2026.6.0 send support by Timshel · Pull Request #7346 · dani-garcia/vaultwarden

Timshel · 2026-06-17T17:49:05Z

With 2026.6.0 the client now start by requiring an access_token.

Some remarks:

Added auth/send.rs since I though that auth.rs was already long enough.
Added the silent property to the Error to be use ErrorKind::Json without logging the error.
Probably could be injected in some place like the Error::empty but wanted to keep modifications to a minimum.

While adding another set of optional values to ConnectData I wondered if it could be converted to an Enum with a value for each grant_type ? I think it would be cleaner, but maybe I'm missing something ?

BlackDex · 2026-06-21T13:21:24Z

@Timshel, which clients btw? I seem to be able to use the old implementation using the web-vault just fine.
I have not tested other clients yet though.

Timshel · 2026-06-21T14:00:45Z

@BlackDex Hum 🤔
It was changed in the client I built based on 2026.6.0 (EX: https://github.com/Timshel/oidc_web_vault/releases/tag/v2026.6.0-3)

BlackDex · 2026-06-21T14:25:42Z

Could be a PR/Commit has been missed on our side then? @stefan0xC?
I used the artifact from here: https://github.com/dani-garcia/bw_web_builds/actions/runs/27478766767

Timshel · 2026-06-21T14:38:57Z

Hum both client appears to be based on Timshel/oidc_web_vault@924ba4b / vaultwarden/vw_web_builds@924ba4b

stefan0xC · 2026-06-21T14:49:31Z

I think creation works just fine the problem is viewing the send? I get an error
[2026-06-21 16:46:53.209][vaultwarden::api::identity][ERROR] Invalid type. send_access

Timshel · 2026-06-21T14:51:59Z

A yes sorry was not clear in the issue the problem is with viewing 😅

BlackDex · 2026-06-21T15:20:21Z

Strange, didn't had issue with that either.
Maybe i still had the old vault loaded then?

BlackDex

LGTM, apart from a few questions.

… ➔ 1.37.0) (#418) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/dani-garcia/vaultwarden](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0` → `1.37.0` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (ghcr.io/dani-garcia/vaultwarden)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](dani-garcia/vaultwarden@1.36.0...1.37.0) ##### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. ##### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. ##### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](dani-garcia/vaultwarden#6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](dani-garcia/vaultwarden#7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](dani-garcia/vaultwarden#7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](dani-garcia/vaultwarden#7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](dani-garcia/vaultwarden#7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](dani-garcia/vaultwarden#6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](dani-garcia/vaultwarden#7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](dani-garcia/vaultwarden#7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](dani-garcia/vaultwarden#7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](dani-garcia/vaultwarden#7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](dani-garcia/vaultwarden#7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](dani-garcia/vaultwarden#7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](dani-garcia/vaultwarden#7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](dani-garcia/vaultwarden#7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](dani-garcia/vaultwarden#7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](dani-garcia/vaultwarden#7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](dani-garcia/vaultwarden#7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](dani-garcia/vaultwarden#7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](dani-garcia/vaultwarden#7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](dani-garcia/vaultwarden#6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](dani-garcia/vaultwarden#7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](dani-garcia/vaultwarden#7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](dani-garcia/vaultwarden#7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](dani-garcia/vaultwarden#7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](dani-garcia/vaultwarden#7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](dani-garcia/vaultwarden#7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](dani-garcia/vaultwarden#7472) ##### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](dani-garcia/vaultwarden#7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](dani-garcia/vaultwarden#7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](dani-garcia/vaultwarden#7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](dani-garcia/vaultwarden#7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](dani-garcia/vaultwarden#6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](dani-garcia/vaultwarden#7442) **Full Changelog**: <dani-garcia/vaultwarden@1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/418

…(#558) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/vaultwarden/server](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0` → `1.37.0` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (quay.io/vaultwarden/server)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](dani-garcia/vaultwarden@1.36.0...1.37.0) #### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. #### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. #### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](dani-garcia/vaultwarden#6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](dani-garcia/vaultwarden#7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](dani-garcia/vaultwarden#7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](dani-garcia/vaultwarden#7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](dani-garcia/vaultwarden#7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](dani-garcia/vaultwarden#6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](dani-garcia/vaultwarden#7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](dani-garcia/vaultwarden#7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](dani-garcia/vaultwarden#7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](dani-garcia/vaultwarden#7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](dani-garcia/vaultwarden#7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](dani-garcia/vaultwarden#7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](dani-garcia/vaultwarden#7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](dani-garcia/vaultwarden#7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](dani-garcia/vaultwarden#7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](dani-garcia/vaultwarden#7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](dani-garcia/vaultwarden#7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](dani-garcia/vaultwarden#7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](dani-garcia/vaultwarden#7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](dani-garcia/vaultwarden#6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](dani-garcia/vaultwarden#7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](dani-garcia/vaultwarden#7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](dani-garcia/vaultwarden#7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](dani-garcia/vaultwarden#7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](dani-garcia/vaultwarden#7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](dani-garcia/vaultwarden#7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](dani-garcia/vaultwarden#7472) #### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](dani-garcia/vaultwarden#7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](dani-garcia/vaultwarden#7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](dani-garcia/vaultwarden#7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](dani-garcia/vaultwarden#7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](dani-garcia/vaultwarden#6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](dani-garcia/vaultwarden#7442) **Full Changelog**: <dani-garcia/vaultwarden@1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [vaultwarden/server](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0` → `1.37.0` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (vaultwarden/server)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](dani-garcia/vaultwarden@1.36.0...1.37.0) #### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. #### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. #### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](dani-garcia/vaultwarden#6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](dani-garcia/vaultwarden#7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](dani-garcia/vaultwarden#7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](dani-garcia/vaultwarden#7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](dani-garcia/vaultwarden#7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](dani-garcia/vaultwarden#6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](dani-garcia/vaultwarden#7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](dani-garcia/vaultwarden#7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](dani-garcia/vaultwarden#7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](dani-garcia/vaultwarden#7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](dani-garcia/vaultwarden#7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](dani-garcia/vaultwarden#7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](dani-garcia/vaultwarden#7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](dani-garcia/vaultwarden#7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](dani-garcia/vaultwarden#7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](dani-garcia/vaultwarden#7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](dani-garcia/vaultwarden#7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](dani-garcia/vaultwarden#7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](dani-garcia/vaultwarden#7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](dani-garcia/vaultwarden#6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](dani-garcia/vaultwarden#7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](dani-garcia/vaultwarden#7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](dani-garcia/vaultwarden#7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](dani-garcia/vaultwarden#7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](dani-garcia/vaultwarden#7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](dani-garcia/vaultwarden#7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](dani-garcia/vaultwarden#7472) #### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](dani-garcia/vaultwarden#7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](dani-garcia/vaultwarden#7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](dani-garcia/vaultwarden#7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](dani-garcia/vaultwarden#7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](dani-garcia/vaultwarden#6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](dani-garcia/vaultwarden#7442) **Full Changelog**: <dani-garcia/vaultwarden@1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://forgejo.internal/forgejo_admin/infra-personal/pulls/126 Co-authored-by: Renovate Bot <renovatebot@forgejo.internal> Co-committed-by: Renovate Bot <renovatebot@forgejo.internal>

