Update bitwarden

This MR contains the following updates:

Package	Update	Change
bitwarden/clients	patch	2026.7.0 → 2026.7.1
bitwarden/server	patch	2026.7.1 → 2026.7.2

---

Release Notes

bitwarden/clients (bitwarden/clients)

v2026.7.1: Web v2026.7.1

Compare Source

What's Changed

• Update policies UI
• Added new confirmation when deleting a passkey
• Updated 1Password importer to be more fault tolerant
• Updated send event logs copy
• Various under-the-hood improvements and minor bug fixes

💙 Community Highlight

• [PM-40131] fix(desktop): add Helium as Linux entry for NativeMessagingHosts by @​0xk1f0 in #​21748
• [PM-39030] Fix Proton Pass import of item custom fields by @​archit-goyal in #​21253
• [PM-19836] Add prefix to fastmail by @​lucacome in #​14105
• [PM-40685] Fix forwarder settings cache collision by @​cyfrit in #​21980
• [PM-39704] fix(send): restore increment/decrement buttons for max access count by @​harikrishna2208 in #​21527
• [PM-39593] reduce calls to nodeIsElement in query (and by extension queryAutofillFormAndFieldElements) by @​datdenkikniet in #​21498

:shipit: Feature Development

• [PM-27060] feat: Call SDK for password prelogin by @​ike-kottlowski in #​21777
• [PM-39815] feat: Add linksEnabled to invite-link status response model by @​r-tome in #​21820
• [CL-1272] Support visually-hidden labels in bit-form-field by @​willmartian in #​21788
• [PM-39778] Fix subtitles when using sdk by @​jengstrom-bw in #​21591
• [PM-40286] - Add Vfo1TerminologyService and VFO1I18nPipe infrastructure by @​nick-livefront in #​21860
• [PM-40060] Use native messaging dialog in browser extension settings by @​quexten in #​21705
• [PM-37990] Add UriMatchDefaultPolicy components and stories by @​JaredScar in #​21827
• [PM-38519] Add AutoConfirmPolicy V2 component and associated templates by @​JaredScar in #​21828
• [PM-32384] Update copy new to create/add browser by @​jengstrom-bw in #​21524
• [PM-40194] - add shared-folder icon by @​jaasen-livefront in #​21801
• [PM-40283] Add v0.1.0 of the AppPairingData schema by @​coltonhurst in #​21814
• [PM-40195] feat: add shared-folder localization keys by @​jaasen-livefront in #​21832
• desktop-autofill: Add missing IPC methods by @​iinuwa in #​21775
• Add generic HEC (SIEM) event integration card by @​maxkpower in #​21445
• [PM-36007] Admin change email event logging by @​BTreston in #​21908
• [PM-27844] Set email on sync by @​ike-kottlowski in #​21349
• [CL-1273] Add bitMenuClose directive to decouple menu dismissal from ARIA roles by @​willmartian in #​21789
• [PM-40104] Relabel "New organization" → "New vault" on org-switcher affordance (web) by @​nick-livefront in #​21871
