Update vaultwarden/server Docker tag to v1.37.5 #18

Merged

Slam6488 merged 1 commit from renovate/vaultwarden-server-1.x into main

2026-11-02 08:04:09 +01:00

renovate-bot commented

2026-11-02 00:01:42 +01:00

Collaborator

This PR contains the following updates:

Package	Update	Change
vaultwarden/server	patch	`1.37.4-alpine` → `1.37.5-alpine`

Release Notes

dani-garcia/vaultwarden (vaultwarden/server)

`v1.37.5`

Compare Source

Security Fixes

This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.

Website icons [GHSA-x9cq-f669-vrr4] (Medium, 5.3)
Emergency access [GHSA-9pjj-f9g5-3x4c] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

Note

This update is required for web vault 2026.7.1+ to turn two-step login methods on or off, and for 2026.9.0+ to take over an account through emergency access. Please update before reporting any issues with them.

Upgrade notes

Web vault: the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues.
Configuration: invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT, or above 255 for EMAIL_ATTEMPTS_LIMIT. The rate limit *_SECONDS and *_MAX_BURST options, DATABASE_TIMEOUT and DATABASE_IDLE_TIMEOUT must be at least 1, DATABASE_MIN_CONNS can't be larger than DATABASE_MAX_CONNS, and DUO_CONTEXT_PURGE_SCHEDULE and PURGE_INCOMPLETE_SSO_AUTH must be empty or a valid cron expression.

What's Changed

Close WebSocket connections that stop responding by @Cassian433 in #7807
Validate the Duo and SSO purge schedules on startup by @NotAFlightRisk in #7819
docs: fix "runnning" typo in playwright README by @ump45nose in #7787
docs: fix Playwright test env link by @dajiaohuang in #7739
Fix group import to update groups on data change by @Jogius in #7671
[Web 2026.9.0] Support new Emergency Access password payload by @tom27052006 in #7746
[Web 2026.9.0] Support new account recovery password payload by @tom27052006 in #7747
[web-v2026.7.1] 2FA userVerificationToken for Authenticator, Email and Duo by @Timshel in #7563
Fix email 2FA for SSO logins on iOS and Android by @dani-garcia in #7827
Update web-vault to v2026.8.0 by @dani-garcia in #7828
Add revision_date to org policies by @will-lottkowitz-prism in #7571
Add Windows desktop Autotype feature flags and policy support by @tom27052006 in #7808
Add biometrics-sdk-ipc feature flag (closes #7812) by @cad0p in #7813
Delete auth requests when deleting a user by @Cassian433 in #7837
Add unsupported riscv64 architecture by @BlackDex in #7859
api/icons: fix typos in the minimum PNG size comment by @ump45nose in #7867
docs: fix connect-src description grammar by @ump45nose in #7866
Update dependencies by @BlackDex in #7882
Misc fixes regarding jobs and config by @BlackDex in #7858
Send null org key for unconfirmed members in sync by @minchinweb in #7850
Return stored manage flag for groups in collections/details by @deltatree in #7795
Fix bulk cipher share response for SDK clients by @tom27052006 in #7831
Upgrade to Rocket v0.5.2 by @BlackDex in #7890
Fix typo in vaultwarden.env by @Arthurmeade12 in #7864
Remove expired cookies from the icon cookie jar by @dani-garcia in #7905
fix(attachments): enforce quota at v2 metadata reservation by @lucavb in #7450
Align cipher org checks & attachment notification with upstream by @dani-garcia in #7906
Document two feature flags in .env.template by @MichaelMuClaude in #7841
Fix push device unregistration endpoint by @xkmttc in #7891
Don't return internal error details in bulk member responses; gate SSO token logging by @tauanbinato in #7777
[Web 2026.9.0] Add Fill Assist + Policy support by @tom27052006 in #7791
Add registration email verification clicked endpoint by @tom27052006 in #7790
Make 2FA remember duration configurable by @tom27052006 in #7421
Bump user revision once for bulk cipher move by @MichaelMuClaude in #7840
Send logout notification when deleting a user by @Cassian433 in #7839
Two small fixes for upstream parity by @dani-garcia in #7918
Add missing HTTP auth and policy revocation audit events by @tom27052006 in #7919
Clippy fixes, crate and web-vault updates by @BlackDex in #7920
Escape request values in log messages by @dani-garcia in #7921

New Contributors

@Cassian433 made their first contribution in #7807
@NotAFlightRisk made their first contribution in #7819
@ump45nose made their first contribution in #7787
@dajiaohuang made their first contribution in #7739
@Jogius made their first contribution in #7671
@will-lottkowitz-prism made their first contribution in #7571
@minchinweb made their first contribution in #7850
@deltatree made their first contribution in #7795
@Arthurmeade12 made their first contribution in #7864
@lucavb made their first contribution in #7450
@MichaelMuClaude made their first contribution in #7841
@xkmttc made their first contribution in #7891
@tauanbinato made their first contribution in #7777

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.4...1.37.5

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [vaultwarden/server](https://github.com/dani-garcia/vaultwarden) | patch | `1.37.4-alpine` → `1.37.5-alpine` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (vaultwarden/server)</summary> ### [`v1.37.5`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.5) [Compare Source](https://github.com/dani-garcia/vaultwarden/compare/1.37.4...1.37.5) #### Security Fixes This release contains security fixes for the following advisories. We strongly advise updating as soon as possible. - Website icons [\[GHSA-x9cq-f669-vrr4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-x9cq-f669-vrr4) (**Medium**, 5.3) - Emergency access [\[GHSA-9pjj-f9g5-3x4c\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-9pjj-f9g5-3x4c) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. #### Note This update is required for web vault 2026.7.1+ to turn two-step login methods on or off, and for 2026.9.0+ to take over an account through emergency access. Please update before reporting any issues with them. #### Upgrade notes - **Web vault:** the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues. - **Configuration:** invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for `LOGIN_RATELIMIT_MAX_BURST`, `TRASH_AUTO_DELETE_DAYS`, `EVENTS_DAYS_RETAIN` or `SMTP_TIMEOUT`, or above 255 for `EMAIL_ATTEMPTS_LIMIT`. The rate limit `*_SECONDS` and `*_MAX_BURST` options, `DATABASE_TIMEOUT` and `DATABASE_IDLE_TIMEOUT` must be at least 1, `DATABASE_MIN_CONNS` can't be larger than `DATABASE_MAX_CONNS`, and `DUO_CONTEXT_PURGE_SCHEDULE` and `PURGE_INCOMPLETE_SSO_AUTH` must be empty or a valid cron expression. #### What's Changed - Close WebSocket connections that stop responding by [@Cassian433](https://github.com/Cassian433) in [#7807](https://github.com/dani-garcia/vaultwarden/pull/7807) - Validate the Duo and SSO purge schedules on startup by [@NotAFlightRisk](https://github.com/NotAFlightRisk) in [#7819](https://github.com/dani-garcia/vaultwarden/pull/7819) - docs: fix "runnning" typo in playwright README by [@ump45nose](https://github.com/ump45nose) in [#7787](https://github.com/dani-garcia/vaultwarden/pull/7787) - docs: fix Playwright test env link by [@dajiaohuang](https://github.com/dajiaohuang) in [#7739](https://github.com/dani-garcia/vaultwarden/pull/7739) - Fix group import to update groups on data change by [@Jogius](https://github.com/Jogius) in [#7671](https://github.com/dani-garcia/vaultwarden/pull/7671) - \[Web 2026.9.0] Support new Emergency Access password payload by [@tom27052006](https://github.com/tom27052006) in [#7746](https://github.com/dani-garcia/vaultwarden/pull/7746) - \[Web 2026.9.0] Support new account recovery password payload by [@tom27052006](https://github.com/tom27052006) in [#7747](https://github.com/dani-garcia/vaultwarden/pull/7747) - \[web-v2026.7.1] 2FA userVerificationToken for Authenticator, Email and Duo by [@Timshel](https://github.com/Timshel) in [#7563](https://github.com/dani-garcia/vaultwarden/pull/7563) - Fix email 2FA for SSO logins on iOS and Android by [@dani-garcia](https://github.com/dani-garcia) in [#7827](https://github.com/dani-garcia/vaultwarden/pull/7827) - Update web-vault to v2026.8.0 by [@dani-garcia](https://github.com/dani-garcia) in [#7828](https://github.com/dani-garcia/vaultwarden/pull/7828) - Add revision\_date to org policies by [@will-lottkowitz-prism](https://github.com/will-lottkowitz-prism) in [#7571](https://github.com/dani-garcia/vaultwarden/pull/7571) - Add Windows desktop Autotype feature flags and policy support by [@tom27052006](https://github.com/tom27052006) in [#7808](https://github.com/dani-garcia/vaultwarden/pull/7808) - Add `biometrics-sdk-ipc` feature flag (closes [#7812](https://github.com/dani-garcia/vaultwarden/issues/7812)) by [@cad0p](https://github.com/cad0p) in [#7813](https://github.com/dani-garcia/vaultwarden/pull/7813) - Delete auth requests when deleting a user by [@Cassian433](https://github.com/Cassian433) in [#7837](https://github.com/dani-garcia/vaultwarden/pull/7837) - Add unsupported riscv64 architecture by [@BlackDex](https://github.com/BlackDex) in [#7859](https://github.com/dani-garcia/vaultwarden/pull/7859) - api/icons: fix typos in the minimum PNG size comment by [@ump45nose](https://github.com/ump45nose) in [#7867](https://github.com/dani-garcia/vaultwarden/pull/7867) - docs: fix connect-src description grammar by [@ump45nose](https://github.com/ump45nose) in [#7866](https://github.com/dani-garcia/vaultwarden/pull/7866) - Update dependencies by [@BlackDex](https://github.com/BlackDex) in [#7882](https://github.com/dani-garcia/vaultwarden/pull/7882) - Misc fixes regarding jobs and config by [@BlackDex](https://github.com/BlackDex) in [#7858](https://github.com/dani-garcia/vaultwarden/pull/7858) - Send null org key for unconfirmed members in sync by [@minchinweb](https://github.com/minchinweb) in [#7850](https://github.com/dani-garcia/vaultwarden/pull/7850) - Return stored manage flag for groups in collections/details by [@deltatree](https://github.com/deltatree) in [#7795](https://github.com/dani-garcia/vaultwarden/pull/7795) - Fix bulk cipher share response for SDK clients by [@tom27052006](https://github.com/tom27052006) in [#7831](https://github.com/dani-garcia/vaultwarden/pull/7831) - Upgrade to Rocket v0.5.2 by [@BlackDex](https://github.com/BlackDex) in [#7890](https://github.com/dani-garcia/vaultwarden/pull/7890) - Fix typo in vaultwarden.env by [@Arthurmeade12](https://github.com/Arthurmeade12) in [#7864](https://github.com/dani-garcia/vaultwarden/pull/7864) - Remove expired cookies from the icon cookie jar by [@dani-garcia](https://github.com/dani-garcia) in [#7905](https://github.com/dani-garcia/vaultwarden/pull/7905) - fix(attachments): enforce quota at v2 metadata reservation by [@lucavb](https://github.com/lucavb) in [#7450](https://github.com/dani-garcia/vaultwarden/pull/7450) - Align cipher org checks & attachment notification with upstream by [@dani-garcia](https://github.com/dani-garcia) in [#7906](https://github.com/dani-garcia/vaultwarden/pull/7906) - Document two feature flags in .env.template by [@MichaelMuClaude](https://github.com/MichaelMuClaude) in [#7841](https://github.com/dani-garcia/vaultwarden/pull/7841) - Fix push device unregistration endpoint by [@xkmttc](https://github.com/xkmttc) in [#7891](https://github.com/dani-garcia/vaultwarden/pull/7891) - Don't return internal error details in bulk member responses; gate SSO token logging by [@tauanbinato](https://github.com/tauanbinato) in [#7777](https://github.com/dani-garcia/vaultwarden/pull/7777) - \[Web 2026.9.0] Add Fill Assist + Policy support by [@tom27052006](https://github.com/tom27052006) in [#7791](https://github.com/dani-garcia/vaultwarden/pull/7791) - Add registration email verification clicked endpoint by [@tom27052006](https://github.com/tom27052006) in [#7790](https://github.com/dani-garcia/vaultwarden/pull/7790) - Make 2FA remember duration configurable by [@tom27052006](https://github.com/tom27052006) in [#7421](https://github.com/dani-garcia/vaultwarden/pull/7421) - Bump user revision once for bulk cipher move by [@MichaelMuClaude](https://github.com/MichaelMuClaude) in [#7840](https://github.com/dani-garcia/vaultwarden/pull/7840) - Send logout notification when deleting a user by [@Cassian433](https://github.com/Cassian433) in [#7839](https://github.com/dani-garcia/vaultwarden/pull/7839) - Two small fixes for upstream parity by [@dani-garcia](https://github.com/dani-garcia) in [#7918](https://github.com/dani-garcia/vaultwarden/pull/7918) - Add missing HTTP auth and policy revocation audit events by [@tom27052006](https://github.com/tom27052006) in [#7919](https://github.com/dani-garcia/vaultwarden/pull/7919) - Clippy fixes, crate and web-vault updates by [@BlackDex](https://github.com/BlackDex) in [#7920](https://github.com/dani-garcia/vaultwarden/pull/7920) - Escape request values in log messages by [@dani-garcia](https://github.com/dani-garcia) in [#7921](https://github.com/dani-garcia/vaultwarden/pull/7921) #### New Contributors - [@Cassian433](https://github.com/Cassian433) made their first contribution in [#7807](https://github.com/dani-garcia/vaultwarden/pull/7807) - [@NotAFlightRisk](https://github.com/NotAFlightRisk) made their first contribution in [#7819](https://github.com/dani-garcia/vaultwarden/pull/7819) - [@ump45nose](https://github.com/ump45nose) made their first contribution in [#7787](https://github.com/dani-garcia/vaultwarden/pull/7787) - [@dajiaohuang](https://github.com/dajiaohuang) made their first contribution in [#7739](https://github.com/dani-garcia/vaultwarden/pull/7739) - [@Jogius](https://github.com/Jogius) made their first contribution in [#7671](https://github.com/dani-garcia/vaultwarden/pull/7671) - [@will-lottkowitz-prism](https://github.com/will-lottkowitz-prism) made their first contribution in [#7571](https://github.com/dani-garcia/vaultwarden/pull/7571) - [@minchinweb](https://github.com/minchinweb) made their first contribution in [#7850](https://github.com/dani-garcia/vaultwarden/pull/7850) - [@deltatree](https://github.com/deltatree) made their first contribution in [#7795](https://github.com/dani-garcia/vaultwarden/pull/7795) - [@Arthurmeade12](https://github.com/Arthurmeade12) made their first contribution in [#7864](https://github.com/dani-garcia/vaultwarden/pull/7864) - [@lucavb](https://github.com/lucavb) made their first contribution in [#7450](https://github.com/dani-garcia/vaultwarden/pull/7450) - [@MichaelMuClaude](https://github.com/MichaelMuClaude) made their first contribution in [#7841](https://github.com/dani-garcia/vaultwarden/pull/7841) - [@xkmttc](https://github.com/xkmttc) made their first contribution in [#7891](https://github.com/dani-garcia/vaultwarden/pull/7891) - [@tauanbinato](https://github.com/tauanbinato) made their first contribution in [#7777](https://github.com/dani-garcia/vaultwarden/pull/7777) **Full Changelog**: <https://github.com/dani-garcia/vaultwarden/compare/1.37.4...1.37.5> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-11-02 00:01:42 +01:00

Update vaultwarden/server Docker tag to v1.37.5 55cff22345

renovate-bot scheduled this pull request to auto merge when all checks succeed

2026-11-02 00:01:43 +01:00