• A passkey request on a page that was open while BW Lite was updated or reloaded now falls straight back to the browser's own passkey dialog instead of waiting for an answer that can't arrive.
• Separate manifests per browser: the Chrome build no longer carries the Firefox-only background.scripts key (which Chrome listed as an error), and the Firefox build no longer carries the service worker key.
• Releases are submitted to Firefox Add-ons and the Chrome Web Store by the Release workflow.
  -----BEGIN PGP SIGNATURE-----

iQJPBAABCAA5FiEEQ/I/9/FR1vHzXhEz8oMNjbyNjoYFAmrjSPcbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEPKDDY28jY6GuCAP/16Ltf2DA4zH4iH+4IS/
TdUOQz3qIe72qA4fqha/erXCa7SECp6nlbKbcdpeg7XCmT3U/9RNw6VoZJgWhnap
2DTlQAPKcxPLIYx3QQkxp7iVYL+jqdkfCjaK5NZwEkFXadxadbEk91yWpCkqUwSA
W68lKTtFiiSwzkVaK8PkD6sThlOwS6t6P5TaOuk0lvv3LQMnHnkwZmUGHzbskq+/
6rVub9pXWtFjxXAfjjK3x0N0W85vW2qNESmB5eD9B7rkkftQWwy1cfoo7vDc0rG7
V4hgzngBFqM8xyl6GHQKjrxwY29zl5GpR9iwuqwIAK9Kdd2eIbVCRtZnYsWGTuDB
VaVz6CdPc6AGygCyfxyJ4t1+wy3elA9raGqmPnov/PuC8PV5G5xMxpWQ3Gu5H4+x
cRgLW5nsmTzISgtisWdjVtq77cGxHEMxJ4drCHdjyLglqIGomi+K4cYkz64Ictow
mG9pehULD8/uAPKXmpKdiOP+eSf/X9P5N9nfx5H73q/XYpD+JRSIczaWil23Rr94
Dq4poCBQna2WXZZNQvnMJCDTtvt5TZk+JPYSyJ3zxw5ysqcWVe9hkjlmbQuHaAw8
m+yuznJ11eS+5ZszmwjjwgE1yYVCPTmz5/TaFcWE1eOe1/KdFvMMuasOMBP81vnC
j+j98YfQFj5GmwZrM1i0NuNF
=oxAC
-----END PGP SIGNATURE-----

Passkeys
- Firefox 140–152: passkey sign-in and save now complete; the answer no longer uses a message option those versions reject.
- Requests with unknown transport names or an empty pubKeyCredParams list are answered instead of handed to the browser (WebAuthn says to ignore unknown values), so a vault passkey is offered on more sites.
- Sites see a user-verifying platform authenticator, so they offer passkey creation on Linux and on Windows without Hello.
- The passkey window links to unlock when a vault is locked, keeps "Use device or security key" when the site's passkey is already saved, expires together with the page's request, cancels the request when closed, and is limited to one per tab.
- Sites that sign in through a related origin (for example facebook.com with the passkey saved under accounts.meta.com) are recognised via /.well-known/webauthn.

Vault
- "Add vault" with the server and email of an existing vault logs that vault in again in place, for after a master password or KDF change elsewhere; the 2FA "remember" token is kept; token refresh and unlock errors say what went wrong.
- Bitwarden's master password re-prompt and hidden passwords are honoured: re-prompt logins ask for the master password before they fill, copy or open, and stay out of the shortcut and the in-page menu.
- Only the private key and organization keys from the sync profile are kept on disk, not the whole profile.
- Network calls no longer hold the shared state lock, so pages don't wait on a popup sync.
- Editing a URL's text keeps its match type.

Autofill and saving
- The in-page menu ignores clicks when the page has hidden it (clickjacking), looks for fields in the focused form only, skips off-screen honeypot fields, and no longer reopens after a fill.
- Save offers survive a redirect to another subdomain and the service worker stopping between the two steps of a login.
- The background vault cache is rebuilt once per change instead of once per open tab.
- The store zip no longer ships the Public Suffix List source file.

Opening or unlocking the popup now syncs any vault last synced more than 5 minutes ago, in the background, so changes made in other Bitwarden apps (a new TOTP secret, a changed password) show up without pressing sync.