Update bitwarden

This MR contains the following updates:

Package	Update	Change
bitwarden/clients	patch	2026.6.3 → 2026.6.4
bitwarden/server	patch	2026.6.1 → 2026.6.2

---

Release Notes

bitwarden/clients (bitwarden/clients)

v2026.6.4: Web v2026.6.4

Compare Source

Overview

• Updated UI for centralized ownership policy
• Added a product tour for access intelligence
• Added information banner to SCIM setup page
• Added a checkout success page following Stripe payment flows
• Various under-the-hood improvements and minor bug fixes

What's Changed

💙 Community Highlight

• [PM-33285] Enhance privacy in password leak detection with response padding by @​TheDcoder in #​19439

:shipit: Feature Development

• [PM-31884] implemented controls for send policy access dropdown by @​bmbitwarden in #​19777
• [PM-35230] clients Web Checkout success page by @​cyprain-okeke in #​20653
• [PM-32696] Add data field to Cipher object to support blob encryption by @​nikwithak in #​20765
• [PM-24223] Add feature flagged support for password v2 registration by @​eligrubb in #​20782
• [PM-35059] Coachmark tour for Access Intelligence by @​voommen-livefront in #​20808
• [PM-37875] Automatic V2 Upgrade Migration by @​quexten in #​20831
• Auth/PM-38298 - Org Invite Acceptance Refactor by @​JaredSnider-Bitwarden in #​21011
• [PM-38565] Replace tray settings with "Keep Bitwarden running in the background" by @​quexten in #​21044
• [PM-38343] 2 step and require sso and remove unlock and remove export into simple toggle by @​JaredScar in #​21092
• [PM-38345] block account, remove card, remove free fam, and desktop autotype to simple toggle by @​JaredScar in #​21097
• Auth/PM-38742 - SSO Invited Existing User Flow Improvement - Show SSO redirect error notification on LoginComponent by @​JaredSnider-Bitwarden in #​21134
• [PM-38787] Pin vault bulk-actions bar to the viewport on scroll by @​nick-livefront in #​21154
• [PM-33408] Add OrganizationUserNotification banner to vault by @​jengstrom-bw in #​21209
• [PM-39048] Feat: scaffold @​bitwarden/pam library by @​Hinton in #​21259
• [PM-34779] Add accept method to OrganizationInviteLinkApiService by @​r-tome in #​21266
• [PM-38580] Adds copy to invite member role select by @​BTreston in #​21280
• [PM-34023] Remove 2FA account recovery flag by @​eliykat in #​21291
• [PM-39129] Add UsePam organization capability by @​Hinton in #​21298
• [PM-36835] implement logging in the weak-passwords component by @​voommen-livefront in #​21305
• Revert "[PM-36835] implement logging in the weak-passwords component" by @​voommen-livefront in #​21343
• Revert "Revert "[PM-36835] implement logging in the weak-passwords component"" by @​voommen-livefront in #​21344
• [PM-37807] Implement VaultBatchBarComponent on organization vault by @​gbubemismith in #​21345
• [PM-34053] Swap verify trust to new SDK method by @​Thomas-Avery in #​21347
• [PM-37986] Centralized ownership UI rework by @​BTreston in #​21348
• [PM-39195] Add banner to scimv2 component for invite link by @​BTreston in #​21363
• [PM-3841] - Default the new collection organization select to the active org by @​jaasen-livefront in #​21374
• [PM-39195] Back port banner to old component by @​BTreston in #​21415
• [PM-36864] Refactor vault routing to use VaultV2Component directly, removing feature flagged code by @​JaredScar in #​21419
• [PM-34580] Rename "Note" to "Secure note" for SecureNote cipher type by @​nick-livefront in #​21423
• [PM-33740] Remove unlock service for password flagged logic by @​mzieniukbw in #​21427

