Release-note fact check — dani-garcia/vaultwarden

1.36.0 → 1.37.0 · 27 commits · 90 files · +5809/−4576 · judge: claude-cli/haiku
79minor gaps
86
correctness
claims supported
100
completeness
churn documented
50
risk
100 − flag penalties
repo: Rust 84% · Handlebars 10% · TypeScript 4% · Shell 1% · 1.5 MB code
release cadence ~31 d
baseline (5 rel.): median churn ±817 Churn per release (oldest → newest) 1.35.5: 2228 1.35.6: 29 1.35.7: 9 1.35.8: 817 1.36.0: 1304 · coverage 100% Note coverage % per release (oldest → newest) 1.35.5: 97 1.35.6: 100 1.35.7: 100 1.35.8: 100 1.36.0: 100

Score derivation — components, flag penalties and the hard cap, per SCORING.md

0255075100perfect releaseperfect release100correctness 86 × 0.45 weighted share of claims the diff supportscorrectness 86 × 0.45−6.3completeness 100 × 0.25 churn-weighted share of commits the notes covercompleteness 100 × 0.250risk 50 × 0.3 0 critical × −25 · 5 warn × −10risk 50 × 0.3−1579/100 minor gaps79/100 minor gaps79

Claims at a glance

verified 33partial 1no-evidence 2contradicted 0skipped 9

Risk flags

WARN 2 claim(s) with no supporting evidence in the diff
WARN Vague note "Updates and fixes by @BlackDex in #7235" hides: New API endpoint PUT /organizations/<org_id>/users/<member_id>/restore/vnext added to support Enforce organization data ownership policy (currently ignores defaultUserCollectionName and delegates to standard restore)
src/api/core/organizations.rs
commits: 22f5e049
WARN Vague note "improve CI by @TriplEight in #6991" hides: Supply-chain security hardening: hadolint binary download replaced with pre-bundled Docker action pinned by commit SHA (hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5). Reduces runtime attack surface and ensures reproducible tool versions.
.github/workflows/hadolint.yml
commits: 64d28ab6
WARN Vague note "Misc updates and fixes by @BlackDex in #7406" hides: Major version bump of `cached` crate from 1.1.0 to 2.0.0 and `cached_proc_macro` from 1.1.0 to 2.0.0 — major versions typically carry breaking changes that could affect caching behavior; Multiple AWS SDK crates updated across multiple minor versions (aws-runtime, aws-sdk-sso, aws-sdk-ssooidc, aws-sdk-sts, aws-smithy-* suite) — unclear if vaultwarden uses AWS features or if these introduce functional changes; `actions/checkout` bumped from v6.0.3 to v7.0.0 in all workflows — major version upgrade could alter checkout behavior
Cargo.lock, .github/workflows/*
commits: 169aa5ef
WARN First-time author(s) changing sensitive paths (not seen in the last 5 releases): @txase, @TriplEight, @tom27052006
commits: cdf711bb, 64d28ab6, 660faee6
INFO New dependencies in Cargo.toml: rustls, ipnet, reqsign-aws-v4, reqsign-core
Cargo.toml
commits: cdf711bb, 22f5e049, 1ba2c6a2, d6a3d539, 169aa5ef
INFO Release churn ±10385 is 12.7× the median (±817) of the last 5 releases

Diff map — tile = file, size = changed lines, color = documentation status, amber border = sensitive path, click opens the diff

