Web v2026.10.0

What's Changed

• Improved unlock speed
• Improved Proton Pass imports to include more item types
• Fixed vault failing to load when certain SSH key items were present
• Fixed special characters being garbled in LastPass imports
• Various under-the-hood improvements and minor bug fixes

💙 Community Highlight

• [PM-42038] Add desktop biometric unlock support to the CLI by @nurfed1 in #22448
• [PM-43951] Add rotation icons (calendar, pause-circle, resume) by @reneelund08 in #23346
• [PM-42997] Clear policiesNew state when the sync response contains no policies by @tom27052006 in #22929
• [PM-42977] Added a length to the passphrase generated by @Jbziscool in #22906
• [PM-44145] [PM-24830] Add regression test for Chrome CSV note import by @MrSerWin in #23506
• [PM-44109] Fix: LastPass direct import corrupts non-ASCII characters (bullets, smart quotes) by @jaykaplon in #23481
• [PM-44235] Group 1Password import sources and add the direct import dialogs by @detunized in #23559

Feature Development

• [PM-42846] Wire up the invite link callout dialog by @BTreston in #23217
• [PM-43141] Introduce new import source component by @harr1424 in #23031
• Updated extension icon size by @trmartin4 in #23342
• [PM-38885] feat: Show sales rep contact message on sales-assisted trial banner by @cyprain-okeke in #23036
• [PM-40417] feat: Source the Premium to organization upgrade cart from the invoice preview by @cyprain-okeke in #23048
• [PM-44001] Add pm-43231-access-intelligence-performance-at-scale feature flag by @Banrion in #23366
• [PM-43143] Admin Console owned importer changes by @harr1424 in #23198
• feat(dev-ex): Add a debug launch script for the CLI by @quexten in #23273
• Autotype GA: port MVP type input and add execute_autotype by @neuronull in #23335
• [PM-43679] Adjust min-width so that long vendor names are truncated by @harr1424 in #23352
• [PM-43142] Vault owned importer changes by @harr1424 in #23197
• Updated icons with sized versions. by @trmartin4 in #23425
• [PM-42836] feat: Update the sponsored Families redemption page for VFO1 by @cyprain-okeke in #23304
• [PM-39106] Remove pm-34423-staged-status feature flag by @sven-bitwarden in #23422
• [PM-43756] Terminology/description change quickly for autofill policy by @JaredScar in #23363
• [PM-40421] feat: Preview-driven premium subscription page with applied-balance cart by @amorask-bitwarden in #23390
• [PM-43684] Show Decryption failures and dialog in VFO1 UX on Web by @shane-melton in #23298
• [PAM-242] Mount the PAM nav slot in the individual user layout by @Hinton in #23483
• [PM-39411] feat: Wire flight recorder into clients behind flag by @dani-garcia in #23448
• feat: Toast automation biometric requests and results by @quexten in #23482
• [CL-1316] feat: Make the vfo1 side nav logo header sticky on scroll by @BryanCunningham in #23339
• [PM-44120] Isolate Beta desktop keychain entries from stable by @trmartin4 in #23485
• [PM-41920] Add WiFi network and unknown item type handling to Proton Pass by @mcamirault in #23156
• [CL-1327] Remove rounded desktop corner from non-Mac OS by @vleague2 in #23498
• [PM-40550][PM-40553] Remove batch bar feature flags by @nick-livefront in #23456
• [PM-42229] Update accordion height to auto in shared folder card grid by @jengstrom-bw in #23561
• [PM-31298][PM-31299] Remove webauthn related origins feature flag by @djsmith85 in #23229
• [PM-43938] Call new organization collections endpoint behind performance flag by @Banrion in #23417
• [PM-44425] Add SDK-backed organization login cipher fetch to CipherService by @shane-melton in #23610
• [PM-43785] Login only organization cipher fetch for Access Intelligence by @Banrion in #23567

❗ Breaking Changes

• [PM-42019] SDK breaking change fix: pass collection type arg to SDK importer by @harr1424 in #23306
• PM-41073: Consume breaking changes from SDK making all children of CipherView decrypted by @nikwithak in #22245

