chore(deps): update docker.io/vaultwarden/server docker tag to v1.37.0 #13

Merged

webmatix-renovate merged 1 commit from renovate/docker.io-vaultwarden-server-1.x into main

2026-07-24 21:00:57 +02:00

webmatix-renovate commented

2026-07-24 21:00:57 +02:00

Collaborator

This PR contains the following updates:

Package	Update	Change
docker.io/vaultwarden/server	minor	`1.36.0-alpine` → `1.37.0-alpine`

Release Notes

dani-garcia/vaultwarden (docker.io/vaultwarden/server)

`v1.37.0`

Compare Source

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3)
Organization Import Authorization [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr] (Medium, 4.3)
Organization Data Enumeration via the Manager role [GHSA-rqf8-2568-r7mc] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

OpenDAL S3 parameter support by @txase in #6127
Fix SSO Cookie path by @BlackDex in #7187
fix email 2fa for bw cli by @stefan0xC in #7225
sso_auth improvements by @Timshel in #7197
Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in #7061
Switch to xx-cargo by @dfunkt in #6640
Updates and fixes by @BlackDex in #7235
Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in #7200
Serve Apple app site association file by @user71424q in #7191
Update Rust, Crates and GHA by @BlackDex in #7307
Fix enforce blocked by @Timshel in #7246
Admin password recovery endpoint change by @Timshel in #7270
fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in #7283
Org membership delete remove Invitation by @Timshel in #7284
[v2026.5.0] Registration request update by @Timshel in #7295
[v2026.5.0] PutPolicy now using vnext format by @Timshel in #7296
2026.6.0 send support by @Timshel in #7346
Add SSO_AUTHORIZE_BODY by @Timshel in #7357
Add pm-26340-linux-biometrics-v2 feature flag by @pilotstew in #7358
improve CI by @TriplEight in #6991
Misc updates and fixes by @BlackDex in #7406
Remove old compatibility code by @Timshel in #7434
Fix compilation with newer rust-musl version by @dfunkt in #7453
Fix Custom Role CSS for new dialog markup by @tom27052006 in #7442
Remove unused fields by @Timshel in #7458
Update API response, crates and GHA by @BlackDex in #7470
Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in #7472

New Contributors

@mfw78 made their first contribution in #7061
@user71424q made their first contribution in #7191
@kvdb made their first contribution in #7283
@pilotstew made their first contribution in #7358
@TriplEight made their first contribution in #6991
@tom27052006 made their first contribution in #7442

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.36.0...1.37.0

Configuration

📅 Schedule: (in timezone Europe/Vienna)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker.io/vaultwarden/server](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0-alpine` → `1.37.0-alpine` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (docker.io/vaultwarden/server)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](https://github.com/dani-garcia/vaultwarden/compare/1.36.0...1.37.0) #### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. #### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. #### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](https://github.com/dani-garcia/vaultwarden/pull/6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](https://github.com/dani-garcia/vaultwarden/pull/7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](https://github.com/dani-garcia/vaultwarden/pull/7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](https://github.com/dani-garcia/vaultwarden/pull/7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](https://github.com/dani-garcia/vaultwarden/pull/7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](https://github.com/dani-garcia/vaultwarden/pull/6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](https://github.com/dani-garcia/vaultwarden/pull/7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](https://github.com/dani-garcia/vaultwarden/pull/7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](https://github.com/dani-garcia/vaultwarden/pull/7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](https://github.com/dani-garcia/vaultwarden/pull/7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](https://github.com/dani-garcia/vaultwarden/pull/7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](https://github.com/dani-garcia/vaultwarden/pull/7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](https://github.com/dani-garcia/vaultwarden/pull/7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](https://github.com/dani-garcia/vaultwarden/pull/7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](https://github.com/dani-garcia/vaultwarden/pull/7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](https://github.com/dani-garcia/vaultwarden/pull/7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](https://github.com/dani-garcia/vaultwarden/pull/7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](https://github.com/dani-garcia/vaultwarden/pull/7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](https://github.com/dani-garcia/vaultwarden/pull/7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](https://github.com/dani-garcia/vaultwarden/pull/6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](https://github.com/dani-garcia/vaultwarden/pull/7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](https://github.com/dani-garcia/vaultwarden/pull/7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](https://github.com/dani-garcia/vaultwarden/pull/7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](https://github.com/dani-garcia/vaultwarden/pull/7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](https://github.com/dani-garcia/vaultwarden/pull/7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](https://github.com/dani-garcia/vaultwarden/pull/7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](https://github.com/dani-garcia/vaultwarden/pull/7472) #### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](https://github.com/dani-garcia/vaultwarden/pull/7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](https://github.com/dani-garcia/vaultwarden/pull/7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](https://github.com/dani-garcia/vaultwarden/pull/7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](https://github.com/dani-garcia/vaultwarden/pull/7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](https://github.com/dani-garcia/vaultwarden/pull/6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](https://github.com/dani-garcia/vaultwarden/pull/7442) **Full Changelog**: <https://github.com/dani-garcia/vaultwarden/compare/1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Vienna) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

webmatix-renovate added 1 commit

2026-07-24 21:00:57 +02:00

chore(deps): update docker.io/vaultwarden/server docker tag to v1.37.0 97b0ef86f6

webmatix-renovate scheduled this pull request to auto merge when all checks succeed

2026-07-24 21:00:57 +02:00

webmatix-renovate merged commit 97b0ef86f6 into main

2026-07-24 21:00:57 +02:00