megachangelog
Feature2026.7.0

Web v2026.7.0

Bitwarden Web 2026.7.0 includes community contributions and new features such as stacked drawer support, bulk selection and batch operations for desktop, Windows passkey plugin improvements, new importers (KeePass KDBX and Keeper), enhanced policy management UI, and numerous bug fixes for stability and usability across web and browser extensions.

What's Changed

💙 Community Highlight

:shipit: Feature Development

🐛 Bug fixes

  • [PM-39746] Exclude search and select components from legacy global desktop css by @vleague2 in #21556
  • [PM-38262] Apply tolerant-validator pattern to V2 read path in Access Intelligence by @Banrion in #21474
  • [PM-38836] harden calculateSubFramePositioning by @audreyality in #21282
  • Fix SSH Agent v2 behavior before first unlock by @neuronull in #21273
  • [PM-18344] Remove XDG_CURRENT_DESKTOP Unity override to fix clipboard on wayland by @quexten in #21513
  • Revert "[PM-38760] Recursively create directory when writing manifest (#21141)" by @addisonbeck in #21568
  • [PM-39805] fix: Exclude permanent migration-grace machine accounts from billable count by @amorask-bitwarden in #21598
  • [PM-39841] Fix unlocking crashing the desktop app by @quexten in #21610
  • [PM-39780] Toast text is incorrect when editing collection access by @gbubemismith in #21601
  • [PM-39900] Enhance PoliciesComponent to clear drawer reference after closing by @JaredScar in #21639
  • [PM-39447] [Shared Unlock] Shared unlock stuck on lock component by @quexten in #21446
  • [PM-39060] Fix new org button not showing up by @BTreston in #21594
  • [PM-39556] Fix access selector not saving changes when the dialog field is modified by @BTreston in #21640
  • [PM-38763] Exclude sponsorship redemption from premium-to-org upgrade flow by @sbrown-livefront in #21180
  • [PM-36888] Do auto confirm when setting is enabled by @BTreston in #21614
  • [PM-39796] Fix bug in new Send dropdown component that prevented navigation after Send creation by @mcamirault in #21590
  • [PM-37489] Fixes issue where checkbox label does not enable checkbox by @JaredScar in #21657
  • [PM-39977] Fix broken shared unlock for browser-desktop in non-dev mode by @quexten in #21688
  • [PM-37196] Tooltip expand max-width by @JaredScar in #21646
  • [PM-39269] Fix At-Risk Members CSV export including extra columns by @AlexRubik in #21477
  • Revert "[Shared Unlock] [PM-34508] Default enable native messaging pe… by @quexten in #21687
  • [PM-39123] Fix members page filters flicker by @JaredScar in #21656
  • [PM-39570] use correct fill for bup logo by @BryanCunningham in #21694
  • Prevent connect to desktop in ipc background if native messaging permission is missing by @quexten in #21702
  • [PM-38896] Enhance DefaultCollectionService tests and improve decryption by @JaredScar in #21439
  • [PM-39349]] - make ssh key cipher fields readonly by @jaasen-livefront in #21505