• [PM-32403] Update button copy desktop by @​jengstrom-bw in #​21528
• [PM-38929] Add new design for edit member dialog by @​BTreston in #​21843
• [INNO] - Passkey Report by @​jrmccannon in #​19787
• [CL-1285] create Storybook feature-flags addon in new @​bitwarden/storybook lib by @​willmartian in #​21913
• [PM-37991] Implement Automatic App Login Policy v2 and associated components by @​JaredScar in #​21824
• [PM-38749] Add OrganizationInviteLinkApiService.updateSupportsConfirmation by @​JimmyVo16 in #​21933
• [PM-40381] Desktop Autofill Cancellation by @​iinuwa in #​21853
• [PM-10383] - confirm before deleting a passkey by @​jaasen-livefront in #​21497
• [PM-40193] feat: add vfo1Icon pipe for flag-gated icon swaps by @​jaasen-livefront in #​21876
• [PM-35093] feat: Support bitwarden-gov.com deeplink redirects on web connectors by @​enmande in #​21752
• [PM-40134] RoutedVaultFilterService accept a vaultId query parameter alongside organizationId by @​jengstrom-bw in #​21930
• [PM-40216] feat: Scope organization invite link lookups by organization ID by @​r-tome in #​21815
• [PM-35107] Remove Argon2Id option from UI in gov environment by @​mzieniukbw in #​21503
• feat(shared-unlock): support trusted devices by @​quexten in #​21895
• [PM-39997] desktop-autofill: Package Windows passkey plugin resources by @​iinuwa in #​21983
• [PM-39387] fix: Auto-sync premium status after returning from Stripe checkout by @​cyprain-okeke in #​21518
• [PM-38794] Add OrganizationInviteLinkApiService.getInvite by @​JimmyVo16 in #​21932
• [PM-40682] desktop-autofill: Graceful Windows plugin registration by @​iinuwa in #​21982
• desktop-autofill: Omit CTAP2 status code in assertion response by @​iinuwa in #​21978
• [PM-40381] desktop-autofill: FIDO2 UI cancellation by @​iinuwa in #​21906
• [CL-998] bit-table-v2 and related components by @​willmartian in #​20900
• [PM-40449] create lit cipher items and list by @​dan-livefront in #​21984
• feat(biometrics): add windows biometrics format based on sdk cryptography by @​quexten in #​21433
• [PM-40089] Show a banner in the vault view when Fill Assist is active for the current page by @​jprusik in #​21754
• [SM-1954] Show expiry status badge on access tokens list by @​maxkpower in #​20939
• Autotype AppData path normalization by @​neuronull in #​21910
• [PM-38813] - update offboarding survey by @​jaasen-livefront in #​21161
• [PM-40111] Rename Owner to Vault field by @​nick-livefront in #​21897
• Pm 38122 fastmail checkbox by @​bmbitwarden in #​21830
• feat(data-recovery): add detection of field decryption ciphers (#​22065) by @​quexten in #​22074