🐛 Bug fixes

• [PM-32445] Extension Scrollbar Fix by @​rr-bw in #​20478
• [Sm-1934] Fixing showing 10/123 secrets issue by @​cd-bitwarden in #​20783
• [PM-37752] - fix collections control when extension loses focus by @​jaasen-livefront in #​20812
• [PM-35212] - allow bulk archive/unarchive of items in a collection by @​jaasen-livefront in #​20920
• [PM-34926] Allow single-character CJK vault searches by @​jaasen-livefront in #​21013
• [PM-38581] - disable drag for single custom fields by @​jaasen-livefront in #​21136
• [PM-38409] - update custom field value on reorder by @​jaasen-livefront in #​21137
• Auth/PM-35783 - Fix Org Invite Policy State Pollution and State Clearing Issue by @​JaredSnider-Bitwarden in #​21218
• [PM-38985] Fix CipherResponse/CipherData type confusion in archive and emergency access services by @​nick-livefront in #​21237
• [PM- 38988] Fix Trial Dialog Dismissal Caching by @​sbrown-livefront in #​21240
• [PM-38275] Fix at-risk application count in Access Intelligence v2 drawer by @​Banrion in #​21265
• [PM-38830] fix: Display fixed-amount and repeating churn discounts by @​amorask-bitwarden in #​21281
• change link for terraform integration in SM GUI by @​vlad-trofimov in #​21285
• [PM-38286] Fix Access Intelligence at-risk drawer can reopen by @​Banrion in #​21314
• [PM-39206] use block input to ensure radios are displayed stacked by @​BryanCunningham in #​21361
• fix(platform): remove hardcoded vault.bitwarden.com checks in getSendUrl and getScimUrl by @​addisonbeck in #​21373
• [SM-1483] Fix self-hosted environment URLs in Secrets Manager config by @​vincentsalucci in #​21375
• [PM-39204] Add extra spacing to vault items when batch bar is visible by @​nick-livefront in #​21390
• [SM-1993][CL-1227] Fix textarea height and fix SM button spacing by @​vleague2 in #​21417
• [PM-39392] Use readonly styles for fields intended to be readonly by @​vleague2 in #​21425
• PM-39289 fixed close to done, misplaced popover and alignment by @​voommen-livefront in #​21437
• [CL-1228] hide actions container if empty and always render button outside by @​BryanCunningham in #​21440
• [PM-39429] remeasure bulk actions bar width when actions change by @​BryanCunningham in #​21443
• [PM-39290] Coachmark navigation in v2 by @​voommen-livefront in #​21456
• PM-39449 resolved root url issues by @​bmbitwarden in #​21468
• [PM-39440] Refactor domain verification dialog to improve form control handling by @​JaredScar in #​21476
• manually recompile select css by @​BryanCunningham in #​21488
• [CL-1225] Berry should hide when count is 0 in toggle group by @​vleague2 in #​21491
• [PM-39576] - [Defect] Coachmark tour page number is displaying "CURRENT of TOTAL" in main. by @​jaasen-livefront in #​21496
• reduce select label font size by @​BryanCunningham in #​21525

⚙️ Maintenance

• [PM-38958] Add ESLint no package self import rule by @​quexten in #​21198
• Auth/BEEEP/PM-21301 - Move SelfHostedEnvConfigDialog out of libs/auth by @​JaredSnider-Bitwarden in #​21268
• [BRE-2013] Fix repo name in MR description link by @​vgrassia in #​21276
• fix(codeowners): Added environment selector to auth's responsibilities by @​Patrick-Pimentel-Bitwarden in #​21284
• [CL-1223] simplify banner component by @​BryanCunningham in #​21301
• [PM-36841] Align Subtitles for all new Item Types by @​jengstrom-bw in #​21316
• [PM-39182] Migrate to relative imports - @​bitwarden/team-billing-dev by @​quexten in #​21325
• [PM-39182] Migrate to relative imports - @​bitwarden/team-data-insights-and-reporting-dev by @​quexten in #​21327
• [PM-39182] Migrate to relative imports - @​bitwarden/team-ui-foundation by @​quexten in #​21328
• [PM-39182] Migrate to relative imports - @​bitwarden/team-admin-console-dev by @​quexten in #​21329
• [PM-39182] Migrate to relative imports - @​bitwarden/team-auth-dev by @​quexten in #​21330
• [PM-39182] Migrate to relative imports - @​bitwarden/team-vault-dev by @​quexten in #​21331
• [PM-39182] Migrate to relative imports - @​bitwarden/team-key-management-dev by @​quexten in #​21333
• Remove unneeded import for ChipActionComponent by @​jengstrom-bw in #​21342
• [PM-38190] Improve sanitization of storybook args helper by @​vleague2 in #​21362
• [PM 34708] Use new shared enforce label workflow by @​djsmith85 in #​21365
• [PM-39293] Remove v2 naming from account recovery dialog by @​eliykat in #​21386
• [deps]: Pin dependencies by @​renovate in #​21406
• [PM-38904] - Managed to Claimed Rename by @​jrmccannon in #​21430
• [deps] Fix Rust nightly toolchain reference in lint workflow by @​coroiu in #​21457
• add data-testids to log in elements by @​nthompson-bitwarden in #​21458
• [PM-36835] Logging to reports by @​voommen-livefront in #​21512
• [PM-39182] Enable no relative imports rule by @​quexten in #​21515
• Bump client version(s) by @​github-actions in #​21554
• Bumped client version(s) (#​21554) by @​addisonbeck in #​21555

