()))
+            };
+            let on_remove = {
+                let file_name = failure.file_name.clone();
+                ctx.link()
+                    .callback(move |_| Message::Remove(file_name.clone()))
+            };
+            html! {
+                <div class="flex space-x-2">
+                    <PrivaxyButton
+                        state={state(is_in_flight)}
+                        color={ButtonColor::Blue}
+                        button_text={"Edit".to_string()}
+                        onclick={on_edit} />
+                    <PrivaxyButton
+                        state={state(is_in_flight)}
+                        color={ButtonColor::Red}
+                        button_text={"Remove".to_string()}
+                        onclick={on_remove} />
+                </div>
+            }
+        };
+
+        html! {
+            <tr>
+                <td class="px-6 py-4 text-sm text-gray-900">
+                    <div>{&failure.title}</div>
+                    <div class="font-mono text-xs text-gray-500 break-all">{&failure.url}</div>
+                </td>
+                <td class="px-6 py-4 text-sm text-gray-500">
+                    <span title={failure.last_error.clone()}>{&failure.last_error}</span>
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
+                    <div>{&failure.last_seen}</div>
+                    <div class="text-xs">
+                        { if failure.count == 1 {
+                            "1 failed attempt".to_string()
+                        } else {
+                            format!("{} failed attempts", failure.count)
+                        }}
+                    </div>
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
+                    { actions }
+                </td>
+            </tr>
+        }
+    }
+}
+
+async fn report_action(
+    result: Result<gloo_net::http::Response, gloo_net::Error>,
+    file_name: String,
+    link: &yew::html::Scope<FilterFailuresPanel>,
+) {
+    match result {
+        Ok(response) if response.ok() => {
+            link.send_message(Message::ActionSucceeded(file_name));
+        }
+        Ok(response) => {
+            let err = response.json::<ApiError>().await.unwrap_or(ApiError {
+                error: format!("HTTP {}", response.status()),
+            });
+            link.send_message(Message::ActionFailed(file_name, err.error));
+        }
+        Err(err) => {
+            link.send_message(Message::ActionFailed(file_name, format!("{err:?}")));
+        }
+    }
+}
diff --git a/web_frontend/src/filterlists.rs b/web_frontend/src/filterlists.rs
index 87982f45..79d3d8b6 100644
--- a/web_frontend/src/filterlists.rs
+++ b/web_frontend/src/filterlists.rs
@@ -1,10 +1,7 @@
-use crate::button;
 use crate::button::{ButtonColor, ButtonState, PrivaxyButton};
 use crate::filters::{AddFilterRequest, Filter, FilterConfiguration, FilterGroup};
-use crate::save_button::BASE_BUTTON_CSS;
-use crate::{failure_banner, save_button, submit_banner, ApiError};
-use filterlists_api;
-use reqwasm::http::Request;
+use crate::{failure_banner, ApiError};
+use gloo_net::http::Request;
 use url::Url;
 use wasm_bindgen_futures::spawn_local;
 use web_sys::HtmlInputElement;
@@ -44,7 +41,7 @@ pub struct SearchFilterList {
     error_message: Option<String>,
 }
 
-const FILTER_TAG_GROUPS: [&'static str; 4] = ["ads", "privacy", "malware", "social"];
+const FILTER_TAG_GROUPS: [&str; 4] = ["ads", "privacy", "malware", "social"];
 
 #[derive(Properties, PartialEq)]
 pub struct Props {
@@ -123,7 +120,8 @@ impl Component for SearchFilterList {
                     let request_body = AddFilterRequest::new(filter_name, group, parsed_url);
                     let request = Request::post("/api/filters")
                         .header("Content-Type", "application/json")
-                        .body(serde_json::to_string(&request_body).unwrap());
+                        .body(serde_json::to_string(&request_body).unwrap())
+                        .unwrap();
                     match request.send().await {
                         Ok(response) if response.ok() => {
                             log::info!("Filter added successfully");
@@ -159,7 +157,8 @@ impl Component for SearchFilterList {
                         AddFilterRequest::new(filter_name, FilterGroup::Malware, parsed_url);
                     let request = Request::delete("/api/filters")
                         .header("Content-Type", "application/json")
-                        .body(serde_json::to_string(&request_body).unwrap());
+                        .body(serde_json::to_string(&request_body).unwrap())
+                        .unwrap();
                     match request.send().await {
                         Ok(response) => {
                             if response.ok() {
@@ -295,7 +294,7 @@ impl Component for SearchFilterList {
             }
             SearchFilterMessage::AcknowledgeError => self.error_message = None,
             SearchFilterMessage::Error(error) => {
-                log::error!("Error loading filters: {}", error.to_string());
+                log::error!("Error loading filters: {}", error);
                 self.loading = false;
             }
             SearchFilterMessage::NextPage => {
diff --git a/web_frontend/src/filters.rs b/web_frontend/src/filters.rs
index 0b7ea0f0..611513ac 100644
--- a/web_frontend/src/filters.rs
+++ b/web_frontend/src/filters.rs
@@ -1,7 +1,9 @@
 use crate::button::ButtonState;
+use crate::filter_edit::FilterEditModal;
+use crate::filter_failures::FilterFailuresPanel;
 use crate::filterlists::SearchFilterList;
 use crate::{failure_banner, save_button, submit_banner, ApiError};
-use reqwasm::http::Request;
+use gloo_net::http::Request;
 use serde::{Deserialize, Serialize};
 use serde_json::de::IoRead;
 use serde_json::StreamDeserializer;
@@ -143,7 +145,8 @@ impl Component for AddFilterComponent {
 
                 let request = Request::post("/api/filters")
                     .header("Content-Type", "application/json")
-                    .body(serde_json::to_string(&request_body).unwrap());
+                    .body(serde_json::to_string(&request_body).unwrap())
+                    .unwrap();
 
                 let link = self.link.clone();
                 spawn_local(async move {
@@ -238,7 +241,7 @@ impl Component for AddFilterComponent {
             .collect();
 
         let url = self.url.clone();
-        let category = self.category.clone();
+        let category = self.category;
         let title = self.title.clone();
 
