Seven upstream advisories fixed, one High (GHSA-69q9-v8p6-xvx3,
org member revocation). Also picks up 1.37.2 (clients 2026.8.0+)
and 1.37.3 (2FA token revocation, prelogin rate limiting).
Replace vaultwarden.cfg with the upstream 1.37.4 template.
- Mount /var/lib/vaultwarden/data as /data with :Z restored; podman
refuses to relabel a volume path that equals $HOME
- Use /var/lib/vaultwarden as service HOME (rootless podman storage
stays in .config/.local, outside the mounted data/ subdir)
- Data location matches the native vaultwarden package
(WorkingDirectory=/var/lib/vaultwarden, relative DATA_FOLDER=data)
- Sync vaultwarden.cfg with the native 1.36.0 template
- Add Conflicts: vaultwarden (shared user, config, unit name, state dir)
zpericic