Release v1.11

🔐 Bitwarden Export v1.11

🐛 Bug Fix — Bitwarden CLI pinned to 2025.11.0

Problem

Starting from Bitwarden CLI 2025.12.0, a breaking change was introduced that causes
authentication to fail when used against Vaultwarden self-hosted instances.

The CLI now expects KDF/userDecryptionOptions fields in the API key authentication
response — fields that current versions of Vaultwarden do not return — resulting in
the following error during login:

TypeError: Cannot read properties of null (reading 'toWrappedAccountCryptographicState')

Or during vault unlock:

ERROR: Failed to unlock vault with BW_PASSWORD.

This issue affects any Vaultwarden instance regardless of its version, as Vaultwarden
has not yet implemented support for these new fields introduced by the official Bitwarden server.

Reference: dani-garcia/vaultwarden#6729

Fix

The Docker image no longer downloads the latest CLI version from vault.bitwarden.com.
Instead, it now explicitly pins version 2025.11.0 — the last fully compatible CLI
version with Vaultwarden — downloaded directly from GitHub Releases, ensuring reproducible
and stable behavior regardless of when the image is built.

# Dockerfile
ENV BW_CLI_VERSION="2025.11.0"

Impact

Scenario	Status
Vaultwarden (self-hosted)	✅ Fixed
Bitwarden (official cloud)	✅ Compatible

Upgrading

If you are building the image locally, make sure to rebuild with --no-cache to ensure
the pinned CLI version is downloaded:

docker compose build --no-cache

Future updates

Once Vaultwarden releases a version with full userDecryptionOptions support,
updating ENV BW_CLI_VERSION in the Dockerfile to the corresponding CLI version
will be sufficient to upgrade.

---

What's Changed

• 🔒 Pin Bitwarden CLI to 2025.11.0 for Vaultwarden compatibility
• 🔗 Switch CLI download source from vault.bitwarden.com to GitHub Releases for reproducible builds

Full Changelog: v1.8...v1.9