🐛 Bug fixes

• [PM-40820] Fix add access filter toggle style by @​BTreston in #​21816
• [PM-16456] Add occupied seat count check when restoring user by @​JaredScar in #​21746
• [PM-33228] Add screen reader only to enhance a11y behavior by @​BryanCunningham in #​21563
• [PM-38940] Close Firefox/Safari Permissions-Policy gaps via webRequest by @​bensbits91 in #​21466
• [PM-39137] Gate Access Intelligence report reads on new-architecture flag by @​Banrion in #​21315
• [PM-16456] Add mock services for billing constraints to fix storybook by @​JaredScar in #​21833
• [PM-39992] Add support for SDK IPC unreachability by @​quexten in #​21653
• [PM-40303] Fix logout when underprivileged user accesses Manage Send policy by @​harr1424 in #​21836
• [CL-1277] Add disabled and readonly variants to Textarea story by @​willmartian in #​21851
• [PM-40377] Fix bug with form field to have textarea behave the same as an input when disabled by @​jengstrom-bw in #​21848
• [PM-39825] Fix URI reordering, drag handle alignment by @​jaasen-livefront in #​21697
• [PM-40444] Hide archive/unarchive from bulk bar in Admin Console by @​nick-livefront in #​21873
• [PM-40457] Fix typos in the message catalogs by @​jprusik in #​21882
• [PM-40370] Use decrypted ciphers cache when using SDK by @​shane-melton in #​21888
• [PM-40484] Fix Autotype IPC channel mismatch by @​coltonhurst in #​21885
• [PM-13643] Refactor user avatar rendering in bulk dialogs to utilize userId for correct color match by @​JaredScar in #​21884
• [PM-40236] Logging out throws error mid-logout due to a race condition. User left in locked state by @​mzieniukbw in #​21858
• Fix SSH Agent concurrent requests by @​neuronull in #​21881
• [PM-40446] Enhance AutoConfirmWarningDialog by adding LinkModule to imports by @​JaredScar in #​21883
• [PM-40482] Return to Default Filter After Revoking Last Staged User by @​sven-bitwarden in #​21911
• [PM-39948][PM-40406] Fix native select issues with dark mode and arrow click handling by @​vleague2 in #​21877
• [PM-13643] avatars in org member remove/revoke modal do not match members page fix by @​JaredScar in #​21931
• [AppSec] AI Fix for Template Injection in GitHub Workflows Action by @​aikido-autofix[bot] in #​21787
• [PM-40247] Fix vault item checkmarks disappearing after clearing a search by @​nick-livefront in #​21823
• [PM-40201] SSH key items with a null public key or fingerprint fail to decrypt and break the vault by @​gbubemismith in #​21778
• [PM-18638] Prevent collection/cipher creation for suspended organizations by @​JaredScar in #​21887
• [PM-40432] Update Send Event Logs copy by @​harr1424 in #​21890
• [PM-40502] communicate message extension payloads using symbol by @​audreyality in #​21909
• [PM-40188] Apply deletion date policy to CLI-created Sends by @​mcamirault in #​21845
• [CL-808] Support forced colors mode for form controls by @​vleague2 in #​21936
• [PM-40543] Default new SCIM connections to staged by @​sven-bitwarden in #​21963
• [CL-1282] use correct size for base icon tile by @​BryanCunningham in #​21856
• fix(desktop): guard will-navigate against renderer escape by @​addisonbeck in #​21935
• [PM-39845] Prevent Access Intelligence report freeze on oversized password values by @​Banrion in #​21987
• [PM-39772] Detect shadow hosts created from iframes by @​bensbits91 in #​21857
• [PM-40241] Bugfix - Rehydrate localData lastUsedDate on local cipher views by @​jprusik in #​21849
• [PM-40440] fix: Source upgrade cart total from server invoice preview by @​amorask-bitwarden in #​21902
• [PM-40375] Add per-item exception handling to 1Pux import by @​harr1424 in #​21941
• [PM-39464] Fix ExpressionChangedAfterItHasBeenCheckedError when assigning collections by @​nikwithak in #​21743
• fix(key-connector): fix sdk key-connector login not working by @​quexten in #​21957
• [PM-38557] Netwrix Password Secure importer should map URL-like fields to Bitwarden website URI by @​harr1424 in #​21889
• [PM-38189] Wire InitiationPath to Organizations to Correct Trial Metadata by @​sbrown-livefront in #​21769
• [PM-40771] Update policy enabled method to accept PolicyStatusResponse by @​JaredScar in #​21997
• fix: race condition leading to decryption errors by @​quexten in #​22063
• fix(desktop): use x11 clipboard by default and only use portal as fallback by @​quexten in #​22062
• [PM-24945] Fix bw send receive not recognizing --password parameter by @​adudek-bw in #​21872

