1.28.0 #3374

dani-garcia · 2023-03-26T18:11:50Z

dani-garcia
Mar 26, 2023
Maintainer

Major changes

The project has changed license to the AGPLv3. If you're hosting a Vaultwarden instance, you now have a requirement to distribute the Vaultwarden source code to your users if they request it. The source code, and any changes you have made, need to be under the same AGPLv3 license. If you simply use our code without modifications, just pointing them to this repository is enough.
Added support for Argon2 key derivation on the clients. To enable it for your account, make sure all your clients are using version v2023.2.0 or greater, then go to account settings > security > keys, and change the algorithm from PBKDF2 to Argon2id.
Added support for Argon2 key derivation for the admin page token. To update your admin token to use it, check the wiki
New alternative registries for the docker images are available (In BETA for now):
- Github Container Registry: https://ghcr.io/dani-garcia/vaultwarden
- Quay: https://quay.io/vaultwarden/server

What's Changed

Remove patched multer-rs by @manofthepeace in Remove patched multer-rs #2968
Removed unsafe-inline JS from CSP and other fixes by @BlackDex in Removed unsafe-inline JS from CSP and other fixes #3058
Validate YUBICO_SERVER string (Not posible to store a YubiKey OTP in the user Account Settings #3003) by @BlackDex in Validate YUBICO_SERVER string (#3003) #3059
Log message to stderr if LOG_FILE is not writable by @pjsier in Log message to stderr if LOG_FILE is not writable #3061
Update WebSocket Notifications by @BlackDex in Update WebSocket Notifications #3076
Optimize config loading messages by @BlackDex in Optimize config loading messages #3092
Percent-encode org_name in links by @am97 in Percent-encode org_name in links #3093
Fix failing large note imports by @BlackDex in Fix failing large note imports #3087
Change text/plain API responses to application/json by @jjlin in Change text/plain API responses to application/json #3124
Remove shrink-to-fit=no from viewport-meta-tag by @redwerkz in Remove shrink-to-fit=no from viewport-meta-tag #3126
Update dependencies and MSRV by @BlackDex in Update dependencies and MSRV #3128
Resolve uninlined_format_args clippy warnings by @BlackDex in Resolve uninlined_format_args clippy warnings #3065
Update Rust to v1.66.1 to patch CVE by @BlackDex in Update Rust to v1.66.1 to patch CVE #3136
Fix remaining inline format by @BlackDex in Fix remaining inline format #3130
Use more modern meta tag for charset encoding by @redwerkz in Use more modern meta tag for charset encoding #3131
fix (2fa.directory): Allow api.2fa.directory, and remove 2fa.directory by @GeekCornerGH in fix (2fa.directory): Allow api.2fa.directory, and remove 2fa.directory #3132
Optimize CipherSyncData for very large vaults by @BlackDex in Optimize CipherSyncData for very large vaults #3133
Add avatar color support by @BlackDex in Add avatar color support #3134
Add MFA icon to org member overview by @BlackDex in Add MFA icon to org member overview #3135
Minor refactoring concering user.setpassword by @sirux88 in Minor refactoring concering user.setpassword #3139
Validate note sizes on key-rotation. by @BlackDex in Validate note sizes on key-rotation. #3157
Update KDF Configuration and processing by @BlackDex in Update KDF Configuration and processing #3163
Remove arm32v6-specific tag by @jjlin in Remove arm32v6-specific tag #3164
Re-License Vaultwarden to AGPLv3 by @BlackDex in Re-License Vaultwarden to AGPLv3 #2561
Admin password reset by @sirux88 in Admin password reset #3116
"Spell-Jacking" mitigation ~ prevent sensitive data leak … by @dlehammer in "Spell-Jacking" mitigation ~ prevent sensitive data leak … #3145
Allow listening on privileged ports (below 1024) as non-root by @jjlin in Allow listening on privileged ports (below 1024) as non-root #3170
don't nullify key when editing emergency access by @stefan0xC in don't nullify key when editing emergency access #3215
Fix trailing slash not getting removed from domain by @BlockListed in Fix trailing slash not getting removed from domain #3228
Generate distinct log messages for regex vs. IP blacklisting. by @kpfleming in Generate distinct log messages for regex vs. IP blacklisting. #3231
allow editing/unhiding by group by @farodin91 in allow editing/unhiding by group #3108
Fix Javascript issue on non sqlite databases by @BlackDex in Fix Javascript issue on non sqlite databases #3167
add argon2 kdf fields by @tessus in add argon2 kdf fields #3210
add support for system mta though sendmail by @soruh in add support for system mta though sendmail #3147
Updated Rust and crates by @BlackDex in Updated Rust and crates #3234
docs: add build status badge in readme by @R3DRUN3 in docs: add build status badge in readme #3245
Validate all needed fields for client API login by @BlackDex in Validate all needed fields for client API login #3251
Fix Organization delete when groups are configured by @BlackDex in Fix Organization delete when groups are configured #3252
Fix Collection Read Only access for groups by @Misterbabou in Fix Collection Read Only access for groups #3254
Make the admin session lifetime adjustable by @mittler-works in Make the admin session lifetime adjustable #3262
Add function to fetch user by email address by @mittler-works in Add function to fetch user by email address #3263
Fix vault item display in org vault view by @jjlin in Fix vault item display in org vault view #3277
Add confirmation for removing 2FA and deauthing sessions in admin panel by @JCBird1012 in Add confirmation for removing 2FA and deauthing sessions in admin panel #3282
Some Admin Interface updates by @BlackDex in Some Admin Interface updates #3288
Fix the web-vault v2023.2.0 API calls by @BlackDex in Fix the web-vault v2023.2.0 API calls #3281
Fix confirmation for removing 2FA and deauthing sessions in admin panel by @dpinse in Fix confirmation for removing 2FA and deauthing sessions in admin panel #3290
Admin token Argon2 hashing support by @BlackDex in Admin token Argon2 hashing support #3289
Add HEAD routes to avoid spurious error messages by @jjlin in Add HEAD routes to avoid spurious error messages #3307
Fix web-vault Member UI show/edit/save by @BlackDex in Fix web-vault Member UI show/edit/save #3315
Upd Crates, Rust, MSRV, GHA and remove Backtrace by @BlackDex in Upd Crates, Rust, MSRV, GHA and remove Backtrace #3310
Add support for /api/devices/knowndevice with HTTP header params by @jjlin in Add support for /api/devices/knowndevice with HTTP header params #3329
Update Rust, MSRV and Crates by @BlackDex in Update Rust, MSRV and Crates #3348
Merge ClientIp with Headers. by @BlackDex in Merge ClientIp with Headers. #3332
add endpoints to bulk delete collections/groups by @stefan0xC in add endpoints to bulk delete collections/groups #3354
Add support for Quay.io and GHCR.io as registries by @BlackDex in Add support for Quay.io and GHCR.io as registries #3363
Some small fixes and updates by @BlackDex in Some small fixes and updates #3366
Update web vault to v2023.3.0 by @dani-garcia

