chore(deps): update vaultwarden/server docker tag to v1.37.3

[renovate]

This PR contains the following updates:

Package	Update	Change
vaultwarden/server	minor	1.36.0 → 1.37.3

⚠️ This bumps the upstream image (tag + digest) only. Before merging, also bump the Hola bundle version (src/<app>/package.json + src/<app>/src/manifest.json — Hola's semver describes impact on the Hola user, not upstream's number) and review whether the manifest's upgrade/backup blocks need changes. CI regenerates catalog.json on merge.

---

Release Notes

dani-garcia/vaultwarden (vaultwarden/server)

v1.37.3

Compare Source

What's Changed

• Fix password change with newer web-vault by @​BlackDex in #​7634
• chore: remove duplicate "the" in ciphers.rs comment by @​mvanhorn in #​7254
• Ignore reset-password auto-enroll when mail is disabled by @​xhon-pelushi in #​7585
• Fix migration for MariaDB 12.2.2 by @​Timshel in #​7265
• Add SSO_SIGNUPS_ALLOWED by @​Timshel in #​7272
• log_event take enum parameter not i32 by @​Timshel in #​7656
• Misc Updates by @​BlackDex in #​7676
• Update rust docker version by @​dani-garcia in #​7689
• Fix organization import failing with missing field groups by @​tom27052006 in #​7699
• Add pm-32413-multi-client-password-management feature flag by @​tom27052006 in #​7677
• Log IP/username on two-factor email-login credential failures by @​crahn in #​7654
• Support admin reset 2fa by @​Timshel in #​7435
• fix(security): revoke 2FA remember tokens when credentials or 2FA change by @​BryanFRD in #​7682
• fix(security): rate limit prelogin and auth request endpoints by @​BryanFRD in #​7681
• fix: Correct invalid comment syntax in .dockerignore by @​niniconi in #​7274
• Update Rust and adjust DockerSettings by @​BlackDex in #​7690
• Route service clients through shared HTTP setup by @​txase in #​7639
• Fix iOS registration token response by @​tom27052006 in #​7714
• Use insert_into when possible by @​Timshel in #​6437
• Fix archiveDate update by @​BlackDex in #​7722

New Contributors

• @​mvanhorn made their first contribution in #​7254
• @​xhon-pelushi made their first contribution in #​7585
• @​crahn made their first contribution in #​7654
• @​BryanFRD made their first contribution in #​7682
• @​niniconi made their first contribution in #​7274

Full Changelog: dani-garcia/vaultwarden@1.37.2...1.37.3

v1.37.2

Compare Source

Note

This update is required for support with clients with version 2026.8.0+, please update before reporting any issues with them.

[!IMPORTANT]
Also read #​7615 for more details if you still have client issues!

What's Changed

• Fix Debian cross-linking with xx-cargo by @​alexliluz in #​7524
• Fix playwright test by @​Timshel in #​7548
• Misc fixes and updates by @​BlackDex in #​7558
• Include user email in successful login logs by @​lmogthb in #​7496
• Fix sendmail executable permission check by @​p-boenisch in #​7483
• add dummy revisionDate by @​stefan0xC in #​7608

New Contributors

• @​alexliluz made their first contribution in #​7524
• @​lmogthb made their first contribution in #​7496
• @​p-boenisch made their first contribution in #​7483

Full Changelog: dani-garcia/vaultwarden@1.37.1...1.37.2

v1.37.1

Compare Source

Note

This patch release resolves the issues with invites.
If you have applied any workaround to fix this locally, please revert those fixes to prevent possible other issues.

I'm sorry that it took some time to check and validate this fix.

Also, this release fixes an issue (#​7475) with all the Alpine based images which are build using https://github.com/BlackDex/rust-musl/.
An issue with the build image OpenSSL compilation is resolved and those are used to build the new alpine tagged containers.

What's Changed

• Always send initOrganization and orgUserHasExistingUser in invite URL by @​vikfox in #​7482
• Indirectly resolved #​7475 by using newer rust-musl build images which had a compilation issue with OpenSSL.

New Contributors

• @​vikfox made their first contribution in #​7482

Full Changelog: dani-garcia/vaultwarden@1.37.0...1.37.1

v1.37.0

Compare Source

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

• SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
• Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
• Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
• Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
• Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
• Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3)
• Organization Import Authorization [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr] (Medium, 4.3)
• Organization Data Enumeration via the Manager role [GHSA-rqf8-2568-r7mc] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

• OpenDAL S3 parameter support by @​txase in #​6127
• Fix SSO Cookie path by @​BlackDex in #​7187
• fix email 2fa for bw cli by @​stefan0xC in #​7225
• sso_auth improvements by @​Timshel in #​7197
• Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @​mfw78 in #​7061
• Switch to xx-cargo by @​dfunkt in #​6640
• Updates and fixes by @​BlackDex in #​7235
• Switch to Edition 2024, more clippy lints, and less macro calls by @​BlackDex in #​7200
• Serve Apple app site association file by @​user71424q in #​7191
• Update Rust, Crates and GHA by @​BlackDex in #​7307
• Fix enforce blocked by @​Timshel in #​7246
• Admin password recovery endpoint change by @​Timshel in #​7270
• fix(sends): emit hideEmail as non-null boolean in sync response by @​kvdb in #​7283
• Org membership delete remove Invitation by @​Timshel in #​7284
• [v2026.5.0] Registration request update by @​Timshel in #​7295
• [v2026.5.0] PutPolicy now using vnext format by @​Timshel in #​7296
• 2026.6.0 send support by @​Timshel in #​7346
• Add SSO_AUTHORIZE_BODY by @​Timshel in #​7357
• Add pm-26340-linux-biometrics-v2 feature flag by @​pilotstew in #​7358
• improve CI by @​TriplEight in #​6991
• Misc updates and fixes by @​BlackDex in #​7406
• Remove old compatibility code by @​Timshel in #​7434
• Fix compilation with newer rust-musl version by @​dfunkt in #​7453
• Fix Custom Role CSS for new dialog markup by @​tom27052006 in #​7442
• Remove unused fields by @​Timshel in #​7458
• Update API response, crates and GHA by @​BlackDex in #​7470
• Trusted proxy support, unauthenticated rate limit & other fixes by @​dani-garcia in #​7472

New Contributors

• @​mfw78 made their first contribution in #​7061
• @​user71424q made their first contribution in #​7191
• @​kvdb made their first contribution in #​7283
• @​pilotstew made their first contribution in #​7358
• @​TriplEight made their first contribution in #​6991
• @​tom27052006 made their first contribution in #​7442

Full Changelog: dani-garcia/vaultwarden@1.36.0...1.37.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.