⚙️ Maintenance

• Bump client version(s) by @​github-actions[bot] in #​21811
• Auth/PM-39905 - Restructure organization-invite into subfolders with barrel imports by @​JaredSnider-Bitwarden in #​21642
• Auth/PM-3813 - 2FA Management Endpoints - User Verification Refactor by @​JaredSnider-Bitwarden in #​21385
• Autosync Crowdin Translations for browser by @​bw-ghapp[bot] in #​21648
• Fix/update CODEOWNERS by @​djsmith85 in #​21826
• [PM-37476] Source canUseAccessIntelligence from server UseRiskInsights ability by @​AlexRubik in #​21760
• [BRE-2044] Keep logic for bumping the Desktop version automatically in clients by @​vgrassia in #​21745
• [BRE-1907] Add artifact manifest to build-web.yml by @​gitclonebrian in #​21726
• [PM-40345] Ignore Storybook stories in code coverage by @​Hinton in #​21842
• [PM-40138] desktop-autofill: refactor Autofill IPC Registration by @​iinuwa in #​21753
• [PM-16487] Remove Add/edit v2 component by @​jengstrom-bw in #​21859
• [PM-39259] Migrate auth token key generation to SDK by @​quexten in #​21706
• Autosync Crowdin Translations for web by @​bw-ghapp[bot] in #​21649
• [PM-40456] Update cSpell settings by @​jprusik in #​21875
• [PM-39259] Remove deprecated randomBytes/aesGenerateKey/createKey by @​quexten in #​21713
• desktop-autofill: Move macOS-specific window position to macOS code by @​iinuwa in #​21852
• chore(biometrics): extract biometrics to separate crate by @​quexten in #​21822
• chore: rename biometric_v2 mod to biometric by @​quexten in #​21891
• Autosync Crowdin Translations for desktop by @​bw-ghapp[bot] in #​21903
• Autosync Crowdin Translations for browser by @​bw-ghapp[bot] in #​21904
• [PM-34857] Remove PoliciesInAcceptedState feature flag by @​eliykat in #​21761
• Autosync Crowdin Translations for web by @​bw-ghapp[bot] in #​21905
• Autosync Crowdin Translations for desktop by @​bw-ghapp[bot] in #​21915
• [PM-36404] Refactor org guards for ts-strict by @​BTreston in #​21914
• [PM-39966] Migrate from @angular/platform-browser-dynamic to @angular/platform-browser by @​djsmith85 in #​21866
• Autosync Crowdin Translations for desktop by @​bw-ghapp[bot] in #​21966
• Autosync Crowdin Translations for browser by @​bw-ghapp[bot] in #​21916
• chore(ci): skip platform-community signal for fork MRs by @​addisonbeck in #​21934
• desktop-autofill: Add missing Skunkworks codeownership by @​iinuwa in #​21907
• Autosync Crowdin Translations for web by @​bw-ghapp[bot] in #​21917
• [PM-40447] Create lit prompt component by @​dan-livefront in #​21892
• [PM-40688] Run prettier to fix failing lint after prettier upgrade by @​dan-livefront in #​21981
• chore: Add team-ai-sme as CODEOWNERS for .mcp.json by @​SaintPatrck in #​21985
• build: allow sdk-internal crypto crates in dependency tooling by @​quexten in #​21925
• refactor: gate desktop_native core allocator and windows deps by @​quexten in #​21926
• DN Autotype: Move mockall and serial_test to be Dev Deps by @​coltonhurst in #​21999
• refactor(login-strategy): clean up crypto-related functions and deprecation notices by @​quexten in #​21958
• [BRE-2118] Adding publish CLI workflow for NPM provenance by @​pixman20 in #​22014
• Autosync Crowdin Translations for web by @​bw-ghapp[bot] in #​22020
• docs(vault): document deprecation of TypeScript vault item decryption by @​quexten in #​22004
• Bump client version(s) by @​github-actions[bot] in #​22038
• Bump client version(s) by @​github-actions[bot] in #​22069
• [CL] mark bit-table-v2 as Beta in Storybook docs by @​willmartian in #​22072

📦 Dependency Updates

• Update sdk-internal to 0.2.0-main.897 by @​bw-ghapp[bot] in #​21718
• [deps]: Update GitHub Artifact Actions (major) by @​renovate[bot] in #​19586
• Pin NPM 11 on CLI builds by @​dani-garcia in #​21838
• [deps]: Update Rust by @​renovate[bot] in #​20390
• [deps] Platform: Lock file maintenance by @​renovate[bot] in #​21796
• [deps]: Update dtolnay/rust-toolchain digest to 4cda84d by @​renovate[bot] in #​21948
• feat(register-finish-request): Add sales_assisted_token to request by @​enmande in #​21961
• [deps] Platform: Update jest-preset-angular to v17 by @​renovate[bot] in #​21678
• [deps] Autofill: Update prettier to v3.9.5 by @​renovate[bot] in #​21668
• [deps] Platform: Update webpack-dev-server to v5.2.6 [SECURITY] by @​renovate[bot] in #​21972
• [deps]: Update cargo-deny to 0.20.0 by @​renovate[bot] in #​21952

🎨 Other

• [PM-39560] [BEEEP] Add MCP server configuration for Chrome and Electron DevTools by @​quexten in #​21483
• feat(llm): add claude note to make key-management aware of encryption related changes by @​quexten in #​21818

