chore(deps): update vaultwarden/server docker tag to v1.35.4 by renovate[bot] · Pull Request #68 · nzbr/nixos

renovate · 2025-02-03T17:31:00Z

This PR contains the following updates:

Package	Update	Change
vaultwarden/server	minor	`1.33.0-alpine` → `1.35.4-alpine`

Release Notes

dani-garcia/vaultwarden (vaultwarden/server)

`v1.35.4`

Compare Source

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.

These are private for now, pending CVE assignment.

What's Changed

Update Rust and Crates and GHA by @BlackDex in #6843
hide remember 2fa token by @stefan0xC in #6852
fix(send_invite): invite links by @proofofcopilot in #6824
Misc organization fixes by @BlackDex in #6867

New Contributors

@proofofcopilot made their first contribution in #6824

Full Changelog: dani-garcia/vaultwarden@1.35.3...1.35.4

`v1.35.3`

Compare Source

Security Fixes

This release contains security fixes for the following advisory. We strongly advice to update as soon as possible if you believe it could affect you.

GHSA-h265-g7rm-h337 (Publication in process, waiting for CVE assignment)
This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong.

What's Changed

Fix User API Key login by @BlackDex in #6712
use email instead of empty name for webauhn by @stefan0xC in #6733
hide password hints via CSS by @stefan0xC in #6726
fix email as 2fa with auth requests by @stefan0xC in #6736
Update crates, web-vault, js, workflows by @BlackDex in #6749
refactor: improve tooltips in diagnostics page by @tessus in #6765
Empty AccountKeys when no private key by @Timshel in #6761
fix error message for purging auth requests by @stefan0xC in #6776
Misc updates, crates, rust, js, gha, vault by @BlackDex in #6799
Update crates and web-vault by @BlackDex in #6810
Fix org-details issue by @BlackDex in #6811

Full Changelog: dani-garcia/vaultwarden@1.35.2...1.35.3

`v1.35.2`

Compare Source

Notable changes

Fixed an issue with the web-vault which prevent creating an organization.

What's Changed

update web-vault to fix org creation by @stefan0xC in #6646
return no content with status code 204 by @stefan0xC in #6665
allow MasterPasswordHash for Android by @stefan0xC in #6673
improve sso callback path by @stefan0xC in #6676
Fix web-vault version check and update web-vault by @BlackDex in #6686

Full Changelog: dani-garcia/vaultwarden@1.35.1...1.35.2

`v1.35.1`

Compare Source

Notable changes

Fixed issue with applications being logged out after upgrading due to changes to refresh token parsing
Updated web vault to 2025.12.1
Correctly publish alpine tag, which was missing in 1.35.0

What's Changed

Update lockfile by @dani-garcia in #6600
Re-add alpine tag by @dfunkt in #6626
Misc updates by @BlackDex in #6627
Try old refresh token if we fail to decode jwt by @dani-garcia in #6629

Full Changelog: dani-garcia/vaultwarden@1.35.0...1.35.1

`v1.35.0`

Compare Source

Notable changes

Implemented support for SSO with OpenID Connect, https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect
Updated web vault to 2025.12.0
Added support for future mobile apps with versions 2026.1.0+
This is the first vaultwarden release using immutable releases and release attestation!

