bitwarden/server v2026.7.0

Version 2026.7.0

on GitHub

What's Changed

💙 Community Highlight

• [PM-37648] Fix double HTML encoding in emergency access emails by @singhvishalkr in #7652

Feature Development

• [PM-38928] - Add name, email to org user update by @jrmccannon in #7871
• Seeder: add --owner-email and --org-name CLI override flags by @JaredSnider-Bitwarden in #7870
• [PM-28365] - Add Feature Flag Admin Initiated Member Email change by @jrmccannon in #7887
• [PM-37514] Support Teams 2019 Migration by @sbrown-livefront in #7864
• [PM-38798] Create validation link confirmation by @JimmyVo16 in #7895
• Auth/PM-39774 - Redirect existing users without org membership back to /login on SSO callback by @JaredSnider-Bitwarden in #7890
• [PM-39745] Scaffold PAM access-rule endpoints by @Hinton in #7878
• [PM-34393] Add event logging for organization invite link actions by @r-tome in #7826
• [PM-39798] Scaffold PAM access-request endpoints by @Hinton in #7893
• [PM-39557] Replace invite link key columns with an opaque Invite blob by @r-tome in #7896
• [PM-37954] Add Command for Provisioning Staged OrganizationUsers by @sven-bitwarden in #7859
• [PM-32187] Add Send Type restriction to Send Controls policy by @mcamirault in #7504
• [PM-36965] feat: Add SeederApi scene for migration cohort CSV-export testing by @cyprain-okeke in #7906
• [PM-38567] Migration Renewal Copy Dynamic Update by @sbrown-livefront in #7921
• [PM-38101] Add Staged Provision API Fields by @sven-bitwarden in #7927
• [PM-31929] Add deletion days restriction to Send Controls policy by @mcamirault in #7506
• [PM-36505] Finalize Send Controls policy, add second feature flag to enable/disable logic by @mcamirault in #7943
• [PM-38927] - Extract Organziation User Role Validation by @jrmccannon in #7876
• [PM-39210] fix: Block converting a Secrets-Manager-enabled org to a Business Unit Portal by @cyprain-okeke in #7892
• [PM-38796] Create link confirmation endpoint by @JimmyVo16 in #7907
• [PM-40085] Remove initial delay on self-hosted database migration by @trmartin4 in #7917
• [PM-39976] Scaffold PAM lease endpoints by @Hinton in #7925
• added new env var to alter backup filename TZ by @keithhubner in #7956
• [PM-37944] Differentiate Send events according to domain by @harr1424 in #7690

🐛 Bug fixes

• [PM-39584] fix: Gate migration grace service accounts on Secrets Manager presence by @amorask-bitwarden in #7897
• [PM-39816] fix: Raise migrated Password Manager seats to cover Secrets Manager seats by @amorask-bitwarden in #7904
• [PM-39805] fix: Expose SM migration-grace service accounts on subscription response by @amorask-bitwarden in #7901
• [PM-38000] Convert text feilds for email to email fields for form validation by @BTreston in #7908
• [PM-39164] Gate Access Intelligence report reads on new-architecture flag by @Banrion in #7825
• fix(codeowners): Reorder Docker rules to fix owner override by @fntyler in #7937
• [PM-35198] - remove orphaned blob attachments after deletion by @jaasen-livefront in #7539
• [PM-40002] Fix Teams 2019 Migration Display by @sbrown-livefront in #7933
• [SHOT-215] fix: Migrate legacy identity.pfx to modern encryption on update by @mimartin12 in #7942
• [PM-39554] Create default collection for demoted admin by @BTreston in #7918
• [PM-38595] Get collection permission with users and groups by @BTreston in #7945
• [PM-38827] Remove errant org membership check by @BTreston in #7929
• [PM-40128] Adjust enforcement message when Send is noncompliant with … by @mcamirault in #7946
• [PM-39909] fixed LINQ error when saving send controls by @itsadrago in #7939
• [SHOT-219] fix: build nginx image for arm64 architecture by @mimartin12 in #7944
• [PM-40281] convert to text field by @BTreston in #7971
• [PM-40516] Fix Extended Cache Service Registration by @sven-bitwarden in #8007