New Contributors

• @​0xk1f0 made their first contribution in #​21748
• @​SaintPatrck made their first contribution in #​21985
• @​archit-goyal made their first contribution in #​21253
• @​lucacome made their first contribution in #​14105
• @​cyfrit made their first contribution in #​21980
• @​harikrishna2208 made their first contribution in #​21527
• @​datdenkikniet made their first contribution in #​21498

Full Changelog: https://github.com/bitwarden/clients/compare/web-v2026.7.0...web-v2026.7.1

bitwarden/server (bitwarden/server)

v2026.7.2: Version 2026.7.2

Compare Source

What's Changed

• removed feature flag for enforcing policies for accepted status members
• removed feature flag for pricing migrations
• Various under-the-hood improvements and minor bug fixes

:shipit: Feature Development

• [PM-38951] feat: Add CreationDate to org user detail endpoints by @​jrmccannon in #​7936
• [PM-39815] feat: Surface org name on invite-link status when links unavailable by @​r-tome in #​7928
• [PM-40152] feat: Require verified email to accept organization invite link by @​r-tome in #​7949
• Add VFO1 Foundation Flag by @​nick-livefront in #​7973
• [PM-27060] chore: add feature flag for password prelogin from SDK by @​ike-kottlowski in #​7954
• [PM-40293] feat: Trim invite-link policies endpoint to Master Password and Account Recovery by @​r-tome in #​7977
• [PM-38388] Support sales-assisted trials by @​enmande in #​7881
• [PM-38791] feat: Add SupportsConfirmation to invite-link status endpoint by @​JimmyVo16 in #​7974
• [PM-39274] Add feature flag event-management-for-generic-hec by @​Banrion in #​7993
• [PM-40006] Add temporary item sharing feature flag by @​mcamirault in #​7996
• [INNO] - Passkey Directory Endpoint by @​jrmccannon in #​7317
• [PM-38749] Add endpoint to update SupportsConfirmation and inviteBlob by @​JimmyVo16 in #​7999
• [PM-40245] Add google favicon API to icon service lookups by @​kspearrin in #​7951
• [PM-40216] feat: Data-protect OrganizationInviteLink.Code at rest by @​r-tome in #​7969
• [PM-40537] fix: Only rewrite Stripe schedules for plan-migration organizations by @​amorask-bitwarden in #​8035
• [PM-39387] fix: Bump AccountRevisionDate when premium status changes by @​cyprain-okeke in #​7966
• [PM-34429] Create an endpoint to retrieve the Invite by @​JimmyVo16 in #​7994
• [PM-40523] feat: Add endpoint to return organization private key to admins by @​r-tome in #​8006
• [PM-40208] Add AccessPam column + PAM seat-occupancy read by @​Hinton in #​7957
• [PM-39236]: Add RenewalNotificationSentDate column + repository method by @​sbrown-livefront in #​8031
• [PM-39197] - improve vault sync performance by @​jaasen-livefront in #​7829
• Revert "[PM-39197] - improve vault sync performance" by @​gbubemismith in #​8064
• [PM-39197] - improve vault sync performance (#​8080) by @​gbubemismith in #​8117

🐛 Bug fixes

• [PM-40281] Convert email search to text search field by @​BTreston in #​7968
• [PM-38951] fix: Correct migration script date to 2026-07-14 by @​jrmccannon in #​7972
• [PM-38773] Require org membership before logging org audit events via /collect by @​AlexRubik in #​7934
• [PM-38874] fix: Keep Admin org page accessible when Stripe customer is deleted by @​kdenney in #​7913
• [PM-40372] Fix Issue with Restoring Staged Users by @​sven-bitwarden in #​7979
• [PM-40516] fix: Isolate ExtendedCache backplane per cache name on shared Redis by @​withinfocus in #​8004
• [PM-18747] Add more protections to endpoints on backend so regular members can't hit endpoints and see data by @​JaredScar in #​7985
• [PM-33940] Enforce per-secret access checks in SecretVersionsController by @​mandreko-bitwarden in #​7823
• [PM-16456] Enhance PreviewOrganizationTaxCommand to support Teams Starter 2023 by @​JaredScar in #​8000
• [PM-40201] Added feature flag for derive ssh keys by @​gbubemismith in #​7998
• [PM-16095] feat: Enhance provider seat limit validation messages by @​JaredScar in #​7980
• [PM-40440] fix: Include Secrets Manager and storage in plan-change tax preview by @​amorask-bitwarden in #​7995
• [PM-40751] fix: Sales-assisted trials email copy by @​enmande in #​8045

