diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 94b4d4c803..78f1ed852e 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -156,6 +156,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     needs: [build_dfx]
     strategy:
+      fail-fast: false
       matrix:
         os: [macos-12, ubuntu-20.04, ubuntu-22.04]
     steps:
@@ -191,6 +192,12 @@ jobs:
             --frontend_url "$FRONTEND_URL" \
             --candid_url "$CANDID_URL" \
             --browser chromium firefox webkit
+          export FRONTEND_URL_LOCALHOST="${FRONTEND_URL/127\.0\.0\.1/localhost}"
+          export CANDID_URL_LOCALHOST="${CANDID_URL/127\.0\.0\.1/localhost}"
+          python scripts/test-uis.py \
+            --frontend_url "$FRONTEND_URL_LOCALHOST" \
+            --candid_url "$CANDID_URL_LOCALHOST" \
+            --browser chromium firefox webkit
 
   aggregate:
     name: e2e:required
diff --git a/.gitignore b/.gitignore
index 57b04341e9..5e2c1a7804 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,6 @@ target/
 
 # Backup files
 *.bak
+
+# DB repo for cargo-audit
+advisory-db/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c088086aa1..5187254e36 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,26 @@
 
 # UNRELEASED
 
+### fix!: always fetch did file from canister when making canister calls
+
+`dfx canister call` will always fetch did file from the canister metadata. This is especially helpful for calling remote canisters. It's a breaking change in the sense that if the canister doesn't have the `candid:service` metadata, we will not read the local did file from build artifact, and dfx will issue a warning in this case to encourage canister developers to put the did file into canister metadata.
+
+### fix: support `import` for local did file
+
+If the local did file contains `import` or init args, dfx will rewrite the did file when storing in canister metadata.
+Due to current limitations of the Candid parser, comments will be dropped during rewriting. 
+If the local did file doesn't contain `import` or init args, we will not perform the rewriting, thus preserving the comments.
+
+### fix: subtyping check reports the special opt rule as error
+
+# 0.16.0
+
+### feat: large canister modules now supported
+
+When using `dfx deploy` or `dfx canister install`, previously WASM modules larger than 2MiB would be rejected.
+They are now automatically submitted via the chunking API if they are large enough.
+From a user perspective the limitation will simply have been lifted.
+
 ### feat: dfx deps: wasm_hash_url and loose the hash check
 
 Providers can provide the hash through `wasm_hash_url` instead of hard coding the hash directly.
@@ -27,6 +47,10 @@ Updated to candid 0.10, ic-cdk 0.12, and ic-cdk-timers 0.6
 They've always been stored with nanosecond precisions on Linux and Macos.
 Now they are stored with nanosecond precision on Windows too.
 
+### fix: dfx canister delete, when using an HSM identity, no longer fails by trying to open two sessions to the HSM
+
+Previously, this would fail with a PKCS#11: CKR_CRYPTOKI_ALREADY_INITIALIZED error.
+
 ## Dependencies
 
 ### Motoko
@@ -37,6 +61,31 @@ Updated Motoko to [0.10.4](https://github.com/dfinity/motoko/releases/tag/0.10.4
 
 Module hash: 3c86d912ead6de7133b9f787df4ca9feee07bea8835d3ed594b47ee89e6cb730
 
+### Candid UI
+
+Module hash: b91e3dd381aedb002633352f8ebad03b6eee330b7e30c3d15a5657e6f428d815
+
+Fix the routing error when deploying to gitpod/github workspace.
+Fix that Candid UI cannot be opened using localhost URL.
+
+### Replica
+
+Updated replica to elected commit 324eb99eb7531369a5ef75560f1a1a652d123714.
+This incorporates the following executed proposals:
+
+- [127096](https://dashboard.internetcomputer.org/proposal/127096)
+- [127094](https://dashboard.internetcomputer.org/proposal/127094)
+- [127034](https://dashboard.internetcomputer.org/proposal/127034)
+- [127031](https://dashboard.internetcomputer.org/proposal/127031)
+- [126879](https://dashboard.internetcomputer.org/proposal/126879)
+- [126878](https://dashboard.internetcomputer.org/proposal/126878)
+- [126730](https://dashboard.internetcomputer.org/proposal/126730)
+- [126729](https://dashboard.internetcomputer.org/proposal/126729)
+- [126727](https://dashboard.internetcomputer.org/proposal/126727)
+- [126366](https://dashboard.internetcomputer.org/proposal/126366)
+- [126365](https://dashboard.internetcomputer.org/proposal/126365)
+- [126293](https://dashboard.internetcomputer.org/proposal/126293)
+
 # 0.15.3
 
 ### fix: allow `http://localhost:*` as `connect-src` in the asset canister's CSP
diff --git a/Cargo.lock b/Cargo.lock
index 8936a6b315..0cefd278cd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2231,9 +2231,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.21"
+version = "0.3.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91fc23aa11be92976ef4729127f1a74adf36d8436f7816b185d18df956790833"
+checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
 dependencies = [
  "bytes",
  "fnv",
@@ -2241,7 +2241,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap 1.9.3",
+ "indexmap 2.1.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -2494,7 +2494,7 @@ dependencies = [
 [[package]]
 name = "ic-agent"
 version = "0.31.0"
-source = "git+https://github.com/dfinity/agent-rs.git?rev=a7f44ad05e77fc89b8447dd65b345e7a62fd1042#a7f44ad05e77fc89b8447dd65b345e7a62fd1042"
+source = "git+https://github.com/dfinity/agent-rs.git?rev=6b02f649a569f354a0a1b370368ba28d31dd8702#6b02f649a569f354a0a1b370368ba28d31dd8702"
 dependencies = [
  "backoff",
  "cached 0.46.1",
@@ -2930,7 +2930,7 @@ dependencies = [
 [[package]]
 name = "ic-identity-hsm"
 version = "0.31.0"
-source = "git+https://github.com/dfinity/agent-rs.git?rev=a7f44ad05e77fc89b8447dd65b345e7a62fd1042#a7f44ad05e77fc89b8447dd65b345e7a62fd1042"
+source = "git+https://github.com/dfinity/agent-rs.git?rev=6b02f649a569f354a0a1b370368ba28d31dd8702#6b02f649a569f354a0a1b370368ba28d31dd8702"
 dependencies = [
  "hex",
  "ic-agent",
@@ -3030,7 +3030,7 @@ dependencies = [
 [[package]]
 name = "ic-transport-types"
 version = "0.31.0"
-source = "git+https://github.com/dfinity/agent-rs.git?rev=a7f44ad05e77fc89b8447dd65b345e7a62fd1042#a7f44ad05e77fc89b8447dd65b345e7a62fd1042"
+source = "git+https://github.com/dfinity/agent-rs.git?rev=6b02f649a569f354a0a1b370368ba28d31dd8702#6b02f649a569f354a0a1b370368ba28d31dd8702"
 dependencies = [
  "candid",
  "hex",
@@ -3099,15 +3099,17 @@ dependencies = [
 [[package]]
 name = "ic-utils"
 version = "0.31.0"
-source = "git+https://github.com/dfinity/agent-rs.git?rev=a7f44ad05e77fc89b8447dd65b345e7a62fd1042#a7f44ad05e77fc89b8447dd65b345e7a62fd1042"
+source = "git+https://github.com/dfinity/agent-rs.git?rev=6b02f649a569f354a0a1b370368ba28d31dd8702#6b02f649a569f354a0a1b370368ba28d31dd8702"
 dependencies = [
  "async-trait",
  "candid",
+ "futures-util",
  "ic-agent",
  "once_cell",
  "semver",
  "serde",
  "serde_bytes",
+ "sha2 0.10.8",
  "strum 0.24.1",
  "strum_macros 0.24.3",
  "thiserror",
diff --git a/Cargo.toml b/Cargo.toml
index f3e8925e6b..2b00b9bc87 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -21,11 +21,11 @@ license = "Apache-2.0"
 [workspace.dependencies]
 candid = "0.10.0"
 candid_parser = "0.1.2"
-ic-agent = { git = "https://github.com/dfinity/agent-rs.git", rev = "a7f44ad05e77fc89b8447dd65b345e7a62fd1042" }
+ic-agent = { git = "https://github.com/dfinity/agent-rs.git", rev = "6b02f649a569f354a0a1b370368ba28d31dd8702" }
 ic-asset = { path = "src/canisters/frontend/ic-asset" }
 ic-cdk = "0.12.0"
-ic-identity-hsm = { git = "https://github.com/dfinity/agent-rs.git", rev = "a7f44ad05e77fc89b8447dd65b345e7a62fd1042" }
-ic-utils = { git = "https://github.com/dfinity/agent-rs.git", rev = "a7f44ad05e77fc89b8447dd65b345e7a62fd1042" }
+ic-identity-hsm = { git = "https://github.com/dfinity/agent-rs.git", rev = "6b02f649a569f354a0a1b370368ba28d31dd8702" }
+ic-utils = { git = "https://github.com/dfinity/agent-rs.git", rev = "6b02f649a569f354a0a1b370368ba28d31dd8702" }
 
 aes-gcm = "0.10.3"
 anyhow = "1.0.56"
diff --git a/docs/cli-reference/dfx-identity.md b/docs/cli-reference/dfx-identity.md
index b993171ced..52185f3af4 100644
--- a/docs/cli-reference/dfx-identity.md
+++ b/docs/cli-reference/dfx-identity.md
@@ -22,6 +22,7 @@ For reference information and examples that illustrate using `dfx identity` comm
 | [`get-principal`](#dfx-identity-get-principal) | Shows the textual representation of the principal associated with the current identity.                                   |
 | [`get-wallet`](#dfx-identity-get-wallet)       | Shows the canister identifier for the wallet associated with your current identity principal.                             |
 | `help`                                          | Displays this usage message or the help of the given subcommand(s).                                                       |
+| [`export`](#dfx-identity-export)               | Exports the PEM definition for an identity. |
 | [`import`](#dfx-identity-import)               | Creates a new identity by importing a PEM file that contains the key information or security certificate for a principal. |
 | [`list`](#dfx-identity-list)                   | Lists existing identities.                                                                                                |
 | [`new`](#dfx-identity-new)                     | Creates a new identity.                                                                                                   |
@@ -110,6 +111,25 @@ To display the canister identifier for the wallet canister associated with your
 dfx identity get-wallet --network=https://192.168.74.4
 ```
 
+## dfx identity export
+
+Use the `dfx identity export` command to export the PEM definition of an existing identity.  You can import this definition elsewhere using [`dfx identity import`](#dfx-identity-import).