Cargo.lock ±1754 lines · covered · sensitive: dependencies (click to open the compare view)Cargo.locksrc/db/models/collection.rs ±758 lines · evidence fns: Collection, CollectionUser, CollectionCipher (click to open the compare view)collection.rssrc/db/models/cipher.rs ±720 lines · evidence fns: Cipher (click to open the compare view)cipher.rssrc/api/core/organizations.rs ±420 lines · evidence fns: routes, get_organization, get_auto_enroll_status, get_org_collections, get_org_collections_details, post_bulk_access_collections, post_organization_collection_update, delete_organization_collection, post_organization_collection_delete, bulk_delete_organization_collections (click to open the compare view)organizations.rssrc/config.rs ±411 lines · evidence fns: validate_config, extract_url_origin, extract_url_path, generate_sso_callback_path, generate_icon_service_csp, smtp_convert_deprecated_ssl_options, Config, case_helper (click to open the compare view)config.rssrc/db/models/organization.rs ±400 lines · covered fns: Organization, OrganizationApiKey, Membership (click to open the compare view)organization.rssrc/api/identity.rs ±336 lines · evidence fns: login, _refresh_login, _sso_login, _password_login, authenticated_response, _user_api_key_login, get_device, twofactor_auth, _json_err_twofactor, register_verification_email (click to open the compare view)identity.rssrc/storage.rs ±297 lines · evidence (click to open the compare view)storage.rssrc/api/core/accounts.rs ±293 lines · covered fns: routes, RegisterData, KeysData, is_email_2fa_required, _register, post_set_password, put_avatar, UnlockData, UpdateResetPasswordData, post_rotatekey (click to open the compare view)accounts.rssrc/db/models/group.rs ±267 lines · covered fns: Group, CollectionGroup, GroupUser (click to open the compare view)group.rssrc/db/models/send.rs ±261 lines · evidence fns: Send (click to open the compare view)send.rssrc/api/core/ciphers.rs ±241 lines · evidence fns: purge_trashed_ciphers, sync, update_cipher_from_data, post_ciphers_import, put_cipher_partial, put_cipher_share_selected, share_cipher_by_uuid, save_attachment, post_attachment_share, delete_attachment (click to open the compare view)ciphers.rssrc/auth.rs ±229 lines · covered · sensitive: auth/crypto fns: new, LoginJwtClaims, BasicJwtClaims, generate_admin_claims, generate_send_claims, From, refresh_tokens (click to open the compare view)auth.rsCargo.toml ±226 lines · covered · sensitive: dependencies (click to open the compare view)Cargo.tomlsrc/db/models/user.rs ±160 lines · covered fns: User, Invitation, SsoUser (click to open the compare view)user.rssrc/api/core/sends.rs ±148 lines · evidence fns: routes, purge_sends, SendData, create_send, get_sends, post_send_file_v2, SendFileData, post_send_file_v2_data, post_access, post_access_file (click to open the compare view)sends.rssrc/auth/send.rs ±147 lines · evidence · sensitive: auth/crypto (click to open the compare view)send.rssrc/db/models/org_policy.rs ±144 lines · evidence · sensitive: auth/crypto fns: OrgPolicy (click to open the compare view)org_policy.rssrc/api/admin.rs ±137 lines · covered fns: new, post_admin_login, get_user_or_404, users_overview, deauth_user, resend_user_invite, update_membership_type, has_http_access, get_release_info, diagnostics (click to open the compare view)admin.rssrc/api/core/public.rs ±134 lines · evidence fns: ldap_import (click to open the compare view)public.rssrc/http_client.rs ±128 lines · evidence fns: make_http_request, get_reqwest_client_builder, should_block_ip, should_block_address_regex, should_block_host, fmt::Display, CustomDnsResolver, pub (click to open the compare view)http_client.rssrc/api/core/events.rs ±122 lines · covered fns: get_org_events, get_user_events, post_events_collect, log_user_event, log_event, _log_event, event_cleanup_job (click to open the compare view)events.rssrc/error.rs ±118 lines · covered fns: Compact, Error, ApiErrorResponse, _compact_api_error (click to open the compare view)error.rssrc/db/models/emergency_access.rs ±116 lines · covered fns: EmergencyAccess (click to open the compare view)emergency_accesssrc/sso_client.rs ±116 lines · covered · sensitive: auth/crypto fns: RefreshTokenResponse, Client (click to open the compare view)sso_client.rssrc/util.rs ±111 lines · covered fns: Fairing, Cors, get_uuid, get_env_str_value, get_env_bool, validate_and_format_date, is_valid_email, get_active_web_release, NumberOrString, convert_json_key_lcase_first (click to open the compare view)util.rssrc/api/core/mod.rs ±97 lines · covered fns: events_routes, GlobalDomain, EquivDomainData, post_eq_domains, config, accept_org_invite (click to open the compare view)mod.rssrc/api/icons.rs ±93 lines · evidence fns: new, get_icon, get_cached_icon, get_favicons_node, get_page, download_icon, save_icon, FaviconEmitter, Emitter (click to open the compare view)icons.rssrc/api/notifications.rs ±91 lines · evidence fns: new, Drop, WSAnonymousEntryMapGuard, websockets_hub, serialize, WebSocketUsers, create_update (click to open the compare view)notificationsrc/sso.rs ±84 lines · evidence · sensitive: auth/crypto fns: encode_ssotoken_claims, decode_token_claims, authorize_url, OIDCIdentifier, exchange_code, redeem, create_auth_tokens, exchange_refresh_token (click to open the compare view)sso.rssrc/db/models/device.rs ±83 lines · covered fns: DeviceWithAuthRequest, Device (click to open the compare view)device.rssrc/api/core/two_factor/webauthn.rs ±80 lines · covered · sensitive: auth/crypto fns: generate_webauthn_challenge, activate_webauthn, delete_webauthn, generate_webauthn_login (click to open the compare view)webauthn.rssrc/db/models/attachment.rs ±79 lines · covered fns: Attachment (click to open the compare view)attachment.rsplaywright/tests/send.spec.ts ±72 lines · covered (click to open the compare view)send.spec.tssrc/main.rs ±72 lines · covered fns: parse_args, init_logging, launch_rocket, schedule_jobs (click to open the compare view)main.rssrc/db/models/folder.rs ±71 lines · covered fns: Folder, FolderCipher (click to open the compare view)folder.rssrc/db/models/two_factor.rs ±67 lines · covered fns: TwoFactor (click to open the compare view)src/db/models/event.rs ±66 lines · covered fns: Event (click to open the compare view)src/db/models/sso_auth.rs ±66 lines · evidence · sensitive: auth/crypto fns: SsoAuth (click to open the compare view)src/db/models/favorite.rs ±62 lines · covered fns: Favorite (click to open the compare view)src/db/mod.rs ±59 lines · evidence fns: DbConnManager, DbPool, DbConnType, backup_sqlite, get_sql_server_version (click to open the compare view)docker/Dockerfile.debian ±58 lines · evidence · sensitive: ci/build (click to open the compare view)docker/Dockerfile.j2 ±56 lines · evidence · sensitive: ci/build (click to open the compare view)src/mail.rs ±56 lines · covered fns: smtp_transport, get_template, send_verify_email, send_invite_confirmed, send_incomplete_2fa_login, send_protected_action_token, send_with_selected_transport (click to open the compare view)src/api/core/emergency_access.rs ±52 lines · covered fns: get_contacts, get_grantees, post_emergency_access, send_invite, accept_invite, emergency_request_timeout_job, emergency_notification_reminder_job (click to open the compare view)src/db/models/auth_request.rs ±52 lines · covered · sensitive: auth/crypto fns: AuthRequest (click to open the compare view)src/static/scripts/datatables.js ±52 lines · covered (click to open the compare view)src/api/push.rs ±48 lines · covered fns: get_auth_api_token, push_cipher_update, push_folder_update, send_to_push_relay (click to open the compare view)src/api/web.rs ±48 lines · covered fns: app_id, attachments, alive_head, _static_files_dev (click to open the compare view)src/db/models/two_factor_duo_context.rs ±48 lines · covered fns: TwoFactorDuoContext (click to open the compare view)src/api/core/two_factor/email.rs ±47 lines · covered fns: routes, send_email_login, email, validate_email_code_str, EmailTokenData, activate_email_2fa (click to open the compare view)src/db/models/two_factor_incomplete.rs ±45 lines · covered fns: TwoFactorIncomplete (click to open the compare view)src/api/core/two_factor/duo_oidc.rs ±44 lines · covered fns: DuoClient, purge_duo_contexts, get_duo_auth_url, validate_duo_login (click to open the compare