# changelog

author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.32.5
    * Fix undisclosed CVE.
    * Fix if logic error by @BlackDex in #5171
    * More authrequest fixes by @dani-garcia in #5176
    * Add dynamic CSS support by @BlackDex in #4940
    * fix hibp username encoding and pw hint check by @BlackDex in #5180
    * Remove auth-request deletion by @BlackDex in #5184
    * fix password hint check by @stefan0xC in #5189
    * don't infer manage permission for groups by @stefan0xC in #5190
    * Some more authrequest changes by @dani-garcia in #5188
    * Support SSH keys on desktop 2024.12 by @dani-garcia in #5187
    * Fix Org Import duplicate collections by @BlackDex in #5200


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.32.6
    * Fix push not working by @BlackDex in #5214
    * Fix editing members which have access-all rights by @BlackDex in #5213
    * chore: fix some comments by @chuangjinglu in #5224
    * Fix another sync issue with native clients by @BlackDex in #5259
    * Some Backend Admin fixes and updates by @BlackDex in #5272


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.32.7
    * feat: mask _smtp_img_src in support string by @tessus in #5281
    * Some refactoring, optimizations and security fixes by @BlackDex in #5291
    * Allow adding connect-src entries by @BlackDex in #5293
    * Use updated fern instead of patch by @BlackDex in #5298


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.33.1
    * Add inline-menu-positioning-improvements feature flag by @Ephemera42 in #5313
    * Fix issues when uri match is a string by @BlackDex in #5332
    * Add TOTP delete endpoint by @Timshel in #5327
    * fix group issue in send_invite by @stefan0xC in #5321
    * Refactor the uri match fix and fix ssh-key sync by @BlackDex in #5339
    * Add partial role support for manager only using web-vault v2024.12.0 by @BlackDex in #5219
    * Fix issue with key-rotate by @BlackDex in #5348
    * fix manager role in admin users overview by @stefan0xC in #5359
    * Prevent new users/members to be stored in db when invite fails by @BlackDex in #5350
    * rename membership and adopt newtype pattern by @stefan0xC in #5320
    * Fix an issue with login with device by @BlackDex in #5379
    * improve admin invite by @stefan0xC in #5403
    * Add manage role for collections and groups by @BlackDex in #5386
    * Security fixes by @BlackDex in #5438
    * only validate SMTP_FROM if necessary by @stefan0xC in #5442
    * hide already approved (or declined) auth_requests by @stefan0xC in #5467
    * let invited members access OrgMemberHeaders by @stefan0xC in #5461
    * Make sure the icons are displayed correctly in desktop clients by @WinLinux1028 in #5469
    * Fix passwordRevisionDate format by @BlackDex in #5477
    * add and use new event types by @stefan0xC in #5482
    * Fix Duo Field Names for Web Client by @ratiner in #5491
    * Allow all manager to create collections again by @BlackDex in #5488


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.33.2
    * fix CVE-2025-24898 by @dfunkt in #5538
    * add bulk-access endpoint for collections by @stefan0xC in #5542
    * Fix icon redirect not working on desktop by @BlackDex in #5536
    * Show assigned collections on member edit by @BlackDex in #5556


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.34.1
    * Implemented new registration flow with email verification
    * Added support for some feature flags (mutual TLS, attachment export, AnonAddy/SimpleLogin self host)
    * Update crates & fix CVE-2025-25188 by @dfunkt in #5576
    * Fix db issues with Option<> values and upd crates by @BlackDex in #5594
    * allow CLI to upload send files with truncated filenames by @stefan0xC in #5618
    * Use subtle to replace deprecated ring::constant_time::verify_slices_are_equal by @Timshel in #5680
    * Add support for mutual-tls feature flag by @bennettmsherman in #5698
    * Add AnonAddy/SimpleLogin self host feature flag by @PseudoResonance in #5694
    * Implement new registration flow with email verification by @dani-garcia in #5215
    * Some fixes for the new web-vault and updates by @BlackDex in #5703
    * Fix invited user registration without SMTP by @Timshel in #5712
    * Updates and general fixes by @BlackDex in #5762
    * On member invite and edit access_all is not sent anymore by @Timshel in #5673
    * respond with cipher json when deleting attachments by @stefan0xC in #5823
    * feat: add feature flag export-attachments by @tessus in #5784
    * Fix Yubico toggle by @Timshel in #5833
    * Fix minimum Android version for self-host email alias feature flags by @PseudoResonance in #5802
    * feat: add ip address in logs when email 2fa token is invalid or not available by @tessus in #5779
    * Add totp menu feature flag by @moodejb123 in #5850
    * Remove Hide Business scss rules by @Timshel in #5855
    * Toggle providers using class by @Timshel in #5832
    * Remove old client version check by @Timshel in #5874
    * web-client now request email 2fa by @Timshel in #5871
    * Update admin interface by @BlackDex in #5880
    * Sync with Upstream by @BlackDex in #5798


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.34.3
      fix css to hide login with passkey by @stefan0xC in #5890
      fix css for locked screen by @stefan0xC in #5905
      Some small admin updates by @BlackDex in #5909
      Fix and improvements to password policies by @Timshel in #5923
      make css for login-page position independent by @stefan0xC in #5906
      allow signup for invited users by @stefan0xC in #5967
      fix account recovery withdrawal by @stefan0xC in #5968
      Fix an issue with yubico keys not validating by @BlackDex in #5991
      Misc Updates and favicon fixes by @BlackDex in #5993
      Update flags version and enable manual error reporting by @dani-garcia in #5994
      Use existing reqwest client for AWS S3 requests by @txase in #5917
      Fix v2025.6.x clients and newer to delete items by @BlackDex in #6004
      fix hiding email as 2fa provider by @stefan0xC in #6026
      Hide login form custom fields by @Timshel in #6054
      fix: resolve group permission conflicts with multiple groups by @DasCanard in #6017
      fix account key rotation by @stefan0xC in #6105


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.35.1
      Fix multi delete slowdown by @BlackDex in #6144
      Perform same checks when setting kdf by @Timshel in #6141
      SSO using OpenID Connect by @Timshel in #3899
      Fix Email 2FA for mobile apps by @dfunkt in #6156
      Fix several more multi select push issues by @BlackDex in #6151
      Fix WebauthN issue with Software Keys by @BlackDex in #6168
      Make database connection pool dynamic by @Samoth69 in #6166
      Fix Webauthn/Passkey 2FA migration/validation issues by @BlackDex in #6190
      refactor(config): update template, add validation by @tessus in #6229
      Show SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION in admin by @Timshel in #6235
      Fix panic around sso_master_password_policy by @Timshel in #6233
      make webauthn more optional by @stefan0xC in #6160
      Fix 2fa recovery endpoint by @BlackDex in #6240
      prevent changing collections when hide_passwords is true by @stefan0xC in #6278
      Fix sso_user dropped on User::save by @Timshel in #6262
      Change OIDC dummy identifier by @Timshel in #6263
      add new billing warnings endpoint by @stefan0xC in #6369
      Add auth_request pending endpoint by @Timshel in #6368
      Fix Org identifier by @Timshel in #6364
      add mail address change warning for invited accounts by @stefan0xC in #6377
      add missing media-src directive by @stefan0xC in #6381
      add seat limit for the invite dialog by @stefan0xC in #6371
      Use Diesels MultiConnections Derive by @BlackDex in #6279
      Improve protected actions by @dani-garcia in #6411
      Fix issue with key-rotation and emergency-access by @BlackDex in #6421
      Fix KDF Change with new web-vault by @BlackDex in #6458
      Fix: admin theme emoji alignment by @joepduin in #6459
      remove invalid emergency access dummy value by @stefan0xC in #6463
      Add pm-25373-windows-biometrics-v2 feature flag by @Ephemera42 in #6468
      Fix icon redirect caching by @BlackDex in #6487
      Fix around singleorg policy by @Timshel in #6247
      fix email as 2fa provider by @stefan0xC in #6473
      Add option to prefer IPv6 resolving by @BlackDex in #6494
      Org.put_policy type not in body anymore by @Timshel in #6514
      Android want response property in camelCase by @Timshel in #6513
      Fix admin invite with SSO by @Timshel in #6498
      Improve sso auth flow by @Timshel in #6205
      fix email as 2fa for sso by @stefan0xC in #6495
      add empty /api/tasks endpoint by @stefan0xC in #6557
      Revert to gzip compression by @dfunkt in #6566
      support UriMatchDefaults policy by @stefan0xC in #6570
      Add new accountKeys and masterPasswordUnlock fields by @dani-garcia in #6572
      Add UserDecryption on /sync too by @dani-garcia in #6574
      Fix posting cipher with readonly collections by @BlackDex in #6578
      Add wrapped named variants to UserDecryptionOptions by @dani-garcia in #6598
      Try old refresh token if we fail to decode jwt by @dani-garcia in #6629


