What bitwarden/server shipped
Generated by FoxPlug from public activity — not affiliated with Bitwarden.
Week of September 14, 2026
What shipped
- Version 2026.9.0 released with organization delete tasks, event integration dead letter retention, and Fido2 v4 upgrades. Release
- Dead letter retention added for event integrations to prevent unbounded queue growth. Pull request #8364
- Secrets versioning implemented with feature flag gating and event logging for restore operations. Pull request #8307
- Fido2 v4 migration completed with Base64UrlSchemaFilter extended across all required properties. Pull request #8071
- Invited member collection and group access scoped to organization to prevent cross-organization access. Pull request #8347
- Encrypted string validation enhanced to check byte lengths of IV and MAC pieces at API boundary. Pull request #8328
- Email notifications added for collection approvers when access requests require decisions. Pull request #8290
- Email notifications added for requesters when their access requests are approved or denied. Pull request #8291
- Email notifications added for lease holders when operators revoke their access. Pull request #8292
- File ID validation added to reject manipulated file ID values from clients. Pull request #8326
Why it matters
Version 2026.9.0 ships critical infrastructure improvements for event handling and security validation, along with the completed Fido2 v4 migration and secrets versioning feature. Access control scoping fixes close authorization gaps, and a new PAM email notification system enables stakeholders to stay informed about access request decisions.
Changelog entry
- Version 2026.9.0 Release
- Secrets versioning with event logging and feature flag gating Pull request #8307
- Dead letter retention for event integrations Pull request #8364
- Fido2 v4 migration with Base64UrlSchemaFilter extended to all required properties Pull request #8071
- Invited member collection and group access scoped to organization Pull request #8347
- Encrypted string validation for IV and MAC piece byte lengths Pull request #8328
- File ID validation to reject manipulated values Pull request #8326
- Collection group and member access scoped to organization Pull request #8329
- PAM access notification mailer infrastructure Pull request #8289
- Email notifications for collection approvers on pending access requests Pull request #8290
- Email notifications for requesters on access request decisions Pull request #8291
- Email notifications for lease holders on access revocation Pull request #8292
- Deprecated Admin Console API endpoints removed Pull request #8342
- Service Bus application-cache broadcast removed in favor of ExtendedCache Pull request #8349
- Global lease duration ceiling raised to one year with enforcement Pull request #8378
- Send invite response type declared in OpenAPI spec Pull request #8283
- Send invite ability for staged users with configurable options Pull request #8281
Bitwarden Server 2026.9.0 is live. Secrets versioning, Fido2 v4, dead letter retention for event integrations, access control scoping fixes, and PAM email notifications.
Bitwarden Server 2026.9.0 is now available. This release includes secrets versioning with feature flag gating, completed Fido2 v4 migration, dead letter retention for event integrations to prevent queue growth, access control scoping fixes for invited members and collections, enhanced encrypted string validation, and a new PAM email notification system for access request decisions.