StefanSA/vaultwarden-plus
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 12 Packages 1 Wiki Activity Actions
12 releases 12 tags
  • v1.36.11 c86f861af4

    Vaultwarden-Plus v1.36.11
    All checks were successful
    auto-image-build / docker-build (push) Successful in 3m31s
    Details
    ci / rust-checks (push) Successful in 2m53s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 3s
    Details
    Stable

    StefanSA released this 2026-07-30 12:50:27 +02:00 | 0 commits to main since this release

    Vaultwarden-Plus v1.36.11

    Release date: 2026-07-30

    Status: PASS

    Highlights

    • Completes production Device Login through the official durable /api/auth-requests flow and standard /identity/connect/token password grant with authRequest.
    • Guarantees atomic, single-use AuthRequest redemption across SQLite, MySQL/MariaDB, and PostgreSQL without a new migration.
    • Removes the obsolete non-token-issuing Device Login prototype and Web Vault approver adapter after native Web Vault 2026.6.4 end-to-end proof.

    Security Model

    • Redemption fails closed unless user, access code, request device identifier, device type, normalized client IP, approval, expiry, and unused state all match.
    • An atomic approved -> redeeming update permits exactly one token-generation attempt; parallel and replay attempts fail.
    • Successful token completion records redeemed; failed token or two-factor completion returns only the same bound request to approved.
    • Disabled-user, email-verification, two-factor, policy, audit, device, session, refresh-token, and login-rate-limit behavior remains on the standard password-login path.
    • TDAUTH-V2, Trusted Device auto-enrollment, Recovery, Passkey/PRF, Send OTP, SES, DKIM, and branding behavior is unchanged.

    Web Vault And Adapters

    • Native Web Vault 2026.6.4 passes Request, Poll, Approval, Response, Token, Sync, Refresh, and vault access without the Plus approver adapter.
    • The in-memory Device Login prototype routes and DEVICE_LOGIN_PROTOTYPE_ENABLED integration are removed.
    • The branding adapter remains packaged; the Account Recovery adapter remains absent where native handling applies.
    • No Web Vault, dependency, grant-type, token-format, or migration change is included.

    Validation

    • cargo fmt --check and git diff --check pass.
    • The full unfiltered locked Rust suite passes in forgejo-rust-node:1.97.1: 238 passed.
    • Locked SQLite, MySQL/MariaDB, PostgreSQL, and sqlite,ses checks pass.
    • Focused API coverage passes for success, rejection, expiry, wrong user/code/device/type/IP, replay, parallel redemption, and failed-token/TOTP recovery.
    • Native two-context HTTPS Device Login passes without the approver adapter, including token issue, sync, refresh, repeated sync, and vault access.
    • Focused browser coverage passes for account creation, TOTP activation/login/deactivation, Send Email OTP/Sends, and Organization invitation/confirmation with deterministic multi-account session isolation.
    • Recovery E2E, Web Vault packaging, container build, cache reuse, and runtime health remain green from the same unchanged product state.

    Image

    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.11
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest

    Migration

    • Database migration: NO
    • Configuration migration: NO
    • Product behavior change: YES; Device Login now issues standard Access-/Refresh-Token sessions through the official AuthRequest flow.

    Residual Risks

    • The separate TDAUTH-V2 trusted-device auto-enrollment/dedicated-redemption track remains prototype-gated.
    • Device Login browser proof covers official Web Vault 2026.6.4; desktop and mobile end-to-end coverage remains outside this release.
    • The multi-account Organization browser test requires an extended local timeout because Web Vault performs several native KDF operations sequentially.
    Downloads
  • v1.36.10 e8560c2482

    Vaultwarden-Plus v1.36.10
    All checks were successful
    auto-image-build / docker-build (push) Successful in 24m50s
    Details
    ci / rust-checks (push) Successful in 2m41s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 3s
    Details
    Stable

    StefanSA released this 2026-07-29 10:53:40 +02:00 | 1 commits to main since this release

    Vaultwarden-Plus v1.36.10

    Release date: 2026-07-29

    Status: PASS

    Highlights

    • Consolidates the Vaultwarden 1.37.0 / Web Vault 2026.6.4 baseline without adding product features, dependencies, migrations, or workflow changes.
    • Makes Rust JWT tests independent of suite ordering by providing one lazily initialized, test-only RSA keypair while leaving production key loading unchanged.
    • Moves the isolated Playwright Vaultwarden fixture to HTTPS and validates the complete Account Recovery flow from enrollment through recovered-password login.