         let failure_banner = if self.show_error {
@@ -309,7 +312,7 @@ impl Component for AddFilterComponent {
                                         />
                                     </div>
                                     <div class="flex space-x-4">
-                                        <button onclick={_ctx.link().callback(move |_| AddFilterMessage::Save(url.clone(), title.clone(), category.clone()))} class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-2 px-4 rounded z-60">{"Save"}</button>
+                                        <button onclick={_ctx.link().callback(move |_| AddFilterMessage::Save(url.clone(), title.clone(), category))} class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-2 px-4 rounded z-60">{"Save"}</button>
                                         <button onclick={_ctx.link().callback(|_| AddFilterMessage::Close)} class="bg-gray-500 hover:bg-gray-700 text-white font-bold py-2 px-4 rounded z-60">{"Cancel"}</button>
                                     </div>
                                 </div>
@@ -330,6 +333,10 @@ pub struct Filter {
     pub title: String,
     group: FilterGroup,
     file_name: String,
+    pub url: String,
+    /// Whether this is one of the built-in lists shipped with the package;
+    /// those can only be enabled/disabled, never edited or removed.
+    pub is_default: bool,
 }
 
 impl Filter {
@@ -339,6 +346,8 @@ impl Filter {
             title,
             group,
             file_name,
+            url: String::new(),
+            is_default: false,
         }
     }
 }
@@ -360,6 +369,12 @@ pub struct FilterStatusChangeRequest {
     file_name: String,
 }
 
+impl FilterStatusChangeRequest {
+    pub fn new(file_name: String, enabled: bool) -> Self {
+        Self { enabled, file_name }
+    }
+}
+
 pub type FilterConfiguration = Vec<Filter>;
 
 pub enum Message {
@@ -369,27 +384,33 @@ pub enum Message {
     Save,
     ChangesSaved,
     AckChanges,
+    OpenEdit(Filter),
+    CloseEdit,
+    EditCompleted,
 }
 
 pub struct Filters {
     filter_configuration: Option<FilterConfiguration>,
     filter_configuration_before_changes: Option<FilterConfiguration>,
     changes_saved: bool,
+    editing_filter: Option<Filter>,
 }
 
 impl Filters {
     fn configuration_has_changed(&self) -> bool {
         self.filter_configuration != self.filter_configuration_before_changes
     }
+    #[allow(dead_code)]
     pub fn get_filters(&self) -> Vec<Filter> {
         self.filter_configuration.as_ref().unwrap().clone()
     }
 
+    #[allow(dead_code)]
     pub fn has_filter(&self, filter: &Filter) -> bool {
         self.filter_configuration
             .as_ref()
             .unwrap()
-            .into_iter()
+            .iter()
             .any(|f| f.file_name == filter.file_name)
     }
 }
@@ -405,6 +426,7 @@ impl Component for Filters {
             filter_configuration: None,
             filter_configuration_before_changes: None,
             changes_saved: false,
+            editing_filter: None,
         }
     }
 
@@ -459,20 +481,16 @@ impl Component for Filters {
 
                 let request = Request::put("/api/filters")
                     .header("Content-Type", "application/json")
-                    .body(serde_json::to_string(&request_body).unwrap());
+                    .body(serde_json::to_string(&request_body).unwrap())
+                    .unwrap();
 
                 let callback = ctx.link().callback(|message: Message| message);
 
                 spawn_local(async move {
-                    match request.send().await {
-                        Ok(response) => {
-                            if response.ok() {
-                                callback.emit(Message::ChangesSaved);
-
-                                return;
-                            }
+                    if let Ok(response) = request.send().await {
+                        if response.ok() {
+                            callback.emit(Message::ChangesSaved);
                         }
-                        Err(_) => {}
                     }
                 });
 
@@ -481,22 +499,27 @@ impl Component for Filters {
             Message::UpdateFilterSelection((filter_name, enabled)) => {
                 self.changes_saved = false;
 
-                self.filter_configuration
+                if let Some(filter) = self
+                    .filter_configuration
                     .as_mut()
                     .unwrap()
                     .iter_mut()
                     .find(|filter| filter.file_name == filter_name)
-                    .and_then(|filter| {
-                        filter.enabled = enabled;
-
-                        Some(filter)
-                    });
+                {
+                    filter.enabled = enabled;
+                }
             }
             Message::ChangesSaved => {
                 self.changes_saved = true;
                 self.filter_configuration_before_changes = self.filter_configuration.clone();
             }
             Message::AckChanges => self.changes_saved = false,
+            Message::OpenEdit(filter) => self.editing_filter = Some(filter),
+            Message::CloseEdit => self.editing_filter = None,
+            Message::EditCompleted => {
+                self.editing_filter = None;
+                ctx.link().send_message(Message::Load);
+            }
         };
 
         true
@@ -518,6 +541,7 @@ impl Component for Filters {
             });
         log::debug!("Retrieved callback.");
         let save_callback = ctx.link().callback(|_| Message::Save);
+        let edit_callback = ctx.link().callback(Message::OpenEdit);
         let render_category_filter = |filter: &Filter| {
             let filter_file_name = filter.file_name.clone();
             let filter_enabled = filter.enabled;
@@ -526,6 +550,26 @@ impl Component for Filters {
             let checkbox_callback = Callback::from(move |_| {
                 callback_clone.emit((filter_file_name.to_string(), !filter_enabled))
             });
+            // Built-in lists shipped with the package can only be toggled;
+            // user-added lists also get an edit (rename/delete) button.
+            let edit_button = if filter.is_default {
+                html! {}
+            } else {
+                let edit_callback = edit_callback.clone();
+                let filter_clone = filter.clone();
+                html! {
+                    <button type="button"
+                        class="mr-4 text-gray-400 hover:text-blue-600"
+                        title="Edit or remove this filter list"
+                        onclick={Callback::from(move |_| edit_callback.emit(filter_clone.clone()))}>
+                        <svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none"
+                            viewBox="0 0 24 24" stroke="currentColor">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+                                d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z" />
+                        </svg>
+                    </button>
+                }
+            };
             log::debug!("Returning category filter.");
             html! {
             <div class="relative flex items-start py-4">
@@ -533,6 +577,7 @@ impl Component for Filters {
                     <label for={filter.file_name.clone()} class="select-none">{&filter.title}</label>
                 </div>
                 <div class="ml-3 flex items-center h-5">
+                    { edit_button }
                     <input checked={filter.enabled} onchange={checkbox_callback} name={filter.file_name.clone()} type="checkbox"
                         class="focus:ring-blue-500 h-4 w-4 text-blue-600 border-gray-300 rounded" />
                 </div>
@@ -591,12 +636,27 @@ impl Component for Filters {
             </div>
         };
 
