CLI v2026.10.1

What's Changed

Feature Development

• [PM-44108] perf: Add performance measurements to unlock and sync by @quexten in #23476
• [PM-42405] feat: Push feature flags from ConfigService.renewConfig by @coroiu in #23867

🐛 Bug fixes

• Bug/pm 13954/passwordboss json import by @adudek-bw in #22845
• [PM-42643 ] Tools-owned URL validation by @harr1424 in #23160
• fix(biometric-ipc): Address the CLI as its own IPC endpoint by @quexten in #23275
• PM-42338 folder assigned by @bmbitwarden in #23629
• [PM-44494] fix(biometrics): fix biometric id update enrollment despite failed biometrics by @quexten in #23646
• fix(export): fix v2 support for account restricted exports by @quexten in #23648
• Export V2 ciphers as data blob only by @quexten in #23750

⚙️ Maintenance

• [PM-38906] bulk decrypt collections with failures unstacked by @JaredScar in #22886
• PM-42720 implemented xxe guard by @bmbitwarden in #22896
• PM-42725 polynomial redos in enpass importer by @bmbitwarden in #22988
• PM-42723 resolved polynomial redos in chrome csv by @bmbitwarden in #23034
• PM-42722 resolved unbounded kdf parameters by @bmbitwarden in #23039
• [PM-28650] Add logout reason in all remaining cases by @trmartin4 in #23317
• [PM-40148] refactor: Read policies$ from accepted-or-confirmed state by @eliykat in #23354
• Auth/PM-44095 - Login Strategies TS Strict Refactor by @JaredSnider-Bitwarden in #23536
• Remove getKeyForCipherKeyDecryption by @quexten in #23591
• [PM-44362] Remove legacy Cipher.decrypt and domain decrypt methods by @quexten in #23592
• [PM-34414] Remove pm-34410-attachment-upload-progress feature flag by @nick-livefront in #23604
• Remove enroll-aead-on-key-rotation feature flagged code by @mzieniukbw in #23671
• [PM-40663] Exempt Bitwarden SDK from npm release-age filter by @addisonbeck in #23674
• [PM-27893] Remove force update KDF settings feature flag by @jlf0dev in #23693
• [PM-40663] Skip npm installs in Renovate to keep lock integrity by @addisonbeck in #23720
• [BRE-2193] Require label to run signed CLI builds for fork PRs by @michalchecinski in #23797
• [BRE-2324] Prevent SDK update PR from moving to an older SDK by @vgrassia in #23831
• [PM-42402] refactor: Resolve SdkService's cycle-forming dependencies lazily by @coroiu in #23861
• [PM-42404] refactor: Add the push API to the SdkService abstraction as no-ops by @coroiu in #23863
• [PM-24325] Remove pm-22134-sdk-cipher-list-view feature flag by @jaasen-livefront in #23872
• ci: Run Rust advisories outside the Rust lint gate by @coroiu in #23882
• ci: Make Rust lint blocking through the Lint gate by @coroiu in #23884
• Bump client version(s) by @github-actions in #23963

📦 Dependency Updates

• [deps] Platform: Lock file maintenance by @renovate in #21973
• Update sdk-internal to 0.2.0-main.1083 by @bw-ghapp in #23624
• Update sdk-internal to 0.2.0-main.1087 by @bw-ghapp in #23657
• Update sdk-internal to 0.2.0-main.1096 by @bw-ghapp in #23666
• [deps] Platform: Update nx to v22.7.10 [SECURITY] by @renovate in #23675
• Update sdk-internal to 0.2.0-main.1105 by @bw-ghapp in #23701
• Update sdk-internal to 0.2.0-main.1115 by @bw-ghapp in #23817
• Update sdk-internal to 0.2.0-main.1116 by @bw-ghapp in #23852
• Update sdk-internal to 0.2.0-main.1122 by @bw-ghapp in #23858
• Update sdk-internal to 0.2.0-main.1126 by @bw-ghapp in #23896

Full Changelog: cli-v2026.10.0...cli-v2026.10.1