Skip to content

Update SDK to 4.0.0-10242-e3cdc1ad - #7539

Open
bw-ghapp[bot] wants to merge 70 commits into
mainfrom
sdlc/sdk-update
Open

bw-ghapp[bot] wants to merge 70 commits into
mainfrom
sdlc/sdk-update

Conversation

@bw-ghapp

@bw-ghapp bw-ghapp Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Updates the SDK version from 4.0.0-9737-d9119f7a to com.bitwarden:sdk-android 4.0.0-10242-e3cdc1ad

Warning

Breaking changes detected :feelsgood:

What's Changed

Raw changelog
- [PM-42985] refactor: Adopt the wasm macros in the PAM crates (#1609)
- ci: Temporarily disable dylint style check (#1693)
- [PM-45931] Fix lock integration test login calls (#1692)
- ci: Run the fork PR breaking change check without running fork code (#1685)
- [PM-45738] Add writing-integration-tests Claude skill (#1677)
- [PM-44474] perf: Mark slow crypto on the performance timeline (#1569)
- [PM-40815] feat: Support AES-256-CBC-HMAC wrapping keys in SymmetricKeyEnvelope (#1616)
- ci: Reuse the workspace build for the pwsh integration tests (#1690)
- ci: Cache workspace build output in Rust tests (#1683)
- ci: Build less for native tests on Windows and macOS (#1691)
- [PM-45259] Adds a per-cipher HTTP authentication setting to logins (#1675)
- [PM-43033] feat: Map auto-confirm policy violation errors on invite link accept (#1688)
- [PM-45939] Include http_authentication_enabled in legacy cipher data (#1696)
- [PM-42946] Add Get Credentials Autotype IPC Channel (#1703)
- [BRE-2231] Download Swift release artifacts with actions/download-artifact@v8 (#1684)
- [PM-44516] Additional metadata for item-type Sends (#1587)
- [BRE-2393] ci: Move macOS workflows from macos-14 to macos-26 (#1713)
- [PM-46036] fix: Prevent PIN migration race condition (#1705)
- Update Identity bindings to 2028f0a5cc9d8ab8ff8475029085f29f81483598 (#1720)
- ci: Speed up the build and lint workflows with the build cache (#1704)
- [PM-41328] feat(organization-crypto): Add account recovery and organization shared key abstractions (#1687)
- [PM-39456] Update members' account recovery keys after their V2 upgrade (#1527)
- [PM-39456] feat(encrypted-migrator): Add the encrypted migrator and the account recovery v2 upgrade (#1695)
- Move core key_management under KM ownership (#1725)
- [PM-46140] feat: Add a list parameter that converts JavaScript arrays lazily (#1722)
- [PM-46109] Ask again for a wrong 1Password SSO verification code (#1716)
- [PM-45832] Add a live-server mode to the integration tests (#1709)
- [PM-45524] Test the 1Password SSO login end to end against a fake server (#1666)
- [PM-46243] [PM-46109] Wait out the check of a wrong 1Password SSO code before asking again (#1738)
- PAM-477: Let an approver revoke an approval with a reason (#1742)
- [deps] Platform: Lock file maintenance (#1430)
- [PM-39336] feat: Add wait_for_peer to wait until an IPC peer answers discover (#1701)
- [PAM-479] Give the PowerShell integration tests room for a slow host start-up (#1744)
- [PAM-479] PAM: ship the access connector as a manual install bundle (#1741)
- [PM-46038] feat: Store the PIN length (#1708)
- feat(crypto): add legacy compat symmetric key envelope (#1515)
- [PM-46030] Ship non-SIMD wasm alongside the SIMD build (#1745)
- [deps]: Update Rust to v1.99.0 (#1603)
- Move wasm and swift tests to e2e folder (#1746)
- [PM-46141] feat: Decrypt items from an iterator in batches (#1726)
- ci: Add non-blocking RustSec advisories check (#1743)
- [PM-42985] refactor: Adopt the wasm macros in autotype and member administration (#1735)
- [PM-44580] Delete deprecated invite link methods (#1714)
- Add assertion and naming rules to e2e test skill (#1749)
- [deps]: Update Rust crate darling to 0.24.0 (#1426)
- Update API bindings to 2028f0a5cc9d8ab8ff8475029085f29f81483598 (#1676)
- [deps] Platform (cargo): Update Rust crate serde_qs to v1 (#767)
- Update API bindings to 9e5b3ecdf0b27bc1b67a179d670bc3f628fc573e (#1764)
- [deps] Platform (npm): Update @openapitools/openapi-generator-cli to v2.42.0 (#1771)
- deps: Bump wasm-bindgen to 0.2.130 (#1766)
- [deps]: Update Rust crate inquire to 0.9.0 (#1773)
- [deps]: Update Rust crate rusqlite to >=0.37.0, <0.42 (#1775)
- [PAM-522] PAM: Active Directory target-system kind (#1779)
- [PAM-526] PAM: one bwac process per access connector token (#1782)
- Update API bindings to 1a0141664b10e8da58e63ce13f5f7f238b3a37b4 (#1778)
- [deps] Platform: Lock file maintenance (#1777)
- [PAM-528] PAM: rank a cipher whose rule refuses a request as unavailable (#1783)
- [deps] Platform (npm): Update @types/node to v26 (#1776)
- [PAM-542] (3-B1) Platform: route ldap3 updates to PAM (#1789)
- Add protocols folder with Verifpal CI (#1729)
- deps: Move RustCrypto crates to stable releases (#1786)
- Update Identity bindings to 5bf198b150280a604d0fdc5a889f9d895ad62311 (#1765)
- [PAM-564] (3-A2) PAM: Active Directory rotation in the access connector (#1793)
- [PM-31065] refactor: Replace settings with PersistedValue handles (#1633)
- [PM-46040] Split the e2e emulator's DTOs into one file per feature (#1787)
- [PM-41227] Add API for backfilling org key id (#1767)
- feat(crypto): decrypt type 7 EncStrings sealed with type 2 keys (#1753)
- [PM-45010] feat: Finish SSO JIT provisioning through new server endpoints (#1784)
- [PM-41227] Add e2e tests for org key id backfill (#1768)
- [PM-46142] feat: Decrypt cipher lists from JavaScript a batch at a time (#1721)