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.35.2
      return no content with status code 204 by @stefan0xC in #6665
      allow MasterPasswordHash for Android by @stefan0xC in #6673
      improve sso callback path by @stefan0xC in #6676
      Fix web-vault version check by @BlackDex in #6686


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.35.3
      Fix User API Key login by @BlackDex in #6712
      use email instead of empty name for webauhn by @stefan0xC in #6733
      hide password hints via CSS by @stefan0xC in #6726
      fix email as 2fa with auth requests by @stefan0xC in #6736
      refactor: improve tooltips in diagnostics page by @tessus in #6765
      Empty AccountKeys when no private key by @Timshel in #6761
      fix error message for purging auth requests by @stefan0xC in #6776
      Fix org-details issue by @BlackDex in #6811


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.35.7
    hide remember 2fa token by @stefan0xC in #6852
    fix(send_invite): invite links by @proofofcopilot in #6824
    Misc organization fixes by @BlackDex in #6867
    apply policies only to confirmed members by @stefan0xC in #6892
    Feat(config): add feature flag for Safari account switching by @DerPlayer2001 in #6891
    fix: add ForcePasswordReset to api key login by @montdidier in #6904
    Add Webauthn related origins flag to known flags. by @pasarenicu in #6900
    Add 30s cache to SSO exchange_refresh_token by @Timshel in #6866
    Add cxp-import-mobile and cxp-export-mobile: feature flags on mobile by @phoeagon in #6853
    Misc updates and fixes by @BlackDex in #6910
    Support new desktop origin on CORS by @dani-garcia in #6920
    Fix apikey login by @BlackDex in #6922
    Fix email header base64 padding by @BlackDex in #6961
    Update Feature Flags by @BlackDex in #6981
    Fix 2FA Remember to actually be 30 days by @BlackDex in #6929
    Rotate refresh-tokens on sstamp reset by @BlackDex in #7031
    Fix empty string FolderId by @BlackDex in #7048
    Fix Send icons by @BlackDex in #7051
    prevent managers from creating collections by @stefan0xC in #6890
    Change SQLite backup to use VACUUM INTO query by @getaaron in #6989
    Handle SIGTERM and SIGQUIT shutdown signals. by @0x484558 in #7008
    Do not display unavailable 2FA options by @0x484558 in #7013
    Fix logout push identifiers and send logout before clearing devices by @qaz741wsd856 in #7047


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 1.36.0
    SSO fallback to UserInfo preferred_username by @Timshel in #7128
    Dummy identifier need to pass for a guid by @Timshel in #7154
    add new /identity/accounts/prelogin/password by @stefan0xC in #7156
    Add DuckDuckGo browser device type by @dfunkt in #7147
    Fix hardcoded sso identifier by @Timshel in #7157
    Fix Host/IP resolving by @BlackDex in #7162
    Several SSO Fixes by @BlackDex in #7163
    Add support for archiving items by @matt-aaron in #6916
    Fix favicon fetching to check all icon links instead of just the first one by @Shocker in #6880
    Replace organization_uuid unwrap with proper error handling by @xjohnyknox in #6936
    fix: return Err instead of panic on unknown cipher atype in to_json() by @mango766 in #7068
    Allow SQLite to be linked against dynamically by @ISSOtm in #7057
    Dummy org Master password policy auth fix by @Timshel in #7097