  • [PM-39380] Bitwarden unencrypted JSON files containing cipher keys prevent import by @harr1424 in #21587
  • [PM-39695] Send fields are unexpectedly editable and changes cannot be saved by @harr1424 in #21542
  • [PM-39608] Update firefox NMHS permission for snap by @quexten in #21728
  • [PM-31138] Perform full sync on other clients after upgrade key rotation by @quexten in #21628
  • fix(vault): archive and unarchive missing from bulk bar for org items by @nick-livefront in #21741
  • [PM-7036] Add support for latest LogMeOnce CSV import format, add folder mapping by @mcamirault in #21473
  • [PM-39450] [Shared Unlock] Scan Secure Preferences when detecting installed Chrome extensions by @quexten in #21449
  • fix(unlock): Biometric unlock shows error dialog when cancelling by @quexten in #21731
  • [PM-39974] Remove Biometric Integration Setting Fully by @quexten in #21684
  • [PM-31068] Wire send SDK repository for edit/removePassword by @adudek-bw in #21579
  • [PM-38761] Fix hard-coded families plan price in revoke sponsorship dialog by @sbrown-livefront in #21243
  • [PM-39554] Create default collection when admin is demoted to user by @BTreston in #21632
  • [PM-39891] Fix edit member dialog badge by @BTreston in #21637
  • [PM-38595] Update local collections from server response by @BTreston in #21744
  • [PM-38771] - add missing i18n strings for button labels by @jaasen-livefront in #21509
  • [CL-1263] Increase active bottom navigation label font weight by @BryanCunningham in #21772
  • [PM-39218] Use global environment for self-hosted env dialog and SSO URL by @trmartin4 in #21723
  • fix(desktop): fix Firefox native messaging host manifest directory creation by @quexten in #21784
  • [PM-38392] Route password-protected Send saves through the SDK by @adudek-bw in #21725
  • fix(desktop): fix crash generating DuckDuckGo native messaging manifests by @quexten in #21783
  • [PM-39705] Edit Access Modal Does Not Display Members With Access When Going Through Bulk Actions by @gbubemismith in #21773
  • Render native form control UI in dark theme with color-scheme: dark by @maxkpower in #21771
  • fix(browser): Fix biometrics setup and connection issues by @quexten in #21782
  • [PM-40147] Fix Send page filters not appearing on browser by @harr1424 in #21759
  • fix(biometrics): Biometric unlock does not work over SDK by @quexten in #21730
  • [PM-38608] [PM-38560] Fix diacritic normalization and multi-word query handling in searchCiphersBasic by @nick-livefront in #21232
  • [PM-40820] fix style by @BTreston in #21821
  • [PM-38940] Cherry-pick to rc: Fix Permissions-Policy VULN-582 (#21466) by @bensbits91 in #21834
  • [PM-40303] Cherry-pick to rc: Fix user logout when missing permissions by @harr1424 in #21846
  • [PM-40236][RC] Logging out throws error mid-logout due to a race condition. User left in locked state by @mzieniukbw in #21869

