12 releases 12 tags

RSS feed

• v1.36.7 67a5176b7a

  Compare

  Vaultwarden-Plus v1.36.7 Stable

  StefanSA released this 2026-07-28 08:34:14 +02:00 | 4 commits to main since this release

  Vaultwarden-Plus v1.36.7

  SSO and OIDC compatibility release published directly from the validated Vaultwarden-Plus commit 67a5176b7a3cc6bd3dfa730a1edd1b80171d1bc3.

  SSO and OIDC Compatibility

  • Integrated the remaining Vaultwarden 1.37.0 SSO authorization-response compatibility from upstream #7197.
  • Persisted OIDC provider errors in pending SSO authorization records so compatible error responses survive the redirect and token-exchange boundary.
  • Added OIDC token-endpoint authentication negotiation from upstream #7357.
  • client_secret_basic remains preferred when advertised; client_secret_post is selected when Basic is unavailable and Post is supported.
  • Discovery documents without token-endpoint authentication metadata retain the existing library-default behavior.
  • Unsupported advertised authentication methods are rejected cleanly.

  Database Migration

  • Added the nullable sso_auth.code_response_error column.
  • Migration up/down behavior and the complete migration chain were validated on SQLite, MariaDB 10, and PostgreSQL 16.
  • The migration is applied automatically by the existing Vaultwarden-Plus migration mechanism.

  Preserved Vaultwarden-Plus Features

  • Account Recovery
  • Passkey Login and PRF
  • Trusted Devices
  • Authentication Requests
  • Device Login
  • Send Email OTP and its attempt/rate-limit protections
  • SES, DKIM, and mail hardening
  • Forgejo-native workflows
  • Existing SSO browser-binding and login-rate-limit protections

  Validation

  • Release target: 67a5176b7a3cc6bd3dfa730a1edd1b80171d1bc3.
  • Rust validation ran exclusively in forgejo-rust-node:1.95.0.
  • Formatting and whitespace validation passed.
  • SQLite, MySQL/MariaDB, PostgreSQL, and sqlite,ses compile checks passed.
  • Focused SSO/OIDC, authorization-flow, client_secret_post, error-persistence, migration, login-compatibility, and authentication-failure tests passed.
  • Broader affected authentication, Account Recovery, Passkey, Trusted Devices, Device Login, two-factor, and mail regressions passed.
  • Forgejo auto-image-build.yml, ci.yml, and validate-publish-surface.yml completed successfully for the release target.
  • No Rust/toolchain, Edition 2024, dependency, Web Vault, Dockerfile, or GitHub workflow changes are included.
  • The successful CI image build is reused for all release artifacts and Registry tags; no duplicate image build is performed.

  Images

  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.7
  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:67a5176b7a3c
  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • RELEASE_NOTES.md
    2 downloads · 2026-07-28 08:38:38 +02:00 · 2.5 KiB
  • RELEASE_NOTES.md.sha256
    4 downloads · 2026-07-28 08:38:38 +02:00 · 83 B
  • vaultwarden-plus-1.36.7.tar.gz
    1 download · 2026-07-28 08:38:59 +02:00 · 77 MiB
  • vaultwarden-plus-1.36.7.tar.gz.sha256
    4 downloads · 2026-07-28 08:39:00 +02:00 · 97 B