+        let edit_modal = match &self.editing_filter {
+            Some(filter) => html! {
+                <FilterEditModal
+                    file_name={filter.file_name.clone()}
+                    title={filter.title.clone()}
+                    url={filter.url.clone()}
+                    group={filter.group}
+                    on_close={ctx.link().callback(|_| Message::CloseEdit)}
+                    on_changed={ctx.link().callback(|_| Message::EditCompleted)} />
+            },
+            None => html! {},
+        };
+
         match &self.filter_configuration {
             Some(filter_configuration) => {
                 html! {
                         <>
                             { title }
+                            <FilterFailuresPanel on_changed={ctx.link().callback(|_| Message::Load)} />
                             {success_banner}
+                            { edit_modal }
                             <div class="mb-5 flex space-x-4">
                                 <AddFilterComponent state={save_button::SaveButtonState::Enabled}/>
                                 <SearchFilterList filter_configuration={filter_configuration.clone()}/>
diff --git a/web_frontend/src/general.rs b/web_frontend/src/general.rs
index e9958e0e..7c0f3ee9 100644
--- a/web_frontend/src/general.rs
+++ b/web_frontend/src/general.rs
@@ -3,9 +3,9 @@ use crate::button::{get_css, ButtonColor};
 use crate::failure_banner;
 use crate::success_banner;
 use crate::{save_button, ApiError};
+use gloo_net::http::Request;
 use gloo_utils::format::JsValueSerdeExt;
 use regex::Regex;
-use reqwasm::http::Request;
 use serde::{Deserialize, Serialize};
 use wasm_bindgen::prelude::*;
 use wasm_bindgen::JsCast;
@@ -36,6 +36,7 @@ pub enum Message {
     ValidationSucceeded,
     CaSaveSuccess,
     UpdateTls(bool),
+    UpdateGuiUrl(String),
     UpdateDohMode(String),
     UpdateDohUpstream(String),
     UpdateDohHosts(String),
@@ -44,6 +45,7 @@ pub enum Message {
     AcknowledgeError,
     AcknowledgeSuccess,
 }
+#[allow(dead_code)]
 enum SettingType {
     Text(String),
     Checkbox(bool),
@@ -60,6 +62,11 @@ pub struct NetworkConfig {
     pub web_port: u16,
     /// Enable TLS for the web server.
     pub tls: bool,
+    /// Full base URL of the web GUI as reachable by clients (e.g. behind a
+    /// reverse proxy). Empty when unset; always serialized so that an empty
+    /// string clears the setting server-side.
+    #[serde(default)]
+    pub gui_url: String,
     /// DNS-over-HTTPS interception policy.
     #[serde(default)]
     pub doh: DohConfig,
@@ -127,9 +134,10 @@ async fn save_ca_certificate(cert_pem: &str, key_pem: &str) -> Result<(), ApiErr
         ca_private_key: key_pem,
     })
     .unwrap();
-    let req = reqwasm::http::Request::put("/api/settings/ca-certificate")
+    let req = gloo_net::http::Request::put("/api/settings/ca-certificate")
+        .header("Content-Type", "application/json")
         .body(body)
-        .header("Content-Type", "application/json");
+        .unwrap();
     match req.send().await {
         Ok(resp) => {
             if resp.ok() {
@@ -182,24 +190,37 @@ impl NetworkSettings {
         }
     }
 
+    /// The backend rejects a GUI URL without an http(s) scheme; mirror that
+    /// here so the save button is disabled instead of the save failing.
+    fn gui_url_error(&self) -> Option<String> {
+        let url = self.current_config.gui_url.trim();
+        if url.is_empty() || url.starts_with("http://") || url.starts_with("https://") {
+            None
+        } else {
+            Some("Must be a full URL starting with http:// or https://".to_string())
+        }
+    }
+
     fn validate(&self) -> bool {
         self.proxy_port_error.is_none()
             && self.bind_addr_error.is_none()
             && self.web_port_error.is_none()
             && self.doh_upstream_error().is_none()
+            && self.gui_url_error().is_none()
     }
     fn config_has_changed(&self) -> bool {
         self.current_config.clone() != self.remote_config
     }
     async fn save(&mut self) -> Result<(), ApiError> {
         let body = serde_json::to_string(&self.current_config).unwrap();
-        let req = reqwasm::http::Request::put("/api/settings/network")
+        let req = gloo_net::http::Request::put("/api/settings/network")
+            .header("Content-Type", "application/json")
             .body(body)
-            .header("Content-Type", "application/json");
+            .unwrap();
         match req.send().await {
             Ok(resp) => {
                 if resp.ok() {
-                    return Ok(());
+                    Ok(())
                 } else {
                     log::error!("Failed to save network config");
                     return Err(resp.json::<ApiError>().await.unwrap());
@@ -215,9 +236,11 @@ impl NetworkSettings {
     }
 }
 
+#[allow(clippy::large_enum_variant)]
 enum SettingCategories {
     Network(NetworkSettings),
     Certificate(CaConfig),
+    #[allow(dead_code)]
     Other,
 }
 
@@ -226,6 +249,7 @@ pub(crate) struct GeneralSettings {
     network_settings: Option<NetworkSettings>,
     ca_config: CaConfig,
     loading: bool,
+    #[allow(dead_code)]
     save_callback: Callback<()>,
     show_error: bool,
     show_success: bool,
@@ -233,6 +257,7 @@ pub(crate) struct GeneralSettings {
 }
 
 impl GeneralSettings {
+    #[allow(dead_code)]
     fn save(&self) {
         self.save_callback.emit(());
     }
@@ -434,6 +459,11 @@ impl Component for GeneralSettings {
                     network_settings.current_config.tls = value;
                 }
             }
+            Message::UpdateGuiUrl(value) => {
+                if let Some(ref mut network_settings) = self.network_settings {
+                    network_settings.current_config.gui_url = value;
+                }
+            }
             Message::UpdateDohMode(value) => {
                 if let Some(ref mut network_settings) = self.network_settings {
                     network_settings.current_config.doh.mode = DohMode::from_value(&value);
@@ -632,6 +662,16 @@ impl Component for GeneralSettings {
                                             Message::UpdateTls(input.checked())
                                         }),
                                         "If the web server uses HTTPS") }
+                                    { render_setting(
+                                        "GUI URL",
+                                        network_settings.current_config.gui_url.clone(),
+                                        ctx.link().callback(|e: InputEvent| {
+                                            let input: web_sys::HtmlInputElement = e.target_unchecked_into();
+                                            Message::UpdateGuiUrl(input.value())
+                                        }),
+                                        network_settings.gui_url_error().as_ref(),
+                                        "Optional. Full URL where this web interface is reachable by clients, e.g. http://proxy.example.lan when behind a reverse proxy. Used for links back here on proxy error pages. Leave blank to derive it from the bound address."
+                                    ) }
                                     { render_select_setting(
                                         "DoH handling",
                                         network_settings.current_config.doh.mode.as_value(),
diff --git a/web_frontend/src/logs.rs b/web_frontend/src/logs.rs
index 0eedb02c..51645b18 100644
--- a/web_frontend/src/logs.rs
+++ b/web_frontend/src/logs.rs
@@ -1,6 +1,6 @@
 use futures::future::{AbortHandle, Abortable};
 use futures::StreamExt;
-use reqwasm::websocket::futures::WebSocket;
+use gloo_net::websocket::futures::WebSocket;
 use serde::Deserialize;
 use wasm_bindgen_futures::spawn_local;
 use web_sys::HtmlSelectElement;
@@ -36,7 +36,7 @@ impl LogEntry {
 
 /// Minimum severity selected in the level dropdown.
 #[derive(Clone, Copy, PartialEq)]
-enum LevelFilter {
+pub enum LevelFilter {
     All,
     Error,
     Warn,
@@ -100,10 +100,10 @@ impl Component for LogStream {
             async move {
                 while let Some(Ok(msg)) = read.next().await {
                     let entry = match msg {
-                        reqwasm::websocket::Message::Text(s) => {
+                        gloo_net::websocket::Message::Text(s) => {
                             serde_json::from_str::<LogEntry>(&s).unwrap()
                         }
-                        reqwasm::websocket::Message::Bytes(_) => unreachable!(),
+                        gloo_net::websocket::Message::Bytes(_) => unreachable!(),
                     };
 
                     message_callback.emit(entry);
diff --git a/web_frontend/src/main.rs b/web_frontend/src/main.rs
index 1908c072..dcc34317 100644
--- a/web_frontend/src/main.rs
+++ b/web_frontend/src/main.rs
@@ -1,4 +1,4 @@
-use reqwasm::http::Request;
+use gloo_net::http::Request;
 use serde::Deserialize;
 use wasm_bindgen_futures::spawn_local;
 use yew::functional::*;
@@ -11,6 +11,10 @@ mod blocking_enabled;
 mod button;
 mod dashboard;
 mod debug;
+mod exclude;
+mod exclusions_page;
+mod filter_edit;
+mod filter_failures;
 mod filterlists;
 mod filters;
 mod general;
@@ -21,6 +25,7 @@ mod save_button;
 mod settings;
 mod settings_textarea;
 mod submit_banner;
+mod tls_failures;
 
 #[derive(Debug, Deserialize, Clone)]
 pub(crate) struct ApiError {
@@ -35,6 +40,8 @@ enum Route {
     Requests,
     #[at("/settings/:s")]
     Settings,
+    #[at("/exclude")]
+    Exclude,
     #[not_found]
     #[at("/404")]
     NotFound,
@@ -61,7 +68,7 @@ fn not_found() -> Html {
      }
 }
 
-fn switch(route: &Route) -> Html {
+fn switch(route: Route) -> Html {
     fn get_classes(current_route: Route, for_route_link: Route) -> Classes {
         if current_route == for_route_link {
             classes!(
@@ -96,9 +103,9 @@ fn switch(route: &Route) -> Html {
               <img class="h-8 w-auto text-white" src="/logo.svg" alt="Logo" />
             </div>
               <div class="flex ml-6 space-x-4">
-              <Link<Route> classes={ get_classes(*route, Route::Dashboard) } to={Route::Dashboard}>{ "Dashboard" }</Link<Route>>
-               <Link<Route> classes={ get_classes(*route, Route::Requests) } to={Route::Requests}>{ "Requests" }</Link<Route>>
-               <Link<settings::SettingsRoute> classes={ get_classes(*route, Route::Settings) } to={settings::SettingsRoute::Filters}>{ "Settings" }</Link<settings::SettingsRoute>>
+              <Link<Route> classes={ get_classes(route, Route::Dashboard) } to={Route::Dashboard}>{ "Dashboard" }</Link<Route>>
+               <Link<Route> classes={ get_classes(route, Route::Requests) } to={Route::Requests}>{ "Requests" }</Link<Route>>
+               <Link<settings::SettingsRoute> classes={ get_classes(route, Route::Settings) } to={settings::SettingsRoute::Filters}>{ "Settings" }</Link<settings::SettingsRoute>>
                </div>
           </div>
           <LogoutButton />
@@ -117,7 +124,11 @@ fn switch(route: &Route) -> Html {
             html! { <>{navigation} <div class={"container mt-4 mb-10 mx-auto px-4 sm:px-6 lg:px-8"}> <requests::Requests /> </div></> }
         }
         Route::Settings => {
-            html! {<>{navigation} <div class={"container mt-4 mb-10 mx-auto px-4 sm:px-6 lg:px-8"}> <Switch<settings::SettingsRoute> render={Switch::render(settings::switch_settings)} /> </div> </>}
+            html! {<>{navigation} <div class={"container mt-4 mb-10 mx-auto px-4 sm:px-6 lg:px-8"}> <Switch<settings::SettingsRoute> render={settings::switch_settings} /> </div> </>}
+        }
+        Route::Exclude => {
+            set_title("Exclude host");
+            html! { <>{navigation} <div class={"container mt-4 mb-10 mx-auto px-4 sm:px-6 lg:px-8"}> <exclude::ExcludePage /> </div></> }
         }
         Route::NotFound => {
             set_title("Not Found");
@@ -131,7 +142,7 @@ fn app() -> Html {
     html! {
         <auth::AuthGate>
             <BrowserRouter>
-                <Switch<Route> render={Switch::render(switch)} />
+                <Switch<Route> render={switch} />
             </BrowserRouter>
         </auth::AuthGate>
     }
@@ -166,5 +177,5 @@ fn set_title(title: &str) {
 fn main() {
     wasm_logger::init(wasm_logger::Config::default());
 
