diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml
index 9e33cbe1..5f2dedc8 100644
--- a/.github/workflows/backend-tests.yml
+++ b/.github/workflows/backend-tests.yml
@@ -8,174 +8,193 @@ jobs:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: Linux without plugins
     runs-on: ubuntu-latest
-
     strategy:
       fail-fast: false
       matrix:
         node: [12, 14, 16]
-
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: ${{ matrix.node }}
-
-    - name: Install libreoffice
-      run: |
-        sudo add-apt-repository -y ppa:libreoffice/ppa
-        sudo apt update
-        sudo apt install -y --no-install-recommends libreoffice libreoffice-pdfimport
-
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: Run the backend tests
-      run: cd src && npm test
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install libreoffice
+        run: |
+          sudo add-apt-repository -y ppa:libreoffice/ppa
+          sudo apt update
+          sudo apt install -y --no-install-recommends libreoffice libreoffice-pdfimport
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: Run the backend tests
+        run: cd src && npm test
 
   withpluginsLinux:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: Linux with Plugins
     runs-on: ubuntu-latest
-
     strategy:
       fail-fast: false
       matrix:
         node: [12, 14, 16]
-
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: ${{ matrix.node }}
-
-    - name: Install libreoffice
-      run: |
-        sudo add-apt-repository -y ppa:libreoffice/ppa
-        sudo apt update
-        sudo apt install -y --no-install-recommends libreoffice libreoffice-pdfimport
-
-    - name: Install Etherpad plugins
-      # The --legacy-peer-deps flag is required to work around a bug in npm v7:
-      # https://github.com/npm/cli/issues/2199
-      run: >
-        npm install --no-save --legacy-peer-deps
-        ep_align
-        ep_author_hover
-        ep_cursortrace
-        ep_font_size
-        ep_hash_auth
-        ep_headings2
-        ep_image_upload
-        ep_markdown
-        ep_readonly_guest
-        ep_set_title_on_pad
-        ep_spellcheck
-        ep_subscript_and_superscript
-        ep_table_of_contents
-
-    # This must be run after installing the plugins, otherwise npm will try to
-    # hoist common dependencies by removing them from src/node_modules and
-    # installing them in the top-level node_modules. As of v6.14.10, npm's hoist
-    # logic appears to be buggy, because it sometimes removes dependencies from
-    # src/node_modules but fails to add them to the top-level node_modules. Even
-    # if npm correctly hoists the dependencies, the hoisting seems to confuse
-    # tools such as `npm outdated`, `npm update`, and some ESLint rules.
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: Run the backend tests
-      run: cd src && npm test
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install libreoffice
+        run: |
+          sudo add-apt-repository -y ppa:libreoffice/ppa
+          sudo apt update
+          sudo apt install -y --no-install-recommends libreoffice libreoffice-pdfimport
+      -
+        name: Install Etherpad plugins
+        # The --legacy-peer-deps flag is required to work around a bug in npm v7:
+        # https://github.com/npm/cli/issues/2199
+        run: >
+          npm install --no-save --legacy-peer-deps
+          ep_align
+          ep_author_hover
+          ep_cursortrace
+          ep_font_size
+          ep_hash_auth
+          ep_headings2
+          ep_image_upload
+          ep_markdown
+          ep_readonly_guest
+          ep_set_title_on_pad
+          ep_spellcheck
+          ep_subscript_and_superscript
+          ep_table_of_contents
+      # Etherpad core dependencies must be installed after installing the
+      # plugin's dependencies, otherwise npm will try to hoist common
+      # dependencies by removing them from src/node_modules and installing them
+      # in the top-level node_modules. As of v6.14.10, npm's hoist logic appears
+      # to be buggy, because it sometimes removes dependencies from
+      # src/node_modules but fails to add them to the top-level node_modules.
+      # Even if npm correctly hoists the dependencies, the hoisting seems to
+      # confuse tools such as `npm outdated`, `npm update`, and some ESLint
+      # rules.
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: Run the backend tests
+        run: cd src && npm test
 
   withoutpluginsWindows:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: Windows without plugins
     runs-on: windows-latest
-
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installOnWindows.bat
-
-    - name:  Fix up the settings.json
-      run: |
-            powershell -Command "(gc settings.json.template) -replace '\"max\": 10', '\"max\": 10000' | Out-File -encoding ASCII settings.json.holder"
-            powershell -Command "(gc settings.json.holder) -replace '\"points\": 10', '\"points\": 1000' | Out-File -encoding ASCII settings.json"
-
-    - name: Run the backend tests
-      run: cd src && npm test
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installOnWindows.bat
+      -
+        name:  Fix up the settings.json
+        run: |
+          powershell -Command "(gc settings.json.template) -replace '\"max\": 10', '\"max\": 10000' | Out-File -encoding ASCII settings.json.holder"
+          powershell -Command "(gc settings.json.holder) -replace '\"points\": 10', '\"points\": 1000' | Out-File -encoding ASCII settings.json"
+      -
+        name: Run the backend tests
+        run: cd src && npm test
 
   withpluginsWindows:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: Windows with Plugins
     runs-on: windows-latest
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install Etherpad plugins
-      # The --legacy-peer-deps flag is required to work around a bug in npm v7:
-      # https://github.com/npm/cli/issues/2199
-      run: >
-        npm install --no-save --legacy-peer-deps
-        ep_align
-        ep_author_hover
-        ep_cursortrace
-        ep_font_size
-        ep_hash_auth
-        ep_headings2
-        ep_image_upload
-        ep_markdown
-        ep_readonly_guest
-        ep_set_title_on_pad
-        ep_spellcheck
-        ep_subscript_and_superscript
-        ep_table_of_contents
-
-    # This must be run after installing the plugins, otherwise npm will try to
-    # hoist common dependencies by removing them from src/node_modules and
-    # installing them in the top-level node_modules. As of v6.14.10, npm's hoist
-    # logic appears to be buggy, because it sometimes removes dependencies from
-    # src/node_modules but fails to add them to the top-level node_modules. Even
-    # if npm correctly hoists the dependencies, the hoisting seems to confuse
-    # tools such as `npm outdated`, `npm update`, and some ESLint rules.
