security/vaultwarden 1.37.2 NetBSD

1.37.4 Security Fixes This release contains security fixes for the following advisories. We strongly advise updating as soon as possible. Organization member revocation [GHSA-69q9-v8p6-xvx3] (High, 8.1) Two-factor authentication [GHSA-7jg8-8m5x-6j9r] (Medium, 6.8) Organization invitations [GHSA-v576-3wvq-xh3c] (Medium, 6.8) Attachments [GHSA-q5x6-grh5-fqgc] (Medium, 6.5) Organization event logs [GHSA-64mc-4p6f-r7x9] (Medium, 4.3) Cipher sharing [GHSA-7ccc-c43j-4p36] (Medium, 4.3) Organization API key [GHSA-qwx4-wcv4-mpcv] (Low, 3.8) Additional dependency updates and minor security enhancements

1.37.3 Fix password change with newer web-vault chore: remove duplicate "the" in ciphers.rs comment Ignore reset-password auto-enroll when mail is disabled Fix migration for MariaDB 12.2.2 Add SSO_SIGNUPS_ALLOWED log_event take enum parameter not i32 Misc Updates Update rust docker version Fix organization import failing with missing field groups Add pm-32413-multi-client-password-management feature flag Log IP/username on two-factor email-login credential failures Support admin reset 2fa fix(security): revoke 2FA remember tokens when credentials or 2FA change fix(security): rate limit prelogin and auth request endpoints fix: Correct invalid comment syntax in .dockerignore Update Rust and adjust DockerSettings Route service clients through shared HTTP setup …

1.37.2 Fix Debian cross-linking with xx-cargo Fix playwright test Misc fixes and updates Include user email in successful login logs Fix sendmail executable permission check add dummy revisionDate

1.37.1 Always send initOrganization and orgUserHasExistingUser in invite URL Indirectly resolved 7475 by using newer rust-musl build images which had a compilation issue with OpenSSL.

XXX Pull-up candidate From upstream's changelog: Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3) Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9) Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5) Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3) Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3) Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3) …