Skip to content

v1.8.0 Deployment Control, Session Reliability, and Compatibility Fixes

Latest
Latest

Choose a tag to compare

View all tags
@shuaiplus shuaiplus released this 17 Jul 03:49
· 23 commits to main since this release
v1.8.0
39c076b

Added

  1. Web Vault visibility control. Cloudflare Workers deployments can now set HIDE_WEB_VAULT=1 to return 404 Not Found for server-hosted Web Vault pages and static assets while keeping Bitwarden login, sync, attachment, icon, notification, and compatibility endpoints available. Removing the variable restores the Web Vault, and already installed or cached PWAs can continue using their local frontend. Commit: d990b2c.

Improved

  1. Simpler desktop and mobile navigation. The Web Vault now uses a consistent grouped sidebar with persistent expanded sections, clearer separation between tools, settings, and system management, and matching mobile settings navigation. This removes the previous layout-mode picker and makes frequently used destinations easier to find. Commit: e25ec15.

  2. Safer YubiKey validation credential management. Yubico validation credentials now use centralized, concurrency-safe initialization; only active administrators can view or replace configured credentials, and credential initialization and reconfiguration are recorded in the security audit log. Regular users can still enroll YubiKeys without gaining access to server-wide credentials. Commit: 573451c.

  3. Bitwarden-compatible personal API keys and safer backups. Personal API keys can now be viewed after master-password verification and rotated without revoking unrelated sessions. Legacy hashed keys continue to authenticate until the user explicitly rotates them, while new backups exclude personal API keys and runtime authentication or device-trust state; older archives remain importable, but that runtime state is intentionally ignored during restore. Commit: 299eda5.

Fixed

  1. Unexpected logout during temporary refresh failures. Refresh sessions now use client-aware sliding lifetimes with an absolute upper bound, and transient network or service failures no longer turn a locked Web Vault into a forced full login. The Web Vault preserves the locked session, shows a retry path, and keeps official desktop, mobile, browser-extension, and web-cookie flows compatible. Commit: b731a01.

  2. Complete key data required for master-password changes. Password changes now reject incomplete or inconsistent authentication and unlock data, require the newly wrapped user key, and prevent KDF settings from being changed through the password-only endpoint. This avoids accepting a password update that could leave the account unable to decrypt its vault. Commit: 19de8d6.

  3. Extended vault item imports preserve their data. Web imports now correctly map bank accounts, driver's licenses, and passports instead of reducing item types 6-8 to incomplete generic drafts. Import summaries also report these item types by name. Commit: e943357.

  4. Reliable bulk folder deletion. Bulk folder deletion now calculates Cloudflare D1 bind limits correctly and batches the related cipher cleanup and folder removal statements safely, preventing large selections from failing or leaving partially updated folder references. Commit: 63b642b.

  5. Fresh remote backup directory listings. Opening a remote backup destination now automatically refreshes directory data when the saved cache is older than five minutes, so newly created backup files appear without requiring a manual refresh. Commit: 72d8ec9.

新增

  1. Web Vault 显示开关。 Cloudflare Workers 部署现在可以设置 HIDE_WEB_VAULT=1，让服务器托管的 Web Vault 页面和静态资源统一返回 404 Not Found，同时继续提供 Bitwarden 客户端所需的登录、同步、附件、图标、通知和兼容接口。删除变量即可恢复 Web Vault，已经安装或缓存的 PWA 仍可继续使用本地前端。提交：d990b2c。

改进

  1. 更简洁的桌面端和移动端导航。 Web Vault 现在统一使用分组侧边栏，并会保存各分组的展开状态；工具、设置和系统管理的层级更加清楚，移动端设置入口也同步调整。原有布局模式选择器已移除，常用功能更容易查找。提交：e25ec15。

  2. 更安全的 YubiKey 验证凭据管理。 Yubico 验证凭据现在通过统一且可防并发冲突的流程初始化；只有状态正常的管理员能够查看或替换服务器凭据，初始化和重新配置操作也会写入安全审计日志。普通用户仍可绑定 YubiKey，但无法接触服务器级凭据。提交：573451c。

  3. 兼容 Bitwarden 的个人 API Key 与更安全的备份。 用户现在可以在验证主密码后查看个人 API Key，并在不撤销无关会话的情况下轮换密钥。旧版哈希密钥在用户主动轮换前仍可继续认证；新备份不再包含个人 API Key、运行中的认证状态或设备信任状态，旧备份仍能导入，但其中这类运行时状态会被主动忽略。提交：299eda5。

修复

  1. 临时刷新失败导致意外退出登录。 刷新会话现在根据客户端采用滑动有效期，并保留绝对最长时限；临时网络或服务故障不会再把已锁定的 Web Vault 直接变成完整登录页。Web Vault 会保留锁定会话并提供重试入口，同时兼容官方桌面端、移动端、浏览器扩展和 Web Cookie 会话。提交：b731a01。

  2. 修改主密码时必须提交完整密钥数据。 密码修改接口现在会拒绝不完整或不一致的认证与解锁数据，强制要求新的用户密钥包装结果，并禁止通过仅修改密码的接口顺带更改 KDF 设置，避免出现密码已更新但保险库无法解密的账户状态。提交：19de8d6。

  3. 扩展保险库条目导入时完整保留数据。 Web 导入现在会正确映射银行账户、驾驶证和护照，不再把类型 6-8 转换为字段缺失的通用草稿；导入结果摘要也会按名称显示这些条目类型。提交：e943357。

  4. 可靠的批量文件夹删除。 批量删除文件夹时现在会正确计算 Cloudflare D1 的绑定参数上限，并安全批处理密码条目引用清理和文件夹删除语句，避免大量选择时失败或留下只更新了一部分的文件夹引用。提交：63b642b。

  5. 远端备份目录自动显示最新文件。 打开远端备份目标时，如果已保存的目录缓存超过五分钟，页面会自动获取最新数据，新生成的备份文件无需手动点击刷新即可出现。提交：72d8ec9。

Assets 2
Loading