Update bitwarden to v2026.8.0

This MR contains the following updates:

Package	Update	Change
bitwarden/clients	minor	2026.7.1 → 2026.8.0
bitwarden/server	minor	2026.7.2 → 2026.8.0

---

Release Notes

bitwarden/clients (bitwarden/clients)

v2026.8.0: Web v2026.8.0

Compare Source

What's Changed

💙 Community Highlight

• [PM-27495] Do not show true length of password in password mask by @​Mauritz8 in #​17052
• [PM-37656] Resolve SSH agent caller name via libproc on macOS by @​lnky102 in #​20680
• [PM-39312] Fix Proton Pass importer dropping custom, alias, and SSH key items by @​theagg-18 in #​21402

:shipit: Feature Development

• [PM-40255] Update collection icon to bwi-shared-folder by @​nick-livefront in #​21996
• feat(data-recovery): add detection of field decryption ciphers by @​quexten in #​22065
• [PM-39220] Add the At-Risk Gauge component by @​AlexRubik in #​21861
• [PM-40682] desktop-autofill: Register Windows native passkey plugin by @​iinuwa in #​21986
• [PM-40240][PM-40239] Updated card control features by @​BryanCunningham in #​21819
• [PM-40252] feat: migrate shared vault components to shared-folder terminology by @​jaasen-livefront in #​21967
• [PM-40165] feat(web): migrate vault components to shared-folder terminology by @​jaasen-livefront in #​21993
• [PM-40335] PAM - Add access rules domain (1/2) by @​Hinton in #​21810
• [PM-17584] Delinea XML parser by @​mcamirault in #​21620
• [PM-41015] Add feature flag for Managed Device Framework by @​djsmith85 in #​22097
• [PM-35157] Remove feature flagged logic for SDK decryption flag by @​JaredScar in #​22078
• [PM-40654] feat: gate org-creation default collection name behind VFO1 terminology by @​jaasen-livefront in #​21969
• [PM-40510] feat: rename vault-filter query param to sharedFolderId by @​jaasen-livefront in #​21968
• [PM-40623] Update invite link service to match SDK by @​eliykat in #​22054
• add problem detail support, wire up email changing by @​BTreston in #​21878
• [CL-972] card updates by @​BryanCunningham in #​21776
• [PM-35943] Browser: Add Health tab and navigation by @​lastbestdev in #​22045
• desktop-autofill: Implement Windows native status command [PM-41025] by @​iinuwa in #​22138
• [PM-39227] Add the browser vault-health reports service (categorize, score, emit) by @​AlexRubik in #​22009
• [PM-40731] Implement VFO1 terminology updates across collection components by @​JaredScar in #​22104
• [PM-39452] fix: Show premium membership status from desktop Account menu by @​cyprain-okeke in #​21992
• [PM-40742] update SSO TDE copy by @​BTreston in #​22113
• desktop-autofill: Implement Windows plugin credential sync [PM-41025] by @​iinuwa in #​22109
• [PM-40734] Settings Collection Terminology changes by @​JaredScar in #​22107
• [PM-40732] Groups terminology changes by @​JaredScar in #​22105
• [PM-39075] Browser: Show Health tab berry until feature is visited by @​lastbestdev in #​22140
• [PM-38799] Add translation for confirm flow audit events by @​JimmyVo16 in #​22117
• [PM-38389] feat: Support sales-assisted trials by @​enmande in #​21929
• [PM-40741] Reports terminology update by @​BTreston in #​22112
• [PM-40733] members terminology update by @​JaredScar in #​22100
• [PM-40335] PAM - Add access rules UI (2/2) by @​Hinton in #​21841
• [PM-40448] create lit password generator by @​dan-livefront in #​22010
• [PM-41312] Bump sdk-internal for Fill Assist policy type by @​bensbits91 in #​22206
• [PM-40735] event logs terminology update by @​JaredScar in #​22133
• [PM-39978] Add Item Send enum and fix resulting build errors by @​mcamirault in #​22135
• [PM-40253] feat(browser): migrate vault components to shared-folder terminology by @​gbubemismith in #​22079
• [PM-38248] Remove SendEventLogging feature flag by @​harr1424 in #​22131
• [PM-39222] Browser: Add intro to Health feature by @​lastbestdev in #​22209
• [PM-41438] - Add new errors for taken emails by @​jrmccannon in #​22220
• added vault health reports by @​maxkpower in #​21432
• [PM-40119] Assign Collection -> "Add to shared folder" action & dialog copy by @​jengstrom-bw in #​21874
• [PM-40548] Web add quick copy icon setting by @​jengstrom-bw in #​22118
• [PM-40549] Desktop add quick copy icon setting by @​jengstrom-bw in #​22120
• desktop-autofill: Prepare native OS user verification [PM-29791] by @​iinuwa in #​22176
• [PM-40254] feat(desktop): migrate vault components to shared-folder terminology by @​gbubemismith in #​22096
• [PM-40944] Add Delinea CSV importer, improve types for Delinea XML by @​mcamirault in #​22207
• [PM-40679] Autotype MVP Naming Refactor by @​coltonhurst in #​22201
• SSH Agent contain edge case IPC failures by @​neuronull in #​22236
• [PM-31619]Create feature-flag for inline menu component by @​dan-livefront in #​22234
• [PM-38333] feat: Annual billing savings offer on cancel by @​kdenney in #​21939
• [CL-51] create file upload component by @​BryanCunningham in #​20899

