fix(sends): emit hideEmail as non-null boolean in sync response by kvdb · Pull Request #7283 · dani-garcia/vaultwarden

kvdb · 2026-06-01T09:08:23Z

Problem

GET /api/sync returns "hideEmail": null for Sends whose hide_email column is NULL. The sends.hide_email column is Nullable<Bool> with no default (added in migration 2021-05-11-205202_add_hide_email), so it is NULL for older Sends and any code path that leaves it unset.

The Bitwarden Android client deserializes SyncResponseJson.Send.hideEmail as a non-null Kotlin Boolean and throws a JsonDecodingException, aborting the entire sync. Web, desktop and CLI clients coerce null to false, so only accounts with at least one Send are affected, and only on Android.

The official Bitwarden server treats hideEmail as non-nullable.

Fix

Default None to false at the serialization boundary in Send::to_json():

"hideEmail": self.hide_email.unwrap_or(false),

The field stays Option<bool> internally. No DB migration is required, and this fixes both existing NULL rows and any future NULLs.

The /api/sync response serialized a Send hide_email field directly from Option<bool>, so a NULL value in the sends table (the column is Nullable<Bool> with no default) produced "hideEmail": null. The Bitwarden Android client deserializes SyncResponseJson.Send.hideEmail as a non-null Kotlin Boolean and aborts the entire sync with a JsonDecodingException when it encounters null. Web, desktop and CLI clients coerce null to false, so only accounts with at least one Send are affected and only on Android. Default None to false at the serialization boundary, matching the official Bitwarden server where hideEmail is non-nullable. This needs no database migration and fixes both legacy NULL rows and any future NULLs. The hide_email field stays Option<bool> internally.

… ➔ 1.37.0) (#418) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/dani-garcia/vaultwarden](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0` → `1.37.0` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (ghcr.io/dani-garcia/vaultwarden)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](dani-garcia/vaultwarden@1.36.0...1.37.0) ##### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. ##### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. ##### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](dani-garcia/vaultwarden#6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](dani-garcia/vaultwarden#7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](dani-garcia/vaultwarden#7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](dani-garcia/vaultwarden#7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](dani-garcia/vaultwarden#7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](dani-garcia/vaultwarden#6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](dani-garcia/vaultwarden#7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](dani-garcia/vaultwarden#7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](dani-garcia/vaultwarden#7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](dani-garcia/vaultwarden#7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](dani-garcia/vaultwarden#7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](dani-garcia/vaultwarden#7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](dani-garcia/vaultwarden#7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](dani-garcia/vaultwarden#7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](dani-garcia/vaultwarden#7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](dani-garcia/vaultwarden#7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](dani-garcia/vaultwarden#7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](dani-garcia/vaultwarden#7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](dani-garcia/vaultwarden#7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](dani-garcia/vaultwarden#6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](dani-garcia/vaultwarden#7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](dani-garcia/vaultwarden#7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](dani-garcia/vaultwarden#7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](dani-garcia/vaultwarden#7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](dani-garcia/vaultwarden#7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](dani-garcia/vaultwarden#7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](dani-garcia/vaultwarden#7472) ##### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](dani-garcia/vaultwarden#7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](dani-garcia/vaultwarden#7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](dani-garcia/vaultwarden#7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](dani-garcia/vaultwarden#7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](dani-garcia/vaultwarden#6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](dani-garcia/vaultwarden#7442) **Full Changelog**: <dani-garcia/vaultwarden@1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/418

