Bitwarden Server Version 2026.6.0

Overview

• Removed feature flag for consolidated session timeout component
• Removed feature flag for disabling type zero decryption
• Removed feature flag for migration of My Vault to My Items
• Removed feature flag for Send UI refresh
• Removed feature flag for unlocking with SDK
• Various under-the-hood improvements and minor bug fixes

What's Changed

:shipit: Feature Development

• [PM-26732] Remove Chromium ABE importer feature flag by @mcamirault in #7026
• [PM-34615] - add SuppressOnboardingInterstitials setting by @jaasen-livefront in #7516
• PM 35227 Extend checkout endpoint for browser/desktop platforms by @cyprain-okeke in #7550
• [PM-35948] Update send openapi to work for sdk by @adudek-bw in #7556
• [PM-35393] MasterPasswordService auth integration by @enmande in #7575
• [PM-35357] Update Trial Length Parameter by @sbrown-livefront in #7597
• [PM-27679] Remove flagged logic from server by @jengstrom-bw in #7612
• [PM-36359] Feature flag for Splunk integration by @voommen-livefront in #7622
• [PM-37237] Move OrganizationsNew into ProfileResponseModel by @eliykat in #7627
• feat(kdf-settings-validator): Enforce salt cannot be empty string. by @enmande in #7628
• [PM-35394] MasterPasswordService Admin Console Integration by @enmande in #7629
• Add PAM feature flag by @Hinton in #7641
• [PM-35656] Add Events for New Item Types by @nick-livefront in #7642
• [PM-36949] feat: Add OrganizationPlanMigrationCohort and Assignment tables with bare repositories by @amorask-bitwarden in #7644
• [PM-35830] Add ChangeEmailCommand by @ike-kottlowski in #7650
• [PM-37251] Add public invite link GET status endpoint by @r-tome in #7656
• [PM-35058] Adoption UX Improvements (feature flag) by @voommen-livefront in #7657
• [PM-38273] feat(admin-console): Add InjectOrganizationAttribute and OrganizationModelBinder by @JaredScar in #7659
• [PM-33951] feat(admin-console): Add bulk confirmation and pending auto-confirmation by @JaredScar in #7661
• [PM-37597] Set Automatic Tax and Prevent Tax Exempt Mutations by @sbrown-livefront in #7662
• [PM-37723] Add feature flag pm-28191-cipher-admin-ops-to-sdk by @nikwithak in #7664
• [PM-37064] feat: Add ScheduleBusinessPriceIncrease scheduler entry point by @amorask-bitwarden in #7665
• [PM-37593] Add OrganizationUserStatusTypeNew - Revoked by @sven-bitwarden in #7666
• [PM-37598] Update Tax Id Warning Logic with Feature Flag by @sbrown-livefront in #7677
• [PM-37068] feat: Add business plan cohort branch to UpcomingInvoiceHandler by @amorask-bitwarden in #7678
• [PM-36563] Send access event logs by @harr1424 in #7679
• [PM-36964] Add per-org migration cohort assignment to the Admin portal by @cyprain-okeke in #7681
• [PM-34776/PM-37797] Add invite link email domain validation endpoint by @r-tome in #7683
• [PM-28178] Remove Send UI refresh feature flag by @mcamirault in #7684
• [PM-37084] Business Aware Schedule Recovery and Cancellation by @sbrown-livefront in #7686
• [Shared Unlock] [PM-35083] Add shared unlock feature flags by @quexten in #7687
• [PM-31021] Resolve authoring exclusions by @jprusik in #7688
• [PM-37083] feat: Add per-phase price resolution to UpdateOrganizationSubscriptionCommand by @amorask-bitwarden in #7695
• [PM-37785] Add vault batch bar feature flags by @nick-livefront in #7696
• Add feature flag for SSH ecdsa by @neuronull in #7697
• [PM-37092] feat: Add business plan migration handler to SubscriptionUpdatedHandler by @cyprain-okeke in #7707
• [PM-31191] Move KDF from Auth to KM constants by @mzieniukbw in #7709
• [PM-29658]: Remove PUT Policy vNext by @sven-bitwarden in #7711
• [PM-27487] Remove disable-type-0-decryption feature flag by @jlf0dev in #7717
• [PM-27298] Remove consolidated-session-timeout-component feature flag by @jlf0dev in #7718
• [PM-37170] feat: Add churn-mitigation offer query, command, and API endpoints by @amorask-bitwarden in #7722
• refactor(server): consolidate cloud region config by @addisonbeck in #7728
• Migrate Web Frontend to Official Aspire JavaScript Hosting by @sbrown-livefront in #7731

Bug fixes

• [PM-35401] Update exception handling in CreateAuthRequestAsync() and PostAdminRequest() by @rr-bw in #7615
• [PM-37727] Fix exceptions when serialzing blob-encrypted ciphers by @nikwithak in #7667
• [PM-36678] Add custom user check by @JimmyVo16 in #7675
• [PM-37259] - Update Sso Request Validator by @jrmccannon in #7676
• SRE-4899 - update node 20 to 24 for admin project by @sneakernuts in #7685
• [PM-37820] Update Missing Tax Logic for US Customers by @sbrown-livefront in #7719
• [PM-38288] - Restore collections endpoint by @jaasen-livefront in #7738

Maintenance

• [PM-4128] Remove nullability of Send.Data and Send.Keys by @harr1424 in #7266
• Use fixture to share state between PushControllerTests by @justindbaur in #7433
• [PM-35066] - remove legacy collections endpoint by @jaasen-livefront in #7520
• [PM-13328] Move OrganizationCollectionManagementUpdateRequestModel to AC team by @eliykat in #7651
• PM-36952 - Improve code review workflow with added triggers by @theMickster in #7663
• Triggering main build to rebuild after cosign failure by @pixman20 in #7669
• [PM-37740] Add missing container configuration to aspire by @eliykat in #7670
• [PM-37486] Remove IPolicyService and associated dead code by @r-tome in #7672
• [PM-12469] Move remaining Admin Password Reset code to AC team by @eliykat in #7680
• [PM-25691] Create OrganizationUpdateCollectionManagementCommand by @r-tome in #7682
• [PM-37956] by @ike-kottlowski in #7698
• [PM-35312] Remove Outdated Stored Procedures by @sven-bitwarden in #7712
• [PM-34502] Remove the IPolicyValidator pattern by @JimmyVo16 in #7714
• refactor(server): move CloudRegion enum from Setup to Core by @addisonbeck in #7727
• docs: expand CACHING.md (non-Redis L2, sizing/cost, SRE coordination) by @withinfocus in #7736

Dependency Updates

• [deps]: Update dotnet monorepo to v10 (major) by @renovate in #6634
• [PM-35479] updating AutoMapper to v14 and adding cve workaround by @itsadrago in #7521
• [PM-36843] Skip relay push registration for non mobile clients by @justindbaur in #7617
• Bump version to 2026.5.0 by @github-actions in #7655
• [deps]: Pin dependencies by @renovate in #7703
• [deps]: Update aspire monorepo to 13.3.4 by @renovate in #7729
• Bump version to 2026.6.0 by @github-actions in #7747

Other

• Add passkey and password history to a subset of seeded credentials by @harr1424 in #7635
• Seeder/item type enhancements by @nthompson-bitwarden in #7694
• Seeder - add favorite for card, identity, secure note, and sshkey scenes by @nthompson-bitwarden in #7710
• [PM-38224] Add claimed domain functionality to seeder by @eliykat in #7735