12 releases 12 tags

RSS feed

• v1.36.10 e8560c2482

  Compare

  Vaultwarden-Plus v1.36.10 Stable

  StefanSA released this 2026-07-29 10:53:40 +02:00 | 1 commits to main since this release

  Vaultwarden-Plus v1.36.10

  Release date: 2026-07-29

  Status: PASS

  Highlights

  • Consolidates the Vaultwarden 1.37.0 / Web Vault 2026.6.4 baseline without adding product features, dependencies, migrations, or workflow changes.
  • Makes Rust JWT tests independent of suite ordering by providing one lazily initialized, test-only RSA keypair while leaving production key loading unchanged.
  • Moves the isolated Playwright Vaultwarden fixture to HTTPS and validates the complete Account Recovery flow from enrollment through recovered-password login.

  Adapter Baseline

  • The obsolete Recovery browser adapter remains removed because Web Vault 2026.6.4 implements the current recovery requests natively.
  • Branding and device-login approver adapters remain intentionally Plus-specific.
  • Direct /recover-account, legacy /reset-password, Passkey/PRF, Trusted Devices, Authentication Requests, Device Login, and Send Email Verification/OTP compatibility remain required and unchanged.

  Validation

  • cargo fmt --check and git diff --check pass.
  • The full unfiltered locked SQLite Rust suite passes in forgejo-rust-node:1.97.1: 237 passed, 0 failed, 0 ignored, and 0 filtered, without deadlock, signal termination, or SIGSEGV.
  • Locked SQLite, MySQL/MariaDB, PostgreSQL, and sqlite,ses checks pass in forgejo-rust-node:1.97.1.
  • Focused Plus Rust/API coverage passes for Passkey/PRF, Trusted Devices, Authentication Requests, Device Login, Account Recovery, Send access, Send Email OTP, and parallel JWT test-key initialization.
  • The Web Vault 2026.6.4 Account Recovery Playwright E2E passes over the isolated HTTPS fixture, including policy and enrollment, admin recovery, temporary-password login, forced password replacement, and subsequent recovered-password login.
  • Focused Web Vault Plus Playwright coverage passes for packaging, branding, retained adapter contracts, login, and passkey routing.
  • The final release container builds successfully and its runtime health endpoint passes using the same image published to the registry.

  Security

  • Production RSA key loading and production TLS guidance are unchanged.
  • The HTTPS certificate and lower test KDF cost are confined to the isolated Playwright fixture.
  • No hardening from v1.36.4 through v1.36.8 is removed or weakened.

  Image

  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.10
  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest

  Migration

  • Database migration: NO
  • Configuration migration: NO
  • Product behavior change: NO

  Residual Risks

  • Provider-specific Account Recovery, Key Connector recovery, and broader custom-role parity remain outside the supported core flow.
  • Desktop and mobile passkey-login coverage remains narrower than Web Vault and official Chromium Extension coverage.
  • The device-login approval adapter remains an explicitly non-token-issuing prototype.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads