[deps] Billing: Update Braintree to 5.36.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Braintree	5.28.0 -> 5.36.0

---

Release Notes

braintree/braintree_dotnet (Braintree)

v5.36.0

Compare Source

• Add Bank Account Instant Verification functionality
• Add BankAccountInstantVerificationGateway for creating JWT tokens
• Add BankAccountInstantVerificationJwt response object
• Add BankAccountInstantVerificationJwtRequest for JWT creation
• Add AchMandate and AchMandateAcceptedAt fields to TransactionRequest
• Add INSTANT_VERIFICATION_ACCOUNT_VALIDATION method to UsBankAccountVerificationMethod
• Add AchRejectReason field to Transaction
• Add sender and receiver to transfer in Transaction
• Add IsDeviceToken to ApplePayCard and ApplePayDetails
• Add PaymentAccountReference to ApplePayDetails, AndroidPayDetails, CreditCard, and CreditCardVerification

v5.35.0

Compare Source

• Add UpcomingRetryDate field to Transaction
• Add RemainingFileEvidenceStorage to Dispute
• Add transfer type to Transaction
• Add transaction_retried webhook

v5.34.0

Compare Source

• Add Session Id to Customer Recommendations Payload

v5.33.0

Compare Source

• Add AccountInformationInquiry to:
  • Customer.create and Customer.update
  • CreditCard.create and CreditCard.update
  • PaymentMethod.create and PaymentMethod.update
  • CreditCardVerification.create
• Enhancements to PayPal customer recommendations
  • Create a session and get recommendations in one call
  • Hash customer email and phone number
• Add business, consumer, corporate, and purchase from the bin data to credit card responses

v5.32.0

Compare Source

• Remove marketplace features
• Add support for capturing payment facilitator and sub-merchant details with transactions

v5.31.0

Compare Source

• Add support for PayPalPaymentResource requests
• Add prepaid_reloadable from the bin data to credit card responses

v5.30.0

Compare Source

• Add support for creating and updating PayPal customer session
• Add support for getting PayPal customer recommendations

v5.29.0

Compare Source

• Add recipient/contact info: recipient_emailand recipient_phone to Transaction

---

Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bitwarden-bot]

Internal tracking:

• ID: PM-22035
• Link: https://bitwarden.atlassian.net/browse/PM-22035

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.65%. Comparing base (b1390c9) to head (929b2b1).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5864   +/-   ##
=======================================
  Coverage   53.65%   53.65%           
=======================================
  Files        1926     1926           
  Lines       85720    85720           
  Branches     7687     7687           
=======================================
+ Hits        45989    45991    +2     
+ Misses      37958    37957    -1     
+ Partials     1773     1772    -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Claude finished @renovate[bot]'s task —— View job

---

Code Review Progress

• Invoke bitwarden-code-reviewer agent to analyze PR changes
• Review agent findings and analyze security implications
• Provide comprehensive review feedback

---

Review Summary

Overall Assessment: ✅ APPROVE

This Braintree SDK update from 5.28.0 to 5.36.0 is safe to merge. The update spans 8 minor releases with exclusively additive changes—no breaking changes affect Bitwarden's existing implementation.

Key Findings

✅ Security & Compatibility

• No Breaking Changes: All updates are additive; existing APIs (Customer, PaymentMethod, Transaction) that Bitwarden uses remain unchanged
• Marketplace Removal (v5.32.0): Confirmed Bitwarden doesn't use marketplace features—no impact
• Zero-Knowledge Architecture: Update doesn't affect encryption or vault data handling; payment processing remains properly isolated
• Compliance: Maintains SOC 2/HIPAA/PCI-DSS alignment

📦 What's New (Not Currently Used)

The following features were added but don't require configuration changes:

• v5.36.0: Bank Account Instant Verification, ACH mandates, Apple Pay enhancements
• v5.35.0: Transaction retry webhooks, dispute tracking
• v5.34.0: Session ID for customer recommendations
• v5.33.0: Account information inquiry, BIN data enhancements
• v5.32.0: Payment facilitator support (replaced marketplace)
• v5.31.0: PayPal payment resources, prepaid card data
• v5.30.0: PayPal customer session management
• v5.29.0: Transaction recipient contact info

🧪 Testing Recommendations

While low-risk, consider testing:

1. PayPal payment method addition/removal
2. New premium subscription creation
3. Braintree payment flows in admin tools (ToolsController.ChargeBraintree)
4. Refund operations

📝 Implementation Details

• File Changed: src/Core/Core.csproj:53 - Single line version bump
• Bitwarden's Usage: Limited to core payment operations (Customer/PaymentMethod/Transaction CRUD)
• Performance Impact: Negligible (payment operations are infrequent)

Recommendation

Safe to merge. This dependency update introduces valuable security enhancements and new features for potential future use, with zero risk to existing functionality.

---

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Checkmarx One – Scan Summary & Details – 0959728d-65bf-494b-be0e-9ddcd3da667d

Great job! No new security vulnerabilities introduced in this pull request

[amorask-bitwarden]

Minor version update with a successful build. No breaking changes in the release notes.