view)src/api/core/two_factor/mod.rs ±35 lines · covered fns: has_global_duo_credentials, is_twofactor_provider_usable, get_twofactor, get_recover, enforce_2fa_policy, enforce_2fa_policy_for_org, send_incomplete_2fa_notifications (click to open the compare view)playwright/tests/organization.smtp.spec.ts ±34 lines · covered fns: test (click to open the compare view)src/api/core/two_factor/duo.rs ±33 lines · covered fns: activate_duo, activate_duo_put, parse_duo_values (click to open the compare view)src/db/models/archive.rs ±32 lines · covered fns: Archive (click to open the compare view).github/workflows/release.yml ±30 lines · covered · sensitive: ci/build (click to open the compare view)src/api/core/two_factor/protected_actions.rs ±26 lines · covered fns: ProtectedActionData, ProtectedActionVerify, validate_protected_action_otp (click to open the compare view)src/ratelimit.rs ±26 lines · evidence fns: new, check_limit_login (click to open the compare view).env.template ±25 lines · evidence (click to open the compare view).github/workflows/hadolint.yml ±25 lines · covered · sensitive: ci/build (click to open the compare view)docker/Dockerfile.alpine ±25 lines · covered · sensitive: ci/build (click to open the compare view)src/api/core/two_factor/authenticator.rs ±22 lines · covered · sensitive: auth/crypto fns: activate_authenticator, validate_totp_code (click to open the compare view)src/api/core/two_factor/yubikey.rs ±20 lines · covered fns: YubikeyMetadata, get_yubico_credentials, activate_yubikey (click to open the compare view)src/api/mod.rs ±11 lines · covered fns: PasswordOrOtpData (click to open the compare view)src/db/query_logger.rs ±11 lines · covered fns: simple_logger (click to open the compare view)build.rs ±10 lines · covered · sensitive: ci/build fns: main, run (click to open the compare view)macros/src/lib.rs ±9 lines · covered fns: impl_derive_uuid_macro (click to open the compare view)src/api/core/folders.rs ±9 lines · covered fns: get_folders (click to open the compare view)src/db/models/mod.rs ±9 lines · evidence (click to open the compare view)docker/DockerSettings.yaml ±8 lines · covered (click to open the compare view).github/workflows/zizmor.yml ±6 lines · covered · sensitive: ci/build (click to open the compare view).github/workflows/trivy.yml ±4 lines · covered · sensitive: ci/build (click to open the compare view).github/workflows/typos.yml ±4 lines · covered · sensitive: ci/build (click to open the compare view)macros/Cargo.toml ±4 lines · covered · sensitive: dependencies (click to open the compare view)src/static/scripts/datatables.css ±4 lines · covered (click to open the compare view)src/static/templates/scss/vaultwarden.scss.hbs ±4 lines · evidence · sensitive: auth/crypto (click to open the compare view).github/workflows/build.yml ±2 lines · covered · sensitive: ci/build (click to open the compare view).github/workflows/check-templates.yml ±2 lines · covered · sensitive: ci/build (click to open the compare view).pre-commit-config.yaml ±2 lines · covered · sensitive: ci/build (click to open the compare view)rust-toolchain.toml ±2 lines · covered (click to open the compare view)rustfmt.toml ±2 lines · covered (click to open the compare view)migrations/mysql/2026-05-05-120000_sso_auth_error/down.sql ±1 lines · evidence · sensitive: auth/crypto (click to open the compare view)migrations/mysql/2026-05-05-120000_sso_auth_error/up.sql ±1 lines · evidence · sensitive: auth/crypto (click to open the compare view)migrations/postgresql/2026-05-05-120000_sso_auth_error/down.sql ±1 lines · evidence · sensitive: auth/crypto (click to open the compare view)migrations/postgresql/2026-05-05-120000_sso_auth_error/up.sql ±1 lines · evidence · sensitive: auth/crypto (click to open the compare view)migrations/sqlite/2026-05-05-120000_sso_auth_error/down.sql ±1 lines · evidence · sensitive: auth/crypto (click to open the compare view)migrations/sqlite/2026-05-05-120000_sso_auth_error/up.sql ±1 lines · evidence · sensitive: auth/crypto (click to open the compare view)src/db/schema.rs ±1 lines · covered (click to open the compare view)
cited as evidence in documented commit undocumented unknown sensitive path (border)