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2024.5.1b
    * Generate unique SP entity IDs with the SAML for SSO configuration
    * Increased import item quantity maximum
    * Allow bulk item collections management in the Admin Console
    * Added onboarding for new users
    * Bug fixes and small improvements
    * Small bug fixes and enhancements
    * disable org seat limit validation by @stefan0xC in #171
    * Strip query params when resolving subpath by @Timshel in #170


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2024.6.2b
    * disable org seat limit validation by @stefan0xC in #171
    * Strip query params when resolving subpath by @Timshel in #170
    * Updated input labels when configuring Duo to reflect new values
    * Updated left hand navigation to include switching between products
    * New collection management setting that configures Owner and Admin permissions to collections
    * Many components migrated to Tailwind
    * Fixed issue with email alias provider keys being stored in plaintext
    * Other small bug fixes and enhancements


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2024.6.2c
    * hide organization plans again by @stefan0xC in #177
    * backport master password verification support by @stefan0xC in #179


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2025.1.1
    * Added new device management section to web app for approving login requests
    * Can now generate SSH keys
    * Dependency updates, small bug fixes, and other small enhancements
    * Updated styles for a more approachable and modern design
    * Added new ‘view’ modal for items. Items no longer open in ‘edit’ modal.
    * Added new item type for SSH keys
    * Improved security of memory management when locking or logging out
    * Added new sorting options to organization collection management
    * Added new import options
    * Updated flow for verifying bank account payment method
    * Revert the passphrase minimum back to 3 words
    * Security update for generating passphrases
    * Renamed menu actions for improved clarity
    * Added sort options to exposed password report
    * Added Member Access report
    * Many components migrated to Tailwind
    * Add password generator to password-protected export option
    * Add support for users to set a master password when their organization updates member decryption options
    * Added support for multi-thread encryption to improve performance
    * Updates to password policy for improved clarity
    * Passkeys now keep encryption capability following account encryption key rotation
    * Updates to two-step login setup
    * Updated vault view table responsiveness


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2025.5.0
    * Dependency updates, small bug-fixes, and enhancements
    * Added SSO External ID to member dialog
    * Update encryption key rotation to preserve Trusted Devices
    * Added .zip export format to include attachments in individual export
    * Added Microsoft Edge import option
    * Added additional console logging when unlocking
    * Updated UI for two-step login with security keys
    * Added location to login with device requests
    * Added banner to web vault for pending login with device requests
    * Made devices table responsive to new login with device requests
    * Refreshed UI for most login flows
    * Updated item UI when viewing items from reports
    * Updated flow for recovery code to log user in
    * Added opt-out for new device login protection
    * Improved performance for exposed passwords reports
    * Bug-fix for TOTP not generating


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2025.7.1
    * Added importer support for Password depot
    * Performance improvements for member access report
    * Renamed “remove individual vault” policy to “enforce organization data ownership”
    * Dependency updates, small bug-fixes, and enhancements
    * Added logging for which transport method is in use for notifications
    * Removed support for users with no userkey


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2025.12.1
    * Re-implemented UI for recovering old attachments
    * UI tweaks when joining a Key Connector organization
    * Updated navigation and policy naming for import and export to provide greater consistency
    * Web app now enforces new session timeout policy configurations
    * Small performance improvement when logging in
    * Various under-the-hood improvements and minor bug fixes.
    * Fixed an issue where Access Intelligence displayed for organizations without the feature enabled.
    * Access intelligence is now generally available
    * Removed beta label from login with passkey feature
    * Release fixes export button failure on Member Access Report page.
    * Updated vault behavior for users subject to organization data ownership policy
    * Updated behavior when logging in when SSO is required
    * Added more event logs for machine accounts
    * Added error message for incorrect two-step login recovery code
    * Updated collection management settings for organizations
    * Improved search speed
    * Improved autofill menu positioning logic in the Safari browser extension to keep it displayed above other content on the page
    * Show website icons when viewing an item
    * Added new policy to disallow saving credit card items


