[UPDATE][vaultwarden][1.0.4] Upgrade Vaultwarden 1.36.0 to 1.37.5

vaultwarden/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: vaultwarden
 description: Vaultwarden is an alternative Bitwarden compatible server written in Rust, compatible with upstream Bitwarden clients.
 type: application
-version: 1.0.3
-appVersion: "1.36.0"
+version: 1.0.4
+appVersion: "1.37.5"

vaultwarden/OlaresManifest.yaml

@@ -9,7 +9,7 @@ metadata:
   description: Alternative Bitwarden compatible server written in Rust.
   icon: https://app.cdn.olares.com/appstore/vaultwarden/icon.png
   appid: vaultwarden
-  version: '1.0.3'
+  version: '1.0.4'
   title: Vaultwarden
   categories:
   - Productivity_v112
@@ -21,7 +21,14 @@ permission:
   userData:
   - Home
 spec:
-  versionName: '1.36.0'
+  versionName: '1.37.5'
+  upgradeDescription: |
+    v1.0.4: Upgrade Vaultwarden from 1.36.0 to 1.37.5.
+    - 1.37.0 through 1.37.5 are security releases and every one of them should be applied. 1.37.0 fixes eight Medium advisories, including SSRF through the icon endpoint, cross-organization cipher access and secret sharing, an organization policy bypass on directory import, a Send access-count bypass, unauthenticated WebSocket flooding, and organization import and enumeration issues. 1.37.4 fixes one High severity organization member revocation issue (GHSA-69q9-v8p6-xvx3) plus five Medium ones covering two-factor authentication, invitations, attachments and event logs. 1.37.5 fixes two Medium issues in website icons and emergency access.
+    - 1.37.5 bundles web vault v2026.10.1. It is required for web vault 2026.7.1+ to turn two-step login methods on or off and for 2026.9.0+ to take over an account through emergency access.
+    - Configuration is validated strictly now: invalid values abort startup. Numeric options outside their range (for example LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT above 65535, EMAIL_ATTEMPTS_LIMIT above 255), rate-limit or database timeouts below 1, DATABASE_MIN_CONNS larger than DATABASE_MAX_CONNS, or an invalid cron expression in DUO_CONTEXT_PURGE_SCHEDULE / PURGE_INCOMPLETE_SSO_AUTH will stop the container. Review any extra environment variable you added before upgrading.
+    - 1.37.0 also rejects an unrecognised DATABASE_URL instead of silently falling back to SQLite, so check that value if you use an external database.
+    - This chart injects only SIGNUPS_ALLOWED, WEBSOCKET_ENABLED and ADMIN_TOKEN and adds no new variable; the existing /data volume is reused as-is.
   fullDescription: |
     Vaultwarden is an alternative Bitwarden compatible server written in Rust, compatible with upstream Bitwarden clients.
 

vaultwarden/i18n/en-US/OlaresManifest.yaml

@@ -2,6 +2,13 @@ metadata:
   title: Vaultwarden
   description: Alternative Bitwarden compatible server written in Rust.
 spec:
+  upgradeDescription: |
+    v1.0.4: Upgrade Vaultwarden from 1.36.0 to 1.37.5.
+    - 1.37.0 through 1.37.5 are security releases and every one of them should be applied. 1.37.0 fixes eight Medium advisories, including SSRF through the icon endpoint, cross-organization cipher access and secret sharing, an organization policy bypass on directory import, a Send access-count bypass, unauthenticated WebSocket flooding, and organization import and enumeration issues. 1.37.4 fixes one High severity organization member revocation issue (GHSA-69q9-v8p6-xvx3) plus five Medium ones covering two-factor authentication, invitations, attachments and event logs. 1.37.5 fixes two Medium issues in website icons and emergency access.
+    - 1.37.5 bundles web vault v2026.10.1. It is required for web vault 2026.7.1+ to turn two-step login methods on or off and for 2026.9.0+ to take over an account through emergency access.
+    - Configuration is validated strictly now: invalid values abort startup. Numeric options outside their range (for example LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT above 65535, EMAIL_ATTEMPTS_LIMIT above 255), rate-limit or database timeouts below 1, DATABASE_MIN_CONNS larger than DATABASE_MAX_CONNS, or an invalid cron expression in DUO_CONTEXT_PURGE_SCHEDULE / PURGE_INCOMPLETE_SSO_AUTH will stop the container. Review any extra environment variable you added before upgrading.
+    - 1.37.0 also rejects an unrecognised DATABASE_URL instead of silently falling back to SQLite, so check that value if you use an external database.
+    - This chart injects only SIGNUPS_ALLOWED, WEBSOCKET_ENABLED and ADMIN_TOKEN and adds no new variable; the existing /data volume is reused as-is.
   fullDescription: |
     Vaultwarden is an alternative Bitwarden compatible server written in Rust, compatible with upstream Bitwarden clients.
 

vaultwarden/i18n/zh-CN/OlaresManifest.yaml

@@ -2,6 +2,13 @@ metadata:
   title: Vaultwarden
   description: 兼容 Bitwarden 客户端的 Rust 编写的自托管服务端。
 spec:
+  upgradeDescription: |
+    v1.0.4：Vaultwarden 从 1.36.0 升级到 1.37.5。
+    - 1.37.0 到 1.37.5 全部是安全修复版本，每一个都应当应用。1.37.0 修复了 8 个中危问题，包括通过图标端点触发的 SSRF、跨组织密码项访问与密钥共享、目录导入时的组织策略绕过、Send 访问计数绕过、未认证的 WebSocket 洪水攻击，以及组织导入与枚举相关问题。1.37.4 修复 1 个高危的组织成员撤销问题（GHSA-69q9-v8p6-xvx3），以及双重验证、邀请、附件与事件日志相关的 5 个中危问题。1.37.5 修复网站图标与紧急访问的 2 个中危问题。
+    - 1.37.5 内置 Web Vault v2026.10.1。Web Vault 2026.7.1+ 开启或关闭两步登录方式、以及 2026.9.0+ 通过紧急访问接管账号，都需要此版本。
+    - 配置校验变严格：非法取值会直接导致启动失败。数值型选项超出范围（例如 LOGIN_RATELIMIT_MAX_BURST、TRASH_AUTO_DELETE_DAYS、EVENTS_DAYS_RETAIN 或 SMTP_TIMEOUT 超过 65535，EMAIL_ATTEMPTS_LIMIT 超过 255）、限流与数据库超时小于 1、DATABASE_MIN_CONNS 大于 DATABASE_MAX_CONNS、DUO_CONTEXT_PURGE_SCHEDULE / PURGE_INCOMPLETE_SSO_AUTH 不是合法 cron 表达式，都会让容器无法启动。升级前请检查你自行添加的环境变量。
+    - 1.37.0 起，无法识别的 DATABASE_URL 会被拒绝，而不再静默回退到 SQLite。使用外部数据库的请核对该值。
+    - 本 chart 仅注入 SIGNUPS_ALLOWED、WEBSOCKET_ENABLED 与 ADMIN_TOKEN，未新增变量；原有 /data 数据卷沿用不变。
   fullDescription: |
     Vaultwarden 是一款兼容 Bitwarden 客户端的自托管服务端，由 Rust 编写。
 

vaultwarden/templates/vaultwarden.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: docker.io/vaultwarden/server:1.36.0
+          image: docker.io/vaultwarden/server:1.37.5
           env:
             - name: PGID
               value: "1000"

vaultwarden/values.yaml

@@ -1,5 +1,5 @@
 image:
-  version: '1.36.0'
+  version: '1.37.5'
 
 userspace:
   appdata: ""