🐛 Bug fixes

• [PM-42038] Gate CLI desktop biometric unlock behind a flag by @quexten in #23333
• [PM-42474] fix: validate initiator in auto-submit redirect handler by @bensbits91 in #23078
• [PM-43844] Remove extra space between Import and Add buttons in table header by @jengstrom-bw in #23341
• [PM-43945] Adds trimming/sanitization to frontend of sending invites to emails v… by @JaredScar in #23300
• [PM-43846] Prepopulate import dialog by @nick-livefront in #23345
• fix: track vault items table rows by cipher id to prevent icon flicker by @nick-livefront in #23256
• [PM-43777] Password Manager product switcher focus highlight gets stuck on by @jengstrom-bw in #23347
• [PM-43971] Hide callout if link is already configured by @BTreston in #23367
• [PM-43844] Move tw-hidden to coachmark component by @jengstrom-bw in #23391
• [PM-43728] VFO1 Item Id query param handling by @shane-melton in #23302
• [PM-43970] Work around for saving domains via the tour by @BTreston in #23388
• [PM-43841] Update URL terminology by @BTreston in #23364
• [PM-44114] Revert change detection by @BTreston in #23484
• [PM-44084] Utilizes the vfo name for success toast when the vfo1 foundation flag on by @JaredScar in #23460
• [PM-44040] fix: Remove period and em dash in My folders empty state by @gbubemismith in #23470
• [PM-44038] Move Add plan next to Subscription in settings nav by @jaasen-livefront in #23471
• [PM-44072] Drop the startup sync from desktop init by @quexten in #23447
• [PM-44071] Dedupe key state emissions by @quexten in #23446
• [PM-43947] Allow share when org settings allow owners/admins to manag… by @mcamirault in #23349
• [PM-44070] Emit feature flags only when their value changes by @quexten in #23445
• PM-39391 resolved flickering when toggling send rows by @bmbitwarden in #23328
• Auth/PM-40943 - Extension - Duo 2FA - Improve DuoResult Validation by @JaredSnider-Bitwarden in #23224
• PM-43842 changed folder label on import by @bmbitwarden in #23435
• [CL-1342] Independent Browser Filters by @nick-livefront in #23494
• [PM-42019] Fix import folder/collection count logic by @harr1424 in #23266
• PM-44046: bugfix: Decryption error is returned when the user leaves org by @nikwithak in #23496
• [PM-43358] fix: Fix account switcher badge icon spacing by @nick-livefront in #23578
• [PM-44197] Decrypt refreshed ciphers via CipherService by @quexten in #23542
• [PM-44222] Keep item URL params while the reprompt is open by @shane-melton in #23586
• [PM-44269] use native messaging for Safari biometrics when SDK IPC is on by @mzieniukbw in #23566
• [PM-44101] fix: Add truncate option to bitLink and truncate shared folder names by @nick-livefront in #23577
• [PM-41263][PM-41035] Add userId on auto-confirm method chain by @trmartin4 in #23428
• [PM-43786] perf(dirt): speed up exposed-password check at scale by @Banrion in #22853
• [PM-44516] Temporarily hide item history on item Sends (#23730) by @mcamirault in #23762

