v1.37.4: update to vaultwarden 1.37.4 (security)

Seven upstream advisories fixed, one High (GHSA-69q9-v8p6-xvx3,
org member revocation). Also picks up 1.37.2 (clients 2026.8.0+)
and 1.37.3 (2FA token revocation, prelogin rate limiting).
Replace vaultwarden.cfg with the upstream 1.37.4 template.

vaultwarden-container.spec

@@ -1,5 +1,5 @@
 Name:           vaultwarden-container
-Version:        1.37.1
+Version:        1.37.4
 Release:        1%{?dist}
 Summary:        Vaultwarden - Bitwarden compatible server (container)
 License:        AGPL-3.0
@@ -78,6 +78,18 @@ fi
 %dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data
 
 %changelog
+* Sat Oct 24 2026 Zoran Pericic <zpericic@netst.org> - 1.37.4-1
+- Update to 1.37.4 (security fixes: GHSA-69q9-v8p6-xvx3 org member
+  revocation [High]; GHSA-7jg8-8m5x-6j9r two-factor auth, GHSA-v576-3wvq-xh3c
+  org invitations, GHSA-q5x6-grh5-fqgc attachments, GHSA-64mc-4p6f-r7x9 org
+  event logs, GHSA-7ccc-c43j-4p36 cipher sharing [Medium];
+  GHSA-qwx4-wcv4-mpcv org API key [Low])
+- Includes 1.37.2 (support for clients 2026.8.0+) and 1.37.3 (2FA remember
+  token revocation, prelogin/auth-request rate limiting, admin 2FA reset)
+- Replace vaultwarden.cfg with the upstream 1.37.4 template
+  (CLIENT_SUPPRESS_ONBOARDING, SSO_SIGNUPS_ALLOWED, DUO_USE_IFRAME removed,
+  updated feature flag list, X-Forwarded-For now uses rightmost untrusted IP)
+
 * Mon Aug 10 2026 Zoran Pericic <zpericic@netst.org> - 1.37.1-1
 - Update to 1.37.1 (security fixes: SSRF via icon endpoint, cross-org
   cipher access, org policy bypass, WebSocket DDoS; invite fixes)
@@ -92,5 +104,5 @@ fi
 - Sync vaultwarden.cfg with the native 1.36.0 template
 - Add Conflicts: vaultwarden
 
-* Tue May 06 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-1
+* Wed May 06 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-1
 - Initial package

vaultwarden.cfg

@@ -23,7 +23,7 @@
 ## When using an external location, make sure to set TMP_FOLDER,
 ## TEMPLATES_FOLDER, and DATABASE_URL to local paths and/or a remote database
 ## location.
-# DATA_FOLDER=/var/lib/vaultwarden
+# DATA_FOLDER=data
 
 ## Individual folders, these override %DATA_FOLDER%
 # RSA_KEY_FILENAME=data/rsa_key
@@ -42,7 +42,7 @@
 # RELOAD_TEMPLATES=false
 
 ## Web vault settings
-# WEB_VAULT_FOLDER=/usr/share/vaultwarden-web
+# WEB_VAULT_FOLDER=web-vault/
 # WEB_VAULT_ENABLED=true
 
 #########################
@@ -180,7 +180,7 @@
 ## Defaults to every minute. Set blank to disable this job.
 # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
 ##
-## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
+## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
 ## Defaults to every minute. Set blank to disable this job.
 # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
 #
@@ -316,6 +316,14 @@
 ## unauthenticated access to potentially sensitive data.
 # SHOW_PASSWORD_HINT=false
 
+#########################
+### Client settings  ###
+#########################
+
+## Control whether clients onboarding interstitials are suppressed
+## (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals)
+# CLIENT_SUPPRESS_ONBOARDING=false
+
 #########################
 ### Advanced settings ###
 #########################
@@ -330,6 +338,8 @@
 ## "local" accepts it from any non global address, which covers a reverse proxy running on the same
 ## host or container network. Use "all" to accept it from anywhere, or list the addresses of your
 ## proxy as IPs and CIDR ranges if it connects from a public address.
+## For a list header like X-Forwarded-For, the client IP is the rightmost address that isn't one of
+## these proxies, so with several proxies in a row (a CDN in front of nginx, for example) list all of them.
 # IP_HEADER_TRUSTED_PROXIES=local
 
 ## Icon service
@@ -382,21 +392,13 @@
 ##
 ## The following flags are available:
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
-## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
+## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
-## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
-## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
-## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0)
-## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
-## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
-## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
-## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
-## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
 ## - "pm-30529-webauthn-related-origins":
-## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
-## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
-## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
-## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 
 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -510,6 +512,9 @@
 ## Prevent users from logging in directly without going through SSO
 # SSO_ONLY=false
 
+## Allow SSO flow to create account. You probably want to disable it when using a public provider.
+# SSO_SIGNUPS_ALLOWED=true
+
 ## On SSO Signup if a user with a matching email already exists make the association
 # SSO_SIGNUPS_MATCH_EMAIL=true
 
@@ -572,11 +577,6 @@
 # DUO_HOST=<API Hostname>
 ## After that, you should be able to follow the rest of the guide linked above,
 ## ignoring the fields that ask for the values that you already configured beforehand.
-##
-## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'.
-## Duo no longer supports this, but it still works for some integrations.
-## If you aren't sure, leave this alone.
-# DUO_USE_IFRAME=false
 
 ## Email 2FA settings
 ## Email token size

vaultwarden.container

@@ -3,7 +3,7 @@ Description=Vaultwarden - Bitwarden compatible server
 
 [Container]
 ContainerName=vaultwarden
-Image=docker.io/vaultwarden/server:1.37.1@sha256:ebdfe70701c60ac0c28c697e787cea767d7972940b786037b29fe0d507f821e8
+Image=docker.io/vaultwarden/server:1.37.4@sha256:efb3cde962015fcc036b2ea625242248611943b27212ebf4392841fb30fad055
 EnvironmentFile=/etc/vaultwarden/vaultwarden.cfg
 PublishPort=127.0.0.1:8000:80
 Volume=/var/lib/vaultwarden/data:/data:Z