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2026.1.1
    * Users can now unlock with passkey
    * Update name and interaction for enabling Centralize organization ownership policy
    * Bug-fix for at risk password warning not disappearing
    * Various under-the-hood improvements and minor bug fixes
    * Added the ability to export the organization members list
    * Updates to Send UI


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2026.2.0
    * Bug-fix for import of passkeys from Bitwarden .json export
    * Various under-the-hood improvements and minor bug fixes
    * fix(importer): improve Buttercup CSV import mapping
    * fix(importer): preserve protected KeePass custom fields as hidden fields
    * fix(vault): preserve card brand when editing existing card
    * Support importing SSH keys from 1pux


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2026.4.1
    * Updated exit survey options
    * Fix an issue with how avatar color selections are stored to fix a crash with some Android devices.
    * Flagged code - users belonging to auto-confirmation orgs cannot issue or accept emergency access invitations
    * Organized policies into categories
    * Consolidated Send policies
    * Added support for deeplink redirect with https schema
    * Various under-the-hood improvements and minor bug fixes
    * Admins can now enable automatic confirmation of new members
    * Updated welcome experience for new users
    * Users subject to the organization data ownership policy will now be prompted to transfer their My Vault items to My Items
    * Sends can now use generated passwords
    * UX improvements for bulk re-invite flow in Admin Console
    * UX improvements for Access Intelligence
    * Send tab now hidden for members subject to the Remove Send policy
    * Added email protected Sends
    * Added background upgrade of KDF settings for accounts below allowed minimums
    * Added prompt to upgrade KDF settings for accounts below allowed minimums
    * Updated loading state UI for access intelligence
    * Updated UI for individual subscription page
    * Improved individual subscription page handling of edge cases
    * Core cryptography improvements to master password salt


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2023.5.0
    * Updated interface for selecting self-hosted environment
    * Bug fix for displaying “Input required” error before entering master password at login
    * Bug fix for Emergency Access invite when logging in with SSO
    * Bug fix for email two-step login with SSO


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2023.8.2
    * Add SSO with trusted devices
    * Expand import page on My Vault to support importing into folders or collections
    * Update Send tab UI components
    * Update Tools tab UI components
    * Update server selector copy
    * Update url for subscription management
    * Update “New” button to allow creation of folders and collections
    * Login with device enabled for self-host
    * Bug fixes


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2023.10.0
    * Allow administrators to manage and delete collections from the individual vault
    * View and edit login items with passkeys saved to them
    * Add support for self-hosting email alias generators
    * Add support for 1Password .json import
    * Bug fix for Duo hardware keys
    * Added password history to Bitwarden export
    * Accessibility improvement for fingerprint-phrases
    * Update AnonAddy to addy.io
    * Security fixes
    * Bug-fix for password re-prompt
    * Bug-fix for Duo prompt
    * Make region button and dropdown/dialog more accessible
    * Bug fixes


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2023.12.0
    * Add prompt to set master password when user logs in with new permissions
    * Bug fix for users with custom permissions import to organization
    * Bug fix for link to item when logging in with SSO
    * Bug fixes


author: Julian Röder <obs@masgalor.de>
changelog:
  - Update to version 2024.1.2
    * Login with passkey
    * Added password complexity checks to password protected export
    * Disallow XXE in import
    * Upgrade paths available for all organization types
    * Bug-fixes for imports
    * Big-fix for minimum/maximum values in generator
    * Bug-fix for screen-readers not announcing stored passkeys
    * Bug-fix for billing contact field for reseller-managed organizations
    * Bug-fix for saving items without a URI