+
+### Basic usage
+
+``` bash
+dfx identity export identity-name
+```
+
+### Examples
+
+The following will export a PEM file for an existing identity.  If you transferred this file to another computer, the
+example below for `dfx identity import` would import it.
+
+``` bash
+dfx identity export alice >generated-id.pem
+```
+
 ## dfx identity import
 
 Use the `dfx identity import` command to create a user identity by importing the user’s key information or security certificate from a PEM file.
diff --git a/e2e/assets/large_canister/Cargo.toml b/e2e/assets/large_canister/Cargo.toml
new file mode 100644
index 0000000000..63c2f1a2ae
--- /dev/null
+++ b/e2e/assets/large_canister/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+name = "large"
+version = "0.0.0"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib"]
+
+[workspace]
diff --git a/e2e/assets/large_canister/dfx.json b/e2e/assets/large_canister/dfx.json
new file mode 100644
index 0000000000..ad4d443cf6
--- /dev/null
+++ b/e2e/assets/large_canister/dfx.json
@@ -0,0 +1,9 @@
+{
+    "canisters": {
+        "large": {
+            "type": "rust",
+            "package": "large",
+            "candid": "large.did"
+        } 
+    }
+}
diff --git a/e2e/assets/large_canister/large.did b/e2e/assets/large_canister/large.did
new file mode 100644
index 0000000000..f424d81e86
--- /dev/null
+++ b/e2e/assets/large_canister/large.did
@@ -0,0 +1 @@
+service : {}
diff --git a/e2e/assets/large_canister/patch.bash b/e2e/assets/large_canister/patch.bash
new file mode 100644
index 0000000000..7f6fccde43
--- /dev/null
+++ b/e2e/assets/large_canister/patch.bash
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+head -c $((1024 * 1024 * 8)) /dev/urandom >garbage.bin
diff --git a/e2e/assets/large_canister/rust-toolchain.toml b/e2e/assets/large_canister/rust-toolchain.toml
new file mode 100644
index 0000000000..e918eb3dbf
--- /dev/null
+++ b/e2e/assets/large_canister/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "stable"
+targets = ["wasm32-unknown-unknown"]
diff --git a/e2e/assets/large_canister/src/lib.rs b/e2e/assets/large_canister/src/lib.rs
new file mode 100644
index 0000000000..3ef35d26ab
--- /dev/null
+++ b/e2e/assets/large_canister/src/lib.rs
@@ -0,0 +1,3 @@
+#[used]
+#[no_mangle]
+pub static LARGE: &[u8] = include_bytes!(concat!(env!("CARGO_MANIFEST_DIR"), "/garbage.bin"));
diff --git a/e2e/assets/prebuilt_custom_canister/dfx.json b/e2e/assets/prebuilt_custom_canister/dfx.json
index dea4e33388..5e0b21bbb9 100644
--- a/e2e/assets/prebuilt_custom_canister/dfx.json
+++ b/e2e/assets/prebuilt_custom_canister/dfx.json
@@ -29,6 +29,15 @@
       "candid": "custom_with_build_step.did",
       "wasm": "main.wasm",
       "build": "echo just a build step"
+    },
+    "prebuilt_local_import": {
+       "type": "custom",
+       "candid": "local_import.did",
+       "wasm": "main.wasm",
+       "build": [],
+       "metadata": [
+         { "name": "candid:service" }
+       ]
     }
   },
   "networks": {
diff --git a/e2e/assets/prebuilt_custom_canister/local_import.did b/e2e/assets/prebuilt_custom_canister/local_import.did
new file mode 100644
index 0000000000..f926f50663
--- /dev/null
+++ b/e2e/assets/prebuilt_custom_canister/local_import.did
@@ -0,0 +1,2 @@
+import service "prebuilt_custom_no_build.did";
+
diff --git a/e2e/assets/upgrade/v1.mo b/e2e/assets/upgrade/v1.mo
index 29e3722bcf..5a8765075f 100644
--- a/e2e/assets/upgrade/v1.mo
+++ b/e2e/assets/upgrade/v1.mo
@@ -4,6 +4,9 @@ actor {
     state += 1;
     return state;
   };
+  public func f() : async ?Int {
+    return ?42;
+  };
   public query func read() : async Int { return state; };
 }
 
diff --git a/e2e/assets/upgrade/v2.mo b/e2e/assets/upgrade/v2.mo
index 5a9b295832..64dc2af3ec 100644
--- a/e2e/assets/upgrade/v2.mo
+++ b/e2e/assets/upgrade/v2.mo
@@ -6,6 +6,9 @@ actor {
     new_state += 1;
     return new_state;
   };
+  public func f() : async ?Int {
+    return ?42;
+  };
   public query func read() : async Nat { return new_state; };
 }
 
diff --git a/e2e/assets/upgrade/v2_bad.mo b/e2e/assets/upgrade/v2_bad.mo
index 58ef15b8d5..3b50c9bd6a 100644
--- a/e2e/assets/upgrade/v2_bad.mo
+++ b/e2e/assets/upgrade/v2_bad.mo
@@ -4,6 +4,9 @@ actor {
     state += 1;
     return state;
   };
+  public func f() : async ?Int {
+    return ?42;
+  };
   public query func read() : async Nat { return state; };
 }
 
diff --git a/e2e/assets/upgrade/v3_bad.mo b/e2e/assets/upgrade/v3_bad.mo
index 6b794e54c9..c5be37f070 100644
--- a/e2e/assets/upgrade/v3_bad.mo
+++ b/e2e/assets/upgrade/v3_bad.mo
@@ -4,6 +4,9 @@ actor {
     state += 1;
     return state;
   };
+  public func f() : async ?Int {
+    return ?42;
+  };
   public query func read2() : async Int { return state; };
 }
 
diff --git a/e2e/assets/upgrade/v4_bad.mo b/e2e/assets/upgrade/v4_bad.mo
new file mode 100644
index 0000000000..dc7c35da1d
--- /dev/null
+++ b/e2e/assets/upgrade/v4_bad.mo
@@ -0,0 +1,12 @@
+actor {
+  stable var state : Int = 0;
+  public func inc() : async Int {
+    state += 1;
+    return state;
+  };
+  public func f() : async ?Text {
+    return ?"";
+  };
+  public query func read() : async Int { return state; };
+}
+
diff --git a/e2e/tests-dfx/assetscanister.bash b/e2e/tests-dfx/assetscanister.bash
index 6656c6849b..bb55041959 100644
--- a/e2e/tests-dfx/assetscanister.bash
+++ b/e2e/tests-dfx/assetscanister.bash
@@ -266,7 +266,7 @@ check_permission_failure() {
   FE_CANISTER_ID="$(dfx canister id e2e_project_frontend)"
   rm .dfx/local/canister_ids.json
   assert_command_fail dfx canister call "$FE_CANISTER_ID" validate_revoke_permission "(record { of_principal=principal \"$PREPARE_PRINCIPAL\"; permission = variant { FlyBeFree }; })"
-  assert_contains "trapped"
+  assert_contains "FlyBeFree not found"
 }
 
 @test "access control - fine-grained" {
@@ -905,10 +905,12 @@ check_permission_failure() {
   dfx canister install e2e_project_frontend
 
   assert_command dfx canister call --query e2e_project_frontend retrieve '("/binary/noise.txt")' --output idl
-  assert_eq '(blob "\b8\01\20\80\0a\77\31\32\20\00\78\79\0a\4b\4c\0b\0a\6a\6b")'
+  # shellcheck disable=SC2154
+  assert_eq '(blob "\b8\01\20\80\0a\77\31\32\20\00\78\79\0a\4b\4c\0b\0a\6a\6b")' "$stdout"
 
   assert_command dfx canister call --query e2e_project_frontend retrieve '("/text-with-newlines.txt")' --output idl
-  assert_eq '(blob "cherries\0ait\27s cherry season\0aCHERRIES")'
+  # shellcheck disable=SC2154
+  assert_eq '(blob "cherries\0ait\27s cherry season\0aCHERRIES")' "$stdout"
 
   assert_command dfx canister call --update e2e_project_frontend store '(record{key="AA"; content_type="text/plain"; content_encoding="identity"; content=blob "hello, world!"})'
   assert_eq '()'
@@ -916,13 +918,16 @@ check_permission_failure() {
   assert_eq '()'
 
   assert_command dfx canister call --query e2e_project_frontend retrieve '("B")' --output idl
-  assert_eq '(blob "XWV")'
+  # shellcheck disable=SC2154
+  assert_eq '(blob "XWV")' "$stdout"
 
   assert_command dfx canister call --query e2e_project_frontend retrieve '("AA")' --output idl
-  assert_eq '(blob "hello, world!")'
+  # shellcheck disable=SC2154
+  assert_eq '(blob "hello, world!")' "$stdout"
 
   assert_command dfx canister call --query e2e_project_frontend retrieve '("B")' --output idl
-  assert_eq '(blob "XWV")'
+  # shellcheck disable=SC2154
+  assert_eq '(blob "XWV")' "$stdout"
 
   assert_command_fail dfx canister call --query e2e_project_frontend retrieve '("C")'
 }
diff --git a/e2e/tests-dfx/build_granular.bash b/e2e/tests-dfx/build_granular.bash
index 3b50ec9d94..d614d63d4d 100644
--- a/e2e/tests-dfx/build_granular.bash
+++ b/e2e/tests-dfx/build_granular.bash
@@ -67,10 +67,12 @@ teardown() {
   dfx canister install e2e_project_frontend
 
   assert_command dfx canister call --query e2e_project_frontend retrieve '("/binary/noise.txt")' --output idl
-  assert_eq '(blob "\b8\01\20\80\0a\77\31\32\20\00\78\79\0a\4b\4c\0b\0a\6a\6b")'
+  # shellcheck disable=SC2154
+  assert_eq '(blob "\b8\01\20\80\0a\77\31\32\20\00\78\79\0a\4b\4c\0b\0a\6a\6b")' "$stdout"
 
   assert_command dfx canister call --query e2e_project_frontend retrieve '("/text-with-newlines.txt")' --output idl
-  assert_eq '(blob "cherries\0ait\27s cherry season\0aCHERRIES")'
+  # shellcheck disable=SC2154
+  assert_eq '(blob "cherries\0ait\27s cherry season\0aCHERRIES")' "$stdout"
 }
 
 @test "cyclic dependencies are detected" {
diff --git a/e2e/tests-dfx/call.bash b/e2e/tests-dfx/call.bash
index 0b2e54b8df..2619e738e6 100644
--- a/e2e/tests-dfx/call.bash
+++ b/e2e/tests-dfx/call.bash
@@ -26,9 +26,9 @@ teardown() {
   CANISTER_ID=$(dfx canister id hello_backend)
   rm .dfx/local/canister_ids.json
 
-  # if no candid file known, then no field names
+  # given a canister id, fetch the did file from metadata
   assert_command dfx canister call "$CANISTER_ID" make_struct '("A", "B")'
-  assert_eq '(record { 99 = "A"; 100 = "B" })'
+  assert_eq '(record { c = "A"; d = "B" })'
 
   # if passing the candid file, field names available
   assert_command dfx canister call --candid .dfx/local/canisters/hello_backend/hello_backend.did "$CANISTER_ID" make_struct '("A", "B")'
diff --git a/e2e/tests-dfx/identity.bash b/e2e/tests-dfx/identity.bash
index 4550368a5a..aae4f5bc36 100644
--- a/e2e/tests-dfx/identity.bash
+++ b/e2e/tests-dfx/identity.bash
@@ -155,7 +155,8 @@ teardown() {
   assert_command dfx canister call e2e_project_frontend store '(record{key="B"; content_type="application/octet-stream"; content_encoding="identity"; content=blob"XWV"})' --identity alice
   assert_eq '()'
   assert_command dfx canister call --output idl e2e_project_frontend retrieve '("B")'
-  assert_eq '(blob "XWV")'
+  # shellcheck disable=SC2154
+  assert_eq '(blob "XWV")' "$stdout"
 }
 
 @test "after renaming an identity, the renamed identity is still initializer" {
@@ -181,7 +182,8 @@ teardown() {
   assert_command dfx canister call e2e_project_frontend store '(record{key="B"; content_type="application/octet-stream"; content_encoding="identity"; content=blob "hello"})' --identity bob
   assert_eq '()'
   assert_command dfx canister call --output idl e2e_project_frontend retrieve '("B")'
-  assert_eq '(blob "hello")'
+    # shellcheck disable=SC2154
+  assert_eq '(blob "hello")' "$stdout"
 }
 
 @test "using an unencrypted identity on mainnet provokes a warning" {
diff --git a/e2e/tests-dfx/install.bash b/e2e/tests-dfx/install.bash
index bd4a4f3d02..966c02e0da 100644
--- a/e2e/tests-dfx/install.bash
+++ b/e2e/tests-dfx/install.bash
@@ -152,6 +152,17 @@ teardown() {
   assert_eq "$BUILD_HASH" "$ONCHAIN_HASH"
 }
 
+@test "can install >2MiB wasm" {
+  install_asset large_canister
+  dfx_start
+  dfx canister create --all
+  assert_command dfx build
+  assert_command dfx canister install --all
+  assert_command dfx canister info large
+  HASH="$(sha256sum .dfx/local/canisters/large/large.wasm | head -c 64)"
+  assert_match "Module hash: 0x$HASH"
+}
+
 @test "--mode=auto selects install or upgrade automatically" {
   dfx_start
   assert_command dfx canister create e2e_project_backend
diff --git a/e2e/tests-dfx/metadata.bash b/e2e/tests-dfx/metadata.bash
index 9790de9178..8fee87cdf2 100644
--- a/e2e/tests-dfx/metadata.bash
+++ b/e2e/tests-dfx/metadata.bash
@@ -169,6 +169,10 @@ teardown() {
   # this canister has a build step, but it is an empty array, so dfx leaves the candid:service metadata as-is
   dfx canister metadata prebuilt_custom_empty_build candid:service >from_canister.txt
   diff main.did from_canister.txt
+
+  # this canister has a local import in did file, the metadata should flatten the definitions
+  assert_command dfx canister metadata prebuilt_local_import candid:service
+  assert_eq "service : { getCanisterId : () -> (principal) query }"
 }
 
 @test "can read canister metadata from replica" {
diff --git a/e2e/tests-dfx/upgrade_check.bash b/e2e/tests-dfx/upgrade_check.bash
index f4d93fc025..986bb90b62 100644
--- a/e2e/tests-dfx/upgrade_check.bash
+++ b/e2e/tests-dfx/upgrade_check.bash
@@ -64,3 +64,17 @@ teardown() {
   assert_command dfx canister call hello_backend read2 '()'
   assert_match "(1 : int)"
 }
+
+@test "warning for using special opt rule" {
+  install_asset upgrade
+  dfx_start
+  dfx deploy
+  dfx canister call hello_backend f '()'
+  jq '.canisters.hello_backend.main="v4_bad.mo"' dfx.json | sponge dfx.json
+  echo yes | (
+  assert_command dfx deploy
+  assert_match "Candid interface compatibility check failed"
+  )
+  assert_command dfx canister call hello_backend f '()'
+  assert_match "(opt \"\")"
+}
diff --git a/e2e/tests-dfx/wallet.bash b/e2e/tests-dfx/wallet.bash
index 37656ab91e..c64eb89223 100644
--- a/e2e/tests-dfx/wallet.bash
+++ b/e2e/tests-dfx/wallet.bash
@@ -131,7 +131,8 @@ teardown() {
 
   assert_command dfx canister call "$WALLET" wallet_call \
     "(record { canister = principal \"$(dfx canister id e2e_project_backend)\"; method_name = \"amInitializer\"; args = blob \"DIDL\00\00\"; cycles = (0:nat64)})"
-  assert_eq '(variant { 17_724 = record { 153_986_224 = blob "\44\49\44\4c\00\01\7e\01" } })'  # True in DIDL.
+  # shellcheck disable=SC2154
+  assert_eq '(variant { 17_724 = record { 153_986_224 = blob "\44\49\44\4c\00\01\7e\01" } })' "$stdout"  # True in DIDL.
 }
 
 @test "forward user call through wallet: deploy" {
@@ -147,7 +148,8 @@ teardown() {
   assert_command dfx canister call e2e_project_backend amInitializer
   assert_command dfx canister call "$WALLET" wallet_call \
     "(record { canister = principal \"$(dfx canister id e2e_project_backend)\"; method_name = \"amInitializer\"; args = blob \"DIDL\00\00\"; cycles = (0:nat64)})"
-  assert_eq '(variant { 17_724 = record { 153_986_224 = blob "\44\49\44\4c\00\01\7e\01" } })'  # True in DIDL.
+  # shellcheck disable=SC2154
+  assert_eq '(variant { 17_724 = record { 153_986_224 = blob "\44\49\44\4c\00\01\7e\01" } })' "$stdout"  # True in DIDL.
 }
 
 @test "a 64-bit wallet can still be called in the 128-bit context" {
diff --git a/nix/sources.json b/nix/sources.json
index 1a8ef923db..43a4856d87 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -6,63 +6,63 @@
         "homepage": "https://rustsec.org",
         "owner": "RustSec",
         "repo": "advisory-db",
-        "rev": "a5fb72de318a74eb69a2c241c0e46705684a35d0",
-        "sha256": "1cypbsjjv6c1azi3lhh8gf368c0zilrddpnf2mi0qym9hj1by7dz",
+        "rev": "fbc3b29acacf335c5fced02566d8f86e59eb1d7a",
+        "sha256": "1bs2ddk14lsqr9sr1ai7qkszpifaaq81c5b1i3bddi5j7kb43zz6",
         "type": "tarball",
-        "url": "https://github.com/RustSec/advisory-db/archive/a5fb72de318a74eb69a2c241c0e46705684a35d0.tar.gz",
+        "url": "https://github.com/RustSec/advisory-db/archive/fbc3b29acacf335c5fced02566d8f86e59eb1d7a.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "canister_sandbox-x86_64-darwin": {
         "builtin": false,
         "description": "The canister_sandbox binary. It must be updated together with the replica binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "049hfmpi7njn439hry1z5qb3k45z300jvrvcgycbxrdiz5nd9kaa",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "1h6r06fkrmk6b4rfyg8dfgxfaw9bqrsvfzgaqc39myg47nswi9a0",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/canister_sandbox.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/canister_sandbox.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/canister_sandbox.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/canister_sandbox.gz"
     },
     "canister_sandbox-x86_64-linux": {
         "builtin": false,
         "description": "The canister_sandbox binary. It must be updated together with the replica binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "04r9rs47ky6715jwia5qzpj5983y2xyg246wncjhybqn79a9m10i",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "17p1jq77kcqgc058kli6wsyiksyh66ghgv6k2hxvif3fmnpfnxz7",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/canister_sandbox.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/canister_sandbox.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/canister_sandbox.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/canister_sandbox.gz"
     },
     "ic-admin-x86_64-darwin": {
         "builtin": false,
         "description": "The ic-admin binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "15r1ymcrhb1z859cpjhg3y9nswskh94sxr8l1gqbw5lsf6y8ygsb",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "09p1l9jvb0f8whdv4dy3mbrl4nf695aps4l4i8dpvl9ia41s7hjm",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-admin.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-admin.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-admin.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/ic-admin.gz"
     },
     "ic-admin-x86_64-linux": {
         "builtin": false,
         "description": "The ic-admin binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "00hry4mjramd8dwx88v8crrzjj0rzkvd23ckqig3bglvaisnsspf",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "0aprgricbmc8glagcfhsl3r33pg7fcyxyyw2kpjg42j2hzyb7hbp",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-admin.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-admin.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-admin.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/ic-admin.gz"
     },
     "ic-btc-adapter-x86_64-darwin": {
         "builtin": false,
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "0y79j7rzi12896808sai0nhfzslmgrg1gvm7kfprf89jrikh1v9w",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "1wp1pk97a1d6fl1d0gblw0bzz80cjm1brkl50h42sp0cxzgzvz4c",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-btc-adapter.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-btc-adapter.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-btc-adapter.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/ic-btc-adapter.gz"
     },
     "ic-btc-adapter-x86_64-linux": {
         "builtin": false,
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "1silh7jx2i6ln7r1k49ndgddm4fm10f9f3f822lyz90vz7dml6yk",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "1h1vmnawi1rwwhjqdczci3hfbvpdy5rkf9h9qdznmh1s9sqlad19",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-btc-adapter.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-btc-adapter.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-btc-adapter.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/ic-btc-adapter.gz"
     },
     "ic-btc-canister": {
         "owner": "dfinity",
@@ -74,69 +74,69 @@
     },
     "ic-https-outcalls-adapter-x86_64-darwin": {
         "builtin": false,
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "14nivx59ww4y0phpwxfcisc4an2sny5r4f3qrmalqk4vi445mszy",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "0l4xlqwsmgmh9yqkabq172m4i2q27ifbihmr9pxiqrfsz585qk79",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-https-outcalls-adapter.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-https-outcalls-adapter.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-https-outcalls-adapter.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/ic-https-outcalls-adapter.gz"
     },
     "ic-https-outcalls-adapter-x86_64-linux": {
         "builtin": false,
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "0qgxzfzym8gh91bsg5krmlrh39anlcgnff330w4jgiwql95ayvr7",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "15zsn11ijamgz20s5ylla4bi6b5jrpjsy4a3f303xashykhm8p1v",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-https-outcalls-adapter.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-https-outcalls-adapter.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-https-outcalls-adapter.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/ic-https-outcalls-adapter.gz"
     },
     "ic-nns-init-x86_64-darwin": {
         "builtin": false,
         "description": "The ic-nns-init binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "0c59dsi9gwxzj9l2d94k48yk2vdz0gb1yjfh58ky1sx4w28hxzc5",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "0d4m42g12bgsg9xpjv7p4apycdacc753pff7cq7fhyw989m5q136",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-nns-init.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-nns-init.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-nns-init.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/ic-nns-init.gz"
     },
     "ic-nns-init-x86_64-linux": {
         "builtin": false,
         "description": "The ic-nns-init binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "15v8a6d71rg7xgl3nvy5l839qxyvkig1mlldpdr4bmmwp3yqx3nm",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "0vsw23bxzb7afha765353s97ai9h96gsxqk1s04x3b0ga88qhbq9",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-nns-init.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-nns-init.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-nns-init.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/ic-nns-init.gz"
     },
     "ic-starter-x86_64-darwin": {
         "builtin": false,
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "1ar30xi3vnrwpyl0cir3m4dvdzdwm09xji33w25krj5n9503acqz",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "0skkhacdl129vnyx6q0bjx8mgzkgiwrxsnkciyp6434v72sr2ky8",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-starter.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-starter.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-starter.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/ic-starter.gz"
     },
     "ic-starter-x86_64-linux": {
         "builtin": false,
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "1ddgxd9pnybnjiqhgggxlkbq8ml99ca4iq54kh221kdj7h1m334d",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "11zxvvb6q86ssj130i0nacy39pzl3pm29zgv32hjkz2si41qg2p5",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-starter.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/ic-starter.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-starter.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/ic-starter.gz"
     },
     "icx-proxy-x86_64-darwin": {
         "builtin": false,
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "1p9gmlz85j514s6da189hwaghg18p62pbknkn3q59jyxmf22fzxh",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "187ww64jpjzmyp996b3zmm5j9liz2mwbf6vm561xnic1pg4px571",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/icx-proxy-dev.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/icx-proxy-dev.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/icx-proxy-dev.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/icx-proxy-dev.gz"
     },
     "icx-proxy-x86_64-linux": {
         "builtin": false,
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "105jm3px6ky88jc86am8dkxz1vnhzcxy0p7skzs98baylr96kzrb",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "1sdpavhcnmnjf29r3k5afxjk6fvsv1sz830sbay5mx5b5q4x7wh3",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/icx-proxy-dev.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/icx-proxy-dev.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/icx-proxy-dev.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/icx-proxy-dev.gz"
     },
     "motoko-base": {
         "builtin": false,
@@ -167,55 +167,55 @@
     "replica-x86_64-darwin": {
         "builtin": false,
         "description": "The replica binary. It must be updated together with the canister_sandbox binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "12z1lvhv257ywf1b4gknywdimh5yqnfx20yxn37f30iifg2zw87k",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "06y9kqikzkw3cxsp04vxhfymd5dicvfkrr59b5fjbj3bi40ivn5i",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/replica.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/replica.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/replica.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/replica.gz"
     },
     "replica-x86_64-linux": {
         "builtin": false,
         "description": "The replica binary. It must be updated together with the canister_sandbox binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "120iinjcybvc346wf1iq6r964a3w5dhhif6rnf2ngf0q3350rlrc",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "0af7mz8k86fxchybmfy43w2l1xw8dp1qnxl5dldwbhyrr1x1x48r",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/replica.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/replica.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/replica.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/replica.gz"
     },
     "sandbox_launcher-x86_64-darwin": {
         "builtin": false,
         "description": "The sandbox_launcher binary. It must be updated together with the replica binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "12pz2i2yhfl2saab3rc5sf0dr24l6siirpsx8z414818mzpc42zd",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "1mnmm9kjljng8gj4g9wak9abm9iyzcf2z2awvlm2bkrnh936m401",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/sandbox_launcher.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/sandbox_launcher.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/sandbox_launcher.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/sandbox_launcher.gz"
     },
     "sandbox_launcher-x86_64-linux": {
         "builtin": false,
         "description": "The sandbox_launcher binary. It must be updated together with the replica binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "0zzpr02vc14ibx1qzd31a9jzh1zhb7ahcg85fazs6jkjk2zidi4n",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "07aiwbjgj08n1511c5mldwniipq7nf5dpl72g4f1908z23ndljwp",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/sandbox_launcher.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/sandbox_launcher.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/sandbox_launcher.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/sandbox_launcher.gz"
     },
     "sns-x86_64-darwin": {
         "builtin": false,
         "description": "The sns binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "12xkvxp3jprxw0205ml4ad3gdksi0x5c3kf7skcmkvqk744nml04",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "0l8812c1z4pkza8qn0vydrd6q4k2saahj0kg74725x158fndnc4i",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/sns.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/sns.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/sns.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-darwin/sns.gz"
     },
     "sns-x86_64-linux": {
         "builtin": false,
         "description": "The sns binary.",
-        "rev": "69e1408347723dbaa7a6cd2faa9b65c42abbe861",
-        "sha256": "02aqj9qcpvk216sdvkz25q1pf32bwb6wnf8v704rw133wpqq8sln",
+        "rev": "324eb99eb7531369a5ef75560f1a1a652d123714",
+        "sha256": "0r9npfkm9b3pg5388mxnj6aldvjpc6y2604gc7lahlyc25rqvl9y",
         "type": "file",
-        "url": "https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/sns.gz",
-        "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-linux/sns.gz"
+        "url": "https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/sns.gz",
+        "url_template": "https://download.dfinity.systems/ic/<rev>/binaries/x86_64-linux/sns.gz"
     }
 }
diff --git a/src/dfx-core/src/canister/mod.rs b/src/dfx-core/src/canister/mod.rs
index 032f578915..9ef051589a 100644
--- a/src/dfx-core/src/canister/mod.rs
+++ b/src/dfx-core/src/canister/mod.rs
@@ -6,7 +6,6 @@ use crate::{
 use candid::Principal;
 use ic_agent::Agent;
 use ic_utils::{
-    call::AsyncCall,
     interfaces::{
         management_canister::builders::{CanisterInstall, InstallMode},
         ManagementCanister, WalletCanister,
@@ -58,7 +57,7 @@ YOU WILL LOSE ALL DATA IN THE CANISTER.
     let mode_str = match mode {
         InstallMode::Install => "Installing",
         InstallMode::Reinstall => "Reinstalling",
-        InstallMode::Upgrade => "Upgrading",
+        InstallMode::Upgrade { .. } => "Upgrading",
     };
     if let Some(name) = canister_name {
         info!(
@@ -71,12 +70,10 @@ YOU WILL LOSE ALL DATA IN THE CANISTER.
     match call_sender {
         CallSender::SelectedId => {
             let install_builder = mgr
-                .install_code(&canister_id, &wasm_module)
+                .install(&canister_id, &wasm_module)
                 .with_raw_arg(args.to_vec())
                 .with_mode(mode);
             install_builder
-                .build()
-                .map_err(CanisterBuilderError::CallSenderBuildError)?
                 .call_and_wait()
                 .await
                 .map_err(CanisterInstallError::InstallWasmError)
diff --git a/src/dfx/assets/dfx-asset-sources.toml b/src/dfx/assets/dfx-asset-sources.toml
index 7e21b9f154..7afe09c44a 100644
--- a/src/dfx/assets/dfx-asset-sources.toml
+++ b/src/dfx/assets/dfx-asset-sources.toml
@@ -1,29 +1,29 @@
 # generated by write-dfx-asset-sources.sh
-replica-rev = '69e1408347723dbaa7a6cd2faa9b65c42abbe861'
+replica-rev = '324eb99eb7531369a5ef75560f1a1a652d123714'
 
 [x86_64-darwin.icx-proxy]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/icx-proxy-dev.gz'
-sha256 = 'b07f2784abddcb54f0b0d3ce7585b9283cf814870905d58c26a1c8823ead2fdd'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/icx-proxy-dev.gz'
+sha256 = 'e1947ec9bb8145db8329751bb778153fd2244bad7f2c93d2f5f5cb2b89e1fca0'
 
 [x86_64-darwin.ic-admin]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-admin.gz'
-sha256 = '4b3f8fbc719a16bef00b14e5ae498253736d931f0fcacb52413f2c9859f52197'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-admin.gz'
+sha256 = '55c2a3035131d17d1b8a84127d5549c65942f3aac337b21be4c881b565a2e126'
 
 [x86_64-darwin.ic-btc-adapter]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-btc-adapter.gz'
-sha256 = '3ced0067cc322197af9ba7ee175e7e95eaefa00551690490494884f8f391e978'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-btc-adapter.gz'
+sha256 = '8cfcfddfef0c5c2d080485cebc42950ca0ff17e0743dd00275a60575d2bce1f2'
 
 [x86_64-darwin.ic-https-outcalls-adapter]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-https-outcalls-adapter.gz'
-sha256 = 'feeb5a08899b4c4c55cd7838928bb75a5845988ecc757ee1059e709e4adfd192'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-https-outcalls-adapter.gz'
+sha256 = 'e94c5c50f9da651cfb4db9c2b85c3c028b48aa38012f35b14fb0beaa39a69d50'
 
 [x86_64-darwin.ic-nns-init]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-nns-init.gz'
-sha256 = '85fd0e91e0a4ebe0272ad0491fd603bf6d313d2293a4266892bff397a26ea930'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-nns-init.gz'
+sha256 = '66045c6a42897be80e66c7b93bca614c35e6af22f76c797b7afa2d119e209534'
 
 [x86_64-darwin.ic-starter]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/ic-starter.gz'
-sha256 = '1f33354049b6c83c8be06344d913a8bcfdb61ba9234706a8bf3cdb3d620723ab'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/ic-starter.gz'
+sha256 = 'c84f91b5389b0c62ae8f6c5add338f6ffe5751970b60d3bddd4904da9882736a'
 
 [x86_64-darwin.motoko]
 url = 'https://github.com/dfinity/motoko/releases/download/0.10.4/motoko-Darwin-x86_64-0.10.4.tar.gz'
@@ -31,21 +31,21 @@ sha256 = '21cb1e976d4970c64e5335bba74cb76a5b056811b9a6460d1bf9432229026757'
 # The replica and canister_sandbox binaries must have the same revision.
 
 [x86_64-darwin.replica]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/replica.gz'
-sha256 = 'f320fec5733182e1ceb0dd03d19dc5bec01a1bf7763eb282e3fe14b1e1a6e18b'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/replica.gz'
+sha256 = 'b1d81d01896bc8255d59a9e43cdd66b19556bd837d1370756783cf3f239ec91b'
 # The replica and canister_sandbox binaries must have the same revision.
 
 [x86_64-darwin.canister_sandbox]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/canister_sandbox.gz'
-sha256 = '4acdd46cf9b1e5be987f6ce72d0118bf9039162e3ff80cd32056da136f753011'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/canister_sandbox.gz'
+sha256 = '40a5c8b53de4f99a06c3ea7db775c62b71e5fa730d3def325966d63c9d01d9c0'
 
 [x86_64-darwin.sandbox_launcher]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/sandbox_launcher.gz'
-sha256 = 'ed0bc2eeaf282012c8475ddf1ca3369488dc80d385e5b194d2823ae84514ff8a'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/sandbox_launcher.gz'
+sha256 = '01906a468236cf252add5c892f1cfb3ea6ba549a8aa747e443cf4a2a67aad5d6'
 
 [x86_64-darwin.sns]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-darwin/sns.gz'
-sha256 = '04d06a093913ef59d9d4c7cdc14a0751cff6465384d60204e03d5f396edfb38b'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-darwin/sns.gz'
+sha256 = '9130dbac4325f4220e396f020995d262126c5a6e7e038b91faf3921f98080851'
 
 [x86_64-darwin.motoko-base]
 url = 'https://github.com/dfinity/motoko/releases/download/0.10.4/motoko-base-library.tar.gz'
@@ -56,28 +56,28 @@ url = 'https://github.com/dfinity/bitcoin-canister/releases/download/release%2F2
 sha256 = '09f5647a45ff6d5d05b2b0ed48613fb2365b5fe6573ba0e901509c39fb9564ac'
 
 [x86_64-linux.icx-proxy]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/icx-proxy-dev.gz'
-sha256 = '2bff6952a65e2d94f49ffa5ce03bfbd0eef0fb6ca82a839844c84fd3efa8b280'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/icx-proxy-dev.gz'
+sha256 = '03f2d3092eabf45abc5a1a0cf475d87a3b336577aacc919370d256cbe056b7e9'
 
 [x86_64-linux.ic-admin]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-admin.gz'
-sha256 = 'ee6a6d75549bbe355ec4930dd1f6fc1948f973666823d47943adaa2c2bf11902'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-admin.gz'
+sha256 = '77c1b3fc87420af2e49d827bdf3d73e7dd31f2a01a3af6147d88d5c5627ef92a'
 
 [x86_64-linux.ic-btc-adapter]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-btc-adapter.gz'
-sha256 = 'd31b5adbf91ba4efa910c80d971c08d591dada6b369119f2b1d444d1e58134ea'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-btc-adapter.gz'
+sha256 = '293445b14e3ac06a7fc309263773f1edeee5e088ecb38625e43c87c895ad3bc0'
 
 [x86_64-linux.ic-https-outcalls-adapter]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-https-outcalls-adapter.gz'
-sha256 = '276faf4aa298c72709076338671fa356a50133ad7996a75748f0a1eabffbfd61'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-https-outcalls-adapter.gz'
+sha256 = '3b5c54e1f450ab3ec0704311afe5cdb22c13175194faa281f8af2a1943b0fa97'
 
 [x86_64-linux.ic-nns-init]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-nns-init.gz'
-sha256 = 'd58e8efdb8bcd64572bb8dd21a5e9cdb779c06a2c56f3be8ebe7e5709a516897'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-nns-init.gz'
+sha256 = '092f8811520facd109d061e2ae9f49304575921e6514731474eaacdfd7105c6f'
 
 [x86_64-linux.ic-starter]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/ic-starter.gz'
-sha256 = '8d8c51033cb2cd20049ca4e048144b895684d7a4fdbd07719476797b53ebafb5'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/ic-starter.gz'
+sha256 = 'e58a8703895afc29a118fbfd24ea1df4df343c5316443082d4da206cd6defd87'
 
 [x86_64-linux.motoko]
 url = 'https://github.com/dfinity/motoko/releases/download/0.10.4/motoko-Linux-x86_64-0.10.4.tar.gz'
@@ -85,21 +85,21 @@ sha256 = '48beb994fe4fc1630e83cc98979e0f77130b23bb909ecf7a1b108140d6088856'
 # The replica and canister_sandbox binaries must have the same revision.
 
 [x86_64-linux.replica]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/replica.gz'
-sha256 = '2cd30cca1818b86785b3d9b808612b7c286252363806c70d196c2fcfa48d1188'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/replica.gz'
+sha256 = '19911e7ac8d9c3c51b6d85768bc36d88f740051fc4bbba3c64dd1934d1afc729'
