What's Changed
Feature Development
- [PM-40418] feat: add organization plan-change preview endpoint by @sbrown-livefront in #8457
- [PAM-190] PAM access audit: API by @Hinton in #8507
- [PM-44226] feat: add PamSeatMinimum column to Organization by @cyprain-okeke in #8521
- [PM-43246] feat: accept Privileged Controls in the trial verification email by @sbrown-livefront in #8526
- [PM-35942] Add pm-39196-health-report-exclusions feature flag by @AlexRubik in #8546
- [PM-40106] feat: Read Privileged Controls pricing and seat minimums from the pricing service by @kdenney in #8540
- [PAM-191] PAM access notifications by @Hinton in #8541
- [PM-40114] feat: add shared Privileged Controls seat change step by @kdenney in #8544
- [PAM-290] Access Connectors: identity contract by @Hinton in #8520
- PAM: carry sealed blobs in the rotation API models by @Hinton in #8579
- [PM-39456] Update members' account recovery keys after their V2 upgrade by @mzieniukbw in #8459
- [PM-44263] feat: Add Privileged Controls section to the subscription preview by @cyprain-okeke in #8543
- [PM-40117] feat: Handle an organization's first Privileged Controls purchase by @kdenney in #8560
- [PM-39077] feat: Add extend trial option to the Admin portal by @cyprain-okeke in #8506
- [PM-40116] feat: Change an organization's Privileged Controls seats by @kdenney in #8574
- Remove MigrateMyVaultToMyItems feature flag by @nick-livefront in #8463
- [PM-44265] feat: Return Privileged Controls seats and trial status with the organization subscription by @cyprain-okeke in #8580
- [PM-44183] Add GetOrganizationInviteValidator by @JimmyVo16 in #8577
- [PM-44693] Handle http auth event by @jprusik in #8578
- [PM-44241] feat: Remove Privileged Controls from an organization by @kdenney in #8595
- [PM-38249] Remove pm-36560-send-event-logging by @harr1424 in #8585
- PAM: carry the wrapped content key in the rotation API models by @Hinton in #8603
- [PM-43272] Sales Trial Invitations include Privileged Controls by @sbrown-livefront in #8545
- [BRE-2312] Let the web vault run the Teams and Slack OAuth flows by @vgrassia in #8591
- [PAM-192] PAM Rotation: domain, persistence & schema by @patriksvensson in #8584
🐛 Bug fixes
- [PM-3499] Remove guid from device approval email by @BTreston in #8487
- [PM-43787] Fix user supplied data protection sentinel in account recovery by @BTreston in #8438
- [PM-42940] fix: prevent custom-role collection bypass on GetAdmin cipher endpoint by @gbubemismith in #8472
- PM-37176: Add collection permission checks to create cipher endpoint. by @nikwithak in #8482
- [PM-43734] Don't re-enable sends for excluded roles/members by @BTreston in #8469
- [PM-42993] - Fix Bulk Collection Cipher Save by @jrmccannon in #8415
- [PM-42938] fix: validate collection access when creating a group by @r-tome in #8374
- [PM-44448] fix: Keep the trial when redeeming the annual upgrade offer by @kdenney in #8519
- [PM-43123] - Add Filter and Token by @jrmccannon in #8467
- [PM-44658] fix: Send and apply U2F AppID for migrated WebAuthn 2FA keys by @enmande in #8554
- [PM-44441] fix: Update policies by token validation by @r-tome in #8499
- [PM-43037] Invalid data structures for ciphers. by @nick-livefront in #8434
- fix: Clear distributed cache Redis key in integration test factory by @enmande in #8597
- fix: Keep the build workflow within the Fork PR permission ceiling by @withinfocus in #8598
- [PM-38893] Add ssrf protections to the oidc httpclient by @jengstrom-bw in #8421
- [PM-44638] fix: Allow Secrets Manager organizations under Reseller providers (#8582) by @connerbw in #8645
- [PM-44640] fix: Block Families sponsorships in the Gov region (#8583) by @connerbw in #8646
- [PM-45461] fix: Stream user cipher rows to prevent /sync out-of-memory by @gbubemismith in #8683
⚙️ Maintenance
- [PM-26913] Remove pm-23995-no-logout-on-kdf-change flagged logic by @jlf0dev in #8424
- [PM-41442] refactor: Migrate Vault to the SDK IFeatureService by @justindbaur in #8513
- [PM-31626] chore: Remove autofill button view login screen flag by @nick-livefront in #8495
- refactor: remove unused PM22136_SdkCipherEncryption feature flag by @nick-livefront in #8465
- [PM-41442] refactor: Migrate Admin Console to the SDK IFeatureService by @justindbaur in #8509
- Fix IFeatureService related merge issues by @justindbaur in #8539
- [PM-41442] refactor: Migrate DIRT to the SDK IFeatureService by @justindbaur in #8511
- [SHOT-304] ci: prune old seeded database images from ACR by @mimartin12 in #8497
- [PM-41442] refactor: Migrate Auth to the SDK IFeatureService by @justindbaur in #8510
- [PM-41442] refactor: Migrate Tools to the SDK IFeatureService by @justindbaur in #8515
- [PM-41442] refactor: Migrate unowned code to the SDK IFeatureService by @justindbaur in #8516
- [PM-41442] refactor: Migrate Billing to the SDK IFeatureService by @justindbaur in #8514
- [PM-41215] Remove feature flag pm-19976-use-sdk-password-generators by @adudek-bw in #8542
- [PM-41442] refactor: Remove legacy Bit.Core IFeatureService by @justindbaur in #8558
- [deps]: Update actions/download-artifact action to v8 by @renovate[bot] in #8028
- fix: Use SDK IFeatureService in OrganizationTrialController by @justindbaur in #8596
- [PM-25386] Remove unlock-with-master-password-unlock-data flag by @quexten in #8575
- [BRE-2199] Require label to run server fork builds and stop fork signing and triggers by @michalchecinski in #8604
- [PM-34546] refactor: Route push notifications on the envelope by @justindbaur in #8501
- [PM-26384] remove pm-19934-auto-confirm-organization-users ff definition by @vincentsalucci in #8612
- PM-40999 - Add opt-in Stripe billing for seeded premium users by @theMickster in #8599
- Bump version to 2026.10.1 by @github-actions[bot] in #8628
📦 Dependency Updates
- [deps] DbOps: Update linq2db to v6.5.0 and linq2db.EntityFrameworkCore to v8.8.0 by @renovate[bot] in #6767
Full Changelog: v2026.10.0...v2026.10.1