❗ Breaking Changes

• Fix AuthEdit SDK break by @​adudek-bw in #​22071
• introduce AutofillResult by @​audreyality in #​22161

🐛 Bug fixes

• [PM-38639] Fix scrollbar color in desktop light mode by @​vleague2 in #​22039
• [PM-40800] re-add removed nested collection permissions checkbox by @​BTreston in #​22000
• [PM-40961] fix: don't show no master password warning for staged users by @​sven-bitwarden in #​22075
• fix(sdk): revert sdk lifecycle changes by @​quexten in #​22090
• [PM-2803] Order collections alphabetically in collections dropdown for nested collections by @​JaredScar in #​22077
• PM-36838 update template to show deviceName instead of deviceType by @​voommen-livefront in #​21600
• [PM-40462] Fix checkbox being unchecked when clicking edit autotype shortcut by @​shane-melton in #​22085
• [PM-25560] Align Safe In Cloud import to match native behavior by @​harr1424 in #​20717
• [PM-26503] Bugfix - Allow inline menu to escape aria model focus traps by @​jprusik in #​22017
• PM-41236 Add additional esccaping to shortcode text element by @​mandreko-bitwarden in #​22156
• [PM-16160] Fixes CLI issue where passwords are show via get item command in CLI by @​JaredScar in #​22083
• [PM-41027] fix: label add-item tile as shared folder under VFO1 terminology by @​gbubemismith in #​22137
• [PM-40766] Handle punycode-unicode domain matching for "Host" URI matching strategy by @​jprusik in #​21994
• Auth/PM-41303 - Direct Org Invite Acceptance - fix url paste scenario eternal spinner bug when org has MP policy by @​JaredSnider-Bitwarden in #​22184
• [PM-40693] Hide copy button on file Sends by @​mcamirault in #​22015
• [PM-41288] Fix bug preventing edits of existing File Sends by @​mcamirault in #​22203
• SSH Agent: fix all-or-nothing key parsing by @​neuronull in #​22200
• [PM-41256] User Is Unable to Create a Passport Cipher by @​jengstrom-bw in #​22181
• [PM-40218] fix: stop autofill and save from deleting the TOTP key by @​gbubemismith in #​22175
• [PM-30289] Fix for loss of focus on extension search input by @​shane-melton in #​18581
• [PM-41539] fix: recognize both Keeper SSO callback URL forms (#​22265) by @​itsadrago in #​22331
• [PM-41691] Fix issue where edit item, hidden passwords wipes password, TOTP by @​JaredScar in #​22329
• [PM-41880] Hotfix for edit members dialog dependencies (cherry-pick to rc) by @​Banrion in #​22417