⚙️ Maintenance

  • Bump client version(s) by @github-actions[bot] in #21554
  • Auth/PM-39619 - Rename AcceptOrganizationComponent to AcceptOrgDirectInviteComponent by @JaredSnider-Bitwarden in #21522
  • [PM-4439] Replace oidc-client-ts with oauth4webapi by @harr1424 in #20824
  • [PM-23485] Share types between autofill_provider and napi crates by @iinuwa in #18787
  • Bump client version(s) by @github-actions[bot] in #21580
  • Autosync Crowdin Translations for web by @bw-ghapp[bot] in #21508
  • [PM-39398] Refactor Vault Component back to OG naming by @JaredScar in #21569
  • [PM-35812] Remove feature flag by @JaredScar in #21567
  • build: Add arm64-only MacOS pack step by @iinuwa in #21588
  • [BRE-1533] Trigger Bitwarden Lite from web vault build by @vgrassia in #21605
  • introduce AutofillLifecycleService by @audreyality in #21530
  • [PM-9420] - add cipher$ observable to cipher service by @jaasen-livefront in #21383
  • [PM-28139] Remove V1 Linux Biometrics by @quexten in #21571
  • [CL-1258] Add NumberInput story to bit-form-field by @willmartian in #21692
  • Fix clippy lint by @iinuwa in #21691
  • [PM-39889] Acknowledge quick-xml advisory by @iinuwa in #21693
  • [PM-33362] Use signals for the app label by @coltonhurst in #21638
  • [CL-1261] Add date input form field story by @willmartian in #21695
  • [BRE-2044] Migrate Auto Bump Desktop Version workflow logic to the deploy repo by @vgrassia in #21641
  • SSH Agent v2: restructure the SignRequest by @neuronull in #21654
  • [BRE-2018] Add snapcraft compatibility note to electron-builder PRs by @brandonbiete in #21735
  • [PM-39259] Migrate FIDO2 credential id to SDK random by @quexten in #21712
  • [PM-39259] Migrate DuckDuckGo secure channel to SDK key generation by @quexten in #21711
  • [PM-39898] desktop_core: Don't compile objc when cross-compiling for non-macOS by @iinuwa in #21636
  • [PM-39259] Migrate key-management consumers to SDK key generation by @quexten in #21707
  • [PM-23485] Use strong types for autofill IPC request parsing by @iinuwa in #21737
  • chore(ci): add platform-community code-review signal by @addisonbeck in #21751
  • Tidy Desktop Autofill Service by @iinuwa in #21736
  • [PM-39427] feat: build Chrome beta extension by @trmartin4 in #21757
  • Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #21647
  • [PM-39259] Migrate vault export and generator to SDK random number client by @quexten in #21708
  • [PM-39259] Migrate risk-insights encryption to SDK key generation by @quexten in #21709
  • [PM-39427] feat: build desktop beta artifacts by @trmartin4 in #21758
  • [PM-35600] Update Password Request Models (Key Management) by @rr-bw in #20665
  • [PM-38210] Remove access-intelligence-trend-chart feature flag by @lastbestdev in #21376
  • test: add Gov region to parametrized environment service test suite by @addisonbeck in #21619
  • [PM-34458] Add release.yml to bitwarden/clients by @djsmith85 in #21732
  • refactor(desktop_native): extract secure_memory into its own crate by @quexten in #21780
  • Stop cosmetic mutations in light DOM from doing rebuild work by @blackwood in #21084
  • [PM-39259] Remove typescript cipherkey generation by @quexten in #21729
  • Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #21779
  • desktop-autofill: Move autofill services and models from platform team by @iinuwa in #21765
  • SSH Agent v2: add README by @neuronull in #21791
  • Bumped client version(s) (#21811) by @addisonbeck in #21817

📦 Dependency Updates

  • Address RUSTSEC-2026-0190 by @neuronull in #21558
  • [deps] Vault: Update form-data to v4.0.6 [SECURITY] by @renovate[bot] in #21279
  • [deps] Vault: Update multer to v2.2.0 [SECURITY] by @renovate[bot] in #21396
  • Bump client version(s) by @github-actions[bot] in #21644
  • Update sdk-internal to 0.2.0-main.870 by @bw-ghapp[bot] in #21482
  • Update sdk-internal to 0.2.0-main.872 by @bw-ghapp[bot] in #21651
  • [deps] Platform: Update Rust crate itertools to v0.15.0 by @renovate[bot] in #21674
  • [deps]: Update dtolnay/rust-toolchain digest to 4be7066 by @renovate[bot] in #21667
  • [deps] Platform: Update macOS/iOS bindings by @renovate[bot] in #20344
  • [deps]: Update codecov/codecov-action action to v7 by @renovate[bot] in #21409
  • [deps]: Update @napi-rs/cli to v3.7.2 by @renovate[bot] in #20121
  • [deps] Desktop Native: Update Rust crate mockall to v0.15.0 by @renovate[bot] in #21671
  • Update sdk-internal to 0.2.0-main.883 by @bw-ghapp[bot] in #21686
  • [PM-35903] Update clients to node 24 by @dani-garcia in #20400
  • chore(deps): move rand to KM Renovate ownership by @addisonbeck in #21719
  • [deps] UI Foundation: Update @storybook/test-runner to v0.24.4 by @renovate[bot] in #17854
  • Fix lockfile by @dani-garcia in #21763
  • [deps]: Update actions/cache action to v6 by @renovate[bot] in #21681
  • [deps] Platform: Update @types/node to v22.20.0 by @renovate[bot] in #21673

🎨 Other

New Contributors

Full Changelog: web-v2026.6.4...web-v2026.7.0

webdesktopbrowserfeaturesbug-fixespasskeys

Source: original entry ↗