-    yew::start_app::<App>();
+    yew::Renderer::<App>::new().render();
 }
diff --git a/web_frontend/src/pac.rs b/web_frontend/src/pac.rs
index 82363cb0..fa6c456d 100644
--- a/web_frontend/src/pac.rs
+++ b/web_frontend/src/pac.rs
@@ -1,6 +1,6 @@
 use crate::save_button;
 use crate::{failure_banner, success_banner, ApiError};
-use reqwasm::http::Request;
+use gloo_net::http::Request;
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 use wasm_bindgen_futures::spawn_local;
@@ -213,10 +213,7 @@ impl Component for PacSettingsPage {
             Message::UpdateDirectCidrs(value) => {
                 if let Some(form) = self.form.as_mut() {
                     form.direct_cidrs = value;
-                    form.cidrs_error = match PacFormState::parse_cidrs(&form.direct_cidrs) {
-                        Ok(_) => None,
-                        Err(err) => Some(err),
-                    };
+                    form.cidrs_error = PacFormState::parse_cidrs(&form.direct_cidrs).err();
                 }
             }
             Message::UpdateDirectFqdns(value) => {
@@ -250,7 +247,8 @@ impl Component for PacSettingsPage {
                     };
                     let request = Request::put(PAC_RESOURCE_URL)
                         .header("Content-Type", "application/json")
-                        .body(body);
+                        .body(body)
+                        .unwrap();
                     match request.send().await {
                         Ok(response) if response.ok() => {
                             link.send_message(Message::LoadSuccess(settings));
diff --git a/web_frontend/src/requests.rs b/web_frontend/src/requests.rs
index 3bb21ee4..699cb73f 100644
--- a/web_frontend/src/requests.rs
+++ b/web_frontend/src/requests.rs
@@ -1,6 +1,6 @@
 use futures::future::{AbortHandle, Abortable};
 use futures::StreamExt;
-use reqwasm::websocket::futures::WebSocket;
+use gloo_net::websocket::futures::WebSocket;
 use serde::Deserialize;
 use wasm_bindgen_futures::spawn_local;
 use yew::{html, Component, Context, Html};
@@ -35,10 +35,10 @@ impl Component for Requests {
             async move {
                 while let Some(Ok(msg)) = read.next().await {
                     let message = match msg {
-                        reqwasm::websocket::Message::Text(s) => {
+                        gloo_net::websocket::Message::Text(s) => {
                             serde_json::from_str::<Message>(&s).unwrap()
                         }
-                        reqwasm::websocket::Message::Bytes(_) => unreachable!(),
+                        gloo_net::websocket::Message::Bytes(_) => unreachable!(),
                     };
 
                     message_callback.emit(message);
diff --git a/web_frontend/src/save_button.rs b/web_frontend/src/save_button.rs
index 81fde995..88130b91 100644
--- a/web_frontend/src/save_button.rs
+++ b/web_frontend/src/save_button.rs
@@ -1,7 +1,8 @@
 use web_sys::MouseEvent;
 use yew::{classes, html, Callback, Component, Context, Html, Properties};
 
-pub const BASE_BUTTON_CSS: [&'static str; 20] = [
+#[allow(dead_code)]
+pub const BASE_BUTTON_CSS: [&str; 20] = [
     "inline-flex",
     "items-center",
     "justify-center",
diff --git a/web_frontend/src/settings.rs b/web_frontend/src/settings.rs
index acb22aa0..0fd78c01 100644
--- a/web_frontend/src/settings.rs
+++ b/web_frontend/src/settings.rs
@@ -1,5 +1,6 @@
 use crate::account::AccountSettings;
 use crate::debug::DebugSettingsPage;
+use crate::exclusions_page::ExclusionsPage;
 use crate::filters::Filters;
 use crate::general::GeneralSettings;
 use crate::pac::PacSettingsPage;
@@ -27,7 +28,7 @@ pub enum SettingsRoute {
     Debug,
 }
 
-pub fn switch_settings(route: &SettingsRoute) -> Html {
+pub fn switch_settings(route: SettingsRoute) -> Html {
     fn get_classes(current_route: SettingsRoute, for_route_link: SettingsRoute) -> Classes {
         if current_route == for_route_link {
             classes!(
@@ -71,23 +72,7 @@ pub fn switch_settings(route: &SettingsRoute) -> Html {
         SettingsRoute::Exclusions => {
             set_title("Settings - Exclusions");
 
-            let resource_url = "/api/exclusions";
-
-            let description = html! {<div class="text-gray-600">
-                    <p>
-                        {"Exclusions are hosts or domains that are not passed through the MITM pipeline. "}
-                        {"Excluded entries will be transparently tunneled."}
-                    </p>
-                    <p class="mt-2">
-                        {"Use "}<span class="font-medium">{"Reset to defaults"}</span>
-                        {" to populate the textarea with a list of commonly cert-pinned hosts. You can then edit it and click Save."}
-                    </p>
-                </div>
-            };
-            let textarea_description = "Insert one entry per line";
-            let defaults_url = Some("/api/exclusions/defaults".to_string());
-
-            html! {<SettingsTextarea h1="Exclusions" {description} input_name="exclusions" {textarea_description} {resource_url} {defaults_url} />}
+            html! { <ExclusionsPage /> }
         }
         SettingsRoute::CustomFilters => {
             set_title("Settings - Custom Filters");
@@ -123,13 +108,13 @@ pub fn switch_settings(route: &SettingsRoute) -> Html {
 