    Adapter Baseline

    • The obsolete Recovery browser adapter remains removed because Web Vault 2026.6.4 implements the current recovery requests natively.
    • Branding and device-login approver adapters remain intentionally Plus-specific.
    • Direct /recover-account, legacy /reset-password, Passkey/PRF, Trusted Devices, Authentication Requests, Device Login, and Send Email Verification/OTP compatibility remain required and unchanged.

    Validation

    • cargo fmt --check and git diff --check pass.
    • The full unfiltered locked SQLite Rust suite passes in forgejo-rust-node:1.97.1: 237 passed, 0 failed, 0 ignored, and 0 filtered, without deadlock, signal termination, or SIGSEGV.
    • Locked SQLite, MySQL/MariaDB, PostgreSQL, and sqlite,ses checks pass in forgejo-rust-node:1.97.1.
    • Focused Plus Rust/API coverage passes for Passkey/PRF, Trusted Devices, Authentication Requests, Device Login, Account Recovery, Send access, Send Email OTP, and parallel JWT test-key initialization.
    • The Web Vault 2026.6.4 Account Recovery Playwright E2E passes over the isolated HTTPS fixture, including policy and enrollment, admin recovery, temporary-password login, forced password replacement, and subsequent recovered-password login.
    • Focused Web Vault Plus Playwright coverage passes for packaging, branding, retained adapter contracts, login, and passkey routing.
    • The final release container builds successfully and its runtime health endpoint passes using the same image published to the registry.

    Security

    • Production RSA key loading and production TLS guidance are unchanged.
    • The HTTPS certificate and lower test KDF cost are confined to the isolated Playwright fixture.
    • No hardening from v1.36.4 through v1.36.8 is removed or weakened.

    Image

    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.10
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest

    Migration

    • Database migration: NO
    • Configuration migration: NO
    • Product behavior change: NO

    Residual Risks

    • Provider-specific Account Recovery, Key Connector recovery, and broader custom-role parity remain outside the supported core flow.
    • Desktop and mobile passkey-login coverage remains narrower than Web Vault and official Chromium Extension coverage.
    • The device-login approval adapter remains an explicitly non-token-issuing prototype.
    Downloads
  • v1.36.9 9ae7d862e8

    Vaultwarden-Plus v1.36.9
    All checks were successful
    auto-image-build / docker-build (push) Successful in 21m45s
    Details
    ci / rust-checks (push) Successful in 2m43s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 3s
    Details
    Stable

    StefanSA released this 2026-07-28 13:56:14 +02:00 | 2 commits to main since this release

    Vaultwarden-Plus v1.36.9

    Date: 2026-07-28

    Status: PASS

    Highlights

    • Bundles upstream Web Vault 2026.6.4 from immutable manifest sha256:e7d3b31ec6a991a6bf447721ea341b4192ce5d3b920929211672fd4f3f891427.
    • Preserves the Vaultwarden 1.37.0 and Vaultwarden-Plus v1.36.4-v1.36.8 security baseline.
    • Uses Web Vault 2026.6.4 native Account Recovery requests and removes the obsolete recovery browser adapter.
    • Retains the Plus branding and device-login approver adapters.
    • Integrates upstream Vaultwarden #7442 for [bit-dialog] custom-role markup.