⚙️ Maintenance

• [PM-40847] Add any missing inline menu renderings to storybook for QA by @​dan-livefront in #​22037
• [PM-40590] Run chromatic workflow when the workflow file is updated, to enable dep testing by @​vleague2 in #​22076
• [PM-40259] introduce AutofillOrchestrator by @​audreyality in #​21768
• [PM-40680] chromium-importer: Replace deprecated LSFindApplicationForInfo function by @​iinuwa in #​21979
• [PM-36403] Group view models ts strict by @​BTreston in #​21825
• [PM-36405] collection dialog refactor by @​BTreston in #​21965
• [PM-36405] Fix types in Storybook after adopting ts-strict by @​eliykat in #​22086
• [CL-1292] update icon docs for filename-based build system by @​BryanCunningham in #​22108
• Add t:deps label for SDK update MRs automatically by @​trmartin4 in #​22142
• Autosync Crowdin Translations for desktop by @​bw-ghapp[bot] in #​22018
• Autosync Crowdin Translations for web by @​bw-ghapp[bot] in #​22162
• Autosync Crowdin Translations for desktop by @​bw-ghapp[bot] in #​22166
• Autosync Crowdin Translations for browser by @​bw-ghapp[bot] in #​22019
• build: Fix Windows cross-compiled builds by @​iinuwa in #​22139
• chore: remove checkmarx from repo by @​sognefej in #​22183
• [PM-35791] Remove old Send access endpoints by @​mcamirault in #​22080
• [BRE-2153] fix(ci): Stage bit-common for commercial browser builds by @​fntyler in #​22198
• [PM-40846] Support Fido2 v4 server update by @​ike-kottlowski in #​22006
• chore(kdf-change): port change kdf to sdk by @​quexten in #​22032
• [PM-24097] - [Vault] Remove getOrgKey from the key service by @​jaasen-livefront in #​21480
• Move browser Health tab files to commercial license by @​lastbestdev in #​22223
• [PM-40107] Deprecate TS generator logic available in the SDK by @​harr1424 in #​22154
• [BRE-2158] Add MR label to creation step for Crowdin Pull workflow by @​vgrassia in #​22228
• mock missing observables to suppress console errors by @​audreyality in #​22174
• [CL-1294] Add FormRecord stories for table-v2 by @​willmartian in #​22160
• chore(crypto): port crypto sync handler to sdk by @​quexten in #​22217
• SSH Agent: fix flaky integration test by @​neuronull in #​22238
• Browser: Refactor client state definitions for Health feature by @​lastbestdev in #​22240
• [BRE-2105] Updating build process for desktop and browser beta channels by @​pixman20 in #​22229
• Autosync Crowdin Translations for web by @​bw-ghapp[bot] in #​22274
• Autosync Crowdin Translations for desktop by @​bw-ghapp[bot] in #​22272
• Autosync Crowdin Translations for browser by @​bw-ghapp[bot] in #​22273
• Autosync Crowdin Translations for browser by @​bw-ghapp[bot] in #​22281
• Autosync Crowdin Translations for desktop by @​bw-ghapp[bot] in #​22279
• Autosync Crowdin Translations for web by @​bw-ghapp[bot] in #​22280
• refactor(crypto): add legacy crypto module by @​quexten in #​22254
• chore(native-messaging): rename native messaging plug to dot-native-messaging by @​quexten in #​22303
• [BRE-2116] Bump actions/checkout to v7.0.1 in non-privileged workflows by @​brandonbiete in #​22157
• Bump client version(s) by @​github-actions[bot] in #​22320

📦 Dependency Updates

• [deps] UI Foundation: Update chromatic to v18 by @​renovate[bot] in #​21954
• [deps]: Update chromaui/action action to v18 by @​renovate[bot] in #​21956
• Auth/PM-40520 - Bump SDK versions in clients to get new registration open org invite crypto APIs by @​JaredSnider-Bitwarden in #​22134
• Update sdk-internal to 0.2.0-main.928 by @​bw-ghapp[bot] in #​21870
• [deps]: Update Rust crate rusqlite to v0.40.1 by @​renovate[bot] in #​21115
• [deps] Tools: Update Rust crate aes-gcm to v0.11.0 by @​renovate[bot] in #​21675
• [deps] Tools: Update @​bufbuild/protobuf to v2.13.0 by @​renovate[bot] in #​21950
• fix: update sdk and add support for kdf in state bridge by @​quexten in #​22197
• [deps] Vault: Update @​koa/router to v15.7.0 by @​renovate[bot] in #​21951
• [deps] Platform: Update electron to v43 by @​renovate[bot] in #​20844
• [deps]: Update Rust crate rkyv to v0.8.17 by @​renovate[bot] in #​22215

New Contributors

• @​lnky102 made their first contribution in #​20680
• @​theagg-18 made their first contribution in #​21402