… ➔ 1.37.0) (#418) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/dani-garcia/vaultwarden](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0` → `1.37.0` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (ghcr.io/dani-garcia/vaultwarden)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](dani-garcia/vaultwarden@1.36.0...1.37.0) ##### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. ##### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. ##### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](dani-garcia/vaultwarden#6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](dani-garcia/vaultwarden#7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](dani-garcia/vaultwarden#7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](dani-garcia/vaultwarden#7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](dani-garcia/vaultwarden#7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](dani-garcia/vaultwarden#6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](dani-garcia/vaultwarden#7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](dani-garcia/vaultwarden#7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](dani-garcia/vaultwarden#7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](dani-garcia/vaultwarden#7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](dani-garcia/vaultwarden#7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](dani-garcia/vaultwarden#7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](dani-garcia/vaultwarden#7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](dani-garcia/vaultwarden#7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](dani-garcia/vaultwarden#7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](dani-garcia/vaultwarden#7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](dani-garcia/vaultwarden#7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](dani-garcia/vaultwarden#7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](dani-garcia/vaultwarden#7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](dani-garcia/vaultwarden#6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](dani-garcia/vaultwarden#7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](dani-garcia/vaultwarden#7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](dani-garcia/vaultwarden#7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](dani-garcia/vaultwarden#7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](dani-garcia/vaultwarden#7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](dani-garcia/vaultwarden#7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](dani-garcia/vaultwarden#7472) ##### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](dani-garcia/vaultwarden#7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](dani-garcia/vaultwarden#7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](dani-garcia/vaultwarden#7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](dani-garcia/vaultwarden#7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](dani-garcia/vaultwarden#6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](dani-garcia/vaultwarden#7442) **Full Changelog**: <dani-garcia/vaultwarden@1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/418

Timshel added 2 commits June 17, 2026 19:34

2026.6.0 send support

64d943b

Prevent creating and editing a Send with email verification

8450af2

Timshel mentioned this pull request Jun 22, 2026

Add Sends email verification support #7363

Open

BlackDex self-assigned this Jun 27, 2026

BlackDex requested changes Jun 27, 2026

View reviewed changes

Comment thread src/api/core/sends.rs Outdated

Comment thread src/auth/send.rs Outdated

Review fixes

5261bd7

Timshel force-pushed the fix/send branch from 8ec5f18 to 5261bd7 Compare June 27, 2026 21:36

BlackDex approved these changes Jun 29, 2026

View reviewed changes

BlackDex merged commit 5c5e8e1 into dani-garcia:main Jul 7, 2026
9 checks passed

Timshel deleted the fix/send branch July 8, 2026 11:33

Navigation Menu

Uh oh!

2026.6.0 send support - #7346

2026.6.0 send support#7346
BlackDex merged 3 commits into
dani-garcia:mainfrom
Timshel:fix/send

Timshel commented Jun 17, 2026

Uh oh!

BlackDex commented Jun 21, 2026

Uh oh!

Timshel commented Jun 21, 2026

Uh oh!

BlackDex commented Jun 21, 2026

Uh oh!

Timshel commented Jun 21, 2026

Uh oh!

stefan0xC commented Jun 21, 2026

Uh oh!

Timshel commented Jun 21, 2026 •

edited

Loading

Uh oh!

BlackDex commented Jun 21, 2026

Uh oh!

BlackDex left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Timshel commented Jun 17, 2026

Uh oh!

BlackDex commented Jun 21, 2026

Uh oh!

Timshel commented Jun 21, 2026

Uh oh!

BlackDex commented Jun 21, 2026

Uh oh!

Timshel commented Jun 21, 2026

Uh oh!

stefan0xC commented Jun 21, 2026

Uh oh!

Timshel commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BlackDex commented Jun 21, 2026

Uh oh!

BlackDex left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Timshel commented Jun 21, 2026 •

edited

Loading