    Compatibility

    • Account Recovery retains direct /recover-account, legacy /reset-password, resetMasterPassword=true, resetTwoFactor=false, forced temporary-password update, and subsequent-login behavior.
    • Web Vault 2026.6.4 can selectively reset master password, two-step login, or both through the native recovery dialog.
    • Passkey Login and PRF unlock retain the official Web Vault request/response surface and remain feature-gated where configured.
    • Trusted Device, Authentication Request, and Device Login prototype contracts remain server-side compatible; prototype behavior remains disabled by default.
    • Send Email Verification/OTP retains legacy and bearer-token access behavior for email-protected text and file Sends.
    • Login, registration, organization, Send, and Bitwarden 2026.7.x request compatibility remain on the Vaultwarden-Plus 1.37.0 baseline.

    Build And Packaging

    • The Web Vault image remains tag-and-digest pinned.
    • A dedicated vault_plus build stage applies and packages the retained adapters without invoking the Rust stage.
    • A repeated vault_plus build uses cached source, adapter copy, and injection layers.
    • The final release image is built once and reused for runtime validation and registry publication.

    Validation

    • Complete Bitwarden clients tag delta: 2,859 changed files, including 561 apps/web files and 1,255 shared-library files.
    • Complete bw_web_builds tag delta and Vaultwarden #7442 patch reviewed.
    • Web Vault adapter-stage build and static packaging passed.
    • Native recovery and passkey markers are present in the packaged bundle.
    • Branding and approver adapter syntax and runtime packaging passed; the removed recovery adapter is absent.
    • Rust fmt, locked SQLite/MySQL/PostgreSQL/sqlite,ses checks, and the full locked SQLite test suite passed in forgejo-rust-node:1.97.1.
    • Focused Playwright Web Vault integration coverage is included for static packaging, branding, adapter contracts, login, and passkey routing.
    • The focused SQLite Playwright integration passes. The broader legacy suite was attempted but its account-creation fixture is parked because the Web Vault 2026.6.4 SDK rejects the harness's insecure HTTP registration URL before issuing an API request; this fixture-only limitation does not block the release.
    • Container runtime health and release publication use the same validated image and commit.

    Security

    • No authentication, cryptographic, session, token, or recovery server semantics were weakened.
    • The recovery browser shim was removed only after its request rewrite/defaulting behavior became native in Web Vault 2026.6.4.
    • Legacy compatibility remains server-side, where it is covered by focused Rust request-contract tests.
    • Unsupported Custom Role controls remain hidden for both legacy <bit-dialog> and new [bit-dialog] hosts.

    Image

    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.9
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest

    Migration

    • Database migration: NO.
    • Configuration migration: NO.
    • Operators using custom branding or the device-login prototype do not need to change configuration.

    Residual Risks

    • Provider-specific Account Recovery, Key Connector recovery, and broader custom-role parity remain outside the supported core flow.
    • Desktop and mobile passkey-login coverage remains narrower than Web Vault and official Chromium Extension coverage.
    • The device-login approval adapter remains an explicitly non-token-issuing prototype.
    • Full browser Account Recovery/login/organization regression remains limited by the parked insecure-HTTP signup fixture; focused browser, static package, API contract, and Rust validation passed.
    Downloads
  • v1.36.8 c57c03f3f3

    Vaultwarden-Plus v1.36.8
    All checks were successful
    auto-image-build / docker-build (push) Successful in 27m18s
    Details
    ci / rust-checks (push) Successful in 2m42s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 3s
    Details
    Stable

    StefanSA released this 2026-07-28 12:06:46 +02:00 | 3 commits to main since this release

    Vaultwarden-Plus v1.36.8

    Rust toolchain and dependency convergence release published directly from validated commit c57c03f3f319362026e221d7b18c6de6aa83fe83.