Claims in detail

Note

partial This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. 0.60
The diff shows the server API version was bumped from '2025.12.0' to '2026.6.0' and a new API setting 'suppressOnboardingInterstitials' was added, which is consistent with supporting newer clients. However, the evidence does not explicitly demonstrate that this version is *required* for clients 2026.7.0+ — there is no code showing version checks, client compatibility enforcement, or feature gates that prove older versions are incompatible with those clients.
src/db/models/cipher.rs, src/db/models/collection.rs
fns: Cipher, Collection, CollectionUser, CollectionCipher

Security Fixes

skipped This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.
verified SSRF via the icon endpoint GHSA-hw4g-2v3f-74x5 GHSA-vh5m-fc9v-m84g (**Medium**, 5.8 / 6.3) 0.95
New URL validation in `get_page_with_referer()` (http_client.rs) explicitly parses URLs and calls `should_block_host()` to block private/internal IPs; comment states this prevents SSRF via 'IP-literal hrefs from attacker-controlled HTML' bypassing DNS checks. The icon endpoint now calls `get_reqwest_client_builder(true)` to enforce these blocks.
src/http_client.rs, src/api/icons.rs
verified Cross-Organization Cipher Access GHSA-xwf8-pjh7-h589 (**Medium**, 5.9) 0.95
In src/api/core/ciphers.rs lines 439-443, the authorization check for moving a cipher to an organization was changed from `if shared_to_collections.is_some()` to `if shared_to_collections.as_ref().is_some_and(|cols| !cols.is_empty())`. The added comment explicitly states this prevents unauthorized organization access by requiring collections to be non-empty before trusting prior validation. The original condition would incorrectly authorize the move even with an empty collection list, constituti
src/api/core/ciphers.rs
verified Organization Policy Bypass on Directory Import GHSA-88qc-6ch9-mc3j (**Medium**, 5.5) 0.95
In src/api/core/public.rs ldap_import, a new OrgPolicy::check_user_allowed() call enforces org policies on restored members during directory import with explicit comment 'Enforce org policies as every other restore path does'. In src/api/core/organizations.rs post_org_import, client-provided cipher organization_id is replaced with the actual target org ('Replace the client-provided, unvalidated organizationId with the real target org'), preventing users from bypassing org boundaries during impor
src/api/core/public.rs, src/api/core/organizations.rs, src/db/models/org_policy.rs
verified Send Access-Count Bypass GHSA-rxhg-2pw9-vf25 (**Medium**, 5.3) 0.98
The diff implements a fix for a concurrent-access race condition on `access_count`. The new `register_access()` method (src/db/models/send.rs:240–258) combines the limit check and increment into a single atomic SQL UPDATE with a filter clause, preventing multiple concurrent requests from bypassing `max_access_count`—the code comment explicitly states 'The check and the increment are a single statement, otherwise concurrent accesses can both pass the check and exceed the limit.' A new JWT token s
src/db/models/send.rs, src/auth/send.rs, src/api/core/sends.rs
verified Unauthenticated WebSocket Flooding DDOS GHSA-96f7-78q5-j345 (**Medium**, 5.3) 0.95
The diff shows implementation of per-IP connection limiting for anonymous WebSocket subscriptions (AnonymousWebSocketSubscriptions::try_reserve checks MAX_ANONYMOUS_CONNECTIONS_PER_IP and rejects new connections when limit is reached), plus unauthenticated rate-limit checks added to legacy Send access endpoints (crate::ratelimit::check_limit_unauthenticated). These changes directly address DDoS via WebSocket flooding by restricting connection volume from single IP addresses.
src/api/notifications.rs, src/api/core/sends.rs, src/ratelimit.rs
fns: new, Drop, WSAnonymousEntryMapGuard, websockets_hub, serialize, WebSocketUsers, create_update
verified Cross-Organization Secret Sharing GHSA-455c-vgg9-jxw8 (**Medium**, 4.3) 0.87
The diff adds explicit validation in post_bulk_access_collections() that checks if requested groups belong to the organization before granting access, rejecting groups with err("Invalid group", ...). This directly implements cross-organization secret-sharing prevention by validating group membership at the access-control boundary.
src/api/core/organizations.rs
verified Organization Import Authorization GHSA-f3qw-qg77-hmm4 GHSA-jq2g-h4xr-4mcr (**Medium**, 4.3) 0.90
The diff shows multiple authorization-hardening changes in organization import: (1) tightened collection write-permission checks (`is_writable_by_user` replaces `can_access_collection`); (2) forced replacement of client-provided organizationId with the real target org to prevent import into unintended organizations; (3) added OrgPolicy enforcement during LDAP/public import restore; (4) bounds-checked collection relationships to prevent invalid assignments. These directly implement authorization
src/api/core/organizations.rs, src/api/core/public.rs
no-evidence Organization Data Enumeration via the Manager role GHSA-rqf8-2568-r7mc (**Medium**, 4.3) 0.75
The diff shown is primarily database query refactoring (converting db_run! macros to async conn.run() calls) and adding feature flag fields. No permission-check logic changes or access-control restrictions specific to the Manager role are visible. The diff is explicitly truncated, and the changes shown do not demonstrate an implementation that would prevent manager-based organization data enumeration.
src/db/models/organization.rs
skipped These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

verifiedgen OpenDAL S3 parameter support by @txase in #6127 0.90
PR #6127 is in the release range (cdf711bb30); auto-generated entry, title matches the squash commit.
src/config.rs, src/storage.rs
fns: post_access_file, new, smtp_convert_deprecated_ssl_options, Config, Attachment, Send, parse_args, RefreshTokenResponse
commits: cdf711bb
verifiedgen Fix SSO Cookie path by @BlackDex in #7187 0.90
PR #7187 is in the release range (9bc14e6e77); auto-generated entry, title matches the squash commit.
fns: _oidcsignin_redirect, authorize
commits: 9bc14e6e
verifiedgen fix email 2fa for bw cli by @stefan0xC in #7225 0.90
PR #7225 is in the release range (2f85b62d2f); auto-generated entry, title matches the squash commit.
fns: routes, send_email_login
commits: 2f85b62d
verifiedgen sso_auth improvements by @Timshel in #7197 0.90
PR #7197 is in the release range (a057c7deae); auto-generated entry, title matches the squash commit.
migrations/mysql/2026-05-05-120000_sso_auth_error/down.sql, migrations/mysql/2026-05-05-120000_sso_auth_error/up.sql, migrations/postgresql/2026-05-05-120000_sso_auth_error/down.sql, migrations/postgresql/2026-05-05-120000_sso_auth_error/up.sql, migrations/sqlite/2026-05-05-120000_sso_auth_error/down.sql, migrations/sqlite/2026-05-05-120000_sso_auth_error/up.sql
fns: _sso_login, ConnectData, oidcsignin_error, _oidcsignin_redirect, SsoAuth, OIDCIdentifier
commits: a057c7de
verifiedgen Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in #7061 0.90
PR #7061 is in the release range (54895ad4be); auto-generated entry, title matches the squash commit.
.env.template, src/db/mod.rs
fns: validate_config, DbConnType, backup_sqlite
commits: 54895ad4
verifiedgen Switch to `xx-cargo` by @dfunkt in #6640 0.90
PR #6640 is in the release range (70f9dfbe8b); auto-generated entry, title matches the squash commit.
docker/Dockerfile.debian, docker/Dockerfile.j2
commits: 70f9dfbe
verifiedgen Updates and fixes by @BlackDex in #7235 0.90
PR #7235 is in the release range (22f5e0496c); auto-generated entry, title matches the squash commit.
fns: routes, _revoke_member
hides: New API endpoint PUT /organizations/<org_id>/users/<member_id>/restore/vnext added to support Enforce organization data ownership policy (currently ignores defaultUserCollectionName and delegates to standard restore) (src/api/core/organizations.rs)
commits: 22f5e049
verifiedgen Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in #7200 0.90
PR #7200 is in the release range (1ba2c6a26c); auto-generated entry, title matches the squash commit.
fns: main, run, impl_derive_uuid_macro, new, post_admin_login, get_user_or_404, users_overview, deauth_user
commits: 1ba2c6a2
verifiedgen Serve Apple app site association file by @user71424q in #7191 0.90
PR #7191 is in the release range (d626ea81ab); auto-generated entry, title matches the squash commit.
fns: routes, app_id
commits: d626ea81
verifiedgen Update Rust, Crates and GHA by @BlackDex in #7307 0.90
PR #7307 is in the release range (d6a3d539ed); auto-generated entry, title matches the squash commit.
fns: has_http_access, validate_config, Client
commits: d6a3d539
verifiedgen Fix enforce blocked by @Timshel in #7246 0.90
PR #7246 is in the release range (b25f715364); auto-generated entry, title matches the squash commit.
fns: new, make_http_request, get_reqwest_client_builder, fmt::Display, CustomDnsResolver, post_resolve, OidcHttpClient
commits: b25f7153
verifiedgen Admin password recovery endpoint change by @Timshel in #7270 0.90
PR #7270 is in the release range (ec7fa137b7); auto-generated entry, title matches the squash commit.
fns: test, routes, OrganizationUserResetPasswordEnrollmentRequest, get_organization_keys, put_reset_password
commits: ec7fa137
verifiedgen fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in #7283 0.90
PR #7283 is in the release range (fddc16d2b8); auto-generated entry, title matches the squash commit.
src/db/models/send.rs
fns: Send
commits: fddc16d2
verifiedgen Org membership delete remove Invitation by @Timshel in #7284 0.90
PR #7284 is in the release range (a16b5afaaa); auto-generated entry, title matches the squash commit.
fns: send_invite, delete_member_impl
commits: a16b5afa
verifiedgen [v2026.5.0] Registration request update by @Timshel in #7295 0.90
PR #7295 is in the release range (a058a35ccd); auto-generated entry, title matches the squash commit.
fns: RegisterData, KeysData, register
commits: a058a35c
verified [v2026.5.0] PutPolicy now using vnext format by @Timshel in #7296 0.95
The diff shows the regular `put_policy` endpoint changing from `data: Json<PolicyData>` to `data: Json<PutPolicy>`, where `PutPolicy` is the wrapper structure (with nested `policy` field) that previously existed only in `PolicyDataVnext`. The old `put_policy_vnext` endpoint is marked "Deprecated with client v2026.5.0" and now delegates to the unified `put_policy`, confirming that the standard endpoint has adopted the vnext format as its primary interface.
src/api/core/organizations.rs
fns: PolicyData, put_policy
commits: 7320a1db
verifiedgen 2026.6.0 send support by @Timshel in #7346 0.90
PR #7346 is in the release range (5c5e8e1a6f); auto-generated entry, title matches the squash commit.
src/api/core/sends.rs
fns: routes, SendData, create_send, SendFileData, post_send_file_v2_data, post_access, post_access_file, put_send
commits: 5c5e8e1a
no-evidence Add SSO_AUTHORIZE_BODY by @Timshel in #7357 0.85
The commit implements SSO auth method fallback logic (ClientSecretPost if ClientSecretBasic unavailable), but the release note claims adding 'SSO_AUTHORIZE_BODY' specifically. This feature name does not appear in the provided diff — no env var, config option, or code construct named SSO_AUTHORIZE_BODY is present. The code changes the auth type selection mechanism, but not a feature called SSO_AUTHORIZE_BODY.
src/sso_client.rs, .env.template
fns: Client
commits: 5447ee6a
verifiedgen Add `pm-26340-linux-biometrics-v2` feature flag by @pilotstew in #7358 0.90
PR #7358 is in the release range (4720cdbe86); auto-generated entry, title matches the squash commit.
.env.template, src/config.rs
commits: 4720cdbe
verifiedgen improve CI by @TriplEight in #6991 0.90
PR #6991 is in the release range (64d28ab66e); auto-generated entry, title matches the squash commit.
hides: Supply-chain security hardening: hadolint binary download replaced with pre-bundled Docker action pinned by commit SHA (hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5). Reduces runtime attack surface and ensures reproducible tool versions. (.github/workflows/hadolint.yml)
commits: 64d28ab6
verifiedgen Misc updates and fixes by @BlackDex in #7406 0.90
PR #7406 is in the release range (169aa5efcc); auto-generated entry, title matches the squash commit.
fns: CipherSyncData, get_org_events, get_cipher_events, get_user_events, get_org_collections_details, get_org_collection_detail, get_groups_data, Cipher
hides: Major version bump of `cached` crate from 1.1.0 to 2.0.0 and `cached_proc_macro` from 1.1.0 to 2.0.0 — major versions typically carry breaking changes that could affect caching behavior (Cargo.lock) · Multiple AWS SDK crates updated across multiple minor versions (aws-runtime, aws-sdk-sso, aws-sdk-ssooidc, aws-sdk-sts, aws-smithy-* suite) — unclear if vaultwarden uses AWS features or if these introduce functional changes (Cargo.lock) · `actions/checkout` bumped from v6.0.3 to v7.0.0 in all workflows — major version upgrade could alter checkout behavior (.github/workflows/*)
commits: 169aa5ef
verifiedgen Remove old compatibility code by @Timshel in #7434 0.90
PR #7434 is in the release range (4a9bcb0694); auto-generated entry, title matches the squash commit.
fns: Cipher
commits: 4a9bcb06
verifiedgen Fix compilation with newer `rust-musl` version by @dfunkt in #7453 0.90
PR #7453 is in the release range (683a23e43c); auto-generated entry, title matches the squash commit.
commits: 683a23e4
verified Fix Custom Role CSS for new dialog markup by @tom27052006 in #7442 0.95
The diff updates CSS selectors in the Custom Role hide rules from `bit-dialog div.tw-ml-4:has(...)` to `:is(bit-dialog, [bit-dialog]) div.tw-ml-4:has(...)`, directly adapting the selectors to work with both element-based and attribute-based dialog markup. The section comment explicitly identifies this as hiding unsupported Custom Role options, matching the claim exactly.
src/static/templates/scss/vaultwarden.scss.hbs
commits: 660faee6
verifiedgen Remove unused fields by @Timshel in #7458 0.90
PR #7458 is in the release range (5040bcb7c0); auto-generated entry, title matches the squash commit.
fns: UnlockData
commits: 5040bcb7
verifiedgen Update API response, crates and GHA by @BlackDex in #7470 0.90
PR #7470 is in the release range (a6a88e7929); auto-generated entry, title matches the squash commit.
fns: prelogin, config, Cipher, Collection, Organization, Membership, User
commits: a6a88e79
verifiedgen Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in #7472 0.90
PR #7472 is in the release range (46ae59eaf4); auto-generated entry, title matches the squash commit.
fns: DeleteRecoverData, PasswordHintData, put_device_token, put_clear_device_token, update_cipher_from_data, post_ciphers_import, share_cipher_by_uuid, post_events_collect
commits: 46ae59ea

New Contributors

skipped @mfw78 made their first contribution in #7061
skipped @user71424q made their first contribution in #7191
skipped @kvdb made their first contribution in #7283
skipped @pilotstew made their first contribution in #7358
skipped @TriplEight made their first contribution in #6991
skipped @tom27052006 made their first contribution in #7442
skipped **Full Changelog**:

Undocumented commits

All commits in the range are covered by the release notes.