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installOnWindows.bat
-
-    - name:  Fix up the settings.json
-      run: |
-            powershell -Command "(gc settings.json.template) -replace '\"max\": 10', '\"max\": 10000' | Out-File -encoding ASCII settings.json.holder"
-            powershell -Command "(gc settings.json.holder) -replace '\"points\": 10', '\"points\": 1000' | Out-File -encoding ASCII settings.json"
-
-    - name: Run the backend tests
-      run: cd src && npm test
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install Etherpad plugins
+        # The --legacy-peer-deps flag is required to work around a bug in npm
+        # v7: https://github.com/npm/cli/issues/2199
+        run: >
+          npm install --no-save --legacy-peer-deps
+          ep_align
+          ep_author_hover
+          ep_cursortrace
+          ep_font_size
+          ep_hash_auth
+          ep_headings2
+          ep_image_upload
+          ep_markdown
+          ep_readonly_guest
+          ep_set_title_on_pad
+          ep_spellcheck
+          ep_subscript_and_superscript
+          ep_table_of_contents
+      # Etherpad core dependencies must be installed after installing the
+      # plugin's dependencies, otherwise npm will try to hoist common
+      # dependencies by removing them from src/node_modules and installing them
+      # in the top-level node_modules. As of v6.14.10, npm's hoist logic appears
+      # to be buggy, because it sometimes removes dependencies from
+      # src/node_modules but fails to add them to the top-level node_modules.
+      # Even if npm correctly hoists the dependencies, the hoisting seems to
+      # confuse tools such as `npm outdated`, `npm update`, and some ESLint
+      # rules.
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installOnWindows.bat
+      -
+        name:  Fix up the settings.json
+        run: |
+          powershell -Command "(gc settings.json.template) -replace '\"max\": 10', '\"max\": 10000' | Out-File -encoding ASCII settings.json.holder"
+          powershell -Command "(gc settings.json.holder) -replace '\"points\": 10', '\"points\": 1000' | Out-File -encoding ASCII settings.json"
+      -
+        name: Run the backend tests
+        run: cd src && npm test
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index f3b1cf2c..4fa9785f 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -13,42 +13,25 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
-
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      # Override language selection by uncommenting this and choosing your languages
-      # with:
-      #   languages: go, javascript, csharp, python, cpp, java
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          # We must fetch at least the immediate parents so that if this is
+          # a pull request then we can checkout the head.
+          fetch-depth: 2
+      # If this run was triggered by a pull request event, then checkout
+      # the head of the pull request instead of the merge commit.
+      -
+        run: git checkout HEAD^2
+        if: ${{ github.event_name == 'pull_request' }}
+      -
+        name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+      -
+        name: Autobuild
+        uses: github/codeql-action/autobuild@v1
+      -
+        name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 00000000..ef728a6e
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,74 @@
+name: Docker
+on:
+  pull_request:
+  push:
+    branches:
+      - 'develop'
+    tags:
+      - 'v?[0-9]+.[0-9]+.[0-9]+'
+env:
+  TEST_TAG: etherpad/etherpad:test
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Check out
+        uses: actions/checkout@v2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Build and export to Docker
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          load: true
+          tags: ${{ env.TEST_TAG }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      -
+        name: Set up Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: 'lts/*'
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Test
+        run: |
+          docker run --rm -d -p 9001:9001 ${{ env.TEST_TAG }}
+          ./src/bin/installDeps.sh
+          sleep 3
+          (cd src && npm run test-container)
+          git clean -dxf .
+      -
+        name: Docker meta
+        if: github.event_name == 'push'
+        id: meta
+        uses: docker/metadata-action@v3
+        with:
+          images: etherpad/etherpad
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+      -
+        name: Log in to Docker Hub
+        if: github.event_name == 'push'
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build and push
+        if: github.event_name == 'push'
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/dockerfile.yml b/.github/workflows/dockerfile.yml
deleted file mode 100644
index 5f838470..00000000
--- a/.github/workflows/dockerfile.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: "Dockerfile"
-
-# any branch is useful for testing before a PR is submitted
-on: [push, pull_request]
-
-jobs:
-  dockerfile:
-    # run on pushes to any branch
-    # run on PRs from external forks
-    if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
-    name: build image and run connectivity test
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - name: docker build
-      run: |
-        docker build -t etherpad:test .
-        docker run -d -p 9001:9001 etherpad:test
-        ./src/bin/installDeps.sh
-        sleep 3 # delay for startup?
-        cd src && npm run test-container
diff --git a/.github/workflows/frontend-admin-tests.yml b/.github/workflows/frontend-admin-tests.yml
index 5fb0f39c..54537e84 100644
--- a/.github/workflows/frontend-admin-tests.yml
+++ b/.github/workflows/frontend-admin-tests.yml
@@ -14,68 +14,85 @@ jobs:
         node: [12, 14, 16]
 
     steps:
-    - name: Generate Sauce Labs strings
-      id: sauce_strings
-      run: |
-        printf %s\\n '::set-output name=name::${{ github.workflow }} - ${{ github.job }} - Node ${{ matrix.node }}'
-        printf %s\\n '::set-output name=tunnel_id::${{ github.run_id }}-${{ github.run_number }}-${{ github.job }}-node${{ matrix.node }}'
-
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: ${{ matrix.node }}
-
-    - name: Install etherpad plugins
-      # We intentionally install an old ep_align version to test upgrades to the minor version number.
-      # The --legacy-peer-deps flag is required to work around a bug in npm v7:
-      # https://github.com/npm/cli/issues/2199
-      run: npm install --no-save --legacy-peer-deps ep_align@0.2.27
-
-    # This must be run after installing the plugins, otherwise npm will try to
-    # hoist common dependencies by removing them from src/node_modules and
-    # installing them in the top-level node_modules. As of v6.14.10, npm's hoist
-    # logic appears to be buggy, because it sometimes removes dependencies from
-    # src/node_modules but fails to add them to the top-level node_modules. Even
-    # if npm correctly hoists the dependencies, the hoisting seems to confuse
-    # tools such as `npm outdated`, `npm update`, and some ESLint rules.
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    # Nuke plugin tests
-    - name: Install etherpad plugins
-      run: rm -Rf node_modules/ep_align/static/tests/*
-
-    - name: export GIT_HASH to env
-      id: environment
-      run: echo "::set-output name=sha_short::$(git rev-parse --short ${{ github.sha }})"
-
-    - name: Create settings.json
-      run: cp settings.json.template settings.json
-
-    - name: Write custom settings.json that enables the Admin UI tests
-      run: "sed -i 's/\"enableAdminUITests\": false/\"enableAdminUITests\": true,\\n\"users\":{\"admin\":{\"password\":\"changeme\",\"is_admin\":true}}/' settings.json"
-
-    - name: increase maxHttpBufferSize
-      run: "sed -i 's/\"maxHttpBufferSize\": 10000/\"maxHttpBufferSize\": 100000/' settings.json"
-
-    - name: Remove standard frontend test files, so only admin tests are run
-      run: mv src/tests/frontend/specs/* /tmp && mv /tmp/admin*.js src/tests/frontend/specs
-
-    - uses: saucelabs/sauce-connect-action@v1.1.2
-      with:
-        username: ${{ secrets.SAUCE_USERNAME }}
-        accessKey: ${{ secrets.SAUCE_ACCESS_KEY }}
-        tunnelIdentifier: ${{ steps.sauce_strings.outputs.tunnel_id }}
-
-    - name: Run the frontend admin tests
-      shell: bash
-      env:
-        SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
-        SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
-        SAUCE_NAME: ${{ steps.sauce_strings.outputs.name }}
-        TRAVIS_JOB_NUMBER: ${{ steps.sauce_strings.outputs.tunnel_id }}
-        GIT_HASH: ${{ steps.environment.outputs.sha_short }}
-      run: |
-        src/tests/frontend/travis/adminrunner.sh
+      -
+        name: Fail if Dependabot
+        if: github.actor == 'dependabot[bot]'
+        run: |
+          cat <<EOF >&2
+          Frontend tests skipped because Dependabot can't access secrets.
+          Manually re-run the jobs to run the frontend tests.
+          For more information, see:
+          https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
+          EOF
+          exit 1
+      -
+        name: Generate Sauce Labs strings
+        id: sauce_strings
+        run: |
+          printf %s\\n '::set-output name=name::${{ github.workflow }} - ${{ github.job }} - Node ${{ matrix.node }}'
+          printf %s\\n '::set-output name=tunnel_id::${{ github.run_id }}-${{ github.run_number }}-${{ github.job }}-node${{ matrix.node }}'
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install etherpad plugins
+        # We intentionally install an old ep_align version to test upgrades to
+        # the minor version number. The --legacy-peer-deps flag is required to
+        # work around a bug in npm v7: https://github.com/npm/cli/issues/2199
+        run: npm install --no-save --legacy-peer-deps ep_align@0.2.27
+      # Etherpad core dependencies must be installed after installing the
+      # plugin's dependencies, otherwise npm will try to hoist common
+      # dependencies by removing them from src/node_modules and installing them
+      # in the top-level node_modules. As of v6.14.10, npm's hoist logic appears
+      # to be buggy, because it sometimes removes dependencies from
+      # src/node_modules but fails to add them to the top-level node_modules.
+      # Even if npm correctly hoists the dependencies, the hoisting seems to
+      # confuse tools such as `npm outdated`, `npm update`, and some ESLint
+      # rules.
