[renovate]

This PR contains the following updates:

Package	Update	Change
vaultwarden/server	patch	1.37.4-alpine → 1.37.5-alpine

---

Release Notes

dani-garcia/vaultwarden (vaultwarden/server)

v1.37.5

Compare Source

Security Fixes

This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.

• Website icons [GHSA-x9cq-f669-vrr4] (Medium, 5.3)
• Emergency access [GHSA-9pjj-f9g5-3x4c] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

Note

This update is required for web vault 2026.7.1+ to turn two-step login methods on or off, and for 2026.9.0+ to take over an account through emergency access. Please update before reporting any issues with them.

Upgrade notes

• Web vault: the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues.
• Configuration: invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT, or above 255 for EMAIL_ATTEMPTS_LIMIT. The rate limit *_SECONDS and *_MAX_BURST options, DATABASE_TIMEOUT and DATABASE_IDLE_TIMEOUT must be at least 1, DATABASE_MIN_CONNS can't be larger than DATABASE_MAX_CONNS, and DUO_CONTEXT_PURGE_SCHEDULE and PURGE_INCOMPLETE_SSO_AUTH must be empty or a valid cron expression.

What's Changed

• Close WebSocket connections that stop responding by @​Cassian433 in #​7807
• Validate the Duo and SSO purge schedules on startup by @​NotAFlightRisk in #​7819
• docs: fix "runnning" typo in playwright README by @​ump45nose in #​7787
• docs: fix Playwright test env link by @​dajiaohuang in #​7739
• Fix group import to update groups on data change by @​Jogius in #​7671
• [Web 2026.9.0] Support new Emergency Access password payload by @​tom27052006 in #​7746
• [Web 2026.9.0] Support new account recovery password payload by @​tom27052006 in #​7747
• [web-v2026.7.1] 2FA userVerificationToken for Authenticator, Email and Duo by @​Timshel in #​7563
• Fix email 2FA for SSO logins on iOS and Android by @​dani-garcia in #​7827
• Update web-vault to v2026.8.0 by @​dani-garcia in #​7828
• Add revision_date to org policies by @​will-lottkowitz-prism in #​7571
• Add Windows desktop Autotype feature flags and policy support by @​tom27052006 in #​7808
• Add biometrics-sdk-ipc feature flag (closes #​7812) by @​cad0p in #​7813
• Delete auth requests when deleting a user by @​Cassian433 in #​7837
• Add unsupported riscv64 architecture by @​BlackDex in #​7859
• api/icons: fix typos in the minimum PNG size comment by @​ump45nose in #​7867
• docs: fix connect-src description grammar by @​ump45nose in #​7866
• Update dependencies by @​BlackDex in #​7882
• Misc fixes regarding jobs and config by @​BlackDex in #​7858
• Send null org key for unconfirmed members in sync by @​minchinweb in #​7850
• Return stored manage flag for groups in collections/details by @​deltatree in #​7795
• Fix bulk cipher share response for SDK clients by @​tom27052006 in #​7831
• Upgrade to Rocket v0.5.2 by @​BlackDex in #​7890
• Fix typo in vaultwarden.env by @​Arthurmeade12 in #​7864
• Remove expired cookies from the icon cookie jar by @​dani-garcia in #​7905
• fix(attachments): enforce quota at v2 metadata reservation by @​lucavb in #​7450
• Align cipher org checks & attachment notification with upstream by @​dani-garcia in #​7906
• Document two feature flags in .env.template by @​MichaelMuClaude in #​7841
• Fix push device unregistration endpoint by @​xkmttc in #​7891
• Don't return internal error details in bulk member responses; gate SSO token logging by @​tauanbinato in #​7777
• [Web 2026.9.0] Add Fill Assist + Policy support by @​tom27052006 in #​7791
• Add registration email verification clicked endpoint by @​tom27052006 in #​7790
• Make 2FA remember duration configurable by @​tom27052006 in #​7421
• Bump user revision once for bulk cipher move by @​MichaelMuClaude in #​7840
• Send logout notification when deleting a user by @​Cassian433 in #​7839
• Two small fixes for upstream parity by @​dani-garcia in #​7918
• Add missing HTTP auth and policy revocation audit events by @​tom27052006 in #​7919
• Clippy fixes, crate and web-vault updates by @​BlackDex in #​7920
• Escape request values in log messages by @​dani-garcia in #​7921

New Contributors

• @​Cassian433 made their first contribution in #​7807
• @​NotAFlightRisk made their first contribution in #​7819
• @​ump45nose made their first contribution in #​7787
• @​dajiaohuang made their first contribution in #​7739
• @​Jogius made their first contribution in #​7671
• @​will-lottkowitz-prism made their first contribution in #​7571
• @​minchinweb made their first contribution in #​7850
• @​deltatree made their first contribution in #​7795
• @​Arthurmeade12 made their first contribution in #​7864
• @​lucavb made their first contribution in #​7450
• @​MichaelMuClaude made their first contribution in #​7841
• @​xkmttc made their first contribution in #​7891
• @​tauanbinato made their first contribution in #​7777

Full Changelog: dani-garcia/vaultwarden@1.37.4...1.37.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.