Version 2026.4.1

Overview

• Removed feature flag for automatic member confirmation settings
• Removed feature flag for unlock with passkey
• Removed feature flag for SCIM refactor
• Various under-the-hood improvements and minor bug fixes

What's Changed

Feature Development

• [PM-34595] Add provider authorization attributes by @eliykat in #7389
• [PM-34230] server side constant for feature flag by @voommen-livefront in #7395
• Add SDK Sends API feature flag by @adudek-bw in #7254
• [PM-34177] Add feature flag for Organization Invite Links by @r-tome in #7404
• [PM-34177] Fix feature flag key value for Organization Invite Links by @r-tome in #7409
• [PM-34171] Add card scanner feature flag by @SaintPatrck in #7310
• PM-34686 Remove Summary Count Limit by @prograhamming in #7398
• [PM-32105] - Org ability feature flag by @jrmccannon in #7401
• [PM-33213] Remove FeatureFlag Around ResetPassword && PolicyRequirements by @sven-bitwarden in #7188
• [PM-32394] Implement Scim V2 features by @JaredScar in #7397
• [PM-34694] - add quick actions feature flag by @jaasen-livefront in #7412
• [PM-34146] Add GetManyConfirmedAcceptedByUserIdAsync(Guid userId) to the IPolicyRepository interface by @JimmyVo16 in #7392
• [PM-34178] Add entities, repository and database migrations for Organization Invite Link feature by @r-tome in #7407
• [PM-31894] remove storage reconciliation job and flags by @kdenney in #7424
• [PM-26383] Remove feature flag from server-side for autoconfirm by @JaredScar in #7402
• [PM-34805] Add new feature flag for Policy Drawers (pm-34804) in Constants.cs by @JaredScar in #7429
• [PM-34147] Add GetManyConfirmedAcceptedDetailsByUserAsync to IOrganizationUserRepository by @JimmyVo16 in #7399
• [PM-34500] Add PM-34500-strict-cipher-decryption feature flag by @nikwithak in #7387
• [PM-35072] Allow account recovery for revoked status users by @kspearrin in #7446
• [PM-34854] Add pm-34145-policies-in-accepted-state feature flag by @eliykat in #7449
• [PM-31941] Implement Feature Flag and Access Intelligence Refactor Integration by @Banrion in #7459
• [PM-34500] Fix Feature Flag pm-34500-strict-cipher-decryption name casing by @nikwithak in #7460
• [PM-30751] - add secure SSRF protection for internal IPs by @jaasen-livefront in #7256
• [PM-31909] Remove m3 flagged logic by @connerbw in #7352
• [PM-31911] Remove m3 flag definition by @connerbw in #7354
• [PM-34825] Add support for ml-dsa44 keypairs by @quexten in #7435
• [PM-31780] Add exempt from billing automation toggle by @amorask-bitwarden in #7438
• [PM-32068] - Org Ability Extended Cache by @jrmccannon in #7443
• [PM-33866] Revocation Reasons: DDL Edition by @sven-bitwarden in #7432
• chore: remove bulk reinvite and org accept init flags by @vincentsalucci in #7484
• Auth/Innovation/PM-4517 - Device Management - Add Last Activity Date by @JaredSnider-Bitwarden in #7302
• [PM-34060] Add bank account item type by @gbubemismith in #7112
• [PM-35154] collection SDK decryption feature flag to Constants.cs by @JaredScar in #7470
• [PM-34595] Update provider controllers to use authz attribute by @eliykat in #7450
• [PM-24927] Add payment optional support to trial initiation flow by @cyprain-okeke in #7418
• [PM-32069] Add ExtendedProviderAbilityCacheService by @JimmyVo16 in #7447
• PM-22228 Added Phishing events by @voommen-livefront in #7427
• [PM-32853] Add Trial Initiation Metadata for Marketing or Product by @sbrown-livefront in #7462
• feat(validation): [PM-32626] by @Patrick-Pimentel-Bitwarden in #7064
• [PM-32073] - Added Bulk Get Org Ability by @jrmccannon in #7476

🐛 Bug fixes

• [PM-22525] Log when provider admin accesses an org vault by @BTreston in #7379
• [PM-34679] Display Phase 2 prices and discount on org subscription page by @amorask-bitwarden in #7393
• [PM-34679] Fix Families 2019 Phase 2 price and discount display by @amorask-bitwarden in #7408
• PM-34391 fixes to eventsController by @voommen-livefront in #7405
• [PM-34728] Use top-level ProrationBehavior on schedule updates by @amorask-bitwarden in #7410
• [PM-33500] - delete attachments from deleted ciphers by @jaasen-livefront in #7208
• fix(change-email): [PM-34742] Change Email Sets Salt by @Patrick-Pimentel-Bitwarden in #7413
• [PM-34773] Fix storage addition during active Phase 2 of schedule by @amorask-bitwarden in #7420
• [PM-34255] - SCIM Api Key Fix by @jrmccannon in #7403
• fix(refactor): [PM-34246] Rename Set Password to Finalize Onboarding by @Patrick-Pimentel-Bitwarden in #7328
• Revert "fix(change-email): [PM-34742] Change Email Sets Salt" by @Patrick-Pimentel-Bitwarden in #7421
• PM-33194 single integration of a type only by @voommen-livefront in #7280
• [PM-22450] Bump Collection.RevisionDate on edits and access changes by @r-tome in #7380
• [PM-26043] Fix bug: can't add secrets manager to legacy plans by @kdenney in #7414
• [PM-22450] Bump date on migration script file CollectionBumpRevisionDateOnAccessChange by @r-tome in #7436
• [PM-33301] Add Functionality for Upgrading Using PayPal by @sbrown-livefront in #7183
• [PM-34866][PM-34865] Fix EnableAutomaticTaxAsync to update schedule phases by @connerbw in #7437
• Fix test clock awareness in schedule-aware cancellation by @connerbw in #7440
• Fix CollectionUsers/CollectionGroups table names for Seeder across all DB providers by @mimartin12 in #7441
• [PM-32463] Remove organization enabled filter from database query/view by @shane-melton in #7037
• Auth/PM-34130 - Fix DeviceAuthDetails constructor and stored procedure for EDD compliance by @JaredSnider-Bitwarden in #7416
• [PM-34390] - Fixing Group/Provider User by @jrmccannon in #7431
• [PM-33539] Fix wrong model response type for file model size by @quexten in #7474
• [PM-35234] Prevent appending duplicate org user in validator request by @BTreston in #7486
• [PM-34427] Fix Users can edit and save sends with the hide email address option enabled by @harr1424 in #7511

⚙️ Maintenance

• [PM-34456] Innovation Sprint: Enable generating automated release notes by @djsmith85 in #7362
• [FIX] Image tag max length logic by @gitclonebrian in #7396
• [PM-29152] Rename VNextSavePolicyCommand to SavePolicyCommand and remove deprecated policy interfaces by @r-tome in #7364
• test(change-email): [PM-34742] Change Email Sets Salt Attempt 2 by @Patrick-Pimentel-Bitwarden in #7422
• [PM-34383] Add import validation allowing providers to perform imports by @harr1424 in #7394
• [PM-33044] Provider Ability Refactor EventService by @JimmyVo16 in #7411
• [PM-34823] Remove missed uses of PolicyRequirements flag by @eliykat in #7426
• [deps]: Update docker/login-action action to v4 by @renovate[bot] in #7346
• [deps]: Update docker/setup-qemu-action action to v4 by @renovate[bot] in #7223
• [deps]: Update codecov/codecov-action action to v6 by @renovate[bot] in #7455
• BRE-1004 - Add write packages permission by @vgrassia in #7457
• [BRE-1004] Fix container image push logic by @vgrassia in #7464
• [deps]: Update actions/create-github-app-token action to v3 by @renovate[bot] in #7345
• [deps]: Update dtolnay/rust-toolchain digest to 29eef33 by @renovate[bot] in #7341
• [deps]: Update docker/setup-buildx-action action to v4 by @renovate[bot] in #7222
• [BRE-1533] Update trigger for Bitwarden lite builds by @vgrassia in #7479
• [BRE-1670] replace PAT tokens with app token by @AmyLGalles in #7434
• Add dev tags back to GHCR for US-DEV by @vgrassia in #7492
• [PM-35150] Make Setup testable and add test for install by @justindbaur in #7445
• [PM-35235] Make PUT Policy identical to PUT Policy/VNext by @sven-bitwarden in #7485
• chore: remove leftover implied reference to create default location ff by @vincentsalucci in #7499

📦 Dependency Updates

• [deps] Billing: Update swashbuckle-aspnetcore monorepo to 10.1.7 by @renovate[bot] in #7008
• [deps] Billing: Update Kralizek.AutoFixture.Extensions.MockHttp to 2.2.1 by @renovate[bot] in #6556
• [deps] DbOps: Update Microsoft.Data.SqlClient to v7 by @renovate[bot] in #7344
• [deps] DbOps: Update dbup-sqlserver to v7 by @renovate[bot] in #7218
• [deps]: Update webpack to v5.105.4 by @renovate[bot] in #7007

🎨 Other

• [PM-31144] Edit Families 2019 renewal email subject by @sbrown-livefront in #7406
• Add SeederApi PlayData delete scheduled job by @MGibson1 in #7281
• Auth-owned PRs for minor/patch updates for their dotnet monorepo deps by @trmartin4 in #7451
• Add scenario docs for Seeder adoption and trim CLI reference by @theMickster in #7456
• [BRE-1413] Empty commit to test hash change in Canary by @pixman20 in #7471
• [BRE-1823] Bumping hash for canary testing by @pixman20 in #7497
• [BRE-1823] Bumping hash for canary testing by @pixman20 in #7498

Full Changelog: v2026.4.0...v2026.4.1