     html! {<div class="md:grid md:grid-cols-8">
     <nav class="space-y-1 mt-4 lg:col-span-1 sm:col-span-2" aria-label="Sidebar">
-        <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::General)} to={SettingsRoute::General}> <span class="truncate">{ "General" }</span></Link<SettingsRoute>>
-        <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::Filters)} to={SettingsRoute::Filters}> <span class="truncate">{ "Filters" }</span></Link<SettingsRoute>>
-        <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::Exclusions)} to={SettingsRoute::Exclusions}> <span class="truncate">{ "Exclusions" }</span></Link<SettingsRoute>>
-        <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::CustomFilters)} to={SettingsRoute::CustomFilters}> <span class="truncate">{ "Custom filters" }</span></Link<SettingsRoute>>
-        <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::Pac)} to={SettingsRoute::Pac}> <span class="truncate">{ "PAC" }</span></Link<SettingsRoute>>
-        <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::Account)} to={SettingsRoute::Account}> <span class="truncate">{ "Account" }</span></Link<SettingsRoute>>
-        <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::Debug)} to={SettingsRoute::Debug}> <span class="truncate">{ "Debug" }</span></Link<SettingsRoute>>
+        <Link<SettingsRoute> classes={get_classes(route, SettingsRoute::General)} to={SettingsRoute::General}> <span class="truncate">{ "General" }</span></Link<SettingsRoute>>
+        <Link<SettingsRoute> classes={get_classes(route, SettingsRoute::Filters)} to={SettingsRoute::Filters}> <span class="truncate">{ "Filters" }</span></Link<SettingsRoute>>
+        <Link<SettingsRoute> classes={get_classes(route, SettingsRoute::Exclusions)} to={SettingsRoute::Exclusions}> <span class="truncate">{ "Exclusions" }</span></Link<SettingsRoute>>
+        <Link<SettingsRoute> classes={get_classes(route, SettingsRoute::CustomFilters)} to={SettingsRoute::CustomFilters}> <span class="truncate">{ "Custom filters" }</span></Link<SettingsRoute>>
+        <Link<SettingsRoute> classes={get_classes(route, SettingsRoute::Pac)} to={SettingsRoute::Pac}> <span class="truncate">{ "PAC" }</span></Link<SettingsRoute>>
+        <Link<SettingsRoute> classes={get_classes(route, SettingsRoute::Account)} to={SettingsRoute::Account}> <span class="truncate">{ "Account" }</span></Link<SettingsRoute>>
+        <Link<SettingsRoute> classes={get_classes(route, SettingsRoute::Debug)} to={SettingsRoute::Debug}> <span class="truncate">{ "Debug" }</span></Link<SettingsRoute>>
     </nav>
         <div class="container mx-auto px-4 sm:px-6 lg:px-8 mt-4 sm:col-span-6">{ content }</div>
     </div>
diff --git a/web_frontend/src/settings_textarea.rs b/web_frontend/src/settings_textarea.rs
index 36d3a926..3ac99064 100644
--- a/web_frontend/src/settings_textarea.rs
+++ b/web_frontend/src/settings_textarea.rs
@@ -1,11 +1,10 @@
 use crate::save_button;
 use crate::submit_banner;
-use crate::success_banner;
-use reqwasm::http::Request;
+use gloo_net::http::Request;
 use wasm_bindgen_futures::spawn_local;
 use web_sys::HtmlInputElement;
 use yew::virtual_dom::VNode;
-use yew::{html, Callback, Component, Context, Html, InputEvent, Properties, TargetCast};
+use yew::{html, Component, Context, Html, InputEvent, Properties, TargetCast};
 
 #[derive(Properties, PartialEq)]
 pub struct Props {
@@ -18,6 +17,11 @@ pub struct Props {
     pub defaults_url: Option<String>,
     #[prop_or_default]
     pub defaults_button_label: Option<String>,
+    /// Lines added to the resource elsewhere (e.g. the TLS-failures panel's
+    /// Exclude action) that should appear in the textarea without a reload.
+    /// New entries are appended in place, preserving unsaved draft edits.
+    #[prop_or_default]
+    pub merge_lines: Vec<String>,
 }
 
 pub struct SettingsTextarea {
@@ -27,6 +31,21 @@ pub struct SettingsTextarea {
     previous_input_data: String,
 }
 
+/// Append `line` to `target` unless an existing (trimmed) line already
+/// matches it.
+fn merge_missing_line(target: &mut String, line: &str) {
+    if target.lines().any(|existing| existing.trim() == line) {
+        return;
+    }
+
+    let trimmed = target.trim_end();
+    *target = if trimmed.is_empty() {
+        line.to_string()
+    } else {
+        format!("{trimmed}\n{line}")
+    };
+}
+
 pub enum Message {
     LoadCurrentState,
     UpdateInput(String),
@@ -67,7 +86,8 @@ impl Component for SettingsTextarea {
 
                 let request = Request::put(&ctx.props().resource_url)
                     .header("Content-Type", "application/json")
-                    .body(&serde_json::to_string(&self.input_data).unwrap());
+                    .body(serde_json::to_string(&self.input_data).unwrap())
+                    .unwrap();
 
                 spawn_local(async move {
                     if let Ok(response) = request.send().await {
@@ -129,7 +149,28 @@ impl Component for SettingsTextarea {
         true
     }
 
-    fn changed(&mut self, ctx: &Context<Self>) -> bool {
+    fn changed(&mut self, ctx: &Context<Self>, old_props: &Self::Properties) -> bool {
+        let props = ctx.props();
+
+        // A pure `merge_lines` change appends the new entries in place: the
+        // server already has them, so both the draft and the saved-state
+        // snapshot gain the lines, and unsaved user edits are preserved
+        // (a reload here would silently discard them).
+        if props.resource_url == old_props.resource_url
+            && props.merge_lines != old_props.merge_lines
+        {
+            for line in &props.merge_lines {
+                let line = line.trim();
+                if line.is_empty() {
+                    continue;
+                }
+                merge_missing_line(&mut self.input_data, line);
+                merge_missing_line(&mut self.previous_input_data, line);
+            }
+
+            return true;
+        }
+
         ctx.link().send_message(Message::UpdateInput(String::new()));
         ctx.link().send_message(Message::LoadCurrentState);
 
@@ -207,7 +248,7 @@ impl Component for SettingsTextarea {
             <div class="mt-4">
                 <label for={props.input_name.clone()} class="block text-sm font-medium text-gray-700">{&props.textarea_description}</label>
                 <div class="mt-1">
-                    <textarea {oninput} value={self.input_data.clone()} rows="8" name={props.input_name.clone()} id={props.input_name.clone()} class="shadow-sm focus:ring-blue-500 focus:border-blue-500 block w-full sm:text-sm border-gray-300 rounded-md"></textarea>
+                    <textarea {oninput} value={self.input_data.clone()} rows="8" name={props.input_name.clone()} id={props.input_name.clone()} class="shadow-sm focus:ring-blue-500 focus:border-blue-500 block w-full sm:text-sm border-gray-300 rounded-md" />
                 </div>
             </div>
             <div class="flex items-center">
diff --git a/web_frontend/src/submit_banner.rs b/web_frontend/src/submit_banner.rs
index 0b142a97..6537c533 100644
--- a/web_frontend/src/submit_banner.rs
+++ b/web_frontend/src/submit_banner.rs
@@ -74,7 +74,7 @@ impl Component for SubmitBanner {
         }
     }
 
