Release v1.12

🔐 Bitwarden Export v1.12

A reliability and security release: a backup that fails now says so, passwords stay off the command line, and external monitors can tell success from failure.

⚠️ Before you upgrade

This image ships Bitwarden CLI 2026.10.0, which needs:

• Vaultwarden 1.37.4 or later. Since CLI 2026.9.0, unlocking the vault calls an endpoint that older Vaultwarden releases do not have. On those servers the export fails with the message below, even though the password is right:

  ERROR: Failed to unlock vault with BW_PASSWORD.
  

  Upgrade Vaultwarden first. bitwarden.com is not affected. Reference: dani-garcia/vaultwarden#7693.

• HTTPS for self-hosted servers. The CLI refuses plain-HTTP URLs.

Then recreate the container so it starts clean:

docker compose pull && docker compose up -d --force-recreate bw-export

✨ New

• 📡 PING_URL for external monitoring (#28, #30). The image pings healthchecks.io, Uptime Kuma or any dead man's switch when the export starts and again when it finishes, with the outcome. Before, a monitor on NOTIFICATION_URL received the same ping for success and failure. Optional: unset, nothing changes. See Monitoring. Thanks to @jwyse and @nemchik for the discussion in #19.
• 🔔 Modern Gotify tokens (#25, #27). Thanks @deejayexe!
• 🦭 Rootless Podman (#31). A new compose.podman.yml override uses keep-id, so PUID/PGID mean what they mean under Docker.

🐛 Fixes

• Stuck CLI session (#21, #22). A session left behind by an earlier run made every later run fail with Failed to unlock vault. It is now detected and cleared. Thanks @morbloe for the report and the diagnosis!
• A failed export no longer passes as a success (#32). An export that could not be written used to log Vault export complete. and exit 0. With KEEP_LAST_BACKUPS, rotation could then delete good backups to keep the empty one. Every export and listing is now checked, and any failure fails the run.
• Attachments are saved where the docs mount them (#31). The README mounted /var/attachment, but the script writes to /var/attachments, so attachments went to an anonymous volume and were lost with the container. Existing setups that mount the old path keep working, with a warning.
• Infisical (#27, #38):
  • the install inside the image is fixed;
  • it now works without INFISICAL_PATH (before, it always failed);
  • if Infisical cannot provide the secrets, the container stops with exit 1 and sends a failure notification.
• The image reports its own version (#29). The OCI version label said 24.04, Ubuntu's version.

🔒 Security

• Passwords off the command line (#36). BW_PASSWORD and EXPORT_PASSWORD no longer appear in ps, so other users on the host cannot read them. See Passwords stay off the command line.
• The notification URL stays secret (#38). NOTIFICATION_URL, which for Telegram contains the bot token, is no longer visible in ps or in the log, even when sending fails.

📝 Docs

• New requirements: Vaultwarden 1.37.4 or later, and HTTPS.
• INFISICAL_PATH has no effect with a service token, because the token's own scope always applies. If a variable is set in both the compose file and Infisical, the Infisical value wins (#41).

🧰 Under the hood

• shoutrrr is pinned to a checked version. The build used to fail at random on the GitHub API rate limit (#24).
• CI runs unit suites (116 + 33 + 13 assertions) and shellcheck, plus a nightly end-to-end test with the real CLI against a real Vaultwarden 1.37.4 (#23, #33, #41).
• Dependabot, repository policies and an issue form (#35, #37).

📦 Image

Image	0netx/bw-export:v1.12, 0netx/bw-export:latest
Bitwarden CLI	2026.10.0
Tested against	Vaultwarden 1.37.4, bitwarden.com

Full changelog: v1.11...v1.12