New Contributors

@manofthepeace made their first contribution in Remove patched multer-rs #2968
@pjsier made their first contribution in Log message to stderr if LOG_FILE is not writable #3061
@am97 made their first contribution in Percent-encode org_name in links #3093
@redwerkz made their first contribution in Remove shrink-to-fit=no from viewport-meta-tag #3126
@sirux88 made their first contribution in Minor refactoring concering user.setpassword #3139
@dlehammer made their first contribution in "Spell-Jacking" mitigation ~ prevent sensitive data leak … #3145
@BlockListed made their first contribution in Fix trailing slash not getting removed from domain #3228
@kpfleming made their first contribution in Generate distinct log messages for regex vs. IP blacklisting. #3231
@farodin91 made their first contribution in allow editing/unhiding by group #3108
@soruh made their first contribution in add support for system mta though sendmail #3147
@R3DRUN3 made their first contribution in docs: add build status badge in readme #3245
@Misterbabou made their first contribution in Fix Collection Read Only access for groups #3254
@mittler-works made their first contribution in Make the admin session lifetime adjustable #3262
@JCBird1012 made their first contribution in Add confirmation for removing 2FA and deauthing sessions in admin panel #3282
@dpinse made their first contribution in Fix confirmation for removing 2FA and deauthing sessions in admin panel #3290

Full Changelog: 1.27.0...1.28.0

This discussion was created from the release 1.28.0.

jeroenhabets · 2023-03-26T19:13:01Z

jeroenhabets
Mar 26, 2023

@dani-garcia Congratulations! Just double checking that 1.28 has not been pushed to docker (or the new alternative registries) yet, right?

1 reply

paolobarbolini Mar 26, 2023
Sponsor

Nope. See https://github.com/dani-garcia/vaultwarden/actions/runs/4525948403/jobs/7970788762

EchoDev · 2023-03-26T21:38:19Z

EchoDev
Mar 26, 2023

Thanks for Argon2 support! I converted my accounts without any issues to Argon2 👍

If you use Apache2 as a reverse proxy and you use a Content Security Policy, make sure you add wasm-unsafe-eval to script-src, else you will not be able to use Argon2.

