v1.37.1: update to vaultwarden 1.37.1

- Bump image to docker.io/vaultwarden/server:1.37.1 (new digest)
- Security fixes upstream: SSRF via icon endpoint, cross-org cipher
  access, org policy bypass, WebSocket DDoS; invite fixes in 1.37.1
- Sync vaultwarden.cfg with upstream 1.37.1 .env.template

vaultwarden-container.spec

@@ -1,6 +1,6 @@
 Name:           vaultwarden-container
-Version:        1.36.0
-Release:        2%{?dist}
+Version:        1.37.1
+Release:        1%{?dist}
 Summary:        Vaultwarden - Bitwarden compatible server (container)
 License:        AGPL-3.0
 Group:          System Environment/Base
@@ -78,6 +78,12 @@ fi
 %dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data
 
 %changelog
+* Mon Aug 10 2026 Zoran Pericic <zpericic@netst.org> - 1.37.1-1
+- Update to 1.37.1 (security fixes: SSRF via icon endpoint, cross-org
+  cipher access, org policy bypass, WebSocket DDoS; invite fixes)
+- Sync vaultwarden.cfg with the 1.37.1 template (IP_HEADER_TRUSTED_PROXIES,
+  UNAUTHENTICATED_RATELIMIT_*, sqlite:// DATABASE_URL scheme)
+
 * Mon Jul 13 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-2
 - Match native vaultwarden layout: data in /var/lib/vaultwarden/data
 - Use /var/lib/vaultwarden as service HOME (rootless podman storage);

vaultwarden.cfg

@@ -50,10 +50,11 @@
 #########################
 
 ## Database URL
-## When using SQLite, this is the path to the DB file, and it defaults to
-## %DATA_FOLDER%/db.sqlite3. If DATA_FOLDER is set to an external location, this
-## must be set to a local sqlite3 file path.
-# DATABASE_URL=data/db.sqlite3
+## When using SQLite, this should use the sqlite:// scheme followed by the path
+## to the DB file. It defaults to sqlite://%DATA_FOLDER%/db.sqlite3.
+## Bare paths without the sqlite:// scheme are supported for backwards compatibility,
+## but only if the database file already exists.
+# DATABASE_URL=sqlite://data/db.sqlite3
 ## When using MySQL, specify an appropriate connection URI.
 ## Details: https://docs.diesel.rs/2.1.x/diesel/mysql/struct.MysqlConnection.html
 # DATABASE_URL=mysql://user:password@host[:port]/database_name
@@ -323,6 +324,14 @@
 ## Set to the string "none" (without quotes), to disable any headers and just use the remote IP
 # IP_HEADER=X-Real-IP
 
+## Which addresses the header above is accepted from, defaults to "local".
+## Anyone able to reach Vaultwarden can set the header, and the client IP is used for the login and
+## admin rate limits, so it is only trusted when the request comes from a proxy listed here.
+## "local" accepts it from any non global address, which covers a reverse proxy running on the same
+## host or container network. Use "all" to accept it from anywhere, or list the addresses of your
+## proxy as IPs and CIDR ranges if it connects from a public address.
+# IP_HEADER_TRUSTED_PROXIES=local
+
 ## Icon service
 ## The predefined icon services are: internal, bitwarden, duckduckgo, google.
 ## To specify a custom icon service, set a URL template with exactly one instance of `{}`,
@@ -377,6 +386,7 @@
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
 ## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
 ## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
+## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0)
 ## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
 ## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
 ## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
@@ -459,6 +469,13 @@
 ## Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2.
 # LOGIN_RATELIMIT_MAX_BURST=10
 
+## Number of seconds, on average, between requests from the same IP address to one of the rate limited
+## unauthenticated endpoints, like the password hint, the account recovery mails or accessing a Send.
+# UNAUTHENTICATED_RATELIMIT_SECONDS=60
+## Allow a burst of requests of up to this size, while maintaining the average indicated by `UNAUTHENTICATED_RATELIMIT_SECONDS`.
+## This budget is shared between all of those endpoints, so it is more lenient than the login one.
+# UNAUTHENTICATED_RATELIMIT_MAX_BURST=50
+
 ## BETA FEATURE: Groups
 ## Controls whether group support is enabled for organizations
 ## This setting applies to organizations.

vaultwarden.container

@@ -3,7 +3,7 @@ Description=Vaultwarden - Bitwarden compatible server
 
 [Container]
 ContainerName=vaultwarden
-Image=docker.io/vaultwarden/server:1.36.0@sha256:d626d04934cd1192ad8ced1adb975099fca78cec33ab467d2d3c923cde7f3b0c
+Image=docker.io/vaultwarden/server:1.37.1@sha256:ebdfe70701c60ac0c28c697e787cea767d7972940b786037b29fe0d507f821e8
 EnvironmentFile=/etc/vaultwarden/vaultwarden.cfg
 PublishPort=127.0.0.1:8000:80
 Volume=/var/lib/vaultwarden/data:/data:Z