What's Changed

Fix multi delete slowdown by @BlackDex in #6144
Perform same checks when setting kdf by @Timshel in #6141
SSO using OpenID Connect by @Timshel in #3899
Delete SSO.md by @dani-garcia in #6152
Update webauthn-rs to 0.5.x by @zUnixorn in #5934
a little cleanup after SSO merge by @stefan0xC in #6153
Fix link to point to the wiki by @Timshel in #6157
Fix Email 2FA for mobile apps by @dfunkt in #6156
Update Rust to 1.89.0 by @dfunkt in #6150
Fix several more multi select push issues by @BlackDex in #6151
Fix minor typo by @ncguk in #6165
Update crates, fixes some yanked crates by @BlackDex in #6167
Fix WebauthN issue with Software Keys by @BlackDex in #6168
Fix Playwright test conf and update deps by @Timshel in #6176
Misc updates by @BlackDex in #6185
fix typo in description of helo_name by @Flottegurke in #6194
Fix Playwright by @Timshel in #6206
Switch to GHA's concurrency control by @dfunkt in #6164
Make database connection pool dynamic by @Samoth69 in #6166
Re-add if check to release workflow by @dfunkt in #6227
Fix Webauthn/Passkey 2FA migration/validation issues by @BlackDex in #6190
refactor(config): update template, add validation by @tessus in #6229
Show SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION in admin by @Timshel in #6235
Update crates, gha and web-vault by @BlackDex in #6234
Fix panic around sso_master_password_policy by @Timshel in #6233
make webauthn more optional by @stefan0xC in #6160
Fix 2fa recovery endpoint by @BlackDex in #6240
update trivy-action to v0.33.0 by @stefan0xC in #6248
update web vault to v2025.9.1 and allow new policy by @stefan0xC in #6340
prevent changing collections when hide_passwords is true by @stefan0xC in #6278
Fix sso_user dropped on User::save by @Timshel in #6262
Change OIDC dummy identifier by @Timshel in #6263
add new billing warnings endpoint by @stefan0xC in #6369
Add auth_request pending endpoint by @Timshel in #6368
Fix Org identifier by @Timshel in #6364
add mail address change warning for invited accounts by @stefan0xC in #6377
add missing media-src directive by @stefan0xC in #6381
add seat limit for the invite dialog by @stefan0xC in #6371
[Playwright] Improvements around node by @Timshel in #6321
Use Diesels MultiConnections Derive by @BlackDex in #6279
Improve protected actions by @dani-garcia in #6411
Fix issue with key-rotation and emergency-access by @BlackDex in #6421
Optimizations and build speedup by @BlackDex in #6339
Use an older version of mariadb to prevent a panic by @BlackDex in #6453
Playwright against abitrary web-vault by @Timshel in #6380
Fix KDF Change with new web-vault by @BlackDex in #6458
Fix: admin theme emoji alignment by @joepduin in #6459
remove invalid emergency access dummy value by @stefan0xC in #6463
Add pm-25373-windows-biometrics-v2 feature flag by @Ephemera42 in #6468
Switch to multiple runners per arch by @dfunkt in #6472
Fix icon redirect caching by @BlackDex in #6487
Fix around singleorg policy by @Timshel in #6247
fix email as 2fa provider by @stefan0xC in #6473
Update crates and Rust version by @BlackDex in #6485
Add option to prefer IPv6 resolving by @BlackDex in #6494
Some small admin js/css updates by @BlackDex in #6501
Update crates and workflows and some fixes by @BlackDex in #6508
Fixed a typo in the default TTL value by @k725 in #6528
Iterate over tags on release by @Timshel in #6518
Org.put_policy type not in body anymore by @Timshel in #6514
Android want response property in camelCase by @Timshel in #6513
Fix admin invite with SSO by @Timshel in #6498
Improve sso auth flow by @Timshel in #6205
fix email as 2fa for sso by @stefan0xC in #6495
Fix release workflow by @BlackDex in #6532
Further fixes for the release workflow by @dfunkt in #6533
add empty /api/tasks endpoint by @stefan0xC in #6557
Revert to gzip compression by @dfunkt in #6566
support UriMatchDefaults policy by @stefan0xC in #6570
Add new accountKeys and masterPasswordUnlock fields by @dani-garcia in #6572
Update crates and Rust by @BlackDex in #6551
Add UserDecryption on /sync too by @dani-garcia in #6574
Update web-vault to v2025.12.0 by @BlackDex in #6577
Fix posting cipher with readonly collections by @BlackDex in #6578
Update crates by @BlackDex in #6585
Simplify binary extraction by @dfunkt in #6554
Remove unnecessary output sharing between jobs by @dfunkt in #6555
Add wrapped named variants to UserDecryptionOptions by @dani-garcia in #6598

New Contributors

@zUnixorn made their first contribution in #5934
@ncguk made their first contribution in #6165
@Flottegurke made their first contribution in #6194
@Samoth69 made their first contribution in #6166
@joepduin made their first contribution in #6459
@k725 made their first contribution in #6528

Full Changelog: dani-garcia/vaultwarden@1.34.3...1.35.0

`v1.34.3`

Compare Source

Notable changes

This release should fix an issue with MySQL/MariaDB database connections when using the Alpine images.
The alpine build image has reverted to use MariaDB Connector/C v3.4.5 which resolved the issue.

What's Changed

Update crates to trigger rebuild for mysql issue by @BlackDex in #6111
fix hiding of signup link by @stefan0xC in #6113

Full Changelog: dani-garcia/vaultwarden@1.34.2...1.34.3

`v1.34.2`

Compare Source

Notable changes

Updated web vault to 2025.7.0
Included experimental support for S3 file backend using OpenDAL. This currently requires compiling from source with the s3 feature flag, check #5626 for more details.