-    fn changed(&mut self, ctx: &Context<Self>) -> bool {
+    fn changed(&mut self, ctx: &Context<Self>, _old_props: &Self::Properties) -> bool {
         if ctx.props().visible && self.transition == TransitionState::Hidden {
             ctx.link().send_message(Msg::Show);
         }
@@ -143,7 +143,7 @@ macro_rules! info_icon {
 macro_rules! success_banner {
     ($visible:expr, $on_hide:expr) => {
         html! {
-            <crate::submit_banner::SubmitBanner message="Changes saved" icon={crate::info_icon!()} color={crate::submit_banner::Color::Green} visible={$visible} on_hide={$on_hide}/>
+            <$crate::submit_banner::SubmitBanner message="Changes saved" icon={$crate::info_icon!()} color={$crate::submit_banner::Color::Green} visible={$visible} on_hide={$on_hide}/>
         }
     };
 }
@@ -152,12 +152,12 @@ macro_rules! success_banner {
 macro_rules! failure_banner {
     ($visible:expr, $on_hide:expr) => {
         html! {
-            <crate::submit_banner::SubmitBanner message="Error saving changes" icon={crate::info_icon!()} color={crate::submit_banner::Color::Red} visible={$visible} on_hide={$on_hide}/>
+            <$crate::submit_banner::SubmitBanner message="Error saving changes" icon={$crate::info_icon!()} color={$crate::submit_banner::Color::Red} visible={$visible} on_hide={$on_hide}/>
         }
     };
     ($visible:expr, $on_hide:expr, $message:expr) => {
         html! {
-            <crate::submit_banner::SubmitBanner message={$message} icon={crate::info_icon!()} color={crate::submit_banner::Color::Red} visible={$visible} on_hide={$on_hide}/>
+            <$crate::submit_banner::SubmitBanner message={$message} icon={$crate::info_icon!()} color={$crate::submit_banner::Color::Red} visible={$visible} on_hide={$on_hide}/>
         }
     };
 }
diff --git a/web_frontend/src/tls_failures.rs b/web_frontend/src/tls_failures.rs
new file mode 100644
index 00000000..21e1b9af
--- /dev/null
+++ b/web_frontend/src/tls_failures.rs
@@ -0,0 +1,327 @@
+use crate::button::{ButtonColor, ButtonState, PrivaxyButton};
+use crate::exclude::add_exclusion_exact;
+use crate::{failure_banner, ApiError};
+use gloo_net::http::Request;
+use gloo_timers::callback::Interval;
+use serde::Deserialize;
+use std::collections::HashSet;
+use wasm_bindgen_futures::spawn_local;
+use yew::{html, Callback, Component, Context, Html, Properties};
+
+const TLS_FAILURES_RESOURCE_URL: &str = "/api/tls-failures";
+const TLS_FAILURES_IGNORE_URL: &str = "/api/tls-failures/ignore";
+const REFRESH_INTERVAL_MILLISECONDS: u32 = 30_000;
+
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+pub struct TlsFailure {
+    pub host: String,
+    pub last_seen: String,
+    pub count: u64,
+    pub likely_pinning: bool,
+    pub last_error: String,
+}
+
+#[derive(Properties, PartialEq)]
+pub struct Props {
+    /// Emitted with the excluded host after a successful Exclude action.
+    pub on_excluded: Callback<String>,
+}
+
+pub enum Message {
+    Refresh,
+    Loaded(u64, Vec<TlsFailure>),
+    LoadFailed(String),
+    Exclude(String),
+    Ignore(String),
+    Excluded(String),
+    Ignored(String),
+    ActionFailed(String, String),
+    AcknowledgeError,
+}
+
+pub struct TlsFailuresPanel {
+    failures: Vec<TlsFailure>,
+    in_flight: HashSet<String>,
+    error_message: Option<String>,
+    load_failed: bool,
+    /// Bumped on every successful Exclude/Ignore; a refresh snapshot fetched
+    /// under an older generation is stale (it may still contain the acted-on
+    /// host) and is dropped instead of resurrecting removed rows.
+    refresh_generation: u64,
+    _refresh_interval: Interval,
+}
+
+impl Component for TlsFailuresPanel {
+    type Message = Message;
+    type Properties = Props;
+
+    fn create(ctx: &Context<Self>) -> Self {
+        ctx.link().send_message(Message::Refresh);
+
+        let link = ctx.link().clone();
+        let refresh_interval = Interval::new(REFRESH_INTERVAL_MILLISECONDS, move || {
+            link.send_message(Message::Refresh)
+        });
+
+        Self {
+            failures: Vec::new(),
+            in_flight: HashSet::new(),
+            error_message: None,
+            load_failed: false,
+            refresh_generation: 0,
+            _refresh_interval: refresh_interval,
+        }
+    }
+
+    fn update(&mut self, ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Message::Refresh => {
+                let link = ctx.link().clone();
+                let generation = self.refresh_generation;
+                spawn_local(async move {
+                    match Request::get(TLS_FAILURES_RESOURCE_URL).send().await {
+                        Ok(response) if response.ok() => {
+                            match response.json::<Vec<TlsFailure>>().await {
+                                Ok(failures) => {
+                                    link.send_message(Message::Loaded(generation, failures))
+                                }
+                                Err(err) => {
+                                    link.send_message(Message::LoadFailed(format!("{err:?}")))
+                                }
+                            }
+                        }
+                        Ok(response) => {
+                            link.send_message(Message::LoadFailed(format!(
+                                "HTTP {}",
+                                response.status()
+                            )));
+                        }
+                        Err(err) => {
+                            link.send_message(Message::LoadFailed(format!("{err:?}")));
+                        }
+                    }
+                });
+                false
+            }
+            Message::Loaded(generation, failures) => {
+                if generation != self.refresh_generation {
+                    return false;
+                }
+                self.failures = failures;
+                self.load_failed = false;
+                true
+            }
+            Message::LoadFailed(error) => {
+                log::error!("Failed to load TLS failures: {error}");
+                self.load_failed = true;
+                true
+            }
+            Message::Exclude(host) => {
+                if !self.in_flight.insert(host.clone()) {
+                    return false;
+                }
+                let link = ctx.link().clone();
+                spawn_local(async move {
+                    match add_exclusion_exact(host.clone()).await {
+                        Ok(_) => link.send_message(Message::Excluded(host)),
+                        Err(err) => link.send_message(Message::ActionFailed(host, err.error)),
+                    }
+                });
+                true
+            }
+            Message::Ignore(host) => {
+                if !self.in_flight.insert(host.clone()) {
+                    return false;
+                }
+                let link = ctx.link().clone();
+                spawn_local(async move {
+                    let request = Request::post(TLS_FAILURES_IGNORE_URL)
+                        .header("Content-Type", "application/json")
+                        .body(serde_json::to_string(&host).unwrap())
+                        .unwrap();
+                    match request.send().await {
+                        Ok(response) if response.ok() => link.send_message(Message::Ignored(host)),
+                        Ok(response) => {
+                            let err = response.json::<ApiError>().await.unwrap_or(ApiError {