PS. When setting parameters for Argon2 I would recommend using your browser to test logins. Logins with the mobile app are blazing fast compared to browsers. In my case my browser was 5-10x slower than the mobile app.

3 replies

jeroenhabets Mar 27, 2023

@EchoDev thanks but shouldn't requiring script-src: wasm-unsafe-eval in such a security sensitive application be considered a security issue/bug? Otherwise it feels a bit like 1 step forward, 2 steps back...

BlackDex Mar 27, 2023
Collaborator

You can disable it your self if you don't want it by overriding the CSP header. But that means no Argon2 support within the web-vault.

EchoDev Mar 27, 2023

@jeroenhabets wasm-unsafe-eval allows your browser to run WebAssembly code from your vaultwarden website. Your webserver already needs to be compromised for non-authorized WebAssembly code to be added to Vaultwarden since you are likely running it in docker.

Risk is minimal, if your webserver is compromised it is already gg

Hardexit · 2023-03-27T06:55:25Z

Hardexit
Mar 27, 2023

Hi,

is it also possible to save the ADMIN_TOKEN in config.json with argon2?

1 reply

BlackDex Mar 27, 2023
Collaborator

That is in theory possible. But i would suggest to then use the admin interface to update it. Then you know all the escaping is done correctly.

stavros-k · 2023-03-27T13:33:37Z

stavros-k
Mar 27, 2023

Hello, thanks for the release!
Noticed that this release requires some extra capabilities. (Trying to figure out which).
Previously I was able to run with with drop: ALL in kubernetes. Now I get /vautlwarden: Operation not permitted

Removing the drop: ALL allows it to run.
Any idea what cap it might need? Thanks

(Note that I don't use the default ROCKET_PORT: 80, but a higher port that does not required capabillity)`

EDIT: It seems to need net_bind_service but why would it need that If I have set ROCKET_PORT > 1024?

1 reply

BlackDex Mar 27, 2023
Collaborator

Could possibly be this PR: #3170.

hawkn · 2023-03-29T13:54:46Z

hawkn
Mar 29, 2023

Not sure if this is the right place, I've been running this as a container on my Mikrotik device (arm64) for months.
Upgrades has always been working, also after upgrades, until the latest and greatest was released.
When upgrading it just throws me an error that it is unable to import container.
I've been trying to pull some logging from the mikrotik, but those logs was a long shot.
I also had issues with the latest on my other docker hosts, but it suddenly worked.
On the Mikrotik device I had to replace :latest with :1.27.0 to be able to pull the image, so I'm guessing an issue with recognizing the architecture ?
The most promising I have from the logs is something about "missing manifest" and "404".
Sorry not being able to provide more detailed info.

4 replies

BlackDex Mar 29, 2023
Collaborator

1.27.0 is not the latest version, that would be 1.28.0

hawkn Mar 29, 2023

1.27.0 is not the latest version, that would be 1.28.0

1.28.0 is the lastest and greatest yes, but my Mikrotik RB5009 is unable to pull it, 1.27.0 pulls just fine.
My calculated guess is some architecture related failing without me getting logs for it.

Attached is the only log results I get from the RB5009:

When trying to pull 1.28.0:

Mar/29/2023 18:02:12 container,info,debug CONTAINER_DEBUG: importing remote image: vaultwarden/server, tag: 1.28.0
Mar/29/2023 18:02:14 container,info,debug CONTAINER_DEBUG: error response getting manifests: 404
Mar/29/2023 18:02:14 container,info,debug CONTAINER_DEBUG: was unable to import, container 267c0e76-67f0-4897-bf10-34e3fd388cb1
Mar/29/2023 18:02:46 container,info,debug CONTAINER_DEBUG: removing files, container 267c0e76-67f0-4897-bf10-34e3fd388cb1

When pulling 1.27.0 that works perfectly:

Mar/29/2023 18:02:50 container,info,debug CONTAINER_DEBUG: importing remote image: vaultwarden/server, tag: 1.27.0
Mar/29/2023 18:02:52 container,info,debug CONTAINER_DEBUG: getting layer sha256:6064e7e5b6afa4dc711228eddfd250aebac271830dc184c400ce640020bc2cb0
Mar/29/2023 18:02:55 container,info,debug CONTAINER_DEBUG: layer sha256:6064e7e5b6afa4dc711228eddfd250aebac271830dc184c400ce640020bc2cb0 downloaded
Mar/29/2023 18:03:06 container,info,debug CONTAINER_DEBUG: getting layer sha256:62e7aab101f2143b55d89813fb308d59e79cc3338c45a481c23445756edf15c2
Mar/29/2023 18:03:07 container,info,debug CONTAINER_DEBUG: layer sha256:62e7aab101f2143b55d89813fb308d59e79cc3338c45a481c23445756edf15c2 downloaded
Mar/29/2023 18:03:07 container,info,debug CONTAINER_DEBUG: getting layer sha256:9d9c6880d97881f162ecb459d83e29ab18daa14a7bee66ecdcba38761b6a427f
Mar/29/2023 18:03:09 container,info,debug CONTAINER_DEBUG: layer sha256:9d9c6880d97881f162ecb459d83e29ab18daa14a7bee66ecdcba38761b6a427f downloaded
Mar/29/2023 18:03:11 container,info,debug CONTAINER_DEBUG: getting layer sha256:208099f8940ed30648c8845fa03e75a27eb3d18c4832b5da878cc79ea1680e25
Mar/29/2023 18:03:11 container,info,debug CONTAINER_DEBUG: layer sha256:208099f8940ed30648c8845fa03e75a27eb3d18c4832b5da878cc79ea1680e25 downloaded
Mar/29/2023 18:03:12 container,info,debug CONTAINER_DEBUG: getting layer sha256:1aa965559c60c363c8e915b1f83c56438df25258c0a2951793932a9a87f6c6c9
Mar/29/2023 18:03:12 container,info,debug CONTAINER_DEBUG: layer sha256:1aa965559c60c363c8e915b1f83c56438df25258c0a2951793932a9a87f6c6c9 downloaded
Mar/29/2023 18:03:12 container,info,debug CONTAINER_DEBUG: getting layer sha256:5d46c03a13706d1945b0b5e6a6b328e4c355644e1aa681f8e145d66eb2fdd3c1
Mar/29/2023 18:03:13 container,info,debug CONTAINER_DEBUG: layer sha256:5d46c03a13706d1945b0b5e6a6b328e4c355644e1aa681f8e145d66eb2fdd3c1 downloaded
Mar/29/2023 18:03:13 container,info,debug CONTAINER_DEBUG: getting layer sha256:5639599549d14012dde14207c03d8566e0979b4bce164d6ca85d15821204985c
Mar/29/2023 18:03:13 container,info,debug CONTAINER_DEBUG: layer sha256:5639599549d14012dde14207c03d8566e0979b4bce164d6ca85d15821204985c downloaded
Mar/29/2023 18:03:13 container,info,debug CONTAINER_DEBUG: getting layer sha256:e6e6be8f2bd11ec0e9bc413879e30d9473fa37ebc10809172283881aa00af9dc
Mar/29/2023 18:03:14 container,info,debug CONTAINER_DEBUG: layer sha256:e6e6be8f2bd11ec0e9bc413879e30d9473fa37ebc10809172283881aa00af9dc downloaded
Mar/29/2023 18:03:14 container,info,debug CONTAINER_DEBUG: getting layer sha256:ca0142fe746bd0ffb642cfb95f93c7d0bf58e3dc067d072345489ae2dd6fd8f0
Mar/29/2023 18:03:15 container,info,debug CONTAINER_DEBUG: layer sha256:ca0142fe746bd0ffb642cfb95f93c7d0bf58e3dc067d072345489ae2dd6fd8f0 downloaded
Mar/29/2023 18:03:15 container,info,debug CONTAINER_DEBUG: getting layer sha256:705194568ab601c8e1b88dc707059abbdf0a69f58c40b8242c4c4ebed9bc20d9
Mar/29/2023 18:03:15 container,info,debug CONTAINER_DEBUG: layer sha256:705194568ab601c8e1b88dc707059abbdf0a69f58c40b8242c4c4ebed9bc20d9 downloaded
Mar/29/2023 18:03:15 container,info,debug CONTAINER_DEBUG: getting layer sha256:49429a084fc31e0a95567d4c1fea3f8b8fa62cff801e8887ee0ac15b48b8699d
Mar/29/2023 18:03:16 container,info,debug CONTAINER_DEBUG: layer sha256:49429a084fc31e0a95567d4c1fea3f8b8fa62cff801e8887ee0ac15b48b8699d downloaded
Mar/29/2023 18:03:16 container,info,debug CONTAINER_DEBUG: getting layer sha256:8356dd4cbf390612e98ab182463c8142e48a28296b85cd67a9ae158470ca7041
Mar/29/2023 18:03:17 container,info,debug CONTAINER_DEBUG: layer sha256:8356dd4cbf390612e98ab182463c8142e48a28296b85cd67a9ae158470ca7041 downloaded
Mar/29/2023 18:03:20 container,info,debug CONTAINER_DEBUG: getting layer sha256:e707c6e73504bf7515d9dce1db82d55b4b4e7a7cc5d978c64c72aaf025b70865
Mar/29/2023 18:03:20 container,info,debug CONTAINER_DEBUG: layer sha256:e707c6e73504bf7515d9dce1db82d55b4b4e7a7cc5d978c64c72aaf025b70865 downloaded
Mar/29/2023 18:03:20 container,info,debug CONTAINER_DEBUG: getting layer sha256:b67f849c8917e848612351bc486530efbfbee4bba3777867520c16575d25d58a
Mar/29/2023 18:03:22 container,info,debug CONTAINER_DEBUG: layer sha256:b67f849c8917e848612351bc486530efbfbee4bba3777867520c16575d25d58a downloaded
Mar/29/2023 18:03:23 container,info,debug CONTAINER_DEBUG: getting layer sha256:773489f3240372908453a133e852e8a959b611109b68807195bbd41d865537f1
Mar/29/2023 18:03:25 container,info,debug CONTAINER_DEBUG: layer sha256:773489f3240372908453a133e852e8a959b611109b68807195bbd41d865537f1 downloaded
Mar/29/2023 18:03:26 container,info,debug CONTAINER_DEBUG: getting layer sha256:42491ea7cdc6785a2ef9a689bab0d7179d392c4f2a1518de3c8c85f838d58d45
Mar/29/2023 18:03:26 container,info,debug CONTAINER_DEBUG: layer sha256:42491ea7cdc6785a2ef9a689bab0d7179d392c4f2a1518de3c8c85f838d58d45 downloaded
Mar/29/2023 18:03:26 container,info,debug CONTAINER_DEBUG: getting layer sha256:2ef0403fbca1ac365dec881c9b45bd8271416a9ea467a3b51cb92fd0e3e4d487
Mar/29/2023 18:03:27 container,info,debug CONTAINER_DEBUG: layer sha256:2ef0403fbca1ac365dec881c9b45bd8271416a9ea467a3b51cb92fd0e3e4d487 downloaded
Mar/29/2023 18:03:27 container,info,debug CONTAINER_DEBUG: import successful, container f894d918-d757-41eb-8cdf-0441642feb10
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: /--------------------------------------------------------------------
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: | Starting Vaultwarden |
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: | Version 1.27.0 |
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: |--------------------------------------------------------------------|
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: | This is an unofficial Bitwarden implementation, DO NOT use the |
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: | official channels to report bugs/features, regardless of client. |
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: | Send usage/configuration questions or feature requests to: |
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: | https://vaultwarden.discourse.group/ |
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: | Report suspected bugs/issues in the software itself at: |
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: | https://github.com/dani-garcia/vaultwarden/issues/new |
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: --------------------------------------------------------------------/
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG:
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: [INFO] No .env file found.
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG:
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: [WARNING] The following environment variables are being overriden by the config file,
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: [WARNING] please use the admin panel to make changes to them:
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG: [WARNING] ADMIN_TOKEN
Mar/29/2023 18:03:59 container,info,debug CONTAINER_DEBUG:
Mar/29/2023 18:04:00 container,info,debug CONTAINER_DEBUG: [2023-03-29 18:04:00.374][start][INFO] Rocket has launched from http://0.0.0.0:80