What's Changed

fix css to hide login with passkey by @stefan0xC in #5890
fix css for locked screen by @stefan0xC in #5905
Abstract persistent files through Apache OpenDAL by @txase in #5626
Some small admin updates by @BlackDex in #5909
Fix and improvements to password policies by @Timshel in #5923
Update Alpine to version 3.22 by @dfunkt in #5938
make css for login-page position independent by @stefan0xC in #5906
Minor fixes to copy in .env.template by @nickgrim in #5928
Update crates and web-vault by @BlackDex in #5955
allow signup for invited users by @stefan0xC in #5967
fix account recovery withdrawal by @stefan0xC in #5968
Fix an issue with yubico keys not validating by @BlackDex in #5991
Misc Updates and favicon fixes by @BlackDex in #5993
Update flags version and enable manual error reporting by @dani-garcia in #5994
Use existing reqwest client for AWS S3 requests by @txase in #5917
Fix v2025.6.x clients and newer to delete items by @BlackDex in #6004
chore: fix some minor issues in the comments by @mountdisk in #5998
fix hiding email as 2fa provider by @stefan0xC in #6026
Update web-vault and admin resources by @BlackDex in #6044
improve the usage section of the README by @stefan0xC in #6041
close unmatched left parenthesis in the README by @stefan0xC in #6046
Update crates, workflow and issue template by @BlackDex in #6056
Update release.yml by @dani-garcia in #6057
fix hash reference in release.yml by @stefan0xC in #6058
Fix digest SHA extraction step by @dfunkt in #6059
Hide login form custom fields by @Timshel in #6054
Adjust issue template by @BlackDex in #6096
fix: resolve group permission conflicts with multiple groups by @DasCanard in #6017
Update crates by @BlackDex in #6100
fix account key rotation by @stefan0xC in #6105

New Contributors

@txase made their first contribution in #5626
@nickgrim made their first contribution in #5928
@mountdisk made their first contribution in #5998
@DasCanard made their first contribution in #6017

Full Changelog: dani-garcia/vaultwarden@1.34.1...1.35.0

`v1.34.1`

Compare Source

What's Changed

Fix admin diagnostics crash by @BlackDex in #5886

Full Changelog: dani-garcia/vaultwarden@1.34.0...1.34.1

`v1.34.0`

Compare Source

Notable changes

Updated web-vault to v2025.5.0
Implemented new registration flow with email verification
Added support for some feature flags (mutual TLS, attachment export, AnonAddy/SimpleLogin self host)

What's Changed

Update crates & fix CVE-2025-25188 by @dfunkt in #5576
Fix db issues with Option<> values and upd crates by @BlackDex in #5594
allow CLI to upload send files with truncated filenames by @stefan0xC in #5618
Update Rust to 1.85.0 by @dfunkt in #5634
Use subtle to replace deprecated ring::constant_time::verify_slices_are_equal by @Timshel in #5680
Add support for mutual-tls feature flag by @bennettmsherman in #5698
Add AnonAddy/SimpleLogin self host feature flag by @PseudoResonance in #5694
Implement new registration flow with email verification by @dani-garcia in #5215
Some fixes for the new web-vault and updates by @BlackDex in #5703
Update Rust, Crates and other deps by @BlackDex in #5709
Update deps and web-vault by @BlackDex in #5742
Fix invited user registration without SMTP by @Timshel in #5712
Fix mysqlclient-sys building by @BlackDex in #5743
Really fix building by @BlackDex in #5745
Update Rust to 1.86.0 by @dfunkt in #5744
Verify templates in CI by @dani-garcia in #5748
Add Docker Templates pre-commit check by @BlackDex in #5749
Fix debian docker building by @BlackDex in #5752
Updates and general fixes by @BlackDex in #5762
On member invite and edit access_all is not sent anymore by @Timshel in #5673
respond with cipher json when deleting attachments by @stefan0xC in #5823
feat: add feature flag export-attachments by @tessus in #5784
Fix Yubico toggle by @Timshel in #5833
Fix minimum Android version for self-host email alias feature flags by @PseudoResonance in #5802
feat: add ip address in logs when email 2fa token is invalid or not available by @tessus in #5779
Update Rust, Crates and Web-Vault by @BlackDex in #5860
Add totp menu feature flag by @moodejb123 in #5850
Remove Hide Business scss rules by @Timshel in #5855
Toggle providers using class by @Timshel in #5832
Remove old client version check by @Timshel in #5874
web-client now request email 2fa by @Timshel in #5871
Update admin interface by @BlackDex in #5880
Sync with Upstream by @BlackDex in #5798