@bw-ghapp bw-ghapp Bot added automated-pr PR created by workflow or other automation t:deps Change Type - Dependencies labels Oct 28, 2026
@bw-ghapp
bw-ghapp Bot requested review from a team and david-livefront as code owners October 28, 2026 12:49
@github-actions github-actions Bot added app:password-manager Bitwarden Password Manager app context app:authenticator Bitwarden Authenticator app context labels Oct 28, 2026
@codecov

codecov Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 94.11765% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 86.85%. Comparing base (1e624ad) to head (44adedb).
⚠️ Report is 47 commits behind head on main.

Files with missing lines Patch % Lines
.../feature/vault/util/VaultAddItemStateExtensions.kt 66.66% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7539      +/-   ##
==========================================
+ Coverage   86.81%   86.85%   +0.04%     
==========================================
  Files         896      898       +2     
  Lines       65782    65230     -552     
  Branches     9407     9383      -24     
==========================================
- Hits        57108    56657     -451     
+ Misses       5188     5098      -90     
+ Partials     3486     3475      -11     
Flag Coverage Δ
app-data 19.02% <82.35%> (+0.29%) ⬆️
app-ui-auth-tools 18.75% <0.00%> (+0.12%) ⬆️
app-ui-platform 16.02% <0.00%> (-0.45%) ⬇️
app-ui-vault 27.01% <11.76%> (+0.07%) ⬆️
authenticator 6.06% <0.00%> (+0.04%) ⬆️
lib-core-network-bridge 4.16% <0.00%> (+0.03%) ⬆️
lib-data-ui 1.33% <0.00%> (+0.07%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@claude

claude Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Claude finished @bw-ghapp[bot]'s task in 6m 39s —— View job


SDK bump evaluated

4.0.0-9737-d9119f7a → 4.0.0-10242-e3cdc1ad — 70 commits in range.