📦 Dependency Updates

• [deps] Platform: Update webpack-dev-server to v5.2.4 [SECURITY] by @​renovate in #​20700
• Update sdk-internal to 0.2.0-main.843 by @​bw-ghapp in #​21233
• [deps] Platform: Update @​babel/core to v7.29.6 [SECURITY] by @​renovate in #​21277
• Update sdk-internal to 0.2.0-main.849 by @​bw-ghapp in #​21299
• [PM-39351][PM-39353][PM-39369] Update Angular to 21.2.17 by @​vleague2 in #​21377
• Update sdk-internal to 0.2.0-main.857 by @​bw-ghapp in #​21393
• [deps] Platform: Update webpack-dev-server to v5.2.5 [SECURITY] by @​renovate in #​21404
• Update sdk-internal to 0.2.0-main.859 by @​bw-ghapp in #​21475

🔧 Other

• Bump client version(s) by @​github-actions in #​21271
• Auth/Add CLAUDE.md files to angular/src/auth and common/src/auth on file organization + barrel files by @​JaredSnider-Bitwarden in #​21283
• Autosync Crowdin Translations for web by @​bw-ghapp in #​21381
• Disable self import rule by @​quexten in #​21410
• Bump client version(s) by @​github-actions in #​21420

New Contributors

• @​TheDcoder made their first contribution in #​19439

Full Changelog: https://github.com/bitwarden/clients/compare/web-v2026.6.3...web-v2026.6.4

bitwarden/server (bitwarden/server)

v2026.6.2: Version 2026.6.2

Compare Source

Overview

• Removed feature flag for organization features caching
• Removed feature flag for member controller refactor
• Removed feature flag for collections component refactor
• Added new ‘staged’ status for organization members
• Invited users no longer reach dead end when attempting to log in with SSO
• Fixed cases where new device login protection email could not be re-sent
• Various under-the-hood improvements and minor bug fixes