    Toolchain and Dependencies

    • Converged directly on the final Vaultwarden 1.37.0 dependency and toolchain state from upstream #7200, #6127, #7406, #7453, and #7470.
    • Updated the canonical Rust toolchain and Forgejo Rust runner to Rust 1.97.1.
    • Migrated the workspace to Edition 2024 while retaining the upstream 1.95.0 minimum supported Rust version.
    • Updated the final upstream Cargo dependency graph and lockfile, including Reqwest 0.13, Cached 2, OpenDAL 0.57, Diesel 2.3.11, JsonWebToken 11, Tokio 1.53, and associated transitive dependencies.
    • Updated the Debian and musl build images to Rust 1.97.1, the Alpine runtime to 3.24, and musl target selection to CARGO_BUILD_TARGET.

    Vaultwarden-Plus Adaptations

    • Preserved the Plus-only SES feature and aws-sdk-sesv2 dependency on the final common AWS SDK graph.
    • Preserved Lettre DKIM and all SMTP/sendmail/mail-hardening behavior.
    • Added explicit, idempotent Ring crypto-provider initialization for the combined Reqwest 0.13, Rustls, OpenDAL, and SES graph.
    • Adapted Cached 2 macro syntax and OIDC's direct Reqwest integration without changing functional API behavior.
    • Preserved Account Recovery, Passkey Login/PRF, Trusted Devices, Authentication Requests, Device Login, and Send Email OTP.
    • Preserved Forgejo-native workflows and BuildKit caching.

    Scope Boundaries

    • Web Vault remains pinned to 2026.4.1 with the existing immutable digest.
    • Existing Web Vault adapters are unchanged.
    • No GitHub Actions, unrelated API features, or database migrations are included.

    Validation

    • Release target: c57c03f3f319362026e221d7b18c6de6aa83fe83.
    • Formatting and whitespace checks passed in forgejo-rust-node:1.97.1.
    • Locked SQLite, MySQL/MariaDB, PostgreSQL, and sqlite,ses Cargo checks passed.
    • Focused dependency, authentication, organization, Send, mail, SSO, Passkey, Trusted Device, Account Recovery, and Device Login tests passed.
    • Optimized release builds passed separately for SQLite, MySQL/MariaDB, and PostgreSQL.
    • Cargo metadata, lockfile source/checksum validation, and dependency-tree resolution passed.
    • The Debian container build and runtime healthcheck smoke test passed.
    • Forgejo auto-image-build.yml, ci.yml, and validate-publish-surface.yml completed successfully for the release target.
    • The successful CI image is reused for release artifacts and Registry tags; no duplicate release build is performed.

    Images

    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.8
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:c57c03f3f319
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest
    Downloads
  • v1.36.7 67a5176b7a

    Vaultwarden-Plus v1.36.7
    All checks were successful
    auto-image-build / docker-build (push) Successful in 21m23s
    Details
    ci / rust-checks (push) Successful in 2m41s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 4s
    Details
    Stable

    StefanSA released this 2026-07-28 08:34:14 +02:00 | 4 commits to main since this release

    Vaultwarden-Plus v1.36.7

    SSO and OIDC compatibility release published directly from the validated Vaultwarden-Plus commit 67a5176b7a3cc6bd3dfa730a1edd1b80171d1bc3.

    SSO and OIDC Compatibility

    • Integrated the remaining Vaultwarden 1.37.0 SSO authorization-response compatibility from upstream #7197.
    • Persisted OIDC provider errors in pending SSO authorization records so compatible error responses survive the redirect and token-exchange boundary.
    • Added OIDC token-endpoint authentication negotiation from upstream #7357.
    • client_secret_basic remains preferred when advertised; client_secret_post is selected when Basic is unavailable and Post is supported.
    • Discovery documents without token-endpoint authentication metadata retain the existing library-default behavior.
    • Unsupported advertised authentication methods are rejected cleanly.

    Database Migration

    • Added the nullable sso_auth.code_response_error column.
    • Migration up/down behavior and the complete migration chain were validated on SQLite, MariaDB 10, and PostgreSQL 16.
    • The migration is applied automatically by the existing Vaultwarden-Plus migration mechanism.