BlackDex Mar 29, 2023
Collaborator

Looks like you need to update your docker version I'm afraid. Not sure what exactly triggered this though.

hawkn Mar 29, 2023

Riiiiiite, haha, you are probably correct, gonna make a ticket for Mikrotik support :)>
I have NO way of updating that, have to wait until Mikrotik releases a new version of RouterOS.
Might try test/beta release to see if the issue is fixed.
And thanks, I did NOT think of that.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

1.28.0 #3374

{{title}}

Replies: 5 comments 10 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

1.28.0 #3374

dani-garcia Mar 26, 2023 Maintainer

Major changes

What's Changed

New Contributors

Replies: 5 comments · 10 replies

paolobarbolini Mar 26, 2023 Sponsor

BlackDex Mar 27, 2023 Collaborator

BlackDex Mar 27, 2023 Collaborator

BlackDex Mar 27, 2023 Collaborator

BlackDex Mar 29, 2023 Collaborator

BlackDex Mar 29, 2023 Collaborator

dani-garcia
Mar 26, 2023
Maintainer

Replies: 5 comments 10 replies

paolobarbolini Mar 26, 2023
Sponsor

BlackDex Mar 27, 2023
Collaborator

BlackDex Mar 27, 2023
Collaborator

BlackDex Mar 27, 2023
Collaborator

BlackDex Mar 29, 2023
Collaborator

BlackDex Mar 29, 2023
Collaborator