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: Install etherpad plugins
+        run: rm -Rf node_modules/ep_align/static/tests/*
+      -
+        name: export GIT_HASH to env
+        id: environment
+        run: echo "::set-output name=sha_short::$(git rev-parse --short ${{ github.sha }})"
+      -
+        name: Create settings.json
+        run: cp settings.json.template settings.json
+      -
+        name: Write custom settings.json that enables the Admin UI tests
+        run: "sed -i 's/\"enableAdminUITests\": false/\"enableAdminUITests\": true,\\n\"users\":{\"admin\":{\"password\":\"changeme\",\"is_admin\":true}}/' settings.json"
+      -
+        name: increase maxHttpBufferSize
+        run: "sed -i 's/\"maxHttpBufferSize\": 10000/\"maxHttpBufferSize\": 100000/' settings.json"
+      -
+        name: Remove standard frontend test files, so only admin tests are run
+        run: mv src/tests/frontend/specs/* /tmp && mv /tmp/admin*.js src/tests/frontend/specs
+      -
+        uses: saucelabs/sauce-connect-action@v2.1.1
+        with:
+          username: ${{ secrets.SAUCE_USERNAME }}
+          accessKey: ${{ secrets.SAUCE_ACCESS_KEY }}
+          tunnelIdentifier: ${{ steps.sauce_strings.outputs.tunnel_id }}
+      -
+        name: Run the frontend admin tests
+        shell: bash
+        env:
+          SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
+          SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+          SAUCE_NAME: ${{ steps.sauce_strings.outputs.name }}
+          TRAVIS_JOB_NUMBER: ${{ steps.sauce_strings.outputs.tunnel_id }}
+          GIT_HASH: ${{ steps.environment.outputs.sha_short }}
+        run: |
+          src/tests/frontend/travis/adminrunner.sh
diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml
index bc138416..c05248b9 100644
--- a/.github/workflows/frontend-tests.yml
+++ b/.github/workflows/frontend-tests.yml
@@ -7,128 +7,160 @@ jobs:
   withoutplugins:
     name: without plugins
     runs-on: ubuntu-latest
-
     steps:
-    - name: Generate Sauce Labs strings
-      id: sauce_strings
-      run: |
-        printf %s\\n '::set-output name=name::${{ github.workflow }} - ${{ github.job }}'
-        printf %s\\n '::set-output name=tunnel_id::${{ github.run_id }}-${{ github.run_number }}-${{ github.job }}'
-
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: export GIT_HASH to env
-      id: environment
-      run: echo "::set-output name=sha_short::$(git rev-parse --short ${{ github.sha }})"
-
-    - name: Create settings.json
-      run: cp settings.json.template settings.json
-
-    - name: Disable import/export rate limiting
-      run: |
-        sed -e '/^ *"importExportRateLimiting":/,/^ *\}/ s/"max":.*/"max": 0/' -i settings.json
-
-    - uses: saucelabs/sauce-connect-action@v1
-      with:
-        username: ${{ secrets.SAUCE_USERNAME }}
-        accessKey: ${{ secrets.SAUCE_ACCESS_KEY }}
-        tunnelIdentifier: ${{ steps.sauce_strings.outputs.tunnel_id }}
-
-    - name: Run the frontend tests
-      shell: bash
-      env:
-        SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
-        SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
-        SAUCE_NAME: ${{ steps.sauce_strings.outputs.name }}
-        TRAVIS_JOB_NUMBER: ${{ steps.sauce_strings.outputs.tunnel_id }}
-        GIT_HASH: ${{ steps.environment.outputs.sha_short }}
-      run: |
-        src/tests/frontend/travis/runner.sh
+      -
+        name: Fail if Dependabot
+        if: github.actor == 'dependabot[bot]'
+        run: |
+          cat <<EOF >&2
+          Frontend tests skipped because Dependabot can't access secrets.
+          Manually re-run the jobs to run the frontend tests.
+          For more information, see:
+          https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
+          EOF
+          exit 1
+      -
+        name: Generate Sauce Labs strings
+        id: sauce_strings
+        run: |
+          printf %s\\n '::set-output name=name::${{ github.workflow }} - ${{ github.job }}'
+          printf %s\\n '::set-output name=tunnel_id::${{ github.run_id }}-${{ github.run_number }}-${{ github.job }}'
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: export GIT_HASH to env
+        id: environment
+        run: echo "::set-output name=sha_short::$(git rev-parse --short ${{ github.sha }})"
+      -
+        name: Create settings.json
+        run: cp settings.json.template settings.json
+      -
+        name: Disable import/export rate limiting
+        run: |
+          sed -e '/^ *"importExportRateLimiting":/,/^ *\}/ s/"max":.*/"max": 0/' -i settings.json
+      -
+        uses: saucelabs/sauce-connect-action@v2.1.1
+        with:
+          username: ${{ secrets.SAUCE_USERNAME }}
+          accessKey: ${{ secrets.SAUCE_ACCESS_KEY }}
+          tunnelIdentifier: ${{ steps.sauce_strings.outputs.tunnel_id }}
+      -
+        name: Run the frontend tests
+        shell: bash
+        env:
+          SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
+          SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+          SAUCE_NAME: ${{ steps.sauce_strings.outputs.name }}
+          TRAVIS_JOB_NUMBER: ${{ steps.sauce_strings.outputs.tunnel_id }}
+          GIT_HASH: ${{ steps.environment.outputs.sha_short }}
+        run: |
+          src/tests/frontend/travis/runner.sh
 
   withplugins:
     name: with plugins
     runs-on: ubuntu-latest
-
     steps:
-    - name: Generate Sauce Labs strings
-      id: sauce_strings
-      run: |
-        printf %s\\n '::set-output name=name::${{ github.workflow }} - ${{ github.job }}'
-        printf %s\\n '::set-output name=tunnel_id::${{ github.run_id }}-${{ github.run_number }}-${{ github.job }}'
-
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install Etherpad plugins
-      # The --legacy-peer-deps flag is required to work around a bug in npm v7:
-      # https://github.com/npm/cli/issues/2199
-      run: >
-        npm install --no-save --legacy-peer-deps
-        ep_align
-        ep_author_hover
-        ep_cursortrace
-        ep_embedmedia
-        ep_font_size
-        ep_hash_auth
-        ep_headings2
-        ep_image_upload
-        ep_markdown
-        ep_readonly_guest
-        ep_set_title_on_pad
-        ep_spellcheck
-        ep_subscript_and_superscript
-        ep_table_of_contents
-
-    # This must be run after installing the plugins, otherwise npm will try to
-    # hoist common dependencies by removing them from src/node_modules and
-    # installing them in the top-level node_modules. As of v6.14.10, npm's hoist
-    # logic appears to be buggy, because it sometimes removes dependencies from
-    # src/node_modules but fails to add them to the top-level node_modules. Even
-    # if npm correctly hoists the dependencies, the hoisting seems to confuse
-    # tools such as `npm outdated`, `npm update`, and some ESLint rules.
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: export GIT_HASH to env
-      id: environment
-      run: echo "::set-output name=sha_short::$(git rev-parse --short ${{ github.sha }})"
-
-    - name: Create settings.json
-      run: cp settings.json.template settings.json
-
-    - name: Disable import/export rate limiting
-      run: |
-        sed -e '/^ *"importExportRateLimiting":/,/^ *\}/ s/"max":.*/"max": 0/' -i settings.json
-
+      -
+        name: Fail if Dependabot
+        if: github.actor == 'dependabot[bot]'
+        run: |
+          cat <<EOF >&2
+          Frontend tests skipped because Dependabot can't access secrets.