⚙️ Maintenance

• feat(desktop): Connect debug browser and desktop over native messaging by @quexten in #22914
• [PM-42469] communicate sender only through trusted channels by @audreyality in #23249
• [PM-43877] Changes UserStatusPipe to standalone component by @JaredScar in #23301
• [PM-43872] Remove ElectronCachedStorage flag by @dani-garcia in #23299
• [PM-43878] Fixes tech debt and moves away from modules into standalone usage by @JaredScar in #23303
• [CL-1354] Add contributing docs to libs/components by @willmartian in #23365
• chore(crypto): drop TS key connector; the master key and master-key-wrapped-user-key state by @quexten in #23207
• [PM-43919] Remove unused KeyApiService by @trmartin4 in #23376
• [PM-43879] Migrate GroupNameBadgeComponent to standalone and move off of module by @JaredScar in #23305
• refactor: Remove unused KeyConnectorUserKeyResponse by @quexten in #23329
• fillAssistRules url swap by @alex8bitw in #23209
• [PM-43929] Exclude core-js polyfills from Chrome extension build by @coroiu in #23433
• [PM-42900] Ts-strict refactor by @BTreston in #23219
• [PM-34691] Remove copy and quick launch actions feature flag by @jaasen-livefront in #23416
• Bump client version(s) by @github-actions[bot] in #23461
• Bump client version(s) by @github-actions[bot] in #23465
• [PM-25909] Commercial desktop builds by @dereknance in #18094
• [PM-43895] migrate domain verification components to standalone by @BTreston in #23457
• [PM-43894] Migrate providers list componet to standalone by @BTreston in #23459
• [PM-43884] Standalone migrations for ReportsHomeComponent by @JaredScar in #23493
• QA-2489/add-data-testid-bit-select-value by @ddanielyan in #23530
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23474
• docs: Deprecate format-internal fields on Cipher by @quexten in #23549
• [PM-42124] Move sass and sass-loader to be owned by UIF by @djsmith85 in #22488
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23473
• [PM-43880] VaultFilterComponent to standalone migration by @JaredScar in #23487
• [PM-43883] Make bulk components standalone by @JaredScar in #23492
• [PM-44130] Access Intelligence: Remove Add-Padding header for HIBP requests by @lastbestdev in #23500
• [BRE-2283] Use the supplied release notes verbatim for the Mac App Store by @pixman20 in #23537
• [BRE-2283] Remove the Mac App Store Fastfile now that deploy owns it by @pixman20 in #23557
• [PM-43942] Access Intelligence: Use stored icon URIs for loading application icons by @lastbestdev in #23421
• [PM-44196] Remove dead encryptObjProperty from CipherService by @quexten in #23541
• [PM-38193] Remove pm-29968-fill-after-save feature flag by @shane-melton in #23427
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23472
• Platform/PM-44117 - SDK client settings - Set device identifier by @JaredSnider-Bitwarden in #23539
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23574
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23576
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23575
• [PM-37683] Remove pm-32016-remove-at-risk-callout feature flag by @shane-melton in #23426
• [PM-31967] Remove pm-31039-item-action-in-extension feature flag by @shane-melton in #23429
• [PM-28191] - remove pm-28191-cipher-admin-ops-to-sdk feature flag by @jaasen-livefront in #23564
• Mute flaky filter menu story for now by @vleague2 in #23595
• [PM-28190] - remove pm-28190-cipher-sharing-ops-to-sdk from clients feature flag by @jaasen-livefront in #23563
• Tools/PM-44409 - CLI - Send Receive command - Add Device Identifier Header to send access token request by @JaredSnider-Bitwarden in #23607
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23614
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23615
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23616
• ci: Sign Windows Stable Appx by @iinuwa in #23600
• Sign Electron Framework files in parallel on macOS by @iinuwa in #23580
• [PM-41279] refactor: Remove pm-40435-quick-copy-icon-setting feature flag by @jaasen-livefront in #23613
• [PM-39412] refactor: Delegate renderer log write to super.write by @dani-garcia in #23495
• Bump client version(s) by @github-actions[bot] in #23647
• [BRE-2323] Use correct Safari build for each macOS build by @vgrassia in #23697
• [BRE-2234] Cherry-pick macOS provisioning profile and Safari artifact fixes to rc by @pixman20 in #23768
• [PM-44917] Cherry pick browser health OSS move by @ttalty in #23845

📦 Dependency Updates

• [PM-40862][PM-40850] deps: Update Angular build toolchain and Storybook to clear advisories by @BryanCunningham in #23294
• [deps] Update rustls to 0.23.45 (RUSTSEC-2026-0285) by @coroiu in #23375
• Update sdk-internal to 0.2.0-main.1046 by @bw-ghapp[bot] in #23370
• [deps] Platform: Update browserslist to v4.28.7 [SECURITY] by @renovate[bot] in #23449
• [deps]: Update actions/setup-node action to v7 by @renovate[bot] in #23453
• [deps] Vault: Update multer to v2.3.0 [SECURITY] by @renovate[bot] in #23451
• [deps] Platform: Roll back browserslist transitives to unblock npm ci by @mandreko-bitwarden in #23468
• [deps] Platform: Update Rust crate dirs to v7 by @renovate[bot] in #23516
• [deps]: Update dtolnay/rust-toolchain digest to 6bed076 by @renovate[bot] in #23509
• [deps] Platform: Update electron to v43.5.0 [SECURITY] by @renovate[bot] in #23560
• [deps] Platform: Pin electron's nested @types/node to 24.13.6 by @mandreko-bitwarden in #23570
• Update sdk-internal to 0.2.0-main.1066 by @bw-ghapp[bot] in #23430
• Update sdk-internal to 0.2.0-main.1068 by @bw-ghapp[bot] in #23590
• Update sdk-internal to 0.2.0-main.1073 by @bw-ghapp[bot] in #23599
• Update sdk-internal to 0.2.0-main.1074 by @bw-ghapp[bot] in #23612
• Update sdk-internal to 0.2.0-main.1075 by @bw-ghapp[bot] in #23621

🎨 Other

• [AI-94] llm: Let the SDK evaluation agent judge the baseline type check by @SaintPatrck in #23373

New Contributors

• @tom27052006 made their first contribution in #22929
• @Jbziscool made their first contribution in #22906
• @MrSerWin made their first contribution in #23506
• @ddanielyan made their first contribution in #23530
• @jaykaplon made their first contribution in #23481

Full Changelog: web-v2026.9.1...web-v2026.10.0