Note: the PR title still says 4.0.0-10241-300aea59, but gradle/libs.versions.toml at HEAD (44adedb3d) is on 4.0.0-10242-e3cdc1ad. The evaluation covers the full range up to HEAD.

Method: evaluating-sdk-internal-updates Identify steps 1–7 against the local bitwarden/sdk-internal clone. Binding-surface crawl covered all 29 uniffi-bearing crates in the range (not just the -G annotation hits), classified per hunk, and every touched symbol was grepped across app and authenticator.

Compile-time breaks

None outstanding — ./gradlew app:compileStandardDebugKotlin authenticator:compileDebugKotlin is green at HEAD.

Two genuine breaks exist in the commit range; both were already absorbed by earlier commits on this branch:

sdk-internal change Break Android side
bitwarden/sdk-internal#1708 — pin_length: u32 added to the state_bridge! macro invocation #[uniffi::export(with_foreign)] callback interface gains three required methods (setPinLength / getPinLength / clearPinLength) — never additive-safe for the Kotlin implementor SdkStateBridge.kt:98-108, plus AuthDiskSource(.Impl) storage, UserLogoutManagerImpl preserve-on-logout, SettingsRepositoryImpl.clearUnlockPin
bitwarden/sdk-internal#1675 + bitwarden/sdk-internal#1696 — http_authentication_enabled on Login / LoginView (uniffi Records) New required constructor arg at every Kotlin construction site VaultSdkCipherExtensions.kt, VaultAddItemStateExtensions.kt, SyncResponseJson.kt

I verified the pin_length lifecycle against the SDK: backfill_pin_length only writes when the value is absent, so SettingsRepositoryImpl's clear-on-PIN-removal is required — the inline comment there is accurate.

Runtime considerations

None are defects; all are notes for whoever picks up the matching feature.

  • [PM-45010] feat: Finish SSO JIT provisioning through new server endpoints sdk-internal#1784 (SSO JIT provisioning) — postKeysForKeyConnectorRegistration gained acceptOrganizationInvite: Boolean?, carrying a UniFFI default(None) so Kotlin gets = null. AuthSdkSourceImpl.kt:84 keeps the default; None means "accept", i.e. unchanged behavior, and the new server path is gated behind pm-34429-invite-link-auto-confirm. Revisit when Android adopts auto-confirm.
  • [PM-41227] Add API for backfilling org key id sdk-internal#1767 (org key id backfill) — OrganizationDetails.key_id added with uniffi(default = None). SyncResponseJsonExtensions.kt:85 doesn't populate it, and the network Organization model has no keyId. Inert today: the backfill client (bitwarden-organization-crypto-management) is registered on bitwarden-wasm-internal only, so Android has no API to call. Needs wiring if/when the backfill lands on mobile.
  • [PM-46142] feat: Decrypt cipher lists from JavaScript a batch at a time sdk-internal#1721 / Account Switching with latest from master #1726 (batched list decrypt) — decryptList / decryptListWithFailures / decryptListFullWithFailures now propagate a new DecryptListError. UniFFI signatures are unchanged; Crypto maps to the same BitwardenError::Decrypt, and the InvalidInput arm is only reachable through the WASM LargeVec path. The only bitwarden-vault change is an added criterion benchmark. No Android-visible change.
  • [PM-46036] fix: Prevent PIN migration race condition sdk-internal#1705 (PIN migration race) — the opt-out disable_local_unlock_migrations is wasm_export-only, so it isn't on the Android surface. The race it guards is multiple concurrent SDK clients for one user, which Android doesn't do.
  • [PM-46038] feat: Store the PIN length sdk-internal#1708, storage location — PIN length is deliberately stored unencrypted by the SDK ("so a lock screen can read it while locked"). AuthDiskSourceImpl.storePinLength routes through BaseDiskSource.putInt, i.e. the plain prefs file, which matches that intent. Flagging only so the choice is on the record: PIN length is now recoverable from an unencrypted pref by anyone with file access.