Full Changelog: https://github.com/bitwarden/clients/compare/web-v2026.7.1...web-v2026.8.0

bitwarden/server (bitwarden/server)

v2026.8.0: Version 2026.8.0

Compare Source

What's Changed

:shipit: Feature Development

• [PM-38923] feat: Add v2 UpdateOrganizationUser command with role-escalation validation by @​jrmccannon in #​7919
• [PM-38926] feat: Add admin change member email to v2 UpdateOrganizationUser command by @​jrmccannon in #​7964
• [PM-36011] feat: add member email change notification email by @​jrmccannon in #​8044
• [PM-39978] Add Item type Send support by @​mcamirault in #​8008
• [PM-41015] Create feature flag for managed-device-framework by @​djsmith85 in #​8072
• [PM-40509] Make sales-assisted trials always payment optional by @​enmande in #​8067
• [PM-40161] feat(admin-approval-email): Update copy by @​enmande in #​8079
• [PM-41065] Arch/seeder api additional auth accounts by @​MGibson1 in #​8077
• [PM-40515] Add the support confirmation check. by @​JimmyVo16 in #​8074
• Auth/PM-40521 - Registration - Optionally carry SealedOpenOrgInviteData through email verification by @​JaredSnider-Bitwarden in #​8037
• [PM-39430] Extract shared business-plan migration coordinator by @​sbrown-livefront in #​8050
• [PM-39894] fix: Exclude provider-linked organizations from add-existing-organization flow by @​cyprain-okeke in #​7988
• [PM-36007] add event logging for changed email by @​BTreston in #​8083
• [DIRT] Expose feature flag for browser extension Health tab by @​lastbestdev in #​8100
• [PM-38799] Add audit events for the confirm flow. by @​JimmyVo16 in #​8081
• [PM-40738] user facing error messages by @​JaredScar in #​8088
• [PM-39197] - improve vault sync performance by @​gbubemismith in #​8080
• [PM-41304] Add feature flag pm-40435-quick-copy-icon-setting by @​jengstrom-bw in #​8121
• [PM-39454] feat(km): add KeyId value type and user key id validation attribute by @​quexten in #​8107
• [PM-41259] Scaffold PAM cipher-lease endpoints by @​Hinton in #​8105
• [PM-40160] SecurityTasksNotification copy update by @​jengstrom-bw in #​7997
• [PM-40744] Update Server Error Messages for VFO1 by @​BTreston in #​8087
• [PM-40743] Update email copy for VFO1 by @​BTreston in #​8131
• [PM-38248] Remove SendEventLogging feature flag by @​harr1424 in #​8084
• [PM-41438] - Add new errors for taken emails by @​jrmccannon in #​8140
• [PM-41481] Fix policy enforcement when accepting invite link by @​eliykat in #​8146
• [PM-39454] feat(km): add UserKeyId column to the user row by @​quexten in #​8108
• [PM-41409] Introduce ImportRefresh Feature Flag by @​harr1424 in #​8126
• [PM-41311] Register Fill Assist policy by @​bensbits91 in #​8123
• feat(crypto): add key ids to request and response models by @​quexten in #​8124
• [PM-39431] feat: Implement SendInvoicePriceMigrationJob by @​cyprain-okeke in #​8086
• [PM-38333] feat: Annual billing savings offer on cancel by @​kdenney in #​8010

🐛 Bug fixes

• [PM-41066] fix: Preserve subscription schedule phase metadata on phase rebuilds by @​amorask-bitwarden in #​8078
• [PM-17000] fix: block self-host from autoscaling Secrets Manager seats on bulk enable by @​jrmccannon in #​8073
• [PM-17002] - Added self host guard to stop autoscale when self hosted and creating a service account. by @​jrmccannon in #​8085
• [PM-17012] - Update Org User Self Host SM Autoscale Guard by @​jrmccannon in #​8089
• [PM-40866] Fix Teams 2019 organization upgrades to Enterprise by @​sbrown-livefront in #​8057
• [PM-40507] Change Password Well Known URLs Issues by @​gbubemismith in #​8036
• PM-41426: PM and SM select for sales-assisted trials by @​enmande in #​8142
• [PM-39998] Omit org owner and admin Sends from policy enforcement by @​mcamirault in #​7982
• Add PendingProtection for safe protect-cert rotation when secrets land before non-secrets by @​justindbaur in #​8104
• [PM-41579] Update email copy by @​BTreston in #​8166
• [PM-41628] Update email copy by @​BTreston in #​8167
• [PM-40694] fix: Derive Stripe tax ID type server-side by @​amorask-bitwarden in #​8122

