Web v2026.7.1

What's Changed

• Update policies UI
• Added new confirmation when deleting a passkey
• Updated 1Password importer to be more fault tolerant
• Updated send event logs copy
• Various under-the-hood improvements and minor bug fixes

💙 Community Highlight

• [PM-40131] fix(desktop): add Helium as Linux entry for NativeMessagingHosts by @0xk1f0 in #21748
• [PM-39030] Fix Proton Pass import of item custom fields by @archit-goyal in #21253
• [PM-19836] Add prefix to fastmail by @lucacome in #14105
• [PM-40685] Fix forwarder settings cache collision by @cyfrit in #21980
• [PM-39704] fix(send): restore increment/decrement buttons for max access count by @harikrishna2208 in #21527
• [PM-39593] reduce calls to nodeIsElement in query (and by extension queryAutofillFormAndFieldElements) by @datdenkikniet in #21498

Feature Development

• [PM-27060] feat: Call SDK for password prelogin by @ike-kottlowski in #21777
• [PM-39815] feat: Add linksEnabled to invite-link status response model by @r-tome in #21820
• [CL-1272] Support visually-hidden labels in bit-form-field by @willmartian in #21788
• [PM-39778] Fix subtitles when using sdk by @jengstrom-bw in #21591
• [PM-40286] - Add Vfo1TerminologyService and VFO1I18nPipe infrastructure by @nick-livefront in #21860
• [PM-40060] Use native messaging dialog in browser extension settings by @quexten in #21705
• [PM-37990] Add UriMatchDefaultPolicy components and stories by @JaredScar in #21827
• [PM-38519] Add AutoConfirmPolicy V2 component and associated templates by @JaredScar in #21828
• [PM-32384] Update copy new to create/add browser by @jengstrom-bw in #21524
• [PM-40194] - add shared-folder icon by @jaasen-livefront in #21801
• [PM-40283] Add v0.1.0 of the AppPairingData schema by @coltonhurst in #21814
• [PM-40195] feat: add shared-folder localization keys by @jaasen-livefront in #21832
• desktop-autofill: Add missing IPC methods by @iinuwa in #21775
• Add generic HEC (SIEM) event integration card by @maxkpower in #21445
• [PM-36007] Admin change email event logging by @BTreston in #21908
• [PM-27844] Set email on sync by @ike-kottlowski in #21349
• [CL-1273] Add bitMenuClose directive to decouple menu dismissal from ARIA roles by @willmartian in #21789
• [PM-40104] Relabel "New organization" → "New vault" on org-switcher affordance (web) by @nick-livefront in #21871
• [PM-32403] Update button copy desktop by @jengstrom-bw in #21528
• [PM-38929] Add new design for edit member dialog by @BTreston in #21843
• [INNO] - Passkey Report by @jrmccannon in #19787
• [CL-1285] create Storybook feature-flags addon in new @bitwarden/storybook lib by @willmartian in #21913
• [PM-37991] Implement Automatic App Login Policy v2 and associated components by @JaredScar in #21824
• [PM-38749] Add OrganizationInviteLinkApiService.updateSupportsConfirmation by @JimmyVo16 in #21933
• [PM-40381] Desktop Autofill Cancellation by @iinuwa in #21853
• [PM-10383] - confirm before deleting a passkey by @jaasen-livefront in #21497
• [PM-40193] feat: add vfo1Icon pipe for flag-gated icon swaps by @jaasen-livefront in #21876
• [PM-35093] feat: Support bitwarden-gov.com deeplink redirects on web connectors by @enmande in #21752
• [PM-40134] RoutedVaultFilterService accept a vaultId query parameter alongside organizationId by @jengstrom-bw in #21930
• [PM-40216] feat: Scope organization invite link lookups by organization ID by @r-tome in #21815
• [PM-35107] Remove Argon2Id option from UI in gov environment by @mzieniukbw in #21503
• feat(shared-unlock): support trusted devices by @quexten in #21895
• [PM-39997] desktop-autofill: Package Windows passkey plugin resources by @iinuwa in #21983
• [PM-39387] fix: Auto-sync premium status after returning from Stripe checkout by @cyprain-okeke in #21518
• [PM-38794] Add OrganizationInviteLinkApiService.getInvite by @JimmyVo16 in #21932
• [PM-40682] desktop-autofill: Graceful Windows plugin registration by @iinuwa in #21982
• desktop-autofill: Omit CTAP2 status code in assertion response by @iinuwa in #21978
• [PM-40381] desktop-autofill: FIDO2 UI cancellation by @iinuwa in #21906
• [CL-998] bit-table-v2 and related components by @willmartian in #20900
• [PM-40449] create lit cipher items and list by @dan-livefront in #21984
• feat(biometrics): add windows biometrics format based on sdk cryptography by @quexten in #21433
• [PM-40089] Show a banner in the vault view when Fill Assist is active for the current page by @jprusik in #21754
• [SM-1954] Show expiry status badge on access tokens list by @maxkpower in #20939
• Autotype AppData path normalization by @neuronull in #21910
• [PM-38813] - update offboarding survey by @jaasen-livefront in #21161
• [PM-40111] Rename Owner to Vault field by @nick-livefront in #21897
• Pm 38122 fastmail checkbox by @bmbitwarden in #21830
• feat(data-recovery): add detection of field decryption ciphers (#22065) by @quexten in #22074