What's Changed

:shipit: Feature Development

• [PM-34053] Add new GET endpoint for fetching key data for user key rotation by @​Thomas-Avery in #​7772
• [PM-38393]: add debug-disable-self-host-premium-check feature flag by @​kdenney in #​7805
• [PM-34779] Add accept invite link endpoint by @​r-tome in #​7812
• [PM-31884] Add access control support to Send Controls policy by @​mcamirault in #​7417
• [PM-36158] - Fix org cipher push notifications to fan out per authorized user by @​jaasen-livefront in #​7522
• [PM-36963] Bulk cohort assignment by @​kdenney in #​7792
• [PM-37513] feat: Add Enterprise 2019 to current pricing migration path by @​cyprain-okeke in #​7819
• [PM-34023] Remove 2FA account recovery flag by @​eliykat in #​7815
• [PM-39129] Add UsePam organization capability by @​Hinton in #​7816
• [PM-39257] Add feature flag pm-32380-btn-text-add-create by @​jengstrom-bw in #​7833
• [PM-32116] Remove pm-32111-provider-ability-extended-cache logic by @​JimmyVo16 in #​7838
• [PM-39102] Feature Flag for Staged Status by @​sven-bitwarden in #​7844
• Auth/PM-38742 - SSO Invited Existing User Flow Improvement - Redirect on error by @​JaredSnider-Bitwarden in #​7785
• [PM-36865] Removes the feature flag from the constants of the server-side code by @​JaredScar in #​7849
• [PM-30806] Self service change email command by @​ike-kottlowski in #​7740
• [PM-38851] Crypto cipher suite feature flag by @​mzieniukbw in #​7852
• [PM-38422] feat: Stack customer-level discount with churn and migration discounts by @​amorask-bitwarden in #​7831
• [PM-37512] feat: Add Teams Starter to current pricing migration path by @​amorask-bitwarden in #​7827
• [PM-37953] Add OrganizationUserStatusType.Staged, Remove Ordinal Checks by @​sven-bitwarden in #​7780
• [PM-36965] feat: Add CSV export of cohort to cohort management table by @​cyprain-okeke in #​7847
• [PM-32108] - Remove FF for org ability cache by @​jrmccannon in #​7821
• [PM-38922] - Adding Problem Details Result by @​jrmccannon in #​7853
• Revert "[PM-38851] Crypto cipher suite feature flag" by @​mzieniukbw in #​7863
• Add PM39071_DefaultPasswordManagerPrompt constant by @​differsthecat in #​7866
• [PM-35314] Backfill Revocation Reasons to All Users by @​sven-bitwarden in #​7713

🐛 Bug fixes

• [PM-38830] fix: Surface fixed-amount and time-bounded discounts in billing API by @​amorask-bitwarden in #​7814
• [PM-36158] - bump migration file name by @​jaasen-livefront in #​7820
• fix broken auto confirm policyRequirement check for org scoped request by @​BTreston in #​7839
• [PM-36574] fix: scope provider client invoice report to the authorized provider by @​connerbw in #​7770
• [PM-39237] fix: Handle mismatched and orphaned migration cohort assignments in admin dropdown by @​cyprain-okeke in #​7836
• [PM-38769] Fix OrganizationConnectionsController logic by @​eliykat in #​7845
• [PM-38456]: Allow License Generation for Sales Trial Orgs by @​sbrown-livefront in #​7793
• [PM-39562] fix: Reconcile org seats to billed quantity on packaged-plan migration by @​amorask-bitwarden in #​7869
• [PM-39569][PM-39286] fix: Wait for Stripe test clock before migration grace write by @​amorask-bitwarden in #​7872

⚙️ Maintenance

• [PM-29129] Add Policy Update Event README by @​JimmyVo16 in #​7159
• [PM-39293] Remove v2 naming from account recovery command by @​eliykat in #​7842
• [BRE-1969] Add Docker login with OAT to Build workflow by @​vgrassia in #​7835
• [PM 34707] Use new shared enforce label workflow by @​djsmith85 in #​7834
• [BEEEP] - Model Binding for Org and Org User Validation by @​jrmccannon in #​7724
• add AccessSecretsManager to OrganizationUserScene by @​nthompson-bitwarden in #​7860
• [PM-39474] - Updating Lock Files by @​jrmccannon in #​7862
• [PM-33402] Remove Feature-Flagged Logic: pm-33398-refactor-members-invite-org-users-command by @​sven-bitwarden in #​7855
• [PM-33403] Remove Feature Flag (pm-33398) by @​sven-bitwarden in #​7865
• Add ability to enable SM on SingleOrgScene by @​bnagawiecki in #​7861
• [PM-39561] Copy ListResponseModel from Api to HttpExtensions by @​Hinton in #​7868
• PM-33964 - Resolve defect in premium user licensing by @​theMickster in #​7788
• Bump version to 2026.6.2 by @​github-actions[bot] in #​7879

📦 Dependency Updates

• [deps] Platform: Update Microsoft.AspNetCore.SignalR.Protocols.MessagePack to v10.0.9 [SECURITY] by @​renovate[bot] in #​7817

🎨 Other

• llm(rules): Auth tokenables must be minted via factory. by @​enmande in #​7857

Full Changelog: https://github.com/bitwarden/server/compare/v2026.6.1...v2026.6.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Mend Renovate.