⚙️ Maintenance

• Stabilize RelayPushRegistration tests by @​justindbaur in #​8041
• Remove unneeded RequireFeature filter by @​justindbaur in #​8062
• PM-40665 - Back out the hardcoded local-sso org GUID so the preset can be reseeded by @​theMickster in #​8060
• docs: note ISNULL rolling-deploy pattern for JSON/TVP NOT NULL columns by @​Hinton in #​7991
• [PM-40946] refactor: Remove unauthenticated Stripe event recovery endpoints and Admin tool by @​amorask-bitwarden in #​8070
• [PM-36838] Render DeviceType display name in event integration templates by @​lastbestdev in #​8011
• [PM-41079] Extract SSRF protection into src/Libraries/SsrfProtection by @​justindbaur in #​8066
• Seeder/Add billing gateway to SingleUserScene by @​nthompson-bitwarden in #​8069
• Aspire: add parameter for idp configuration by @​eliykat in #​8082
• Seeder: Add UsePam organization override by @​Hinton in #​8093
• PM-40996 - Add async and post-commit step support to the seeder pipeline by @​theMickster in #​8094
• [PM-41220] add integration tests capturing current middleware behavior by @​justindbaur in #​8096
• [PM-41225] Extract exception handling into src/Libraries/ExceptionHandling by @​justindbaur in #​8090
• chore: remove checkmarx from repo by @​sognefej in #​8120
• [PM-41272] Extract organization authorization into a new library by @​Hinton in #​8095
• [PM-39454] refactor(users): make UpdateUserData provider-agnostic and enlist EF delegates by @​quexten in #​8106
• Add steps to build and push gov container images by @​gitclonebrian in #​7822
• [PM-35791] Remove email verification FF and legacy Send access endpoints by @​mcamirault in #​8065
• [BRE] Add login step for Chainguard repo by @​gitclonebrian in #​8129
• Move the shared exception handler to Bit.ExceptionHandling and use it for PAM endpoints by @​Hinton in #​8118
• [PM-41451] Migrate AC files off off AssemblyHelpers.GetVersion() by @​justindbaur in #​8133
• [PM-16936] Fix double HTML encoding by @​JimmyVo16 in #​8047
• Update registry to FedRAMP-specific ACR by @​gitclonebrian in #​8148
• [PM-41451] Migrate Dirt files off of AssemblyHelpers.GetVersion() by @​justindbaur in #​8136
• [PM-41451] Migrate Auth files off of AssemblyHelpers.GetVersion() by @​justindbaur in #​8134
• [BRE-2158] Add MR label to _move_edd_db_scripts workflow by @​vgrassia in #​8145
• [PM-41451] Migrate Billing files off of AssemblyHelpers.GetVersion() by @​justindbaur in #​8135
• Extract Serilog file logging into Libraries/SerilogFileLogging by @​justindbaur in #​8149
• QA-2270: add OrganizationGroupScene to the seeder by @​awiester-bw in #​8150
• [BRE-2157] ci(build): Centralize Docker image tag sanitization by @​fntyler in #​8144
• [PM-33046] Drop obsolete ReadAbilities stored procedures by @​JimmyVo16 in #​7961
• Refactor Seeder Factories by @​theMickster in #​8152
• Add GlobalSettingsBridge library by @​justindbaur in #​8156
• [BRE-2116] Bump actions/checkout to v7.0.1 in non-privileged workflows by @​brandonbiete in #​8101
• Bump version to 2026.8.0 by @​github-actions[bot] in #​8179

📦 Dependency Updates

• [deps] Platform: Lock file maintenance by @​renovate[bot] in #​6336
• [deps]: Update Testcontainers to v4.13.0 by @​renovate[bot] in #​7776
• Server update sdk by @​justindbaur in #​8128
• [deps] Vault: Update AngleSharp to v1.5.2 [SECURITY] by @​renovate[bot] in #​8012
• nginx alpine bump by @​keithhubner in #​8147
• [SHOT-251] build: update Dockerfile to use Ubuntu 22.04 by @​mimartin12 in #​8195

Full Changelog: https://github.com/bitwarden/server/compare/v2026.7.2...v2026.8.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Mend Renovate CLI.