bitwarden/server v2026.10.0

Version 2026.10.0

on GitHub

What's Changed

• Added support for sharing vault items through temporary links
• Added a setting to configure access token lifetime
• Fixed switching to annual billing during a trial charging an extra month
• Various under-the-hood improvements and minor bug fixes

Feature Development

• [PM-40416] feat: Add Premium to organization upgrade invoice preview endpoint by @cyprain-okeke in #8322
• [PM-44001] Add pm-43231-access-intelligence-performance-at-scale feature flag by @Banrion in #8419
• [PM-43031] Add email verification check to confirm-invite endpoint by @JimmyVo16 in #8418
• Add ability to override access token lifetime by @trmartin4 in #8367
• [PM-40097] feat: add PamSeats and MaxAutoscalePamSeats columns to Organization by @amorask-bitwarden in #8405
• [PFI-1300] Add SCIM 2.0 discovery endpoints by @fer in #8430
• [PM-42836] feat: Return the sponsoring organization name from sponsorship token pre-validation by @cyprain-okeke in #8403
• [PM-39106] refactor: Remove pm-34423-staged-status feature flag by @sven-bitwarden in #8402
• [PAM-185] Access Leasing: derive status from stored facts by @Hinton in #8411
• [PM-40420] feat: add account subscription preview endpoint by @amorask-bitwarden in #8435
• Auth/PM-41569 - New Device Verification Cache Improvement by @JaredSnider-Bitwarden in #8353
• [PM-44094] feat: Make the dead letter sweep interval configurable by @withinfocus in #8401
• [PAM-186] Access Requests: API by @Hinton in #8448
• [PM-44131] Remove feature check on bulk folder delete by @trmartin4 in #8460
• [PAM-187] Access Leasing: API by @Hinton in #8461
• [PM-40412] feat: Add Premium and organization purchase invoice preview endpoints by @cyprain-okeke in #8453
• Add Windows Native Credential Sync feature flag by @iinuwa in #8479
• [PM-43032] Add PreAccessPolicyEnforce by @JimmyVo16 in #8437
• Add the PAM access-audit event store by @patriksvensson in #8230
• [PM-42434] Account for staged users in confirm endpoint by @JimmyVo16 in #8447
• [BRE-1175] Allow choosing the Teams channel per event configuration by @vgrassia in #8480
• [PM-44349] Add force-upgrade-v2-encryption feature flag by @mzieniukbw in #8492
• [PM-44202] feat: Store item id in Item Send metadata by @quexten in #8485
• [PM-43938] Collection endpoint for Access Intelligence Needs by @Banrion in #8425
• [PM-44303] Add emergency access SDK API flag by @quexten in #8493
• [PM-43785] Login only organization cipher fetch for Access Intelligence by @Banrion in #8443
• [PM-41284] feat: Mark Stripe subscription schedules with their managing system by @kdenney in #8478
• [PAM-188] Cipher Leases: API and commercial gate by @Hinton in #8494

🐛 Bug fixes

• [PM-42488] fix: Treat a blank account recovery key as a withdrawal by @r-tome in #8356
• [PM-43897] fix: set Reply-To on price migration email by @connerbw in #8386
• [PM-42473] Use SSRF protected HttpClient in Teams service, block Teams/Slack integrations from API updates by @lastbestdev in #8334
• PM-43809: bugfix: Retain attachments in default collection (My Items) when purging org vault by @nikwithak in #8387
• [PM-16095] Fix up messages for Teams error messages for seat counts by @JaredScar in #8406
• [PM-43335] VFO1 Terminology name changes to utilize with error toasts by @JaredScar in #8417
• [PM-42560] fix: Gate billing exception detail behind IsDevelopment by @connerbw in #8348
• [PM-42560] fix: Stop disclosing exception detail from licensed SSO errors by @connerbw in #8358
• [PM-43757] clean up SSO user rows on bulk delete by @BTreston in #8412
• [PM-43790] Fix collection access validation to reject invalid Manage/ReadOnly combinations by @JimmyVo16 in #8413
• [PM-35064] fix: Scope EF Core collection removal to caller's available collections by @gbubemismith in #8441
• Fix flaky access-rule RevisionDate test on SqlServer by @Hinton in #8444
• [PM-43336] - Fix Invite Default Collection Assignment by @jrmccannon in #8420
• [BRE-1175] Fix Teams integration tenant by @vgrassia in #8452
• [BRE-1175] Fix API base URL for Slack and Teams integration by @vgrassia in #8449
• Seeder/fix deployed cloud licensing error on single user scene by @nthompson-bitwarden in #8451
• [PM-43763] Fix SCIM group patch parsing guids by @BTreston in #8455
• [PM-42982] fix: WantAssertionsSigned throws on encrypted assertion by @enmande in #8381
• [BRE-1175] Fix Teams integration handler error handling by @vgrassia in #8473
• Seeder/fix flaky integration tests from self-hosted data protection path by @nthompson-bitwarden in #8486
• [PM-43029] fix: apply Restrict item deletion policy to attachment paths by @jaasen-livefront in #8422
• Cherry-pick: [PM-44448] fix: Keep the trial when redeeming the annual upgrade offer by @kdenney in #8528
• [PM-44658] fix: Send and apply U2F AppID for migrated WebAuthn 2FA keys (#8554) by @enmande in #8555

