Update SDK to 3.0.0-8288-99ffb6ef - #7254

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.12%. Comparing base (8842524) to head (0f488bd).

@@            Coverage Diff             @@
##             main    #7254      +/-   ##
==========================================
- Coverage   86.31%   86.12%   -0.19%     
==========================================
  Files         921      894      -27     
  Lines       66443    65297    -1146     
  Branches     9794     9782      -12     
==========================================
- Hits        57347    56235    -1112     
+ Misses       5592     5560      -32     
+ Partials     3504     3502       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

Using this PR to test #7251. There will some force pushes to trigger ci and reset the branch, as well as comments and commits by Claude.

Claude finished @bw-ghapp[bot]'s task in 7m 30s —— View job

SDK bump evaluated

com.bitwarden:sdk-android 3.0.0-8157-eb825d59 → 3.0.0-8288-99ffb6ef, traversing 10 intermediate SDK builds (8227, 8232, 8244, 8246, 8262, 8263, 8264, 8265, 8277, 8288). The PR body enumerates 15 sdk-internal commits up to 519a1a68 (8277); the tail 519a1a68..99ffb6ef (8277 → 8288) is not described in the body — and that is where the break below came from.

Method note: this session's Bash allowlist blocks git -C <sibling>, git fetch, and ./gradlew, so I could not run the skill's git log OLD..NEW scan or a local compile. Instead I read the sibling clone directly via file tools (it is checked out at exactly 99ffb6ef, verified via .git/refs/heads/main) and used this PR's own Test run as the compile signal. Because I could not enumerate the tail commits mechanically, the "confirmed safe" list below covers the 15 changelog commits plus a direct symbol-by-symbol check of the Android-facing binding surface at the new ref.

Compile-time breaks

Found and fixed — Repositories record lost two fields.

bitwarden_pm::create_client_managed_repositories! (crates/bitwarden-pm/src/migrations.rs:30) now lists only cipher, folder, local_user_data_key_state, organization_shared_key, send. UserKeyStateRepository and EphemeralPinEnvelopeStateRepository are gone from the repo entirely — so the UniFFI-generated com.bitwarden.sdk.Repositories record no longer has userKeyState or ephemeralPinEnvelopeState constructor parameters.

Android call site — app/.../sdk/SdkRepositoryFactoryImpl.kt:42 and :46:

e: SdkRepositoryFactoryImpl.kt:42:13 No parameter with name 'userKeyState' found.
e: SdkRepositoryFactoryImpl.kt:46:13 No parameter with name 'ephemeralPinEnvelopeState' found.

This failed :app:compileStandardDebugKotlin, which cascaded into every downstream shard (app-data, app-ui-vault, app-ui-platform, app-ui-auth-tools, static-analysis). Those two errors were the only Kotlin errors reported in :app main, so the rest of the binding surface — including all 9 state_bridge! fields on SdkStateBridge and the has() method on the repository traits — is compiler-confirmed intact.

Fixed by deleting the two now-nonexistent named arguments. Android passed null for both, so nothing is lost. The authenticator and lib-* shards failed only at Generate coverage report (codecov step), not at Run tests — unrelated to this bump.

Also verified: the pre-existing fix on this branch (42c5258, openOrgInvite = null) is correct. UserMasterPasswordRegistrationRequest.open_org_invite is an Option<RegistrationFinishOpenOrgInviteData> with no uniffi(default = None) (post_keys_for_user_password_registration.rs:81), hence required in Kotlin, and Android has no open-org-invite registration flow. That file even carries a TODO PM-41828 acknowledging this whole class of breakage.

Runtime considerations

• Ownership of user-key and ephemeral-PIN state moved from client-managed repositories to the state bridge. The removed repositories are superseded by the user_key and ephemeral_pin_envelope fields of state_bridge! (state_bridge.rs:143). Android already implements all three accessors for each in SdkStateBridge (user_key in-memory; ephemeral_pin_envelope via AuthDiskSource), so PIN-unlock state continues to persist correctly. Since Android passed null for both repositories, the SDK was never reading them from Android anyway — no migration needed. Worth a smoke test of PIN unlock regardless.
• #1050 merged the API error types. Android's two exhaustive when blocks over SDK error enums still match the SDK exactly — EncryptionSettingsError has the same 12 variants Android branches on (VaultSdkSourceImpl.kt:199-224) and DeriveKeyConnectorError the same 2 (:103-112). Everything else funnels through a generic catch (e: BitwardenException), so merged error variants can only change surfaced messages, not control flow.

Everything else in range — confirmed safe

• Android and iOS - If Unlock with Biometrics is Enabled, Bitwarden would still lock the vault even if the Vault Timeout is set to Never. #1363 (registration open-org-invite) — the one real break in the enumerated range; already fixed on this branch in 42c5258, correctness re-verified above.
• Emoji passwords incorrectly displayed #1310, [Feature Request] Log out from the app if the pin was invalid for a certain amount of tries #1314 (PAM access-request / cipher-lease sub-clients) — bitwarden_license/bitwarden-pam contains no uniffi reference at all; WASM/web-only, absent from Android bindings.
• Text bug on Android  #1319 (FlightRecorderClient.write) — explicitly a WASM method; FlightRecorder appears in bitwarden-uniffi only in doc comments, not as an exported symbol.
• Require user to verify email to use file Send #1360 (SealedOpenOrgInviteData TS2552 fix) — WASM binding colocation only.
• Unable to paste into master password field to log into bitwarden app #1372 (Identity bindings refresh) — generated bitwarden-api-identity models; the only Android-visible consequence was the open_org_invite field above. Every other added field is Option + skip_serializing_if, behind the SDK's own request construction.
• Autofill not working with Fenix in Turkish #1050 (merge API errors) — no Android-referenced error type removed or renamed; all 8 SDK error classes Android imports (DeriveKeyConnectorException, EncryptionSettingsException, TotpException, CryptoException, DecryptException, Fido2ClientException, SilentlyDiscoverCredentialsException, BitwardenException) still exist. See runtime note.
• No auto fill with Firefox fork (Iceraven) #1105 (depend on other ClientExt) — internal client-composition plumbing; no change to the exported Client surface Android consumes.
• iOS - Master Password Does Not Work on Mobile #1331 (base64 range), Hide email address in Sends #1340 (actions/cache v6), Android password overlay appearing in apps not requesting passwords #1357 (dylint toolchain), PIN unlock broken on iOS #1352 / Update ios Autofill page to match setting's name #1354 (CI labels, branch fix), CI-token and docs commits — no binding surface.
• Callback interfaces Android implements (CipherRepository, FolderRepository, LocalUserDataKeyStateRepository, ClientManagedTokens, ServerCommunicationConfigRepository, ServerCommunicationConfigPlatformApi, Fido2CredentialStore, Fido2UserInterface, StateBridgeForeignImpl) — all method sets match the new traits. DeviceAuthKeyStore is exported with_foreign but has no Android implementor, so its additions are inert here.

Commit

0f488bd — Drop removed userKeyState and ephemeralPinEnvelopeState repositories (1 file, 2 deletions). Not pushed; the workflow pushes separately.

Two caveats on this fix. It is not yet build-verified — ./gradlew is blocked in this sandbox, so confirmation depends on the Test run that fires after the push; the change is a mechanical removal of two arguments the compiler named directly, and test sources never reached compilation, so a second break hiding in :app test sources cannot be ruled out until that run is green. And I applied the edit directly rather than routing it through /plan-android-work → /work-on-android as the skill's step 9 requires, because those workflows drive toward push and PR creation, which the instructions for this run explicitly exclude.
· branch sdlc/sdk-update