 # The replica and canister_sandbox binaries must have the same revision.
 
 [x86_64-linux.canister_sandbox]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/canister_sandbox.gz'
-sha256 = '11849a543a162f0f25b3dc10f17c177ea054e4fdb8a8c86509c7f87988ce2913'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/canister_sandbox.gz'
+sha256 = 'e777ebaead6eb8b83b14d3ec079f31d0eb19bde626d2890a600fb3790e96e19e'
 
 [x86_64-linux.sandbox_launcher]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/sandbox_launcher.gz'
-sha256 = '96c416bf98724aa3bf72053d06d559f007f8655261b48f435f9104b605c8f77f'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/sandbox_launcher.gz'
+sha256 = '974bdaec101f81141c79e2d0db8ab307df182d6fb4161642091601f9e4e2511d'
 
 [x86_64-linux.sns]
-url = 'https://download.dfinity.systems/ic/69e1408347723dbaa7a6cd2faa9b65c42abbe861/openssl-static-binaries/x86_64-linux/sns.gz'
-sha256 = '966a84f1e563049e09381b39cbcde24b0c77032ee2cfddb40962eecb70925809'
+url = 'https://download.dfinity.systems/ic/324eb99eb7531369a5ef75560f1a1a652d123714/binaries/x86_64-linux/sns.gz'
+sha256 = '3ed18d7311cc53a8e8618f0023bc6157ee469591b65784467977ac54a7bb3665'
 
 [x86_64-linux.motoko-base]
 url = 'https://github.com/dfinity/motoko/releases/download/0.10.4/motoko-base-library.tar.gz'
diff --git a/src/dfx/src/commands/canister/call.rs b/src/dfx/src/commands/canister/call.rs
index eb034120f6..70f9a642c9 100644
--- a/src/dfx/src/commands/canister/call.rs
+++ b/src/dfx/src/commands/canister/call.rs
@@ -4,10 +4,13 @@ use crate::lib::error::DfxResult;
 use crate::lib::operations::canister::get_local_cid_and_candid_path;
 use crate::lib::root_key::fetch_root_key_if_needed;
 use crate::util::clap::parsers::{cycle_amount_parser, file_or_stdin_parser};
-use crate::util::{arguments_from_file, blob_from_arguments, get_candid_type, print_idl_blob};
+use crate::util::{
+    arguments_from_file, blob_from_arguments, get_candid_type, print_idl_blob, read_module_metadata,
+};
 use anyhow::{anyhow, Context};
 use candid::Principal as CanisterId;
 use candid::{CandidType, Decode, Deserialize, Principal};
+use candid_parser::utils::CandidSource;
 use clap::Parser;
 use dfx_core::canister::build_wallet_canister;
 use dfx_core::identity::CallSender;
@@ -183,7 +186,10 @@ pub fn get_effective_canister_id(
             | MgmtMethod::DeleteCanister
             | MgmtMethod::DepositCycles
             | MgmtMethod::UninstallCode
-            | MgmtMethod::ProvisionalTopUpCanister => {
+            | MgmtMethod::ProvisionalTopUpCanister
+            | MgmtMethod::UploadChunk
+            | MgmtMethod::ClearChunkStore
+            | MgmtMethod::StoredChunks => {
                 #[derive(CandidType, Deserialize)]
                 struct In {
                     canister_id: CanisterId,
@@ -195,6 +201,15 @@ pub fn get_effective_canister_id(
             MgmtMethod::ProvisionalCreateCanisterWithCycles => {
                 Ok(CanisterId::management_canister())
             }
+            MgmtMethod::InstallChunkedCode => {
+                #[derive(CandidType, Deserialize)]
+                struct In {
+                    target_canister: Principal,
+                }
+                let in_args = Decode!(arg_value, In)
+                    .context("Argument is not valid for InstallChunkedCode")?;
+                Ok(in_args.target_canister)
+            }
         }
     } else {
         Ok(canister_id)
@@ -206,29 +221,32 @@ pub async fn exec(
     opts: CanisterCallOpts,
     call_sender: &CallSender,
 ) -> DfxResult {
+    let agent = env.get_agent();
+    fetch_root_key_if_needed(env).await?;
+
     let callee_canister = opts.canister_name.as_str();
     let method_name = opts.method_name.as_str();
     let canister_id_store = env.get_canister_id_store()?;
 
-    let (canister_id, maybe_candid_path) = match CanisterId::from_text(callee_canister) {
-        Ok(id) => {
-            if let Some(canister_name) = canister_id_store.get_name(callee_canister) {
-                get_local_cid_and_candid_path(env, canister_name, Some(id))?
-            } else {
-                // TODO fetch candid file from remote canister
-                (id, None)
-            }
-        }
+    let canister_id = match CanisterId::from_text(callee_canister) {
+        Ok(id) => id,
         Err(_) => {
             let canister_id = canister_id_store.get(callee_canister)?;
-            get_local_cid_and_candid_path(env, callee_canister, Some(canister_id))?
+            get_local_cid_and_candid_path(env, callee_canister, Some(canister_id))?.0
         }
     };
-    let maybe_candid_path = opts.candid.or(maybe_candid_path);
+    let method_type = if let Some(path) = opts.candid {
+        get_candid_type(CandidSource::File(&path), method_name)
+    } else {
+        read_module_metadata(agent, canister_id, "candid:service")
+            .await
+            .and_then(|did| get_candid_type(CandidSource::Text(&did), method_name))
+    };
+    if method_type.is_none() {
+        eprintln!("Cannot fetch Candid interface from canister metadata, sending arguments with inferred types.");
+    }
 
     let is_management_canister = canister_id == CanisterId::management_canister();
-
-    let method_type = maybe_candid_path.and_then(|path| get_candid_type(&path, method_name));
     let is_query_method = method_type.as_ref().map(|(_, f)| f.is_query());
 
     let arguments_from_file = opts
@@ -263,9 +281,6 @@ pub async fn exec(
     // Get the argument, get the type, convert the argument to the type and return
     // an error if any of it doesn't work.
     let arg_value = blob_from_arguments(arguments, opts.random.as_deref(), arg_type, &method_type)?;
-    let agent = env.get_agent();
-
-    fetch_root_key_if_needed(env).await?;
 
     // amount has been validated by cycle_amount_validator
     let cycles = opts.with_cycles.unwrap_or(0);
diff --git a/src/dfx/src/commands/canister/delete.rs b/src/dfx/src/commands/canister/delete.rs
index 3cd04a9faa..877d316ae6 100644
--- a/src/dfx/src/commands/canister/delete.rs
+++ b/src/dfx/src/commands/canister/delete.rs
@@ -1,4 +1,3 @@
-use crate::lib::agent::create_agent_environment;
 use crate::lib::environment::Environment;
 use crate::lib::error::DfxResult;
 use crate::lib::ic_attributes::CanisterSettings;
@@ -129,8 +128,7 @@ async fn delete_canister(
                     },
                     CallSender::SelectedId => {
                         let network = env.get_network_descriptor();
-                        let agent_env = create_agent_environment(env, Some(network.name.clone()))?;
-                        let identity_name = agent_env
+                        let identity_name = env
                             .get_selected_identity()
                             .expect("No selected identity.")
                             .to_string();
diff --git a/src/dfx/src/commands/canister/sign.rs b/src/dfx/src/commands/canister/sign.rs
index 69515733de..d00d4ecbaf 100644
--- a/src/dfx/src/commands/canister/sign.rs
+++ b/src/dfx/src/commands/canister/sign.rs
@@ -8,6 +8,7 @@ use crate::util::clap::parsers::file_or_stdin_parser;
 use crate::util::{arguments_from_file, blob_from_arguments, get_candid_type};
 use anyhow::{anyhow, bail, Context};
 use candid::Principal;
+use candid_parser::utils::CandidSource;
 use clap::Parser;
 use dfx_core::identity::CallSender;
 use ic_agent::AgentError;
@@ -86,7 +87,7 @@ pub async fn exec(
             if let Some(canister_name) = canister_id_store.get_name(callee_canister) {
                 get_local_cid_and_candid_path(env, canister_name, Some(id))?