    Preserved Vaultwarden-Plus Features

    • Account Recovery
    • Passkey Login and PRF
    • Trusted Devices
    • Authentication Requests
    • Device Login
    • Send Email OTP and its attempt/rate-limit protections
    • SES, DKIM, and mail hardening
    • Forgejo-native workflows
    • Existing SSO browser-binding and login-rate-limit protections

    Validation

    • Release target: 67a5176b7a3cc6bd3dfa730a1edd1b80171d1bc3.
    • Rust validation ran exclusively in forgejo-rust-node:1.95.0.
    • Formatting and whitespace validation passed.
    • SQLite, MySQL/MariaDB, PostgreSQL, and sqlite,ses compile checks passed.
    • Focused SSO/OIDC, authorization-flow, client_secret_post, error-persistence, migration, login-compatibility, and authentication-failure tests passed.
    • Broader affected authentication, Account Recovery, Passkey, Trusted Devices, Device Login, two-factor, and mail regressions passed.
    • Forgejo auto-image-build.yml, ci.yml, and validate-publish-surface.yml completed successfully for the release target.
    • No Rust/toolchain, Edition 2024, dependency, Web Vault, Dockerfile, or GitHub workflow changes are included.
    • The successful CI image build is reused for all release artifacts and Registry tags; no duplicate image build is performed.

    Images

    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.7
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:67a5176b7a3c
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest
    Downloads
  • v1.36.6 f0228cccfd

    Vaultwarden-Plus v1.36.6
    All checks were successful
    auto-image-build / docker-build (push) Successful in 21m36s
    Details
    ci / rust-checks (push) Successful in 2m45s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 4s
    Details
    Stable

    StefanSA released this 2026-07-27 15:12:59 +02:00 | 5 commits to main since this release

    Vaultwarden-Plus v1.36.6

    Client-compatibility maintenance release for Bitwarden 2026.7.x clients, published directly from the validated Vaultwarden-Plus commit.

    Client Compatibility

    • Added Bitwarden 2026.7.x API compatibility while retaining the existing Vaultwarden-Plus architecture.
    • Added current prelogin kdfSettings and salt fields while preserving legacy KDF response fields.
    • Updated /api/config compatibility, including the supported server version contract, onboarding setting, and communication field.
    • Added Bank Account, Driver's License, and Passport cipher-type compatibility.
    • Added collection type and defaultUserCollectionEmail response compatibility.
    • Added user accountKeys responses and current organization capability flags.
    • Added the vNext organization-member restore route, Apple application-site association response, Linux biometrics feature flag, and CLI email two-factor compatibility.
    • Removed the obsolete cipher data response wrapper and obsolete required KDF-change fields.
    • Hardened database URL classification so malformed connection URLs cannot silently fall back to a new SQLite database.

    Security and Preserved Features

    • No security regressions were identified in focused or broader affected regression testing.
    • The v1.36.5 security hardening remains intact.
    • Account Recovery, Passkey Login/PRF, Trusted Devices, Authentication Requests, Device Login, Send Email OTP, SES, DKIM, and mail hardening remain preserved.

    Validation Notes

    • Release target: f0228cccfd1b5cdc8896c871ba36448c71382eb0.
    • Rust formatting and SQLite, MySQL/MariaDB, PostgreSQL, and sqlite,ses compile checks passed.
    • Focused Bitwarden 2026.7.x compatibility tests and isolated broader affected API/client regressions passed.
    • The existing monolithic test-harness SIGSEGV is unrelated to this compatibility change and does not represent a Rust assertion or compatibility failure.
    • No database schema migration is required.
    • The successful CI image build from the validated commit is reused for the release artifact and all Registry tags; no duplicate image build is performed.

    Images

    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.6
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:f0228cccfd1b
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest
    Downloads
  • v1.36.5 63f4f4ce02

    Vaultwarden-Plus v1.36.5
    Some checks failed
    auto-image-build / docker-build (push) Failing after 2m24s
    Details
    ci / rust-checks (push) Successful in 2m49s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 4s
    Details
    Stable

    StefanSA released this 2026-07-27 13:35:33 +02:00 | 6 commits to main since this release

    Vaultwarden-Plus v1.36.5

    Security maintenance release backporting the applicable hardening from upstream Vaultwarden PR #7472 onto the validated Vaultwarden-Plus v1.36 release line.