+          Manually re-run the jobs to run the frontend tests.
+          For more information, see:
+          https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
+          EOF
+          exit 1
+      -
+        name: Generate Sauce Labs strings
+        id: sauce_strings
+        run: |
+          printf %s\\n '::set-output name=name::${{ github.workflow }} - ${{ github.job }}'
+          printf %s\\n '::set-output name=tunnel_id::${{ github.run_id }}-${{ github.run_number }}-${{ github.job }}'
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install Etherpad plugins
+        # The --legacy-peer-deps flag is required to work around a bug in npm v7:
+        # https://github.com/npm/cli/issues/2199
+        run: >
+          npm install --no-save --legacy-peer-deps
+          ep_align
+          ep_author_hover
+          ep_cursortrace
+          ep_embedmedia
+          ep_font_size
+          ep_hash_auth
+          ep_headings2
+          ep_image_upload
+          ep_markdown
+          ep_readonly_guest
+          ep_set_title_on_pad
+          ep_spellcheck
+          ep_subscript_and_superscript
+          ep_table_of_contents
+      # Etherpad core dependencies must be installed after installing the
+      # plugin's dependencies, otherwise npm will try to hoist common
+      # dependencies by removing them from src/node_modules and installing them
+      # in the top-level node_modules. As of v6.14.10, npm's hoist logic appears
+      # to be buggy, because it sometimes removes dependencies from
+      # src/node_modules but fails to add them to the top-level node_modules.
+      # Even if npm correctly hoists the dependencies, the hoisting seems to
+      # confuse tools such as `npm outdated`, `npm update`, and some ESLint
+      # rules.
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: export GIT_HASH to env
+        id: environment
+        run: echo "::set-output name=sha_short::$(git rev-parse --short ${{ github.sha }})"
+      -
+        name: Create settings.json
+        run: cp settings.json.template settings.json
+      -
+        name: Disable import/export rate limiting
+        run: |
+          sed -e '/^ *"importExportRateLimiting":/,/^ *\}/ s/"max":.*/"max": 0/' -i settings.json
       # XXX we should probably run all tests, because plugins could effect their results
-    - name: Remove standard frontend test files, so only plugin tests are run
-      run: rm src/tests/frontend/specs/*
-
-    - uses: saucelabs/sauce-connect-action@v1
-      with:
-        username: ${{ secrets.SAUCE_USERNAME }}
-        accessKey: ${{ secrets.SAUCE_ACCESS_KEY }}
-        tunnelIdentifier: ${{ steps.sauce_strings.outputs.tunnel_id }}
-
-    - name: Run the frontend tests
-      shell: bash
-      env:
-        SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
-        SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
-        SAUCE_NAME: ${{ steps.sauce_strings.outputs.name }}
-        TRAVIS_JOB_NUMBER: ${{ steps.sauce_strings.outputs.tunnel_id }}
-        GIT_HASH: ${{ steps.environment.outputs.sha_short }}
-      run: |
-        src/tests/frontend/travis/runner.sh
+      -
+        name: Remove standard frontend test files, so only plugin tests are run
+        run: rm src/tests/frontend/specs/*
+      -
+        uses: saucelabs/sauce-connect-action@v2.1.1
+        with:
+          username: ${{ secrets.SAUCE_USERNAME }}
+          accessKey: ${{ secrets.SAUCE_ACCESS_KEY }}
+          tunnelIdentifier: ${{ steps.sauce_strings.outputs.tunnel_id }}
+      -
+        name: Run the frontend tests
+        shell: bash
+        env:
+          SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
+          SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+          SAUCE_NAME: ${{ steps.sauce_strings.outputs.name }}
+          TRAVIS_JOB_NUMBER: ${{ steps.sauce_strings.outputs.tunnel_id }}
+          GIT_HASH: ${{ steps.environment.outputs.sha_short }}
+        run: |
+          src/tests/frontend/travis/runner.sh
diff --git a/.github/workflows/lint-package-lock.yml b/.github/workflows/lint-package-lock.yml
index a9596aa3..cb34c84d 100644
--- a/.github/workflows/lint-package-lock.yml
+++ b/.github/workflows/lint-package-lock.yml
@@ -8,21 +8,31 @@ jobs:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: package-lock.json
     runs-on: ubuntu-latest
-
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install lockfile-lint
-      run: npm install lockfile-lint
-
-    - name: Run lockfile-lint on package-lock.json
-      run: npx lockfile-lint --path src/package-lock.json --validate-https --allowed-hosts npm
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install lockfile-lint
+        run: npm install --no-save lockfile-lint
+      -
+        name: Run lockfile-lint on package-lock.json
+        run: >
+          npx lockfile-lint
+          --path src/package-lock.json
+          --allowed-hosts npm
+          --allowed-schemes https:
+          --allowed-schemes github:
+          --allowed-urls github:mapbox/node-sqlite3#593c9d498be2510d286349134537e3bf89401c4a
diff --git a/.github/workflows/load-test.yml b/.github/workflows/load-test.yml
index f4cbbb58..3941dcc5 100644
--- a/.github/workflows/load-test.yml
+++ b/.github/workflows/load-test.yml
@@ -8,104 +8,115 @@ jobs:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: without plugins
     runs-on: ubuntu-latest
-
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: Install etherpad-load-test
-      run: sudo npm install -g etherpad-load-test
-
-    - name: Run load test
-      run: src/tests/frontend/travis/runnerLoadTest.sh 25 50
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: Install etherpad-load-test
+        run: sudo npm install -g etherpad-load-test
+      -
+        name: Run load test
+        run: src/tests/frontend/travis/runnerLoadTest.sh 25 50
 
   withplugins:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: with Plugins
     runs-on: ubuntu-latest
-
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install etherpad-load-test
-      run: sudo npm install -g etherpad-load-test
-
-    - name: Install etherpad plugins
-      # The --legacy-peer-deps flag is required to work around a bug in npm v7:
-      # https://github.com/npm/cli/issues/2199
-      run: >
-        npm install --no-save --legacy-peer-deps
-        ep_align
-        ep_author_hover
-        ep_cursortrace
-        ep_font_size
-        ep_hash_auth
-        ep_headings2
-        ep_markdown
-        ep_readonly_guest
-        ep_set_title_on_pad
-        ep_spellcheck
-        ep_subscript_and_superscript
-        ep_table_of_contents
-
-    # This must be run after installing the plugins, otherwise npm will try to
-    # hoist common dependencies by removing them from src/node_modules and
-    # installing them in the top-level node_modules. As of v6.14.10, npm's hoist
-    # logic appears to be buggy, because it sometimes removes dependencies from
-    # src/node_modules but fails to add them to the top-level node_modules. Even
-    # if npm correctly hoists the dependencies, the hoisting seems to confuse
-    # tools such as `npm outdated`, `npm update`, and some ESLint rules.
