Shipped · APIs and backends

What bitwarden/server shipped

The public repository of Bitwarden · github.com/bitwarden/server

Written by FoxPlug from the repository's own releases; not affiliated with Bitwarden. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/bitwarden/server; Bitwarden did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

Follow server's weekly shipped digest

Week of October 5, 2026

What shipped

Why it matters

This week leans on access control: group creation, cipher creation, the admin cipher endpoint and account recovery all got tighter checks, so callers can no longer reach collections or data they should not. Billing and trial behavior also improved, with the annual upgrade offer no longer cutting a trial short, and WebAuthn-migrated YubiKeys working for two-factor login again. The PAM work continued landing through cipher leases, notifications and the access audit API.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: group creation, cipher creation, the admin cipher endpoint and account recovery all got stricter access checks. Trial stays alive when redeeming the annual upgrade offer. U2F-migrated YubiKeys work for 2FA again. PAM gained cipher leases, notifications and an audit API

Post for LinkedIn

This week's server changes focus on access control and billing correctness. Creating a group now validates collection access like updating one does, cipher creation checks collection permissions, the admin cipher endpoint no longer authorizes custom roles via the org-wide collection check, and account recovery no longer trusts a caller-supplied data protection sentinel. On billing, redeeming the annual upgrade offer during a free trial no longer ends the trial and invoices a full period, and that fix was cherry-picked to the release branch. Two-factor login works again for YubiKeys registered as U2F and migrated to WebAuthn. PAM work continued with cipher lease APIs and a commercial gate, access notifications, and an access audit API.

Week of September 28, 2026

What shipped

Why it matters

This week includes new API endpoints for organizations to retrieve filtered cipher and collection data, improvements to policy enforcement and deletion restrictions, and expanded integrations with Teams channels. Several deprecated feature flags were removed and infrastructure changes improve reliability of seeding and testing systems.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V2026.9.2 ships with new org endpoints for collections and login ciphers, Teams channel selection, invoice previews, improved item deletion policies, and multiple infrastructure improvements.

Post for LinkedIn

Bitwarden v2026.9.2 adds new organization API endpoints for accessing collections and login ciphers with detailed metadata, enables Teams integration to post to specific channels, includes invoice preview functionality for purchases, strengthens item deletion policy enforcement, and resolves several infrastructure reliability issues.

Week of September 21, 2026

What shipped

Why it matters

This week includes security fixes for collection access validation and Teams/Slack integrations, new SCIM 2.0 discovery endpoints for enterprise compliance, and billing infrastructure improvements for PAM and subscription preview features. Configuration flexibility was added for dead letter queue cleanup and email template tooling was modernized.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: SCIM 2.0 discovery endpoints for Microsoft Entra eligibility, fixed collection access validation, Teams integration TenantId support, and security updates for billing and SSO error handling.

Post for LinkedIn

New in Bitwarden server: SCIM 2.0 discovery endpoints (ServiceProviderConfig, Schemas, ResourceTypes) now available for RFC 7643/7644 compliance and Microsoft Entra App Gallery eligibility. Also shipped: fixed collection access validation to prevent invalid permission combinations, Teams integration TenantId requirement, configurable dead letter queue cleanup intervals, and security improvements for billing and SSO error disclosure.

Week of September 14, 2026

What shipped

Why it matters

Version 2026.9.0 ships critical infrastructure improvements for event handling and security validation, along with the completed Fido2 v4 migration and secrets versioning feature. Access control scoping fixes close authorization gaps, and a new PAM email notification system enables stakeholders to stay informed about access request decisions.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Bitwarden Server 2026.9.0 is live. Secrets versioning, Fido2 v4, dead letter retention for event integrations, access control scoping fixes, and PAM email notifications.

Post for LinkedIn

Bitwarden Server 2026.9.0 is now available. This release includes secrets versioning with feature flag gating, completed Fido2 v4 migration, dead letter retention for event integrations to prevent queue growth, access control scoping fixes for invited members and collections, enhanced encrypted string validation, and a new PAM email notification system for access request decisions.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-10-13.

Is this your repo? Ask us to remove this page.