bitwarden/clients web-v2026.10.1

Web v2026.10.1

on GitHub

What's Changed

💙 Community Highlight

• [PM-43146] feat(desktop): add persistent biometric unlock on Linux via Secret Service by @prostopasta in #23033
• [PM-44559] Add PAM core icons (access connector, managed credential, target system) by @reneelund08 in #23689
• [PM-42345] Fix Chromium import when elevated as a different Windows user by @detunized in #22599
• [PM-44168] Render the popup loading spinner only while loading by @Lolig4 in #23528
• [PM-44451] Add 1Password direct import through the SDK on desktop and in the extension by @detunized in #23627

Feature Development

• desktop-autofill: Enable autofill IPC when the feature flag turns on after startup by @iinuwa in #23652
• [PM-44267] Gate basic auth requests by a user opt-in setting by @jprusik in #23583
• [PM-44246] introduce tab-lifecycle module by @audreyality in #23625
• [CL-1364] Make header suffix slot visible when breadcrumbs are h1 by @vleague2 in #23630
• [PM-40419] Plan Change Preview-Driven Cart by @sbrown-livefront in #23499
• [PM-43117] feat: add Default/Custom selection for fill assist rule source by @bensbits91 in #23558
• [PM-44108] perf: Add performance measurements to unlock and sync by @quexten in #23476
• [PM-44463] Shared folders card grid subtext by @jengstrom-bw in #23682
• [PM-42846] Re-design tour by @BTreston in #23664
• [CL-1257] feat: Add column customization to bit-table-v2 by @BryanCunningham in #23531
• [PM-43953] Extension introduce new experience by @jengstrom-bw in #23467
• [PM-40231] feat: Source the create-organization cart from the invoice preview by @cyprain-okeke in #23415
• [CL-1365] feat: Add hover reveal directives by @BryanCunningham in #23650
• desktop-autofill: Expose OS passkey plugin status APIs by @iinuwa in #23656
• desktop-autofill: Implement passkey provider OS settings APIs by @iinuwa in #23659
• desktop-autofill: Show passkey provider status in app settings by @iinuwa in #23662
• [PM-40413] feat: Source the Premium and Families purchase cart from the invoice preview by @cyprain-okeke in #23524
• desktop-autofill: Match desktop passkey modal style with browser extension by @iinuwa in #23717
• [PM-44025] feat: Anchor popovers to elements inside library components by @BryanCunningham in #23649
• [PM-43958] Web/desktop introduce new experience by @jengstrom-bw in #23679
• Autotype: Separate Existing Autotype Default Policy to MVP Only by @neuronull in #23609
• [PM-44461] Shared folder table updates by @jengstrom-bw in #23658
• [PM-44316] Harden basic auth responses by @jprusik in #23585
• desktop-autofill: Propagate native webauthn errors by @iinuwa in #23721
• [CL-1246] feat: Add keyboard shortcut hints to search component by @BryanCunningham in #22830
• desktop-autofill: credential not found UI by @iinuwa in #23819
• desktop-autofill: Refine passkey provider system settings design by @iinuwa in #23824
• [PM-42581] Add Invite Staged Users Members Actions by @sven-bitwarden in #22822
• [PM-44965] Update GA date by @jengstrom-bw in #23844
• [PM-44026] feat: Add the tour callout to the side nav by @gbubemismith in #23745
• feat(vault): route PAM gated ciphers through the SDK (partial-cipher pivot) by @Hinton in #22171
• [PM-41469] Create new import controls component by @harr1424 in #23503
• [CL-1257][CL-1368] feat: Let users customize vault items table columns by @BryanCunningham in #23532
• desktop-autofill: Clarify why UV prompt is being shown by @iinuwa in #23820
• feat(tests): add basic key-management e2e test suite by @quexten in #23477
• [CL-1371] filter row spotlight by @BryanCunningham in #23870
• [PM-44663] Redirect legacy folder links to /folders/:folderId by @nick-livefront in #23776
• [PM-42405] feat: Push feature flags from ConfigService.renewConfig by @coroiu in #23867
• [PM-44693] Emit http auth event on credential release by @jprusik in #23764
• [PM-32124] Show consistent bulk reinvite toast for self-hosted orgs by @r-tome in #22517
• macos: Enable macOS autofill extension in Beta channel by @iinuwa in #22624
• desktop-autofill: Prevent creating passkeys for Bitwarden vault in desktop app by @iinuwa in #23892
• [CL-1369] feat: Wrap active filter chips in a chip group by @BryanCunningham in #23804
• [PM-44918] Remove pagination from shared folders table by @jengstrom-bw in #23830
• [PAM-344] Access rules: UI follow-ups from UAT by @Hinton in #23836
• macos: Enable macOS autofill extension in Stable channel by @iinuwa in #23809
• [PM-43959] feat: Add the nav walkthrough steps by @gbubemismith in #23774
• [PM-42582] Add Staged Member Management Actions by @sven-bitwarden in #22828
• [PM-44027] feat: Add the filters step to the VFO1 walkthrough by @gbubemismith in #23851
• (B3) [PAM-337] Add collection access-rule flag and dialog callout slot by @Hinton in #23909