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    # configures some settings and runs npm run test
-    - name: Run load test
-      run: src/tests/frontend/travis/runnerLoadTest.sh 25 50
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install etherpad-load-test
+        run: sudo npm install -g etherpad-load-test
+      -
+        name: Install etherpad plugins
+        # The --legacy-peer-deps flag is required to work around a bug in npm v7:
+        # https://github.com/npm/cli/issues/2199
+        run: >
+          npm install --no-save --legacy-peer-deps
+          ep_align
+          ep_author_hover
+          ep_cursortrace
+          ep_font_size
+          ep_hash_auth
+          ep_headings2
+          ep_markdown
+          ep_readonly_guest
+          ep_set_title_on_pad
+          ep_spellcheck
+          ep_subscript_and_superscript
+          ep_table_of_contents
+      # Etherpad core dependencies must be installed after installing the
+      # plugin's dependencies, otherwise npm will try to hoist common
+      # dependencies by removing them from src/node_modules and installing them
+      # in the top-level node_modules. As of v6.14.10, npm's hoist logic appears
+      # to be buggy, because it sometimes removes dependencies from
+      # src/node_modules but fails to add them to the top-level node_modules.
+      # Even if npm correctly hoists the dependencies, the hoisting seems to
+      # confuse tools such as `npm outdated`, `npm update`, and some ESLint
+      # rules.
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: Run load test
+        run: src/tests/frontend/travis/runnerLoadTest.sh 25 50
 
   long:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: long running
     runs-on: ubuntu-latest
-
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: Install etherpad-load-test
-      run: sudo npm install -g etherpad-load-test
-
-
-    # configures some settings and runs npm run test
-    - name: Run load test
-      run: src/tests/frontend/travis/runnerLoadTest.sh 5000 5
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: Install etherpad-load-test
+        run: sudo npm install -g etherpad-load-test
+      -
+        name: Run load test
+        run: src/tests/frontend/travis/runnerLoadTest.sh 5000 5
diff --git a/.github/workflows/rate-limit.yml b/.github/workflows/rate-limit.yml
index 0849f8e0..3208cdb2 100644
--- a/.github/workflows/rate-limit.yml
+++ b/.github/workflows/rate-limit.yml
@@ -8,36 +8,42 @@ jobs:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: test
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: docker network
-      run: docker network create --subnet=172.23.42.0/16 ep_net
-
-    - name: build docker image
-      run: |
-        docker build -f Dockerfile -t epl-debian-slim .
-        docker build -f src/tests/ratelimit/Dockerfile.nginx -t nginx-latest .
-        docker build -f src/tests/ratelimit/Dockerfile.anotherip -t anotherip .
-    - name: run docker images
-      run: |
-        docker run --name etherpad-docker -p 9000:9001 --rm --network ep_net --ip 172.23.42.2 -e 'TRUST_PROXY=true' epl-debian-slim &
-        docker run -p 8081:80 --rm --network ep_net --ip 172.23.42.1 -d nginx-latest
-        docker run --rm --network ep_net --ip 172.23.42.3 --name anotherip -dt anotherip
-
-    - name: install dependencies and create symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: run rate limit test
-      run: |
-        cd src/tests/ratelimit
-        ./testlimits.sh
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: docker network
+        run: docker network create --subnet=172.23.42.0/16 ep_net
+      -
+        name: build docker image
+        run: |
+          docker build -f Dockerfile -t epl-debian-slim .
+          docker build -f src/tests/ratelimit/Dockerfile.nginx -t nginx-latest .
+          docker build -f src/tests/ratelimit/Dockerfile.anotherip -t anotherip .