             } else {
-                // TODO fetch candid file from remote canister
+                // Sign works in offline mode, cannot fetch candid file from remote canister
                 (id, None)
             }
         }
@@ -96,7 +97,8 @@ pub async fn exec(
         }
     };
 
-    let method_type = maybe_candid_path.and_then(|path| get_candid_type(&path, method_name));
+    let method_type =
+        maybe_candid_path.and_then(|path| get_candid_type(CandidSource::File(&path), method_name));
     let is_query_method = method_type.as_ref().map(|(_, f)| f.is_query());
 
     let arguments_from_file = opts
diff --git a/src/dfx/src/commands/deps/init.rs b/src/dfx/src/commands/deps/init.rs
index 05e0b81172..44350710f6 100644
--- a/src/dfx/src/commands/deps/init.rs
+++ b/src/dfx/src/commands/deps/init.rs
@@ -5,10 +5,10 @@ use crate::lib::deps::{
 };
 use crate::lib::environment::Environment;
 use crate::lib::error::DfxResult;
-use crate::util::{check_candid_file, fuzzy_parse_argument};
+use crate::util::fuzzy_parse_argument;
 use anyhow::{anyhow, bail};
 use candid::Principal;
-use candid_parser::{types::IDLTypes, typing::ast_to_type};
+use candid_parser::{types::IDLTypes, typing::ast_to_type, utils::CandidSource};
 use clap::Parser;
 use slog::{info, warn, Logger};
 
@@ -68,7 +68,7 @@ fn set_init(
         .ok_or_else(|| anyhow!("Failed to find {canister_id} entry in pulled.json"))?;
     let canister_prompt = get_canister_prompt(canister_id, pulled_canister);
     let idl_path = get_pulled_service_candid_path(canister_id)?;
-    let (env, _) = check_candid_file(&idl_path)?;
+    let (env, _) = CandidSource::File(&idl_path).load()?;
     let candid_args = pulled_json.get_candid_args(canister_id)?;
     let candid_args_idl_types: IDLTypes = candid_args.parse()?;
     let mut types = vec![];
diff --git a/src/dfx/src/commands/remote/generate_binding.rs b/src/dfx/src/commands/remote/generate_binding.rs
index 947b5b852a..45a48b8b20 100644
--- a/src/dfx/src/commands/remote/generate_binding.rs
+++ b/src/dfx/src/commands/remote/generate_binding.rs
@@ -2,8 +2,8 @@ use crate::lib::agent::create_agent_environment;
 use crate::lib::environment::Environment;
 use crate::lib::error::DfxResult;
 use crate::lib::models::canister::CanisterPool;
-use crate::util::check_candid_file;
 use anyhow::Context;
+use candid_parser::utils::CandidSource;
 use clap::Parser;
 use slog::info;
 
@@ -70,7 +70,7 @@ pub fn exec(env: &dyn Environment, opts: GenerateBindingOpts) -> DfxResult {
                         continue;
                     }
                 }
-                let (type_env, did_types) = check_candid_file(&candid)?;
+                let (type_env, did_types) = CandidSource::File(&candid).load()?;
                 let extension = main.extension().unwrap_or_default();
                 let bindings = if extension == "mo" {
                     Some(candid_parser::bindings::motoko::compile(
diff --git a/src/dfx/src/commands/wallet/upgrade.rs b/src/dfx/src/commands/wallet/upgrade.rs
index a0d36b3076..229738cd8a 100644
--- a/src/dfx/src/commands/wallet/upgrade.rs
+++ b/src/dfx/src/commands/wallet/upgrade.rs
@@ -43,7 +43,15 @@ pub async fn exec(env: &dyn Environment, _opts: UpgradeOpts) -> DfxResult {
 
     let agent = env.get_agent();
 
-    install_wallet(env, agent, canister_id, InstallMode::Upgrade).await?;
+    install_wallet(
+        env,
+        agent,
+        canister_id,
+        InstallMode::Upgrade {
+            skip_pre_upgrade: false,
+        },
+    )
+    .await?;
 
     println!("Upgraded the wallet wasm module.");
     Ok(())
diff --git a/src/dfx/src/lib/builders/mod.rs b/src/dfx/src/lib/builders/mod.rs
index 59846b8a39..05c6706905 100644
--- a/src/dfx/src/lib/builders/mod.rs
+++ b/src/dfx/src/lib/builders/mod.rs
@@ -3,9 +3,9 @@ use crate::lib::canister_info::CanisterInfo;
 use crate::lib::environment::Environment;
 use crate::lib::error::{BuildError, DfxError, DfxResult};
 use crate::lib::models::canister::CanisterPool;
-use crate::util::check_candid_file;
 use anyhow::{anyhow, bail, Context};
 use candid::Principal as CanisterId;
+use candid_parser::utils::CandidSource;
 use dfx_core::config::model::dfinity::{Config, Profile};
 use dfx_core::network::provider::get_network_context;
 use dfx_core::util;
@@ -150,7 +150,7 @@ pub trait CanisterBuilder {
 
         let generated_idl_path = self.generate_idl(pool, info, config)?;
 
-        let (env, ty) = check_candid_file(generated_idl_path.as_path())?;
+        let (env, ty) = CandidSource::File(generated_idl_path.as_path()).load()?;
 
         // Typescript
         if bindings.contains(&"ts".to_string()) {
diff --git a/src/dfx/src/lib/migrate.rs b/src/dfx/src/lib/migrate.rs
index 16642be28a..a1bb2085a9 100644
--- a/src/dfx/src/lib/migrate.rs
+++ b/src/dfx/src/lib/migrate.rs
@@ -65,7 +65,15 @@ async fn migrate_wallet(
     if !wallet.version_supports_u128_cycles() {
         if fix {
             println!("Upgrading wallet... ");
-            install_wallet(env, agent, *wallet.canister_id_(), InstallMode::Upgrade).await?
+            install_wallet(
+                env,
+                agent,
+                *wallet.canister_id_(),
+                InstallMode::Upgrade {
+                    skip_pre_upgrade: false,
+                },
+            )
+            .await?
         } else {
             println!("The wallet is outdated; run `dfx wallet upgrade`");
         }
diff --git a/src/dfx/src/lib/models/canister.rs b/src/dfx/src/lib/models/canister.rs
index 002445de10..9dec60901d 100644
--- a/src/dfx/src/lib/models/canister.rs
+++ b/src/dfx/src/lib/models/canister.rs
@@ -8,9 +8,10 @@ use crate::lib::error::{BuildError, DfxError, DfxResult};
 use crate::lib::metadata::dfx::DfxMetadata;
 use crate::lib::metadata::names::{CANDID_ARGS, CANDID_SERVICE, DFX};
 use crate::lib::wasm::file::{compress_bytes, read_wasm_module};
-use crate::util::{assets, check_candid_file};
+use crate::util::assets;
 use anyhow::{anyhow, bail, Context};
 use candid::Principal as CanisterId;
+use candid_parser::utils::CandidSource;
 use dfx_core::config::model::canister_id_store::CanisterIdStore;
 use dfx_core::config::model::dfinity::{
     CanisterMetadataSection, Config, MetadataVisibility, WasmOptLevel,
@@ -275,15 +276,15 @@ impl Canister {
 
         let IdlBuildOutput::File(build_idl_path) = &build_output.idl;
 
-        // 1. Copy the complete IDL file to .dfx/local/canisters/NAME/constructor.did.
+        // 1. Separate into constructor.did, service.did and init_args
+        let (constructor_did, service_did, init_args) = separate_candid(build_idl_path)?;
+
+        // 2. Copy the constructor IDL file to .dfx/local/canisters/NAME/constructor.did.
         let constructor_idl_path = self.info.get_constructor_idl_path();
         dfx_core::fs::composite::ensure_parent_dir_exists(&constructor_idl_path)?;
-        dfx_core::fs::copy(build_idl_path, &constructor_idl_path)?;
+        dfx_core::fs::write(&constructor_idl_path, constructor_did)?;
         dfx_core::fs::set_permissions_readwrite(&constructor_idl_path)?;
 
-        // 2. Separate into service.did and init_args
-        let (service_did, init_args) = separate_candid(build_idl_path)?;
-
         // 3. Save service.did into following places in .dfx/local/:
         //   - canisters/NAME/service.did
         //   - IDL_ROOT/CANISTER_ID.did
@@ -337,42 +338,61 @@ fn wasm_opt_level_convert(opt_level: WasmOptLevel) -> OptLevel {
     }
 }
 
-fn separate_candid(path: &Path) -> DfxResult<(String, String)> {
-    let (env, actor) = check_candid_file(path)?;
+fn separate_candid(path: &Path) -> DfxResult<(String, String, String)> {
+    use candid::pretty::candid::{compile, pp_args};
+    use candid::types::internal::TypeInner;
+    use candid_parser::{
+        pretty_parse,
+        types::{Dec, IDLProg},
+    };
+    let did = dfx_core::fs::read_to_string(path)?;
+    let prog = pretty_parse::<IDLProg>(&format!("{}", path.display()), &did)?;
+    let has_imports = prog
+        .decs
+        .iter()
+        .any(|dec| matches!(dec, Dec::ImportType(_) | Dec::ImportServ(_)));
+    let (env, actor) = CandidSource::File(path).load()?;
     let actor = actor.ok_or_else(|| anyhow!("provided candid file contains no main service"))?;
-    if let candid::types::internal::TypeInner::Class(args, ty) = actor.as_ref() {
-        use candid_parser::pretty::{
-            candid::{compile, pp_ty},
-            utils::{concat, enclose},
+    let actor = env.trace_type(&actor)?;
+    let has_init_args = matches!(actor.as_ref(), TypeInner::Class(_, _));
+    if has_imports || has_init_args {
+        let (init_args, serv) = match actor.as_ref() {
+            TypeInner::Class(args, ty) => (args.clone(), ty.clone()),
+            TypeInner::Service(_) => (vec![], actor.clone()),
+            _ => unreachable!(),
         };
-
-        let actor = Some(ty.clone());
-        let service_did = compile(&env, &actor);
-        let doc = concat(args.iter().map(pp_ty), ",");
-        let init_args = enclose("(", doc, ")").pretty(80).to_string();
-        Ok((service_did, init_args))
+        let init_args = pp_args(&init_args).pretty(80).to_string();
+        let service = compile(&env, &Some(serv));
+        let constructor = compile(&env, &Some(actor));
+        Ok((constructor, service, init_args))
     } else {
-        // The original candid from builder output doesn't contain init_args
-        // Use it directly to avoid items reordering
-        let service_did = dfx_core::fs::read_to_string(path)?;
-        let init_args = String::from("()");
-        Ok((service_did, init_args))
