chore(deps): update dependency dani-garcia/vaultwarden to v1.37.0

[renovate]

This PR contains the following updates:

Package	Update	Change
dani-garcia/vaultwarden	minor	1.36.0 → 1.37.0

---

Release Notes

dani-garcia/vaultwarden (dani-garcia/vaultwarden)

v1.37.0

Compare Source

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

• SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
• Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
• Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
• Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
• Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
• Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3)
• Organization Import Authorization [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr] (Medium, 4.3)
• Organization Data Enumeration via the Manager role [GHSA-rqf8-2568-r7mc] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

• OpenDAL S3 parameter support by @​txase in #​6127
• Fix SSO Cookie path by @​BlackDex in #​7187
• fix email 2fa for bw cli by @​stefan0xC in #​7225
• sso_auth improvements by @​Timshel in #​7197
• Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @​mfw78 in #​7061
• Switch to xx-cargo by @​dfunkt in #​6640
• Updates and fixes by @​BlackDex in #​7235
• Switch to Edition 2024, more clippy lints, and less macro calls by @​BlackDex in #​7200
• Serve Apple app site association file by @​user71424q in #​7191
• Update Rust, Crates and GHA by @​BlackDex in #​7307
• Fix enforce blocked by @​Timshel in #​7246
• Admin password recovery endpoint change by @​Timshel in #​7270
• fix(sends): emit hideEmail as non-null boolean in sync response by @​kvdb in #​7283
• Org membership delete remove Invitation by @​Timshel in #​7284
• [v2026.5.0] Registration request update by @​Timshel in #​7295
• [v2026.5.0] PutPolicy now using vnext format by @​Timshel in #​7296
• 2026.6.0 send support by @​Timshel in #​7346
• Add SSO_AUTHORIZE_BODY by @​Timshel in #​7357
• Add pm-26340-linux-biometrics-v2 feature flag by @​pilotstew in #​7358
• improve CI by @​TriplEight in #​6991
• Misc updates and fixes by @​BlackDex in #​7406
• Remove old compatibility code by @​Timshel in #​7434
• Fix compilation with newer rust-musl version by @​dfunkt in #​7453
• Fix Custom Role CSS for new dialog markup by @​tom27052006 in #​7442
• Remove unused fields by @​Timshel in #​7458
• Update API response, crates and GHA by @​BlackDex in #​7470
• Trusted proxy support, unauthenticated rate limit & other fixes by @​dani-garcia in #​7472

New Contributors

• @​mfw78 made their first contribution in #​7061
• @​user71424q made their first contribution in #​7191
• @​kvdb made their first contribution in #​7283
• @​pilotstew made their first contribution in #​7358
• @​TriplEight made their first contribution in #​6991
• @​tom27052006 made their first contribution in #​7442

Full Changelog: dani-garcia/vaultwarden@1.36.0...1.37.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.