…(#558) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/vaultwarden/server](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0` → `1.37.0` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (quay.io/vaultwarden/server)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](dani-garcia/vaultwarden@1.36.0...1.37.0) #### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. #### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. #### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](dani-garcia/vaultwarden#6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](dani-garcia/vaultwarden#7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](dani-garcia/vaultwarden#7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](dani-garcia/vaultwarden#7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](dani-garcia/vaultwarden#7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](dani-garcia/vaultwarden#6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](dani-garcia/vaultwarden#7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](dani-garcia/vaultwarden#7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](dani-garcia/vaultwarden#7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](dani-garcia/vaultwarden#7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](dani-garcia/vaultwarden#7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](dani-garcia/vaultwarden#7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](dani-garcia/vaultwarden#7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](dani-garcia/vaultwarden#7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](dani-garcia/vaultwarden#7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](dani-garcia/vaultwarden#7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](dani-garcia/vaultwarden#7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](dani-garcia/vaultwarden#7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](dani-garcia/vaultwarden#7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](dani-garcia/vaultwarden#6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](dani-garcia/vaultwarden#7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](dani-garcia/vaultwarden#7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](dani-garcia/vaultwarden#7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](dani-garcia/vaultwarden#7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](dani-garcia/vaultwarden#7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](dani-garcia/vaultwarden#7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](dani-garcia/vaultwarden#7472) #### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](dani-garcia/vaultwarden#7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](dani-garcia/vaultwarden#7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](dani-garcia/vaultwarden#7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](dani-garcia/vaultwarden#7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](dani-garcia/vaultwarden#6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](dani-garcia/vaultwarden#7442) **Full Changelog**: <dani-garcia/vaultwarden@1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [vaultwarden/server](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0` → `1.37.0` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (vaultwarden/server)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](dani-garcia/vaultwarden@1.36.0...1.37.0) #### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. #### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. #### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](dani-garcia/vaultwarden#6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](dani-garcia/vaultwarden#7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](dani-garcia/vaultwarden#7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](dani-garcia/vaultwarden#7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](dani-garcia/vaultwarden#7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](dani-garcia/vaultwarden#6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](dani-garcia/vaultwarden#7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](dani-garcia/vaultwarden#7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](dani-garcia/vaultwarden#7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](dani-garcia/vaultwarden#7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](dani-garcia/vaultwarden#7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](dani-garcia/vaultwarden#7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](dani-garcia/vaultwarden#7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](dani-garcia/vaultwarden#7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](dani-garcia/vaultwarden#7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](dani-garcia/vaultwarden#7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](dani-garcia/vaultwarden#7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](dani-garcia/vaultwarden#7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](dani-garcia/vaultwarden#7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](dani-garcia/vaultwarden#6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](dani-garcia/vaultwarden#7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](dani-garcia/vaultwarden#7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](dani-garcia/vaultwarden#7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](dani-garcia/vaultwarden#7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](dani-garcia/vaultwarden#7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](dani-garcia/vaultwarden#7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](dani-garcia/vaultwarden#7472) #### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](dani-garcia/vaultwarden#7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](dani-garcia/vaultwarden#7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](dani-garcia/vaultwarden#7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](dani-garcia/vaultwarden#7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](dani-garcia/vaultwarden#6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](dani-garcia/vaultwarden#7442) **Full Changelog**: <dani-garcia/vaultwarden@1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://forgejo.internal/forgejo_admin/infra-personal/pulls/126 Co-authored-by: Renovate Bot <renovatebot@forgejo.internal> Co-committed-by: Renovate Bot <renovatebot@forgejo.internal>