Everything else in range — confirmed safe

Commit

No commit — nothing needed fixing. The branch already carries the fixes for both breaks in range, and the build is green.
· branch sdlc/sdk-update

@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9751-1789780d Update SDK to 4.0.0-9762-b8c41223 Oct 28, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9762-b8c41223 Update SDK to 4.0.0-9769-4d983d78 Oct 28, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9769-4d983d78 Update SDK to 4.0.0-9779-5c0b59ae Oct 28, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9779-5c0b59ae Update SDK to 4.0.0-9795-47f3a7f7 Oct 29, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9795-47f3a7f7 Update SDK to 4.0.0-9796-f2f05345 Oct 29, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9796-f2f05345 Update SDK to 4.0.0-9801-71794918 Oct 29, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9801-71794918 Update SDK to 4.0.0-9812-89119cd8 Oct 29, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9812-89119cd8 Update SDK to 4.0.0-9816-d7ab9964 Oct 29, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9816-d7ab9964 Update SDK to 4.0.0-9829-bae4427e Oct 29, 2026
bw-ghapp Bot added 2 commits October 29, 2026 14:41
The SDK bump to 4.0.0-9829-bae4427e adds LoginView.httpAuthenticationEnabled
(bitwarden/sdk-internal#1675). It defaults to null in the generated Kotlin, so
the build stayed clean, but toLoginView rebuilds a fresh LoginView from UI
state on every save and was dropping the field.

On the blob path the SDK seals this with unwrap_or(false), so sending null is
not "leave unchanged" — it writes false. Editing a blob-encrypted login on
Android would have silently turned off an HTTP authentication setting enabled
by another client. Android does not model the setting, so round-trip it from
the original cipher, matching autofillOnPageLoad.
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-9829-bae4427e Update SDK to 4.0.0-9838-404d3d4f Oct 29, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10165-2a588111 Update SDK to 4.0.0-10166-8a9566aa Nov 9, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10166-8a9566aa Update SDK to 4.0.0-10168-afc7f7f5 Nov 9, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10168-afc7f7f5 Update SDK to 4.0.0-10174-86bea6b5 Nov 9, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10174-86bea6b5 Update SDK to 4.0.0-10176-839c6ca0 Nov 9, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10176-839c6ca0 Update SDK to 4.0.0-10188-69bca2ad Nov 10, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10188-69bca2ad Update SDK to 4.0.0-10189-c5111daf Nov 10, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10189-c5111daf Update SDK to 4.0.0-10193-5582920a Nov 10, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10193-5582920a Update SDK to 4.0.0-10197-c04bc697 Nov 10, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10197-c04bc697 Update SDK to 4.0.0-10198-56b5ff13 Nov 10, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10198-56b5ff13 Update SDK to 4.0.0-10203-8e40e22e Nov 10, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10203-8e40e22e Update SDK to 4.0.0-10208-5bcc1260 Nov 10, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10208-5bcc1260 Update SDK to 4.0.0-10214-15db6b9f Nov 11, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10214-15db6b9f Update SDK to 4.0.0-10217-8d6a6715 Nov 11, 2026
@bw-ghapp bw-ghapp Bot changed the title Update SDK to 4.0.0-10217-8d6a6715 Update SDK to 4.0.0-10228-187a3470 Nov 11, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

app:authenticator Bitwarden Authenticator app context app:password-manager Bitwarden Password Manager app context automated-pr PR created by workflow or other automation t:deps Change Type - Dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants