86 Releases 87 Tags

RSS Feed

• 1.37.2 46d71107f5

  Compare

  Stable

  GiteaMirror released this 2026-08-22 07:09:11 -05:00 | 1 commits to main since this release

  📅 Originally published on GitHub: Sat, 22 Aug 2026 12:29:13 GMT
  🏷️ Git tag created: Sat, 22 Aug 2026 12:09:11 GMT

  Note

  This update is required for support with clients with version 2026.8.0+, please update before reporting any issues with them.

  What's Changed

  • Fix Debian cross-linking with xx-cargo by @alexliluz in https://github.com/dani-garcia/vaultwarden/pull/7524
  • Fix playwright test by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7548
  • Misc fixes and updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7558
  • Include user email in successful login logs by @lmogthb in https://github.com/dani-garcia/vaultwarden/pull/7496
  • Fix sendmail executable permission check by @p-boenisch in https://github.com/dani-garcia/vaultwarden/pull/7483
  • add dummy revisionDate by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/7608

  New Contributors

  • @alexliluz made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7524
  • @lmogthb made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7496
  • @p-boenisch made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7483

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.1...1.37.2

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.37.1 2629bcbe13

  Compare

  Stable

  GiteaMirror released this 2026-07-29 08:27:25 -05:00 | 7 commits to main since this release

  📅 Originally published on GitHub: Wed, 29 Jul 2026 13:40:10 GMT
  🏷️ Git tag created: Wed, 29 Jul 2026 13:27:25 GMT

  Note

  This patch release resolves the issues with invites.
  If you have applied any workaround to fix this locally, please revert those fixes to prevent possible other issues.

  I'm sorry that it took some time to check and validate this fix.

  Also, this release fixes an issue (#7475) with all the Alpine based images which are build using https://github.com/BlackDex/rust-musl/.
  An issue with the build image OpenSSL compilation is resolved and those are used to build the new alpine tagged containers.

  What's Changed

  • Always send initOrganization and orgUserHasExistingUser in invite URL by @vikfox in https://github.com/dani-garcia/vaultwarden/pull/7482
  • Indirectly resolved #7475 by using newer rust-musl build images which had a compilation issue with OpenSSL.

  New Contributors

  • @vikfox made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7482

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.0...1.37.1

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.37.0 46ae59eaf4

  Compare

  Stable

  GiteaMirror released this 2026-07-24 11:28:59 -05:00 | 8 commits to main since this release

  📅 Originally published on GitHub: Fri, 24 Jul 2026 17:04:39 GMT
  🏷️ Git tag created: Fri, 24 Jul 2026 16:28:59 GMT

  Note

  This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

  Security Fixes

  This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

  • SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
  • Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
  • Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
  • Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
  • Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
  • Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3)
  • Organization Import Authorization [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr] (Medium, 4.3)
  • Organization Data Enumeration via the Manager role [GHSA-rqf8-2568-r7mc] (Medium, 4.3)

  These are private for now, pending CVE assignment and publishing at a later date.

  What's Changed

  • OpenDAL S3 parameter support by @txase in https://github.com/dani-garcia/vaultwarden/pull/6127
  • Fix SSO Cookie path by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7187
  • fix email 2fa for bw cli by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/7225
  • sso_auth improvements by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7197
  • Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in https://github.com/dani-garcia/vaultwarden/pull/7061
  • Switch to xx-cargo by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/6640
  • Updates and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7235
  • Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7200
  • Serve Apple app site association file by @user71424q in https://github.com/dani-garcia/vaultwarden/pull/7191
  • Update Rust, Crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7307
  • Fix enforce blocked by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7246
  • Admin password recovery endpoint change by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7270
  • fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in https://github.com/dani-garcia/vaultwarden/pull/7283
  • Org membership delete remove Invitation by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7284
  • [v2026.5.0] Registration request update by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7295
  • [v2026.5.0] PutPolicy now using vnext format by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7296
  • 2026.6.0 send support by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7346
  • Add SSO_AUTHORIZE_BODY by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7357
  • Add pm-26340-linux-biometrics-v2 feature flag by @pilotstew in https://github.com/dani-garcia/vaultwarden/pull/7358
  • improve CI by @TriplEight in https://github.com/dani-garcia/vaultwarden/pull/6991
  • Misc updates and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7406
  • Remove old compatibility code by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7434
  • Fix compilation with newer rust-musl version by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7453
  • Fix Custom Role CSS for new dialog markup by @tom27052006 in https://github.com/dani-garcia/vaultwarden/pull/7442
  • Remove unused fields by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7458
  • Update API response, crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7470
  • Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/7472

  New Contributors

  • @mfw78 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7061
  • @user71424q made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7191
  • @kvdb made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7283
  • @pilotstew made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7358
  • @TriplEight made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6991
  • @tom27052006 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7442

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.36.0...1.37.0

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.36.0 f21a3adae2

  Compare

  Stable

  GiteaMirror released this 2026-05-03 07:20:45 -05:00 | 35 commits to main since this release

  📅 Originally published on GitHub: Sun, 03 May 2026 12:54:52 GMT
  🏷️ Git tag created: Sun, 03 May 2026 12:20:45 GMT

  Security Fixes

  This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

  • SSO Login CSRF
    GHSA-pfp2-jhgq-6hg5
    GHSA-w6h6-8r66-hcv7
  • User/Organization Enumeration
    GHSA-hxqh-ff5p-wfr3
  • SSO existing-user binding
    GHSA-j4j8-gpvj-7fqr
    GHSA-6x5c-84vm-5j56
  • SSRF via Icon Endpoint
    GHSA-72vh-x5jq-m82g
  • Some crate's updated and other minor security enhancements

  These are private for now, pending CVE assignment.

  Notes

  • Archiving of items is available
    https://bitwarden.com/blog/keep-your-vault-tidy-with-item-archiving/
    https://bitwarden.com/nl-nl/help/managing-items/#archive
  • Web Vault updated to v2026.4.1

  What's Changed

  • SSO fallback to UserInfo preferred_username by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7128
  • Dummy identifier need to pass for a guid by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7154
  • add new /identity/accounts/prelogin/password by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/7156
  • Add DuckDuckGo browser device type by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7147
  • Apply duration_suboptimal_units lint findings by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7144
  • Apply ref_option lint findings by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7143
  • Fix hardcoded sso identifier by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7157
  • Update crates and fix a nightly lint by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7161
  • Fix Host/IP resolving by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7162
  • Several SSO Fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7163
  • Add support for archiving items by @matt-aaron in https://github.com/dani-garcia/vaultwarden/pull/6916
  • Fix favicon fetching to check all icon links instead of just the first one by @Shocker in https://github.com/dani-garcia/vaultwarden/pull/6880
  • Fix merge conflict by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/7164
  • Replace organization_uuid unwrap with proper error handling by @xjohnyknox in https://github.com/dani-garcia/vaultwarden/pull/6936
  • fix: return Err instead of panic on unknown cipher atype in to_json() by @mango766 in https://github.com/dani-garcia/vaultwarden/pull/7068
  • Allow SQLite to be linked against dynamically by @ISSOtm in https://github.com/dani-garcia/vaultwarden/pull/7057
  • Update crates and web-vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7171
  • Update hickory by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7175

  New Contributors

  • @matt-aaron made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6916
  • @Shocker made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6880
  • @xjohnyknox made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6936
  • @mango766 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7068
  • @ISSOtm made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7057

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.8...1.36.0

  You can discuss this release here https://github.com/dani-garcia/vaultwarden/discussions/7177

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.35.8 7cf0c5d67e

  Compare

  Stable

  GiteaMirror released this 2026-04-25 12:40:33 -05:00 | 53 commits to main since this release

  📅 Originally published on GitHub: Sat, 25 Apr 2026 18:08:50 GMT
  🏷️ Git tag created: Sat, 25 Apr 2026 17:40:33 GMT

  What's Changed

  • Dummy org Master password policy auth fix by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7097
  • Fix recovery-code not working by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7102
  • Fix invalid refresh token response by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7105
  • Update Rust, Crates, GHA and fix a DNS issue by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7108
  • Update web-vault and crates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7121

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.7...1.35.8

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.35.7 e7e4b9a86d

  Compare

  Stable

  GiteaMirror released this 2026-04-13 16:10:06 -05:00 | 58 commits to main since this release

  📅 Originally published on GitHub: Mon, 13 Apr 2026 21:51:32 GMT
  🏷️ Git tag created: Mon, 13 Apr 2026 21:10:06 GMT

  What's Changed

  • Fix 2FA for Android by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7093

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.6...1.35.7

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.35.6 bb549986e6

  Compare

  Stable

  GiteaMirror released this 2026-04-12 14:10:26 -05:00 | 59 commits to main since this release

  📅 Originally published on GitHub: Sun, 12 Apr 2026 19:28:35 GMT
  🏷️ Git tag created: Sun, 12 Apr 2026 19:10:26 GMT

  Notes

  The previous release contained an issue where Two Factor Remember Tokens and Recovery Tokens were not accepted at all.
  This has been fixed now in this release.

  What's Changed

  • Fix MFA Remember by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7085

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.5...1.35.6

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.35.5 39954af96a

  Compare

  Stable

  GiteaMirror released this 2026-04-12 09:53:59 -05:00 | 60 commits to main since this release

  📅 Originally published on GitHub: Sun, 12 Apr 2026 15:59:21 GMT
  🏷️ Git tag created: Sun, 12 Apr 2026 14:53:59 GMT

  Security Fixes

  This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

  • GHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault.
  • GHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
  • GHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation

  These are private for now, pending CVE assignment.

  Notes

  • The admin templates have changed, please update them if you override these via templates.
  • Two Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.

  What's Changed

  • apply policies only to confirmed members by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6892
  • Feat(config): add feature flag for Safari account switching by @DerPlayer2001 in https://github.com/dani-garcia/vaultwarden/pull/6891
  • fix: add ForcePasswordReset to api key login by @montdidier in https://github.com/dani-garcia/vaultwarden/pull/6904
  • Add Webauthn related origins flag to known flags. by @pasarenicu in https://github.com/dani-garcia/vaultwarden/pull/6900
  • Add 30s cache to SSO exchange_refresh_token by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/6866
  • Add cxp-import-mobile and cxp-export-mobile: feature flags on mobile by @phoeagon in https://github.com/dani-garcia/vaultwarden/pull/6853
  • Misc updates and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6910
  • Support new desktop origin on CORS by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/6920
  • Fix checkout action version by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/6921
  • Fix apikey login by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6922
  • Fix email header base64 padding by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6961
  • Update Feature Flags by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6981
  • Update crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6980
  • Use protected CI environment by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/7004
  • Fix 2FA Remember to actually be 30 days by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6929
  • Misc Updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7027
  • Switch to attest action by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7017
  • Rotate refresh-tokens on sstamp reset by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7031
  • Misc org fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7032
  • Fix empty string FolderId by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7048
  • Disable deployments for release env by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7033
  • Fix Send icons by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7051
  • prevent managers from creating collections by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6890
  • Change SQLite backup to use VACUUM INTO query by @getaaron in https://github.com/dani-garcia/vaultwarden/pull/6989
  • Handle SIGTERM and SIGQUIT shutdown signals. by @0x484558 in https://github.com/dani-garcia/vaultwarden/pull/7008
  • Do not display unavailable 2FA options by @0x484558 in https://github.com/dani-garcia/vaultwarden/pull/7013
  • Fix logout push identifiers and send logout before clearing devices by @qaz741wsd856 in https://github.com/dani-garcia/vaultwarden/pull/7047
  • Fix windows build issues by @idontneedonetho in https://github.com/dani-garcia/vaultwarden/pull/7065
  • Crate and GHA updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7081

  New Contributors

  • @DerPlayer2001 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6891
  • @montdidier made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6904
  • @pasarenicu made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6900
  • @phoeagon made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6853
  • @getaaron made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6989
  • @0x484558 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7008
  • @qaz741wsd856 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7047
  • @idontneedonetho made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7065

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.4...1.35.5

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.35.4 c555f7d198

  Compare

  Stable

  GiteaMirror released this 2026-02-23 15:23:41 -06:00 | 90 commits to main since this release

  📅 Originally published on GitHub: Mon, 23 Feb 2026 21:43:25 GMT
  🏷️ Git tag created: Mon, 23 Feb 2026 21:23:41 GMT

  Security Fixes

  This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

  • GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
  • GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
  • GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.

  These are private for now, pending CVE assignment.

  What's Changed

  • Update Rust and Crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6843
  • hide remember 2fa token by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6852
  • fix(send_invite): invite links by @proofofcopilot in https://github.com/dani-garcia/vaultwarden/pull/6824
  • Misc organization fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6867

  New Contributors

  • @proofofcopilot made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6824

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.3...1.35.4

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• 1.35.3 36f0620fd1

  Compare

  Stable

  GiteaMirror released this 2026-02-10 14:20:59 -06:00 | 94 commits to main since this release

  📅 Originally published on GitHub: Tue, 10 Feb 2026 20:37:03 GMT
  🏷️ Git tag created: Tue, 10 Feb 2026 20:20:59 GMT

  Security Fixes

  This release contains security fixes for the following advisory. We strongly advice to update as soon as possible if you believe it could affect you.

  • GHSA-h265-g7rm-h337 (Publication in process, waiting for CVE assignment)
    This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong.

  What's Changed

  • Fix User API Key login by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6712
  • use email instead of empty name for webauhn by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6733
  • hide password hints via CSS by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6726
  • fix email as 2fa with auth requests by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6736
  • Update crates, web-vault, js, workflows by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6749
  • refactor: improve tooltips in diagnostics page by @tessus in https://github.com/dani-garcia/vaultwarden/pull/6765
  • Empty AccountKeys when no private key by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/6761
  • fix error message for purging auth requests by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6776
  • Misc updates, crates, rust, js, gha, vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6799
  • Update crates and web-vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6810
  • Fix org-details issue by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6811

  Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.2...1.35.3

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)