+        // Keep the original did file to preserve comments
+        Ok((did.clone(), did, "()".to_string()))
     }
 }
 
 #[context("{} is not a valid subtype of {}", specified_idl_path.display(), compiled_idl_path.display())]
 fn check_valid_subtype(compiled_idl_path: &Path, specified_idl_path: &Path) -> DfxResult {
-    let (mut env, opt_specified) =
-        check_candid_file(specified_idl_path).context("Checking specified candid file.")?;
+    use candid::types::subtype::{subtype_with_config, OptReport};
+    let (mut env, opt_specified) = CandidSource::File(specified_idl_path)
+        .load()
+        .context("Checking specified candid file.")?;
     let specified_type =
         opt_specified.expect("Specified did file should contain some service interface");
-    let (env2, opt_compiled) =
-        check_candid_file(compiled_idl_path).context("Checking compiled candid file.")?;
+    let (env2, opt_compiled) = CandidSource::File(compiled_idl_path)
+        .load()
+        .context("Checking compiled candid file.")?;
     let compiled_type =
         opt_compiled.expect("Compiled did file should contain some service interface");
     let mut gamma = HashSet::new();
     let specified_type = env.merge_type(env2, specified_type);
-    candid::types::subtype::subtype(&mut gamma, &env, &compiled_type, &specified_type)?;
+    subtype_with_config(
+        OptReport::Error,
+        &mut gamma,
+        &env,
+        &compiled_type,
+        &specified_type,
+    )?;
     Ok(())
 }
 
@@ -812,7 +832,7 @@ fn build_canister_js(canister_id: &CanisterId, canister_info: &CanisterInfo) ->
         .get_service_idl_path()
         .with_extension("did.d.ts");
 
-    let (env, ty) = check_candid_file(&canister_info.get_service_idl_path())?;
+    let (env, ty) = CandidSource::File(&canister_info.get_constructor_idl_path()).load()?;
     let content = ensure_trailing_newline(candid_parser::bindings::javascript::compile(&env, &ty));
     std::fs::write(&output_did_js_path, content).with_context(|| {
         format!(
diff --git a/src/dfx/src/lib/operations/canister/install_canister.rs b/src/dfx/src/lib/operations/canister/install_canister.rs
index fe9b034f89..60f1988573 100644
--- a/src/dfx/src/lib/operations/canister/install_canister.rs
+++ b/src/dfx/src/lib/operations/canister/install_canister.rs
@@ -63,13 +63,15 @@ pub async fn install_canister(
     );
     let mode = mode.unwrap_or_else(|| {
         if installed_module_hash.is_some() {
-            InstallMode::Upgrade
+            InstallMode::Upgrade {
+                skip_pre_upgrade: false,
+            }
         } else {
             InstallMode::Install
         }
     });
     if let Some(canister_info) = canister_info {
-        if !skip_consent && matches!(mode, InstallMode::Reinstall | InstallMode::Upgrade) {
+        if !skip_consent && matches!(mode, InstallMode::Reinstall | InstallMode::Upgrade { .. }) {
             let candid = read_module_metadata(agent, canister_id, "candid:service").await;
             if let Some(candid) = &candid {
                 match check_candid_compatibility(canister_info, candid) {
@@ -85,7 +87,8 @@ pub async fn install_canister(
                 }
             }
         }
-        if !skip_consent && canister_info.is_motoko() && matches!(mode, InstallMode::Upgrade) {
+        if !skip_consent && canister_info.is_motoko() && matches!(mode, InstallMode::Upgrade { .. })
+        {
             let stable_types =
                 read_module_metadata(agent, canister_id, "motoko:stable-types").await;
             if let Some(stable_types) = &stable_types {
@@ -120,7 +123,7 @@ pub async fn install_canister(
     let new_hash = Sha256::digest(&wasm_module);
     debug!(log, "New wasm module hash: {}", hex::encode(new_hash));
 
-    if mode == InstallMode::Upgrade
+    if matches!(mode, InstallMode::Upgrade { .. })
         && matches!(&installed_module_hash, Some(old_hash) if old_hash[..] == new_hash[..])
         && !upgrade_unchanged
     {
@@ -246,7 +249,8 @@ fn check_candid_compatibility(
     canister_info: &CanisterInfo,
     candid: &str,
 ) -> anyhow::Result<Option<String>> {
-    use crate::util::check_candid_file;
+    use candid::types::subtype::{subtype_with_config, OptReport};
+    use candid_parser::utils::CandidSource;
     let candid_path = canister_info.get_constructor_idl_path();
     let deployed_path = canister_info
         .get_constructor_idl_path()
@@ -257,16 +261,19 @@ fn check_candid_compatibility(
             deployed_path.to_string_lossy()
         )
     })?;
-    let (mut env, opt_new) =
-        check_candid_file(&candid_path).context("Checking generated did file.")?;
+    let (mut env, opt_new) = CandidSource::File(&candid_path)
+        .load()
+        .context("Checking generated did file.")?;
     let new_type = opt_new
         .ok_or_else(|| anyhow!("Generated did file should contain some service interface"))?;
-    let (env2, opt_old) = check_candid_file(&deployed_path).context("Checking old candid file.")?;
+    let (env2, opt_old) = CandidSource::File(&deployed_path)
+        .load()
+        .context("Checking old candid file.")?;
     let old_type = opt_old
         .ok_or_else(|| anyhow!("Deployed did file should contain some service interface"))?;
     let mut gamma = HashSet::new();
     let old_type = env.merge_type(env2, old_type);
-    let result = candid::types::subtype::subtype(&mut gamma, &env, &new_type, &old_type);
+    let result = subtype_with_config(OptReport::Error, &mut gamma, &env, &new_type, &old_type);
     Ok(match result {
         Ok(_) => None,
         Err(e) => Some(e.to_string()),
diff --git a/src/dfx/src/lib/operations/canister/motoko_playground.rs b/src/dfx/src/lib/operations/canister/motoko_playground.rs
index 1d6d41db4a..22dd90afe6 100644
--- a/src/dfx/src/lib/operations/canister/motoko_playground.rs
+++ b/src/dfx/src/lib/operations/canister/motoko_playground.rs
@@ -45,9 +45,36 @@ impl CanisterInfo {
 pub struct InstallArgs<'a> {
     pub arg: &'a [u8],
     pub wasm_module: &'a [u8],
-    pub mode: InstallMode,
+    pub mode: PlaygroundInstallMode,
     pub canister_id: Principal,
 }
+
+#[derive(CandidType, Deserialize, Debug)]
+pub enum PlaygroundInstallMode {
+    #[serde(rename = "install")]
+    Install,
+    #[serde(rename = "upgrade")]
+    Upgrade,
+    #[serde(rename = "reinstall")]
+    Reinstall,
+}
+
+impl TryFrom<InstallMode> for PlaygroundInstallMode {
+    type Error = anyhow::Error;
+    fn try_from(m: InstallMode) -> DfxResult<Self> {
+        match m {
+            InstallMode::Install => Ok(Self::Install),
+            InstallMode::Reinstall => Ok(Self::Reinstall),
+            InstallMode::Upgrade {
+                skip_pre_upgrade: false,
+            } => Ok(Self::Upgrade),
+            InstallMode::Upgrade {
+                skip_pre_upgrade: true,
+            } => bail!("Cannot skip pre-upgrade on the playground"),
+        }
+    }
+}
+
 #[derive(CandidType)]
 struct InstallConfig<'a> {
     profiling: bool,
@@ -167,7 +194,7 @@ pub async fn playground_install_code(
     let install_arg = InstallArgs {
         arg,
         wasm_module,
-        mode,
+        mode: mode.try_into()?,
         canister_id: canister_info.id,
     };
     let install_config = InstallConfig {
diff --git a/src/dfx/src/util/mod.rs b/src/dfx/src/util/mod.rs
index e0afdecea3..aa3b8b6b68 100644
--- a/src/dfx/src/util/mod.rs
+++ b/src/dfx/src/util/mod.rs
@@ -7,7 +7,7 @@ use bytes::Bytes;
 use candid::types::{value::IDLValue, Function, Type, TypeEnv, TypeInner};
 use candid::IDLArgs;
 use candid_parser::error::pretty_diagnose;
-use candid_parser::typing::pretty_check_file;
+use candid_parser::utils::CandidSource;
 use dfx_core::fs::create_dir_all;
 use fn_error_context::context;
 #[cfg(unix)]
@@ -112,18 +112,15 @@ pub async fn read_module_metadata(
 /// Parse IDL file into TypeEnv. This is a best effort function: it will succeed if
 /// the IDL file can be parsed and type checked in Rust parser, and has an
 /// actor in the IDL file. If anything fails, it returns None.
-pub fn get_candid_type(
-    idl_path: &std::path::Path,
-    method_name: &str,
-) -> Option<(TypeEnv, Function)> {
-    let (env, ty) = check_candid_file(idl_path).ok()?;
+pub fn get_candid_type(candid: CandidSource, method_name: &str) -> Option<(TypeEnv, Function)> {
+    let (env, ty) = candid.load().ok()?;
     let actor = ty?;
     let method = env.get_method(&actor, method_name).ok()?.clone();
     Some((env, method))
 }
 
 pub fn get_candid_init_type(idl_path: &std::path::Path) -> Option<(TypeEnv, Function)> {
-    let (env, ty) = check_candid_file(idl_path).ok()?;
+    let (env, ty) = CandidSource::File(idl_path).load().ok()?;
     let actor = ty?;
     let args = match actor.as_ref() {
         TypeInner::Class(args, _) => args.clone(),
@@ -137,16 +134,6 @@ pub fn get_candid_init_type(idl_path: &std::path::Path) -> Option<(TypeEnv, Func
     Some((env, res))
 }
 
-pub fn check_candid_file(idl_path: &std::path::Path) -> DfxResult<(TypeEnv, Option<Type>)> {
-    //context macro does not work for the returned error type
-    pretty_check_file(idl_path).with_context(|| {
-        format!(
-            "Candid file check failed for {}.",
-            idl_path.to_string_lossy()
-        )
-    })
-}
-
 pub fn arguments_from_file(file_name: &Path) -> DfxResult<String> {
     if file_name == Path::new("-") {
         let mut content = String::new();
diff --git a/src/distributed/ui.wasm b/src/distributed/ui.wasm
index 673188b3e5..8d9153ce31 100644
Binary files a/src/distributed/ui.wasm and b/src/distributed/ui.wasm differ