+                                error: format!("HTTP {}", response.status()),
+                            });
+                            link.send_message(Message::ActionFailed(host, err.error));
+                        }
+                        Err(err) => {
+                            link.send_message(Message::ActionFailed(host, format!("{err:?}")));
+                        }
+                    }
+                });
+                true
+            }
+            Message::Excluded(host) => {
+                self.in_flight.remove(&host);
+                self.failures.retain(|failure| failure.host != host);
+                self.refresh_generation += 1;
+                ctx.props().on_excluded.emit(host);
+                true
+            }
+            Message::Ignored(host) => {
+                self.in_flight.remove(&host);
+                self.failures.retain(|failure| failure.host != host);
+                self.refresh_generation += 1;
+                true
+            }
+            Message::ActionFailed(host, error) => {
+                self.in_flight.remove(&host);
+                self.error_message = Some(error);
+                true
+            }
+            Message::AcknowledgeError => {
+                self.error_message = None;
+                true
+            }
+        }
+    }
+
+    fn view(&self, ctx: &Context<Self>) -> Html {
+        let failure_banner = match &self.error_message {
+            Some(message) => failure_banner!(
+                true,
+                ctx.link().callback(|_| Message::AcknowledgeError),
+                message.clone()
+            ),
+            None => html! {},
+        };
+
+        let content = if self.failures.is_empty() {
+            // A failed load must not masquerade as the reassuring empty
+            // state — the difference matters when diagnosing a pinned app.
+            if self.load_failed {
+                html! {
+                    <p class="mt-4 text-sm text-red-700">
+                        {"Could not load TLS interception failures. Reload the page to retry."}
+                    </p>
+                }
+            } else {
+                html! {
+                    <p class="mt-4 text-sm text-gray-500">{"No recent TLS interception failures."}</p>
+                }
+            }
+        } else {
+            let rows = self
+                .failures
+                .iter()
+                .map(|failure| self.render_row(ctx, failure));
+
+            html! {
+                <div class="mt-4 flex flex-col">
+                    <div class="-my-2 overflow-x-auto sm:-mx-6 lg:-mx-8">
+                        <div class="py-2 align-middle inline-block min-w-full sm:px-6 lg:px-8">
+                            <div class="shadow overflow-hidden border-b border-gray-200 sm:rounded-lg">
+                                <table class="min-w-full divide-y divide-gray-200">
+                                    <thead class="bg-gray-50">
+                                        <tr>
+                                            <th scope="col"
+                                                class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                                {"Host"}
+                                            </th>
+                                            <th scope="col"
+                                                class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                                {"Last seen"}
+                                            </th>
+                                            <th scope="col"
+                                                class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                                {"Count"}
+                                            </th>
+                                            <th scope="col"
+                                                class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                                {"Actions"}
+                                            </th>
+                                        </tr>
+                                    </thead>
+                                    <tbody class="w-full bg-white divide-y divide-gray-200">
+                                        { for rows }
+                                    </tbody>
+                                </table>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            }
+        };
+
+        html! {
+            <>
+                <div class="pt-1.5 mb-4">
+                    <h2 class="text-xl font-bold text-gray-900">{"Recent TLS interception failures"}</h2>
+                </div>
+                <p class="text-gray-600">
+                    {"These hosts recently failed the TLS handshake while being intercepted, which often means they use certificate pinning. Excluding a host makes Privaxy tunnel it without inspection; ignoring it only hides it from this list."}
+                </p>
+                { failure_banner }
+                { content }
+            </>
+        }
+    }
+}
+
+impl TlsFailuresPanel {
+    fn render_row(&self, ctx: &Context<Self>, failure: &TlsFailure) -> Html {
+        let is_in_flight = self.in_flight.contains(&failure.host);
+        let exclude_state = if is_in_flight {
+            ButtonState::Loading
+        } else {
+            ButtonState::Enabled
+        };
+        let ignore_state = if is_in_flight {
+            ButtonState::Loading
+        } else {
+            ButtonState::Enabled
+        };
+
+        let on_exclude = {
+            let host = failure.host.clone();
+            ctx.link().callback(move |_| Message::Exclude(host.clone()))
+        };
+        let on_ignore = {
+            let host = failure.host.clone();
+            ctx.link().callback(move |_| Message::Ignore(host.clone()))
+        };
+
+        let pinning_badge = if failure.likely_pinning {
+            html! {
+                <span class="ml-2 inline-flex items-center px-2.5 py-0.5 rounded-md text-xs font-medium bg-gray-100 text-gray-800"
+                    title="This host appears to use certificate pinning: it only accepts its own certificates and rejects the ones Privaxy generates.">
+                    {"pinning?"}
+                </span>
+            }
+        } else {
+            html! {}
+        };
+
+        html! {
+            <tr>
+                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-900">
+                    <span class="font-mono" title={failure.last_error.clone()}>{&failure.host}</span>
+                    { pinning_badge }
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
+                    {&failure.last_seen}
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
+                    {failure.count.to_string()}
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
+                    <div class="flex space-x-2">
+                        <PrivaxyButton
+                            state={exclude_state}
+                            color={ButtonColor::Green}
+                            button_text={"Exclude".to_string()}
+                            onclick={on_exclude} />
+                        <PrivaxyButton
+                            state={ignore_state}
+                            color={ButtonColor::Gray}
+                            button_text={"Ignore".to_string()}
+                            onclick={on_ignore} />
+                    </div>
+                </td>
+            </tr>
+        }
+    }
+}