    Security Hardening

    • Enforced organization boundaries for cipher, group, collection, membership, and organization-data access.
    • Hardened directory and organization imports with policy enforcement, write authorization, fixed organization targeting, and bounded relationships.
    • Made Send maximum-access-count consumption atomic across SQLite, PostgreSQL, and MySQL/MariaDB.
    • Bounded anonymous WebSocket connections per client address while preserving reconnecting Authentication Request subscribers.
    • Added a shared unauthenticated request limiter without replacing existing login, mail, or Send Email OTP controls.
    • Enforced trusted-proxy validation before accepting client-IP headers.
    • Hardened icon fetching against unsafe schemes, hosts, IP literals, redirects, and DNS rebinding.
    • Required organization or cipher authorization before accepting event-ingestion records.
    • Prevented cross-organization and out-of-range group/collection import relationships.
    • Prevented OIDC response-body logging unless explicit token debugging is enabled.

    Preserved Vaultwarden-Plus Features

    • Account Recovery.
    • Passkey Login and PRF support.
    • Trusted Devices.
    • Authentication Requests.
    • Device Login prototypes.
    • Send Email OTP, including attempt and rate-limit protections.
    • SES, DKIM, and mail hardening.

    Operator Notes

    • New trusted-proxy and unauthenticated-rate-limit settings retain safe defaults.
    • No database schema migration is required.
    • The unrelated attachment test-harness issue is not included in this release.

    Provenance and Validation

    • Release target: 63f4f4ce02a3813ab9c6fea42cd7ab05401b3d2d.
    • Rust formatting, SQLite/MySQL/PostgreSQL compile checks, sqlite,ses, focused security tests, and broader affected tests passed before release.
    • Atomic Send race tests passed against SQLite, MariaDB 10, and PostgreSQL 16.
    • The release image was built once from the validated commit, smoke-tested, then reused for all registry tags and release artifacts.

    Images

    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.5
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:63f4f4ce02a3
    • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest
    Downloads
  • v1.36.4 a402004edd

    Vaultwarden-Plus v1.36.4
    All checks were successful
    auto-image-build / docker-build (push) Successful in 21m36s
    Details
    ci / rust-checks (push) Successful in 2m43s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 3s
    Details
    Stable

    StefanSA released this 2026-07-11 15:41:40 +02:00 | 7 commits to main since this release

    Vaultwarden-Plus v1.36.4

    Security maintenance release for the Send Email Verification OTP flow.

    Security Fix

    • Added Send Email Verification OTP brute-force protection.
    • Enforced a persisted per-challenge attempt limit.
    • Made verification atomic and single-use so a successful OTP cannot be replayed.
    • Added IP-based rate limiting for OTP issuance and verification.
    • Blocked resend after a challenge has exhausted its allowed attempts.
    • No unrelated feature changes are included in this release.

    Validation

    • Released from validated commit a402004edd4ea8d452b60e2080c43222ebce680e.
    • Rust validation and focused Send Email OTP regression coverage completed before release.
    • Release image promoted from the successful CI image for the validated commit; no second full Docker build was run for release publication.
    Downloads
  • v1.36.3 d257ffa8c4

    Vaultwarden-Plus v1.36.3
    All checks were successful
    auto-image-build / docker-build (push) Successful in 21m30s
    Details
    ci / rust-checks (push) Successful in 2m47s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 4s
    Details
    Stable

    StefanSA released this 2026-07-03 09:58:59 +02:00 | 10 commits to main since this release

    Vaultwarden-Plus v1.36.3

    Stable release date: 2026-07-03

    This release promotes the manually validated Organization Account Recovery feature into the public release line while keeping the bundled Web Vault intentionally pinned to 2026.4.1.