⚙️ Maintenance

• add MyItems to ApplyEnterpriseFeatures by @nthompson-bitwarden in #7882
• [PM-31107] Seeder: blob-migration preset + fido2/password-history/linked-field fixture support by @shane-melton in #7809
• [PM-19169] Remove feature flag pm-19148-innovation-archive by @jengstrom-bw in #7884
• [PM-29251] Remove pm-23384-browser-premium-spotlight feature flag by @jengstrom-bw in #7885
• Seeder: fix RecipeOrchestratorIntegrationTests build after SeederDependencies arity change by @JaredSnider-Bitwarden in #7888
• Minor but important doc update to align with other overrides by @theMickster in #7889
• [PM-39734] Support Minimal API endpoints in OpenAPI by @Hinton in #7874
• [PM-39512] Stricter data protection errors by @justindbaur in #7837
• [PM-35812] Remove BulkAutoConfirmOnLogin feature flag logic by @JaredScar in #7902
• [BRE-1533] Trigger Bitwarden Lite for server builds (including PRs) by @vgrassia in #7905
• Relax cert check on development builds by @justindbaur in #7912
• Seeder - Bump RustSdk to the latest release of sdk-internal by @theMickster in #7903
• Opt the Aspire project out of package locking by @justindbaur in #7916
• add new cipher type scenes by @rdaugherty in #7911
• [deps]: Update github-action minor by @renovate[bot] in #7006
• test(accounts-controller): Move tests under Auth/ directories for CODEOWNERS. by @enmande in #7658
• PM-39866 - Enhance seeder to seed archive and deleted ciphers by @theMickster in #7923
• Add Seeder query to get email codes by @bnagawiecki in #7880
• Add OrganizationUserInviteQuery by @bnagawiecki in #7915
• [BRE-2039] ci(docker): add distroless FIPS gov.Dockerfile variants by @fntyler in #7875
• [PM-32699] Utilize cache to check ability of useMyItems if available by @JaredScar in #7922
• [PM-37469] UseRiskInsights organization ability: migration, plan mapping, admin toggle, license, and endpoint guard by @AlexRubik in #7782
• [BRE-1907] Add artifact manifest to build.yml by @gitclonebrian in #7920
• [BRE-2039] chore: cleanup dockerfile comments by @fntyler in #7935
• Refactor Skill(bump-rust-sdk) to align with current workflow & best practices for skill evaluation by @theMickster in #7909
• [PM-33045] Remove FeatureRoutedCacheService by @JimmyVo16 in #7931
• chore(ci): add platform-community code-review signal by @addisonbeck in #7948
• [PM-38209] Remove pm-26961-access-intelligence-trend-chart feature flag by @lastbestdev in #7840
• [BRE-1907] Corrected artifact manifest container image format by @gitclonebrian in #7938
• Auth/PM-38811 - KM - Update RotateUserAccountKeysCommand to use MasterPasswordService by @JaredSnider-Bitwarden in #7804
• Bumped version to 2026.7.0 (#7967) by @addisonbeck in #7970

📦 Dependency Updates

• [PM-39443] pin automapper dependency to under v15 by @itsadrago in #7856
• [deps]: Update actions/upload-artifact action to v7 by @renovate[bot] in #7219
• [deps]: Update Microsoft.NET.Test.Sdk to v18.7.0 by @renovate[bot] in #7777
• [deps] Tools: Update MailKit to v4.17.0 by @renovate[bot] in #7775
• [deps] BRE: Update nginx Docker tag to v1.31 by @renovate[bot] in #7932

🎨 Other

• Stripe integration tests by @justindbaur in #7828
• [VULN-649] ci: Remove deprecated scan workflow by @theMickster in #7851
• Auth - Tokenables Claude Rule Update - Add binding-property lockdown and known-limitation note by @JaredSnider-Bitwarden in #7900
• Create exploring-bitwarden-data Claude Skill by @theMickster in #7763

New Contributors

• @rdaugherty made their first contribution in #7911
• @singhvishalkr made their first contribution in #7652

Full Changelog: v2026.6.2...v2026.7.0