🐛 Bug fixes

• [PM-44198] Load emergency access view ciphers via SDK by @quexten in #23544
• [PM-44493] fix(biometrics: Bump desktop_native SDK to support XAES user keys by @quexten in #23645
• fix(biometric-ipc): Address the CLI as its own IPC endpoint by @quexten in #23275
• fix(export): fix v2 support for account restricted exports by @quexten in #23648
• Bug/pm 13954/passwordboss json import by @adudek-bw in #22845
• Pick up local SDK rebuilds in desktop watch mode by @coroiu in #23050
• [CL-1325] fix: Keep the vfo1 filter dialog open across popup close by @BryanCunningham in #23348
• [PM-44509] fix: use sentence-case "My folder" label on import page by @gbubemismith in #23685
• [PM-44509] fix: use "My folders" label on import page by @gbubemismith in #23688
• [PM-43843] custom user with manage user permission is logged out when inviting member by @JaredScar in #23201
• PM-39163 Automatic Login not working by @dan-livefront in #23392
• Papercut - Fix unused component warning by @jprusik in #23692
• [PM-44315] Fix batch bar count including items hidden by a filter by @nick-livefront in #23579
• [CL-1363] fix: Count each selected option in the filter trigger berry by @BryanCunningham in #23731
• [CL-1366] fix: Re-measure the table's virtual viewport when it resizes by @BryanCunningham in #23734
• Auth/PM-44119 - SSO + MP Decryption - Deep linking fix by @JaredSnider-Bitwarden in #23491
• Export V2 ciphers as data blob only by @quexten in #23750
• [PM-44516] Temporarily hide item history on item Sends by @mcamirault in #23730
• [PM-44701] Persist last manual lock for shared unlock by @quexten in #23747
• [PM-42643 ] Tools-owned URL validation by @harr1424 in #23160
• [PM-44781] Update new experience dialog to large size by @jengstrom-bw in #23812
• [PM-36815] fix: credit card autofill in tightly sized iframes by @bensbits91 in #23605
• [PM-44806] Don't display the new experience dialog when a tour is already running by @jengstrom-bw in #23815
• [PM-44545] Add vault options menu to the vault side nav by @shane-melton in #23709
• [PM-32144] Improve Access Intelligence review new applications dialog performance by @Banrion in #23694
• Auth/PM-38259 - Desktop - Fix account switch loop and add AccountSwitcherService by @JaredSnider-Bitwarden in #23699
• [CL-1337][CL-1367] minor sidenav updates by @BryanCunningham in #23765
• [CL-1336] fix: Keep vault header collapsed when returning from an item by @BryanCunningham in #23805
• Write Firefox manifest when ~/.mozilla is absent by @quexten in #23876
• Create NativeMessagingHosts dir for all browsers by @quexten in #23877
• [PM-44494] fix(biometrics): fix biometric id update enrollment despite failed biometrics by @quexten in #23646
• [PM-44600] feat: Count filter options against active filters by @jaasen-livefront in #23735
• PM-24268 resolve close by @bmbitwarden in #23593
• PM-42338 folder assigned by @bmbitwarden in #23629
• [CL-1356][CL-1340][CL-1341] table toolbar responsiveness by @BryanCunningham in #23866
• [SM-2091] Fixing issue with Event Logging storing the incorrect OrguserId/actin… by @cd-bitwarden in #23424
• [PM-44603] Restore last selected vault on Vault tab click by @nick-livefront in #23732
• [PM-44200] fix: Check clone passkey warning on decrypted cipher by @quexten in #23547
• [PM-44522] fix: recognize and fill password inputs when type is text by @bensbits91 in #23722
• [PM-43104] Update tab URL handling to frame URLs by @jprusik in #23813
• [PM-44338] Move insecure page autofill check to a consolidated background check by @jprusik in #23739
• [PM-44496] Fill TOTP instead of username in ambiguous 2FA fields by @bw-dmitriy in #23670
• [PM-44640] fix: Hide Families sponsorship options in Gov mode (#23826) by @connerbw in #23997
• rc pick: fix(biometrics): race condition unchecks biometric unlock when turned on. by @mzieniukbw in #24019
• [CL-1366] Stop importing ngx-toastr's full stylesheet to workaround Chromium bug (#24006) by @vleague2 in #24027

