12 releases 12 tags

RSS feed

• v1.36.5 63f4f4ce02

  Compare

  Vaultwarden-Plus v1.36.5 Stable

  StefanSA released this 2026-07-27 13:35:33 +02:00 | 6 commits to main since this release

  Vaultwarden-Plus v1.36.5

  Security maintenance release backporting the applicable hardening from upstream Vaultwarden PR #7472 onto the validated Vaultwarden-Plus v1.36 release line.

  Security Hardening

  • Enforced organization boundaries for cipher, group, collection, membership, and organization-data access.
  • Hardened directory and organization imports with policy enforcement, write authorization, fixed organization targeting, and bounded relationships.
  • Made Send maximum-access-count consumption atomic across SQLite, PostgreSQL, and MySQL/MariaDB.
  • Bounded anonymous WebSocket connections per client address while preserving reconnecting Authentication Request subscribers.
  • Added a shared unauthenticated request limiter without replacing existing login, mail, or Send Email OTP controls.
  • Enforced trusted-proxy validation before accepting client-IP headers.
  • Hardened icon fetching against unsafe schemes, hosts, IP literals, redirects, and DNS rebinding.
  • Required organization or cipher authorization before accepting event-ingestion records.
  • Prevented cross-organization and out-of-range group/collection import relationships.
  • Prevented OIDC response-body logging unless explicit token debugging is enabled.

  Preserved Vaultwarden-Plus Features

  • Account Recovery.
  • Passkey Login and PRF support.
  • Trusted Devices.
  • Authentication Requests.
  • Device Login prototypes.
  • Send Email OTP, including attempt and rate-limit protections.
  • SES, DKIM, and mail hardening.

  Operator Notes

  • New trusted-proxy and unauthenticated-rate-limit settings retain safe defaults.
  • No database schema migration is required.
  • The unrelated attachment test-harness issue is not included in this release.

  Provenance and Validation

  • Release target: 63f4f4ce02a3813ab9c6fea42cd7ab05401b3d2d.
  • Rust formatting, SQLite/MySQL/PostgreSQL compile checks, sqlite,ses, focused security tests, and broader affected tests passed before release.
  • Atomic Send race tests passed against SQLite, MariaDB 10, and PostgreSQL 16.
  • The release image was built once from the validated commit, smoke-tested, then reused for all registry tags and release artifacts.

  Images

  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.5
  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:63f4f4ce02a3
  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • RELEASE_NOTES.md
    2 downloads · 2026-07-27 14:06:06 +02:00 · 2.3 KiB
  • RELEASE_NOTES.md.sha256
    3 downloads · 2026-07-27 14:06:07 +02:00 · 83 B
  • vaultwarden-plus-1.36.5.tar.gz
    1 download · 2026-07-27 14:06:29 +02:00 · 77 MiB
  • vaultwarden-plus-1.36.5.tar.gz.sha256
    3 downloads · 2026-07-27 14:06:29 +02:00 · 97 B