Release v1.12

🔐 Bitwarden Export v1.12

A reliability and security release: a backup that fails now says so, passwords stay off the command line, and external monitors can tell success from failure.

⚠️ Before you upgrade

This image ships Bitwarden CLI 2026.10.0, which needs:

• Vaultwarden 1.37.4 or later. Since CLI 2026.9.0, unlocking the vault calls an endpoint that older Vaultwarden releases do not have. On those servers the export fails with the message below, even though the password is right:

  ERROR: Failed to unlock vault with BW_PASSWORD.
  

  Upgrade Vaultwarden first. bitwarden.com is not affected. Reference: dani-garcia/vaultwarden#7693.

• HTTPS for self-hosted servers. The CLI refuses plain-HTTP URLs.

Then recreate the container so it starts clean:

docker compose pull && docker compose up -d --force-recreate bw-export

✨ New

• 📡 PING_URL for external monitoring (#28, #30). The image pings healthchecks.io, Uptime Kuma or any dead man's switch when the export starts and again when it finishes, with the outcome. Before, a monitor on NOTIFICATION_URL received the same ping for success and failure. Optional: unset, nothing changes. See Monitoring. Thanks to @jwyse and @nemchik for the discussion in #19.
• 🔔 Modern Gotify tokens (#25, #27). Thanks @deejayexe!
• 🦭 Rootless Podman (#31). A new compose.podman.yml override uses keep-id, so PUID/PGID mean what they mean under Docker.

🐛 Fixes

• Stuck CLI session (#21, #22). A session left behind by an earlier run made every later run fail with Failed to unlock vault. It is now detected and cleared. Thanks @morbloe for the report and the diagnosis!
• A failed export no longer passes as a success (#32). An export that could not be written used to log Vault export complete. and exit 0. With KEEP_LAST_BACKUPS, rotation could then delete good backups to keep the empty one. Every export and listing is now checked, and any failure fails the run.
• Attachments are saved where the docs mount them (#31). The README mounted /var/attachment, but the script writes to /var/attachments, so attachments went to an anonymous volume and were lost with the container. Existing setups that mount the old path keep working, with a warning.
• Infisical (#27, #38):
  • the install inside the image is fixed;
  • it now works without INFISICAL_PATH (before, it always failed);
  • if Infisical cannot provide the secrets, the container stops with exit 1 and sends a failure notification.
• The image reports its own version (#29). The OCI version label said 24.04, Ubuntu's version.

🔒 Security

• Passwords off the command line (#36). BW_PASSWORD and EXPORT_PASSWORD no longer appear in ps, so other users on the host cannot read them. See Passwords stay off the command line.
• The notification URL stays secret (#38). NOTIFICATION_URL, which for Telegram contains the bot token, is no longer visible in ps or in the log, even when sending fails.

📝 Docs

• New requirements: Vaultwarden 1.37.4 or later, and HTTPS.
• INFISICAL_PATH has no effect with a service token, because the token's own scope always applies. If a variable is set in both the compose file and Infisical, the Infisical value wins (#41).

🧰 Under the hood

• shoutrrr is pinned to a checked version. The build used to fail at random on the GitHub API rate limit (#24).
• CI runs unit suites (116 + 33 + 13 assertions) and shellcheck, plus a nightly end-to-end test with the real CLI against a real Vaultwarden 1.37.4 (#23, #33, #41).
• Dependabot, repository policies and an issue form (#35, #37).

📦 Image

Image	0netx/bw-export:v1.12, 0netx/bw-export:latest
Bitwarden CLI	2026.10.0
Tested against	Vaultwarden 1.37.4, bitwarden.com

Full changelog: v1.11...v1.12

Release v1.11

🔐 Bitwarden Export v1.11

🐛 Bug Fix — Bitwarden CLI pinned to 2025.11.0

Problem

Starting from Bitwarden CLI 2025.12.0, a breaking change was introduced that causes
authentication to fail when used against Vaultwarden self-hosted instances.

The CLI now expects KDF/userDecryptionOptions fields in the API key authentication
response — fields that current versions of Vaultwarden do not return — resulting in
the following error during login:

TypeError: Cannot read properties of null (reading 'toWrappedAccountCryptographicState')

Or during vault unlock:

ERROR: Failed to unlock vault with BW_PASSWORD.

This issue affects any Vaultwarden instance regardless of its version, as Vaultwarden
has not yet implemented support for these new fields introduced by the official Bitwarden server.

Reference: dani-garcia/vaultwarden#6729

Fix

The Docker image no longer downloads the latest CLI version from vault.bitwarden.com.
Instead, it now explicitly pins version 2025.11.0 — the last fully compatible CLI
version with Vaultwarden — downloaded directly from GitHub Releases, ensuring reproducible
and stable behavior regardless of when the image is built.

# Dockerfile
ENV BW_CLI_VERSION="2025.11.0"

Impact

Scenario	Status
Vaultwarden (self-hosted)	✅ Fixed
Bitwarden (official cloud)	✅ Compatible

Upgrading

If you are building the image locally, make sure to rebuild with --no-cache to ensure
the pinned CLI version is downloaded:

docker compose build --no-cache

Future updates

Once Vaultwarden releases a version with full userDecryptionOptions support,
updating ENV BW_CLI_VERSION in the Dockerfile to the corresponding CLI version
will be sufficient to upgrade.

---

What's Changed

• 🔒 Pin Bitwarden CLI to 2025.11.0 for Vaultwarden compatibility
• 🔗 Switch CLI download source from vault.bitwarden.com to GitHub Releases for reproducible builds

Full Changelog: v1.8...v1.9

v1.8

What's Changed

No changes related to code.
bw export client update from Bitwarden Organization to 2024.7.2

v1.6

What's Changed

No changes related to code.
bw export client update from Bitwarden Organization to 2024.6.0

v1.5

What's Changed

• [Dev ](feat: Clean up previous backups when the export process is complete.) by @0neTX in #10

KEEP_LAST_BACKUPS Variable

Keep the maximum number of exports defined. A maximum of X exports will be retained, the oldest exports will be deleted.

environment:
  - KEEP_LAST_BACKUPS=5

Each export is saved in the output folder with the template <DateTime>-bw-export.
When the variable KEEP_LAST_BACKUPS is set, the container will sort the folders and delete the oldest ones while keeping the number of folders indicated by the variable.

Full Changelog: v1.4...v1.5

What's Changed

• [Dev ](feat: Clean up previous backups when the export process is complete.) by @0neTX in #10

Full Changelog: v1.4...v1.5

v1.4

What's Changed

• fix: Error in execution permissions in entrypoint.sh by @0neTX in #9

Full Changelog: v1.3...v1.4

Release v1.2

Feature

• Using the PUID and PGID allows our containers to map the container's internal user to a user on the host machine.

What's Changed

• feat: Allows the container to map the container's internal user to a… by @0neTX in #5

Full Changelog: v1.1...v1.2

Release v1.1

docker pull 0netx/bw-export:latest