⚙️ Maintenance

• desktop-autofill: Register COM plugin for stable app. by @iinuwa in #23620
• [PM-26913] Remove pm-23995-no-logout-on-kdf-change feature flag by @jlf0dev in #23369
• desktop-autofill: Fix beta and dark logo variants by @iinuwa in #23622
• Assign passkey_authenticator NAPI module to skunkworks by @iinuwa in #23651
• [PM-43887] Migrate MembersComponent and related to standalone by @JaredScar in #23534
• [PM-38906] bulk decrypt collections with failures unstacked by @JaredScar in #22886
• [PM-39246] chore: Remove pm-32380-btn-text-add-create feature flag by @gbubemismith in #23632
• Auth/PM-44095 - Login Strategies TS Strict Refactor by @JaredSnider-Bitwarden in #23536
• [PM-40148] refactor: Read policies$ from accepted-or-confirmed state by @eliykat in #23354
• Remove getKeyForCipherKeyDecryption by @quexten in #23591
• [PM-40663] Enforce 7-day cargo publish age for Renovate by @addisonbeck in #23668
• Remove enroll-aead-on-key-rotation feature flagged code by @mzieniukbw in #23671
• Remove no longer needed models, fields by @mzieniukbw in #23673
• [PM-40663] Exempt Bitwarden SDK from npm release-age filter by @addisonbeck in #23674
• Revert "Sign Electron Framework files in parallel on macOS (#23580)" by @iinuwa in #23676
• Remove Bootstrap migration Storybook docs by @willmartian in #23681
• [PM-44447 BEEEP] add stories for various missing AC components by @BTreston in #23584
• [BRE-2323] Use correct Safari build for each Desktop macOS build by @vgrassia in #23677
• [PM-41211] Move remaining invite link logic to sdk by @eliykat in #23308
• [BRE-2234] Fix autofill extension provisioning profile names by @brandonbiete in #23710
• Revert "PM-39163 Automatic Login not working" by @dan-livefront in #23713
• [PM-41317] orchestrate collect page details by @audreyality in #22380
• [BRE-2234] Use channel-named provisioning profile blobs for stable macOS jobs by @brandonbiete in #23712
• [PM-27893] Remove force update KDF settings feature flag by @jlf0dev in #23693
• [PM-40663] Skip npm installs in Renovate to keep lock integrity by @addisonbeck in #23720
• [BRE-2234] Use group-prefixed App Group identifier on macOS desktop by @brandonbiete in #23711
• feat(automation-driver): expose the SDK client in dev builds by @coroiu in #23655
• feat: Initialize SDK and main IPC before creating the desktop window by @coroiu in #23727
• [BRE-2234] Use beta-specific provisioning profiles for macOS beta desktop build by @brandonbiete in #23703
• [PM-44024] refactor: Move coachmark tour engine to libs/vault by @gbubemismith in #23706
• [PM-39503] remove no logout key upgrade rotation feature flag by @mzieniukbw in #23758
• [PM-44182] Refactor and ts-strict by @BTreston in #23718
• Fixing race condition for safari artifact download by @pixman20 in #23766
• [PM-44702] Reword shared unlock settings in extension by @quexten in #23748
• Auth/PM-44119 - Add spec for web Key Connector domain confirmation by @JaredSnider-Bitwarden in #23769
• build: Fix Objective-C build script staleness issue by @iinuwa in #23771
• [PM-33747] remove sdk key rotation feature flag by @mzieniukbw in #23757
• ci: Upload commercial macOS App Store build to TestFlight by @AmyLGalles in #23778
• desktop-autofill: Fix passkey plugin startup on fresh installs by @iinuwa in #23772
• [PM-44178] refactor: Make provider permissions guard spec and web provider service TS strict by @vchauhan-bitwarden in #23686
• [deps]: Update actions/cache action to v6 by @renovate[bot] in #21955
• [PM-43890] refactor: Migrate provider setup components to standalone by @vchauhan-bitwarden in #23801
• [BRE-2324] Prevent SDK update PR from moving to an older SDK by @vgrassia in #23831
• destkop-autofill: Refactor modal by @iinuwa in #23821
• [PM-44303] Use SDK for emergency access API by @quexten in #23552
• [PAM-273] Trim and reword PAM access-rule comments by @Hinton in #23837
• [PM-28650] Add logout reason in all remaining cases by @trmartin4 in #23317
• [PM-44362] Remove legacy Cipher.decrypt and domain decrypt methods by @quexten in #23592
• [CL-1346] Add filter menu story with long labels and counts by @BryanCunningham in #23767
• [PM-44917] Browser: Move Health report feature into OSS directory by @lastbestdev in #23825
• [PM-44391] Keep Vault filter on org pages under data ownership by @jaasen-livefront in #23665
• [PM-43891] refactor: Migrate provider AccountComponent and VerifyRecoverDeleteProviderComponent to standalone by @vchauhan-bitwarden in #23834
• [BRE-2193] Require label to run signed CLI builds for fork PRs by @michalchecinski in #23797
• [BRE-2194] Require label to run web fork builds and stop fork lite builds by @michalchecinski in #23806
• [PM-42402] refactor: Resolve SdkService's cycle-forming dependencies lazily by @coroiu in #23861
• ci: Run Rust advisories outside the Rust lint gate by @coroiu in #23882
• [BRE-2196] Require label to run desktop fork builds and fetch signing secrets after the build by @michalchecinski in #23808
• ci: Make Rust lint blocking through the Lint gate by @coroiu in #23884
• [PM-42404] refactor: Add the push API to the SdkService abstraction as no-ops by @coroiu in #23863
• [PM-44827] fix: Install Brave native messaging manifest on macOS by @dani-garcia in #23838
• macos: Lookup group containers at runtime by @iinuwa in #22622
• macos: Prefer group containers for IPC sockets by @iinuwa in #22626
• [PM-24325] Remove pm-22134-sdk-cipher-list-view feature flag by @jaasen-livefront in #23872
• [PM-34414] Remove pm-34410-attachment-upload-progress feature flag by @nick-livefront in #23604
• build: Fix browser integration on Appx builds by @iinuwa in #23848
• PM-42723 resolved polynomial redos in chrome csv by @bmbitwarden in #23034
• PM-42722 resolved unbounded kdf parameters by @bmbitwarden in #23039
• PM-42720 implemented xxe guard by @bmbitwarden in #22896
• PM-42725 polynomial redos in enpass importer by @bmbitwarden in #22988
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23744
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23742
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23743
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23966
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23964
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23965
• Bump client version(s) by @github-actions[bot] in #23963
• bump desktop version by @addisonbeck in #24119

📦 Dependency Updates

• Update sdk-internal to 0.2.0-main.1083 by @bw-ghapp[bot] in #23624
• Update sdk-internal to 0.2.0-main.1087 by @bw-ghapp[bot] in #23657
• [deps] Platform: Update jest-environment-jsdom to v30 by @renovate[bot] in #20845
• [deps] Platform: Update nx to v22.7.10 [SECURITY] by @renovate[bot] in #23675
• Update sdk-internal to 0.2.0-main.1096 by @bw-ghapp[bot] in #23666
• [PM-40663] Pin napi-derive-backend for napi 3.8.5 by @addisonbeck in #23691
• [PM-44116] Update renovate dependency updates ownerships by @jprusik in #23486
• Update sdk-internal to 0.2.0-main.1105 by @bw-ghapp[bot] in #23701
• Update sdk-internal to 0.2.0-main.1115 by @bw-ghapp[bot] in #23817
• Update sdk-internal to 0.2.0-main.1116 by @bw-ghapp[bot] in #23852
• fix(ssh-agent): exact-pin rsa to 0.9.6 to avoid signing breakage by @addisonbeck in #23847
• [deps] Platform: Lock file maintenance by @renovate[bot] in #21973
• Update sdk-internal to 0.2.0-main.1122 by @bw-ghapp[bot] in #23858
• Update sdk-internal to 0.2.0-main.1126 by @bw-ghapp[bot] in #23896

🎨 Other

• llm: Add SafeInjectionToken typing rule to Angular rules by @gbubemismith in #23719

New Contributors

• @prostopasta made their first contribution in #23033
• @Lolig4 made their first contribution in #23528

Full Changelog: web-v2026.10.0...web-v2026.10.1