From c6f86f223b6a0acf09568b7d79ea09ed09004968 Mon Sep 17 00:00:00 2001 From: Chris Alfano Date: Tue, 25 Aug 2026 12:11:05 -0400 Subject: [PATCH] chore(vaultwarden): bump app image to v1.37.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Required for Bitwarden clients v2026.7.0+ (1.37.0) and v2026.8.0+ (1.37.2) — auto-updated browser extensions can no longer authenticate against 1.36.0. See dani-garcia/vaultwarden#7615. Also picks up eight medium-severity security fixes in 1.37.0 (SSRF via icon endpoint, cross-org cipher access, org policy bypass on directory import, Send access-count bypass, unauthenticated WebSocket flooding DoS, cross-org secret sharing, org import authorization, org data enumeration via Manager role). Notes: - Schema migrations run on startup and are not reversible; rollback requires restoring the database from a restic snapshot. Verified snapshot f5440783 (2026-08-25 15:40 UTC) before this change. - 1.37.0 adds per-IP rate limiting on unauthenticated endpoints. We route via Envoy Gateway, which sets x-forwarded-for rather than the x-real-ip that vaultwarden's IP_HEADER defaults to. Watch for client-IP warnings after rollout; may need IP_HEADER set. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01MSNAVVDuF46SMHjnyfmxwU --- vaultwarden/release-values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vaultwarden/release-values.yaml b/vaultwarden/release-values.yaml index 07a2976..bf0e41e 100644 --- a/vaultwarden/release-values.yaml +++ b/vaultwarden/release-values.yaml @@ -4,7 +4,7 @@ # override version until https://github.com/gissilabs/charts/issues/31 image: - tag: 1.36.0 + tag: 1.37.2 # Routing is handled by Envoy Gateway — see _gateways/vaultwarden.yaml. # vaultwarden.domain below is set explicitly, so DOMAIN survives this.