⚙️ Maintenance

• [CL-1059] Remove router focus flag by @vleague2 in #8414
• [PM-30484] [PM-28140] Remove pm-2035-passkey-unlock and pm-26340-linux-biometrics-v2 feature flags by @jlf0dev in #8423
• Bump version to 2026.9.2 by @github-actions[bot] in #8454
• Delete deprecated AC tests in EFIntegration.Test by @eliykat in #8426
• broken identity test by @mzieniukbw in #8462
• [PM-42982] refactor: Rename-only refactor saml -> saml2 by @enmande in #8436
• [BRE-2266] ci: Set load test thresholds from observed data by @withinfocus in #8470
• Delete deprecated EF Integration tests - Platform by @eliykat in #8474
• Update equivalent domains list. by @blackwood in #8404
• Delete deprecated EF Integration tests - Auth by @eliykat in #8477
• Delete deprecated EF Integration tests - Vault by @eliykat in #8475
• [PM-19945] chore: Remove PM19941MigrateCipherDomainToSdk feature flag by @nick-livefront in #8464
• Delete deprecated EF Integration tests - DIRT by @eliykat in #8476
• [PM-31313] chore: remove pm-29437-welcome-dialog-no-ext-prompt feature flag by @gbubemismith in #8489
• [PM-31318][Server] - remove welcome-dialog-with-extension-prompt feature flag by @jaasen-livefront in #8481
• [PM-28061] - remove vault-skeleton-loaders feature flag by @jaasen-livefront in #8483
• Delete deprecated EF integration tests by @eliykat in #8491
• QA-2572/ClaimedDomainOrgScenes by @ddanielyan in #8488
• [PM-34546] refactor: Pin the push notification wire format and carry routing on the envelope by @justindbaur in #8254
• QA-2596/fix-for-unexpected-error-occurred-sqlDateTime-overflow by @ddanielyan in #8500
• Bump version to 2026.10.0 by @github-actions[bot] in #8505

📦 Dependency Updates

• Add Microsoft.Data.SqlClient.Extensions.Azure by @MGibson1 in #8260
• [PM-39828] chore: Upgrade mjml to 5.4.1 [SECURITY] by @vleague2 in #8388
• [PM-39828] chore: Rebuild Admin Console email templates with mjml 5 by @vleague2 in #8390
• [PM-39828] chore: Rebuild Billing email templates with mjml 5 by @vleague2 in #8392
• [PM-39828] chore: Rebuild Auth email template with mjml 5 by @vleague2 in #8393
• [PM-39828] chore: Group mjml dependencies under UI Foundation in Renovate by @vleague2 in #8389
• [PM-44131] Bump Server SDK to 1.7.0 by @justindbaur in #8468
• [deps] BRE: Update YamlDotNet to v18 by @renovate[bot] in #7778
• [deps] DbOps: Update Npgsql.EntityFrameworkCore.PostgreSQL to v8.0.11 by @renovate[bot] in #6321
• [deps]: Update codecov/codecov-action action to v7 by @renovate[bot] in #8029

🎨 Other

• [PM-42982] feat: Add an SSO CLAUDE.md by @enmande in #8394

New Contributors

• @fer made their first contribution in #8430
• @ddanielyan made their first contribution in #8488

Full Changelog: v2026.9.2...v2026.10.0