New Contributors

@bennettmsherman made their first contribution in #5698
@PseudoResonance made their first contribution in #5694
@moodejb123 made their first contribution in #5850

Full Changelog: dani-garcia/vaultwarden@1.33.2...1.34.0

`v1.33.2`

Compare Source

What's Changed

Update workflows and enhance security by @BlackDex in #5537
Update crates & fix CVE-2025-24898 by @dfunkt in #5538
add bulk-access endpoint for collections by @stefan0xC in #5542
Fix icon redirect not working on desktop by @BlackDex in #5536
Show assigned collections on member edit by @BlackDex in #5556

Full Changelog: dani-garcia/vaultwarden@1.33.1...1.33.2

`v1.33.1`

Compare Source

General mention

This release has some minor issues fixed like:

Icon's not working on the Desktop clients
Invites not always working
DUO settings not able to configure
Manager rights
Mobile client sync issues fixed

What's Changed

hide already approved (or declined) auth_requests by @stefan0xC in #5467
let invited members access OrgMemberHeaders by @stefan0xC in #5461
Make sure the icons are displayed correctly in desktop clients by @WinLinux1028 in #5469
Fix passwordRevisionDate format by @BlackDex in #5477
add and use new event types by @stefan0xC in #5482
Fix Duo Field Names for Web Client by @ratiner in #5491
Allow all manager to create collections again by @BlackDex in #5488
Update Rust to 1.84.1 by @dfunkt in #5508

New Contributors

@WinLinux1028 made their first contribution in #5469
@ratiner made their first contribution in #5491

Full Changelog: dani-garcia/vaultwarden@1.33.0...1.33.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from e8d0f2c to e7bcfe0 Compare February 9, 2025 20:25

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.33.1~~ chore(deps): update vaultwarden/server docker tag to v1.33.2 Feb 9, 2025

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from e7bcfe0 to 9de9684 Compare April 28, 2025 17:40

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.33.2~~ chore(deps): update vaultwarden/server docker tag to v1.34.1 May 26, 2025

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from 9de9684 to c32299f Compare May 26, 2025 23:04

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.34.1~~ chore(deps): update vaultwarden/server docker tag to v1.34.2 Jul 27, 2025

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from c32299f to 5b48d61 Compare July 27, 2025 22:35

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from 5b48d61 to 8f14a2d Compare August 7, 2025 11:37

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.34.2~~ chore(deps): update vaultwarden/server docker tag to v1.34.3 Aug 7, 2025

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from 8f14a2d to 722eced Compare December 28, 2025 01:48

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.34.3~~ chore(deps): update vaultwarden/server docker tag to v1.35.0 Dec 28, 2025

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.35.0~~ chore(deps): update vaultwarden/server docker tag to v1.35.1 Dec 30, 2025

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from 722eced to da5959f Compare December 30, 2025 18:49

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from da5959f to 33b5921 Compare January 9, 2026 21:36

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.35.1~~ chore(deps): update vaultwarden/server docker tag to v1.35.2 Jan 9, 2026

nzbr force-pushed the main branch from a0033e1 to abd6a4a Compare January 11, 2026 02:15

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from 33b5921 to 147d667 Compare February 2, 2026 18:54

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.35.2~~ chore(deps): update vaultwarden/server docker tag to v1.35.3 Feb 10, 2026

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from 147d667 to 1b96313 Compare February 10, 2026 21:37

chore(deps): update vaultwarden/server docker tag to v1.35.4

6f95ad4

renovate bot changed the title ~~chore(deps): update vaultwarden/server docker tag to v1.35.3~~ chore(deps): update vaultwarden/server docker tag to v1.35.4 Feb 24, 2026

renovate bot force-pushed the renovate/vaultwarden-server-1.x branch from 1b96313 to 6f95ad4 Compare February 24, 2026 01:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update vaultwarden/server docker tag to v1.35.4#68

chore(deps): update vaultwarden/server docker tag to v1.35.4#68
renovate[bot] wants to merge 1 commit intomainfrom
renovate/vaultwarden-server-1.x

renovate bot commented Feb 3, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Feb 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Security Fixes

What's Changed

New Contributors

Security Fixes

What's Changed

Notable changes

What's Changed

Notable changes

What's Changed

Notable changes

What's Changed

New Contributors

Notable changes

What's Changed

Notable changes

What's Changed

New Contributors

What's Changed

Notable changes

What's Changed

New Contributors

What's Changed

General mention

What's Changed

New Contributors

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Feb 3, 2025 •

edited

Loading