🐛 Bug fixes

• [PM-40820] Fix add access filter toggle style by @BTreston in #21816
• [PM-16456] Add occupied seat count check when restoring user by @JaredScar in #21746
• [PM-33228] Add screen reader only to enhance a11y behavior by @BryanCunningham in #21563
• [PM-38940] Close Firefox/Safari Permissions-Policy gaps via webRequest by @bensbits91 in #21466
• [PM-39137] Gate Access Intelligence report reads on new-architecture flag by @Banrion in #21315
• [PM-16456] Add mock services for billing constraints to fix storybook by @JaredScar in #21833
• [PM-39992] Add support for SDK IPC unreachability by @quexten in #21653
• [PM-40303] Fix logout when underprivileged user accesses Manage Send policy by @harr1424 in #21836
• [CL-1277] Add disabled and readonly variants to Textarea story by @willmartian in #21851
• [PM-40377] Fix bug with form field to have textarea behave the same as an input when disabled by @jengstrom-bw in #21848
• [PM-39825] Fix URI reordering, drag handle alignment by @jaasen-livefront in #21697
• [PM-40444] Hide archive/unarchive from bulk bar in Admin Console by @nick-livefront in #21873
• [PM-40457] Fix typos in the message catalogs by @jprusik in #21882
• [PM-40370] Use decrypted ciphers cache when using SDK by @shane-melton in #21888
• [PM-40484] Fix Autotype IPC channel mismatch by @coltonhurst in #21885
• [PM-13643] Refactor user avatar rendering in bulk dialogs to utilize userId for correct color match by @JaredScar in #21884
• [PM-40236] Logging out throws error mid-logout due to a race condition. User left in locked state by @mzieniukbw in #21858
• Fix SSH Agent concurrent requests by @neuronull in #21881
• [PM-40446] Enhance AutoConfirmWarningDialog by adding LinkModule to imports by @JaredScar in #21883
• [PM-40482] Return to Default Filter After Revoking Last Staged User by @sven-bitwarden in #21911
• [PM-39948][PM-40406] Fix native select issues with dark mode and arrow click handling by @vleague2 in #21877
• [PM-13643] avatars in org member remove/revoke modal do not match members page fix by @JaredScar in #21931
• [AppSec] AI Fix for Template Injection in GitHub Workflows Action by @aikido-autofix[bot] in #21787
• [PM-40247] Fix vault item checkmarks disappearing after clearing a search by @nick-livefront in #21823
• [PM-40201] SSH key items with a null public key or fingerprint fail to decrypt and break the vault by @gbubemismith in #21778
• [PM-18638] Prevent collection/cipher creation for suspended organizations by @JaredScar in #21887
• [PM-40432] Update Send Event Logs copy by @harr1424 in #21890
• [PM-40502] communicate message extension payloads using symbol by @audreyality in #21909
• [PM-40188] Apply deletion date policy to CLI-created Sends by @mcamirault in #21845
• [CL-808] Support forced colors mode for form controls by @vleague2 in #21936
• [PM-40543] Default new SCIM connections to staged by @sven-bitwarden in #21963
• [CL-1282] use correct size for base icon tile by @BryanCunningham in #21856
• fix(desktop): guard will-navigate against renderer escape by @addisonbeck in #21935
• [PM-39845] Prevent Access Intelligence report freeze on oversized password values by @Banrion in #21987
• [PM-39772] Detect shadow hosts created from iframes by @bensbits91 in #21857
• [PM-40241] Bugfix - Rehydrate localData lastUsedDate on local cipher views by @jprusik in #21849
• [PM-40440] fix: Source upgrade cart total from server invoice preview by @amorask-bitwarden in #21902
• [PM-40375] Add per-item exception handling to 1Pux import by @harr1424 in #21941
• [PM-39464] Fix ExpressionChangedAfterItHasBeenCheckedError when assigning collections by @nikwithak in #21743
• fix(key-connector): fix sdk key-connector login not working by @quexten in #21957
• [PM-38557] Netwrix Password Secure importer should map URL-like fields to Bitwarden website URI by @harr1424 in #21889
• [PM-38189] Wire InitiationPath to Organizations to Correct Trial Metadata by @sbrown-livefront in #21769
• [PM-40771] Update policy enabled method to accept PolicyStatusResponse by @JaredScar in #21997
• fix: race condition leading to decryption errors by @quexten in #22063
• fix(desktop): use x11 clipboard by default and only use portal as fallback by @quexten in #22062
• [PM-24945] Fix bw send receive not recognizing --password parameter by @adudek-bw in #21872