    Highlights

    • Organization Account Recovery server implementation is available for enrolled organization members.
    • Web Vault 2026.4.1 integration is validated through the Admin Console recovery flow.
    • Admin Recover Account uses PUT /organizations/{orgId}/users/{memberId}/recover-account.
    • Affected members complete the forced password-reset flow through PUT /accounts/update-temp-password.
    • Legacy password payloads with newMasterPasswordHash and key remain supported.
    • V2 password payloads with authenticationData and unlockData remain supported.
    • 2FA-only recovery requests remain supported through resetTwoFactor=true.
    • The Web Vault adapter now handles legacy /reset-password rewrites, direct /recover-account requests, and fetch(Request) body cloning.

    Security

    • Zero-knowledge constraints remain unchanged: the server does not store plaintext master passwords, plaintext vault keys, plaintext organization private keys, passkey PRF secrets, trusted-device key material, or decrypted vault contents.
    • Recovery requires organization policy support, enrolled recovery material, authorization, and valid recovery payloads.
    • Credential mutation remains fail-closed when the recovery request is malformed or no recovery action is requested.
    • Recovery material, tokens, passwords, encrypted keys, and mail action links must not be logged or committed.

    Compatibility

    • Web Vault intentionally remains on version 2026.4.1.
    • The adapter preserves compatibility with older Web Vault calls that still use /reset-password.
    • The adapter supports current Web Vault 2026.4.1 direct /recover-account calls and request-body handling.
    • Official client compatibility remains the primary release constraint.
    • Remaining non-core differences are still tracked separately:
      • provider-specific behavior
      • custom role permissions
      • Key Connector handling

    Operator Improvements

    • Release image is published as:
      • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.3
      • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest
      • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:<short-sha>
    • Release artifacts:
      • vaultwarden-plus-1.36.3.tar.gz
      • vaultwarden-plus-1.36.3.tar.gz.sha256
    • No database migration or configuration migration is required.
    • SMTP, sendmail, or SES must be configured for recovery notification mail.

    Validation

    • Manual end-to-end validation completed on an isolated local stack with Vaultwarden-Plus, SQLite, and Maildev.
    • Validated:
      • Web Vault loads.
      • Account Recovery policy and enrollment make the Recover Account menu visible.
      • Admin Recover Account completes successfully.
      • Member login enters forced password-reset state.
      • PUT /accounts/update-temp-password completes recovery.
      • Web Vault 2026.4.1 adapter injection works for the observed request path.

    Documentation

    • README.md
    • CHANGELOG.md
    • docs/CHANGELOG.md
    • docs/PROJECT_STATE.md
    • docs/PRODUCT.md
    • docs/MAINTAINER_GUIDE.md
    • docs/upstream/FEATURE_MATRIX.md
    • docs/upstream/UPSTREAM_ISSUE_TRACKER.md
    • docs/releases/2026-07-v1.36.3/RELEASE_NOTES.md

    Deferred

    • Provider-specific account recovery behavior.
    • Custom role manageResetPassword parity.
    • Key Connector account recovery behavior.
    • Web Vault upgrades beyond 2026.4.1 until an accepted upstream artifact is available and separately validated.
    Downloads
  • v1.36.2 2ad1370dcc

    v1.36.2
    All checks were successful
    auto-image-build / docker-build (push) Successful in 21m37s
    Details
    ci / rust-checks (push) Successful in 2m54s
    Details
    validate-publish-surface / validate-publish-surface (push) Successful in 4s
    Details
    Stable

    StefanSA released this 2026-07-01 18:36:06 +02:00 | 22 commits to main since this release

    Hotfix release for attachment downloads.

    Changes:

    • Fixes attachment downloads returning 404 because /api/ciphers/attachment/download?token=... was not registered as an API route.
    • Upload and attachment metadata were unaffected.
    • Valid attachment download tokens now return attachment bytes through the API route.
    • Invalid tokens still fail safely with 404.
    Downloads