Skip to content

v1.7.4 - Password Tools, Localization, and Security Hardening

Choose a tag to compare

View all tags
@shuaiplus shuaiplus released this 12 Jul 14:14
· 34 commits to main since this release
v1.7.4
b093c01

Added

  1. Built-in password generator. The web vault now provides a dedicated generator for creating strong, configurable passwords, including memorable passphrases backed by the EFF word list. Generated values can be used while creating or editing vault items without leaving the app. Commits: dfc9800, fb37679.

  2. Password security dashboard. A new password-security view scans the vault and reports weak, reused, exposed, and missing two-factor-authentication passwords, helping users prioritize account cleanup. Commit: 99b5027.

  3. Duplicate-item selection tools. Duplicate results are grouped by color and sorted alphabetically, and the vault now lets users select the unique items from a duplicate group for quicker review and cleanup. Commits: 0992170, 39d9df7.

  4. Five additional interface languages. Finnish, German, French, Italian, and Swedish are now available in the web vault, expanding the supported interface languages to ten. Commits: dd90d7b, 9caa064.

Improved

  1. Passkey unlock and Bitwarden-client compatibility. Account passkeys can now unlock the web vault directly, and supported FIDO2 origins, worker-routed fill-assist, Android asset-links checks, and web bootstrap paths are recognized more consistently. Commits: 8c65cb2, db31792.

  2. Clearer offline and Send experiences. The app now clearly indicates when it is operating offline, Send pages use improved date formatting, and closing dialogs retain their title through the animation to avoid a visual flash. Commits: aae614a, 04cb475, 525b773.

  3. Simplified new-device sign-in. New-device verification is no longer enforced, removing an extra login step for devices that are otherwise able to authenticate successfully. Commit: 14dff8e.

Fixed

  1. Backup destination SSRF protection. Backup destination validation now rejects IPv6 loopback addresses, closing a path that could otherwise bypass loopback-host safeguards. Commit: 3c581d1.

  2. Sensitive admin actions require the master password. Administrative operations and device-wipe actions now require master-password confirmation, reducing the impact of an unattended or compromised web session. Commit: fa611dc.

新增

  1. 内置密码生成器。 Web 保险库现在提供专用的密码生成器，可创建高强度且可配置的密码，也支持基于 EFF 词表的易记口令短语。生成的值可直接用于新建或编辑保险库条目，无需离开应用。提交：dfc9800、fb37679。

  2. 密码安全仪表板。 新增的密码安全视图会扫描保险库，并报告弱密码、重复密码、已泄露密码和缺少双因素认证的密码，帮助用户优先处理需要清理的账户。提交：99b5027。

  3. 重复条目选择工具。 重复项结果会按颜色分组并按字母顺序排序；保险库现在还可以从重复组中选择唯一条目，以便更快地审查和清理。提交：0992170、39d9df7。

  4. 新增五种界面语言。 Web 保险库现在提供芬兰语、德语、法语、意大利语和瑞典语，支持的界面语言扩展至十种。提交：dd90d7b、9caa064。

改进

  1. 通行密钥解锁和 Bitwarden 客户端兼容性。 账户通行密钥现在可以直接解锁 Web 保险库；同时，对受支持 FIDO2 来源、Worker 路由的 fill-assist、Android asset-links 检查和 Web 启动路径的识别更加一致。提交：8c65cb2、db31792。

  2. 更清晰的离线和 Send 使用体验。 应用现在会明确提示离线运行状态，Send 页面采用了更好的日期格式，关闭对话框时会在动画期间保留标题，避免视觉闪烁。提交：aae614a、04cb475、525b773。

  3. 简化新设备登录。 不再强制执行新设备验证，能够正常完成身份验证的设备无需额外登录步骤。提交：14dff8e。

修复

  1. 备份目标的 SSRF 防护。 备份目标校验现在会拒绝 IPv6 回环地址，堵住了可能绕过回环主机保护的路径。提交：3c581d1。

  2. 敏感管理员操作需要主密码。 管理员操作和设备擦除操作现在需要确认主密码，降低无人值守或会话遭入侵时的影响。提交：fa611dc。

Assets 2
Loading