⚙️ Maintenance

• Bump version to 2026.7.0 by @​github-actions[bot] in #​7967
• [PM-33046] Remove legacy cache DI registration in Events by @​JimmyVo16 in #​7958
• Auth/PM-3813 - 2FA Management Endpoints - User Verification Refactor by @​JaredSnider-Bitwarden in #​7841
• [PM-33046] Remove legacy in-memory application cache services by @​JimmyVo16 in #​7959
• [PM-40343] Extract ITableObject, IRepository, CombGuid to Data by @​Hinton in #​7976
• [PM-40047] Detect blob ciphers via format_version probe by @​shane-melton in #​7930
• ci: route Swashbuckle (Swagger) Renovate updates to Platform by @​amorask-bitwarden in #​7978
• PM-39869 - Implement attachments in Seeder & cipher key encryption by @​theMickster in #​7953
• Add library documentation by @​justindbaur in #​7950
• [PM-33046] Remove GetManyAbilities repo methods and cache interface by @​JimmyVo16 in #​7960
• chore: update code owners to include architecture team for RustSDK by @​theMickster in #​7986
• [PM-34857] Remove PoliciesInAcceptedState feature flag by @​eliykat in #​7947
• Switch to Bitwarden.Server.Sdk.Features by @​justindbaur in #​7898
• removed curl and replaced healthcheck with wget by @​keithhubner in #​7858
• chore(ci): skip platform-community signal for fork MRs by @​addisonbeck in #​8009
• Seeder/add parameterized org seeding by @​nthompson-bitwarden in #​7987
• [PM-37260] Profile service improvements by @​ike-kottlowski in #​7924
• Bump version to 2026.7.1 by @​github-actions[bot] in #​8038
• Resolve minor code smells in attachment tests by @​theMickster in #​8030
• PM-40665 - Seed SSO configuration and a realistic local-sso dev org in the Seeder by @​theMickster in #​8014
• Fix date of migration files that broke main by @​patriksvensson in #​8048
• Seeder/provider scenes by @​nthompson-bitwarden in #​8034
• [PM-40623] Add ProducesResponseType to fix SDK server bindings by @​eliykat in #​8046
• map System.Text.Json.Nodes types to OpenAPI schemas by @​dani-garcia in #​8053
• [PM-37599] refactor: Remove PM37597 always-enable-Stripe-automatic-tax feature flag by @​amorask-bitwarden in #​7989
• [PM-16095] Revert changes before RC by @​JaredScar in #​8055
• [PM-40623] Add ProducesResponseType to OrganizationUsersController.GetInvite by @​eliykat in #​8058
• Bump version to 2026.7.2 by @​github-actions[bot] in #​8063
• Seeder - Tech debt - Migrate CoreHelpers.GenerateComb to CombGuid.Generate by @​theMickster in #​8061
• [PM-36062] refactor: Remove defer-price-migration-to-renewal feature flag by @​amorask-bitwarden in #​7883

📦 Dependency Updates

• [deps]: Update MarkDig to v1.3.2 by @​renovate[bot] in #​7704
• [deps]: Update dtolnay/rust-toolchain digest to 4cda84d by @​renovate[bot] in #​8016
• [deps]: Pin rust to 1.97.1 by @​renovate[bot] in #​8015

New Contributors

• @​patriksvensson made their first contribution in #​8048

Full Changelog: https://github.com/bitwarden/server/compare/v2026.7.1...v2026.7.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Mend Renovate.