+      -
+        name: run docker images
+        run: |
+          docker run --name etherpad-docker -p 9000:9001 --rm --network ep_net --ip 172.23.42.2 -e 'TRUST_PROXY=true' epl-debian-slim &
+          docker run -p 8081:80 --rm --network ep_net --ip 172.23.42.1 -d nginx-latest
+          docker run --rm --network ep_net --ip 172.23.42.3 --name anotherip -dt anotherip
+      -
+        name: install dependencies and create symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: run rate limit test
+        run: |
+          cd src/tests/ratelimit
+          ./testlimits.sh
diff --git a/.github/workflows/upgrade-from-latest-release.yml b/.github/workflows/upgrade-from-latest-release.yml
index e57e63eb..54e3527e 100644
--- a/.github/workflows/upgrade-from-latest-release.yml
+++ b/.github/workflows/upgrade-from-latest-release.yml
@@ -8,84 +8,90 @@ jobs:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: Linux with Plugins
     runs-on: ubuntu-latest
-
     strategy:
       fail-fast: false
       matrix:
         node: [12, 14, 16]
-
     steps:
-    - name: Check out latest release
-      uses: actions/checkout@v2
-      with:
-        ref: master
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: ${{ matrix.node }}
-
-    - name: Install Etherpad plugins
-      # The --legacy-peer-deps flag is required to work around a bug in npm v7:
-      # https://github.com/npm/cli/issues/2199
-      run: >
-        npm install --no-save --legacy-peer-deps
-        ep_align
-        ep_author_hover
-        ep_cursortrace
-        ep_font_size
-        ep_hash_auth
-        ep_headings2
-        ep_image_upload
-        ep_markdown
-        ep_readonly_guest
-        ep_set_title_on_pad
-        ep_spellcheck
-        ep_subscript_and_superscript
-        ep_table_of_contents
-
-    # This must be run after installing the plugins, otherwise npm will try to
-    # hoist common dependencies by removing them from src/node_modules and
-    # installing them in the top-level node_modules. As of v6.14.10, npm's hoist
-    # logic appears to be buggy, because it sometimes removes dependencies from
-    # src/node_modules but fails to add them to the top-level node_modules. Even
-    # if npm correctly hoists the dependencies, the hoisting seems to confuse
-    # tools such as `npm outdated`, `npm update`, and some ESLint rules.
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: Run the backend tests
-      run: cd src && npm test
-
-    # Because actions/checkout@v2 is called with "ref: master" and without
-    # "fetch-depth: 0", the local clone does not have the ${GITHUB_SHA} commit.
-    # Fetch ${GITHUB_REF} to get the ${GITHUB_SHA} commit. Note that a plain
-    # "git fetch" only fetches "normal" references (refs/heads/* and
-    # refs/tags/*), and for pull requests none of the normal references include
-    # ${GITHUB_SHA}, so we have to explicitly tell Git to fetch ${GITHUB_REF}.
-    - name: Fetch the new Git commits
-      run: git fetch --depth=1 origin "${GITHUB_REF}"
-
-    - name: Upgrade to the new Git revision
-      # For pull requests, ${GITHUB_SHA} is the automatically generated merge
-      # commit that merges the PR's source branch to its destination branch.
-      run: git checkout "${GITHUB_SHA}"
-
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
-    - name: Run the backend tests
-      run: cd src && npm test
-
-    - name: Install Cypress
-      run: npm install cypress -g
-
-    - name: Run Etherpad & Test Frontend
-      run: |
-            node src/node/server.js &
-            curl --connect-timeout 10 --max-time 20 --retry 5 --retry-delay 10 --retry-max-time 60 --retry-connrefused http://127.0.0.1:9001/p/test
-            cd src/tests/frontend
-            cypress run --spec cypress/integration/test.js --config-file cypress/cypress.json
+      -
+        name: Check out latest release
+        uses: actions/checkout@v2
+        with:
+          ref: master
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install Etherpad plugins
+        # The --legacy-peer-deps flag is required to work around a bug in npm
+        # v7: https://github.com/npm/cli/issues/2199
+        run: >
+          npm install --no-save --legacy-peer-deps
+          ep_align
+          ep_author_hover
+          ep_cursortrace
+          ep_font_size
+          ep_hash_auth
+          ep_headings2
+          ep_image_upload
+          ep_markdown
+          ep_readonly_guest
+          ep_set_title_on_pad
+          ep_spellcheck
+          ep_subscript_and_superscript
+          ep_table_of_contents
+      # Etherpad core dependencies must be installed after installing the
+      # plugin's dependencies, otherwise npm will try to hoist common
+      # dependencies by removing them from src/node_modules and installing them
+      # in the top-level node_modules. As of v6.14.10, npm's hoist logic appears
+      # to be buggy, because it sometimes removes dependencies from
+      # src/node_modules but fails to add them to the top-level node_modules.
+      # Even if npm correctly hoists the dependencies, the hoisting seems to
+      # confuse tools such as `npm outdated`, `npm update`, and some ESLint
+      # rules.
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: Run the backend tests
+        run: cd src && npm test
+      # Because actions/checkout@v2 is called with "ref: master" and without
+      # "fetch-depth: 0", the local clone does not have the ${GITHUB_SHA}
+      # commit. Fetch ${GITHUB_REF} to get the ${GITHUB_SHA} commit. Note that a
+      # plain "git fetch" only fetches "normal" references (refs/heads/* and
+      # refs/tags/*), and for pull requests none of the normal references
+      # include ${GITHUB_SHA}, so we have to explicitly tell Git to fetch
+      # ${GITHUB_REF}.
+      -
+        name: Fetch the new Git commits
+        run: git fetch --depth=1 origin "${GITHUB_REF}"
+      -
+        name: Upgrade to the new Git revision
+        # For pull requests, ${GITHUB_SHA} is the automatically generated merge
+        # commit that merges the PR's source branch to its destination branch.
+        run: git checkout "${GITHUB_SHA}"
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        run: src/bin/installDeps.sh
+      -
+        name: Run the backend tests
+        run: cd src && npm test
+      -
+        name: Install Cypress
+        run: npm install cypress -g
+      -
+        name: Run Etherpad & Test Frontend
+        run: |
+          node src/node/server.js &
+          curl --connect-timeout 10 --max-time 20 --retry 5 --retry-delay 10 --retry-max-time 60 --retry-connrefused http://127.0.0.1:9001/p/test
+          cd src/tests/frontend
+          cypress run --spec cypress/integration/test.js --config-file cypress/cypress.json
diff --git a/.github/workflows/windows-installer.yml b/.github/workflows/windows-installer.yml
index 37d86a9a..7bf22a14 100644
--- a/.github/workflows/windows-installer.yml
+++ b/.github/workflows/windows-installer.yml
@@ -8,54 +8,57 @@ jobs:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
-
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: Build Zip & Exe
     runs-on: windows-latest
-
     steps:
-    - uses: msys2/setup-msys2@v2
-      with:
-        path-type: inherit
-        install: >-
-          zip
-
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      shell: msys2 {0}
-      run: src/bin/installDeps.sh
-
-    - name: Run the backend tests
-      shell: msys2 {0}
-      run: cd src && npm test
-
-    - name: Build the .zip
-      shell: msys2 {0}
-      run: src/bin/buildForWindows.sh
-
-    - name: Extract the .zip into folder
-      run: 7z x etherpad-lite-win.zip -oetherpad-lite-new
-
-    - name: Grab nsis config
-      run: git clone https://github.com/ether/etherpad_nsis.git
-
-    - name: Create installer
-      uses: joncloud/makensis-action@v3.4
-      with:
-        script-file: 'etherpad_nsis/etherpad.nsi'
-
-    - name: Check something..
-      run: ls etherpad_nsis
-
-    - name: Archive production artifacts
-      uses: actions/upload-artifact@v2
-      with:
-        name: etherpad-server-windows.exe
-        path: etherpad_nsis/etherpad-server-windows.exe
+      -
+        uses: msys2/setup-msys2@v2
+        with:
+          path-type: inherit
+          install: >-
+            zip
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        shell: msys2 {0}
+        run: src/bin/installDeps.sh
+      -
+        name: Run the backend tests
+        shell: msys2 {0}
+        run: cd src && npm test
+      -
+        name: Build the .zip
+        shell: msys2 {0}
+        run: src/bin/buildForWindows.sh
+      -
+        name: Extract the .zip into folder
+        run: 7z x etherpad-lite-win.zip -oetherpad-lite-new
+      -
+        name: Grab nsis config
+        run: git clone https://github.com/ether/etherpad_nsis.git
+      -
+        name: Create installer
+        uses: joncloud/makensis-action@v3.6
+        with:
+          script-file: 'etherpad_nsis/etherpad.nsi'
+      -
+        name: Check something..
+        run: ls etherpad_nsis
+      -
+        name: Archive production artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: etherpad-server-windows.exe
+          path: etherpad_nsis/etherpad-server-windows.exe
diff --git a/.github/workflows/windows-zip.yml b/.github/workflows/windows-zip.yml
index 42a99a19..4cc93ca0 100644
--- a/.github/workflows/windows-zip.yml
+++ b/.github/workflows/windows-zip.yml
@@ -8,70 +8,81 @@ jobs:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: Build
     runs-on: windows-latest
-
     steps:
-    - uses: msys2/setup-msys2@v2
-      with:
-        path-type: inherit
-        install: >-
-          zip
-
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      shell: msys2 {0}
-      run: src/bin/installDeps.sh
-
-    - name: Run the backend tests
-      shell: msys2 {0}
-      run: cd src && npm test
-
-    - name: Build the .zip
-      shell: msys2 {0}
-      run: src/bin/buildForWindows.sh
-
-    - name: Archive production artifacts
-      uses: actions/upload-artifact@v2
-      with:
-        name: etherpad-lite-win.zip
-        path: etherpad-lite-win.zip
-
+      -
+        uses: msys2/setup-msys2@v2
+        with:
+          path-type: inherit
+          install: >-
+            zip
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            src/package-lock.json
+            src/bin/doc/package-lock.json
+      -
+        name: Install all dependencies and symlink for ep_etherpad-lite
+        shell: msys2 {0}
+        run: src/bin/installDeps.sh
+      -
+        name: Run the backend tests
+        shell: msys2 {0}
+        run: cd src && npm test
+      -
+        name: Build the .zip
+        shell: msys2 {0}
+        run: src/bin/buildForWindows.sh
+      -
+        name: Archive production artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: etherpad-lite-win.zip
+          path: etherpad-lite-win.zip
 
   deploy:
     # run on pushes to any branch
     # run on PRs from external forks
     if: |
-         (github.event_name != 'pull_request')
-         || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      (github.event_name != 'pull_request')
+      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
     name: Deploy
     needs: build
     runs-on: windows-latest
-
     steps:
-    - name: Download zip
-      uses: actions/download-artifact@v2
-      with:
-        name: etherpad-lite-win.zip
-
-    - name: Extract Etherpad
-      run: 7z x etherpad-lite-win.zip -oetherpad
-
-    - name: Install Cypress
-      run: npm install cypress -g
-
-    - name: Run Etherpad
-      run: |
-            cd etherpad
-            node node_modules\ep_etherpad-lite\node\server.js &
-            curl --connect-timeout 10 --max-time 20 --retry 5 --retry-delay 10 --retry-max-time 60 --retry-connrefused http://127.0.0.1:9001/p/test
-            cd src\tests\frontend
-            cypress run --spec cypress\integration\test.js --config-file cypress\cypress.json
+      -
+        name: Download zip
+        uses: actions/download-artifact@v2
+        with:
+          name: etherpad-lite-win.zip
+      -
+        name: Extract Etherpad
+        run: 7z x etherpad-lite-win.zip -oetherpad
+      -
+        uses: actions/setup-node@v3
+        with:
+          node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            etherpad/src/package-lock.json
+            etherpad/src/bin/doc/package-lock.json
+      -
+        name: Install Cypress
+        run: npm install cypress -g
+      -
+        name: Run Etherpad
+        run: |
+          cd etherpad
+          node node_modules\ep_etherpad-lite\node\server.js &
+          curl --connect-timeout 10 --max-time 20 --retry 5 --retry-delay 10 --retry-max-time 60 --retry-connrefused http://127.0.0.1:9001/p/test
+          cd src\tests\frontend
+          cypress run --spec cypress\integration\test.js --config-file cypress\cypress.json