⚙️ Maintenance

• Bump client version(s) by @github-actions[bot] in #21811
• Auth/PM-39905 - Restructure organization-invite into subfolders with barrel imports by @JaredSnider-Bitwarden in #21642
• Auth/PM-3813 - 2FA Management Endpoints - User Verification Refactor by @JaredSnider-Bitwarden in #21385
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #21648
• Fix/update CODEOWNERS by @djsmith85 in #21826
• [PM-37476] Source canUseAccessIntelligence from server UseRiskInsights ability by @AlexRubik in #21760
• [BRE-2044] Keep logic for bumping the Desktop version automatically in clients by @vgrassia in #21745
• [BRE-1907] Add artifact manifest to build-web.yml by @gitclonebrian in #21726
• [PM-40345] Ignore Storybook stories in code coverage by @Hinton in #21842
• [PM-40138] desktop-autofill: refactor Autofill IPC Registration by @iinuwa in #21753
• [PM-16487] Remove Add/edit v2 component by @jengstrom-bw in #21859
• [PM-39259] Migrate auth token key generation to SDK by @quexten in #21706
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #21649
• [PM-40456] Update cSpell settings by @jprusik in #21875
• [PM-39259] Remove deprecated randomBytes/aesGenerateKey/createKey by @quexten in #21713
• desktop-autofill: Move macOS-specific window position to macOS code by @iinuwa in #21852
• chore(biometrics): extract biometrics to separate crate by @quexten in #21822
• chore: rename biometric_v2 mod to biometric by @quexten in #21891
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #21903
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #21904
• [PM-34857] Remove PoliciesInAcceptedState feature flag by @eliykat in #21761
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #21905
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #21915
• [PM-36404] Refactor org guards for ts-strict by @BTreston in #21914
• [PM-39966] Migrate from @angular/platform-browser-dynamic to @angular/platform-browser by @djsmith85 in #21866
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #21966
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #21916
• chore(ci): skip platform-community signal for fork PRs by @addisonbeck in #21934
• desktop-autofill: Add missing Skunkworks codeownership by @iinuwa in #21907
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #21917
• [PM-40447] Create lit prompt component by @dan-livefront in #21892
• [PM-40688] Run prettier to fix failing lint after prettier upgrade by @dan-livefront in #21981
• chore: Add team-ai-sme as CODEOWNERS for .mcp.json by @SaintPatrck in #21985
• build: allow sdk-internal crypto crates in dependency tooling by @quexten in #21925
• refactor: gate desktop_native core allocator and windows deps by @quexten in #21926
• DN Autotype: Move mockall and serial_test to be Dev Deps by @coltonhurst in #21999
• refactor(login-strategy): clean up crypto-related functions and deprecation notices by @quexten in #21958
• [BRE-2118] Adding publish CLI workflow for NPM provenance by @pixman20 in #22014
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #22020
• docs(vault): document deprecation of TypeScript vault item decryption by @quexten in #22004
• Bump client version(s) by @github-actions[bot] in #22038
• Bump client version(s) by @github-actions[bot] in #22069
• [CL] mark bit-table-v2 as Beta in Storybook docs by @willmartian in #22072

📦 Dependency Updates

• Update sdk-internal to 0.2.0-main.897 by @bw-ghapp[bot] in #21718
• [deps]: Update GitHub Artifact Actions (major) by @renovate[bot] in #19586
• Pin NPM 11 on CLI builds by @dani-garcia in #21838
• [deps]: Update Rust by @renovate[bot] in #20390
• [deps] Platform: Lock file maintenance by @renovate[bot] in #21796
• [deps]: Update dtolnay/rust-toolchain digest to 4cda84d by @renovate[bot] in #21948
• feat(register-finish-request): Add sales_assisted_token to request by @enmande in #21961
• [deps] Platform: Update jest-preset-angular to v17 by @renovate[bot] in #21678
• [deps] Autofill: Update prettier to v3.9.5 by @renovate[bot] in #21668
• [deps] Platform: Update webpack-dev-server to v5.2.6 [SECURITY] by @renovate[bot] in #21972
• [deps]: Update cargo-deny to 0.20.0 by @renovate[bot] in #21952

🎨 Other

• [PM-39560] [BEEEP] Add MCP server configuration for Chrome and Electron DevTools by @quexten in #21483
• feat(llm): add claude note to make key-management aware of encryption related changes by @quexten in #21818

New Contributors

• @0xk1f0 made their first contribution in #21748
• @SaintPatrck made their first contribution in #21985
• @archit-goyal made their first contribution in #21253
• @lucacome made their first contribution in #14105
• @cyfrit made their first contribution in #21980
• @harikrishna2208 made their first contribution in #21527
• @datdenkikniet made their first contribution in #21498

Full Changelog: web-v2026.7.0...web-v2026.7.1