… ➔ 1.37.0) (#418) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/dani-garcia/vaultwarden](https://github.com/dani-garcia/vaultwarden) | minor | `1.36.0` → `1.37.0` | --- ### Release Notes <details> <summary>dani-garcia/vaultwarden (ghcr.io/dani-garcia/vaultwarden)</summary> ### [`v1.37.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0) [Compare Source](dani-garcia/vaultwarden@1.36.0...1.37.0) ##### Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. ##### Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. - SSRF via the icon endpoint [\[GHSA-hw4g-2v3f-74x5\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [\[GHSA-vh5m-fc9v-m84g\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3) - Cross-Organization Cipher Access [\[GHSA-xwf8-pjh7-h589\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9) - Organization Policy Bypass on Directory Import [\[GHSA-88qc-6ch9-mc3j\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5) - Send Access-Count Bypass [\[GHSA-rxhg-2pw9-vf25\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3) - Unauthenticated WebSocket Flooding DDOS [\[GHSA-96f7-78q5-j345\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3) - Cross-Organization Secret Sharing [\[GHSA-455c-vgg9-jxw8\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3) - Organization Import Authorization [\[GHSA-f3qw-qg77-hmm4\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[\[GHSA-jq2g-h4xr-4mcr\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3) - Organization Data Enumeration via the Manager role [\[GHSA-rqf8-2568-r7mc\]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3) These are private for now, pending CVE assignment and publishing at a later date. ##### What's Changed - OpenDAL S3 parameter support by [@txase](https://github.com/txase) in [#6127](dani-garcia/vaultwarden#6127) - Fix SSO Cookie path by [@BlackDex](https://github.com/BlackDex) in [#7187](dani-garcia/vaultwarden#7187) - fix email 2fa for bw cli by [@stefan0xC](https://github.com/stefan0xC) in [#7225](dani-garcia/vaultwarden#7225) - sso\_auth improvements by [@Timshel](https://github.com/Timshel) in [#7197](dani-garcia/vaultwarden#7197) - Reject unrecognised DATABASE\_URL instead of silent SQLite fallback by [@mfw78](https://github.com/mfw78) in [#7061](dani-garcia/vaultwarden#7061) - Switch to `xx-cargo` by [@dfunkt](https://github.com/dfunkt) in [#6640](dani-garcia/vaultwarden#6640) - Updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7235](dani-garcia/vaultwarden#7235) - Switch to Edition 2024, more clippy lints, and less macro calls by [@BlackDex](https://github.com/BlackDex) in [#7200](dani-garcia/vaultwarden#7200) - Serve Apple app site association file by [@user71424q](https://github.com/user71424q) in [#7191](dani-garcia/vaultwarden#7191) - Update Rust, Crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7307](dani-garcia/vaultwarden#7307) - Fix enforce blocked by [@Timshel](https://github.com/Timshel) in [#7246](dani-garcia/vaultwarden#7246) - Admin password recovery endpoint change by [@Timshel](https://github.com/Timshel) in [#7270](dani-garcia/vaultwarden#7270) - fix(sends): emit hideEmail as non-null boolean in sync response by [@kvdb](https://github.com/kvdb) in [#7283](dani-garcia/vaultwarden#7283) - Org membership delete remove Invitation by [@Timshel](https://github.com/Timshel) in [#7284](dani-garcia/vaultwarden#7284) - \[v2026.5.0] Registration request update by [@Timshel](https://github.com/Timshel) in [#7295](dani-garcia/vaultwarden#7295) - \[v2026.5.0] PutPolicy now using vnext format by [@Timshel](https://github.com/Timshel) in [#7296](dani-garcia/vaultwarden#7296) - 2026.6.0 send support by [@Timshel](https://github.com/Timshel) in [#7346](dani-garcia/vaultwarden#7346) - Add SSO\_AUTHORIZE\_BODY by [@Timshel](https://github.com/Timshel) in [#7357](dani-garcia/vaultwarden#7357) - Add `pm-26340-linux-biometrics-v2` feature flag by [@pilotstew](https://github.com/pilotstew) in [#7358](dani-garcia/vaultwarden#7358) - improve CI by [@TriplEight](https://github.com/TriplEight) in [#6991](dani-garcia/vaultwarden#6991) - Misc updates and fixes by [@BlackDex](https://github.com/BlackDex) in [#7406](dani-garcia/vaultwarden#7406) - Remove old compatibility code by [@Timshel](https://github.com/Timshel) in [#7434](dani-garcia/vaultwarden#7434) - Fix compilation with newer `rust-musl` version by [@dfunkt](https://github.com/dfunkt) in [#7453](dani-garcia/vaultwarden#7453) - Fix Custom Role CSS for new dialog markup by [@tom27052006](https://github.com/tom27052006) in [#7442](dani-garcia/vaultwarden#7442) - Remove unused fields by [@Timshel](https://github.com/Timshel) in [#7458](dani-garcia/vaultwarden#7458) - Update API response, crates and GHA by [@BlackDex](https://github.com/BlackDex) in [#7470](dani-garcia/vaultwarden#7470) - Trusted proxy support, unauthenticated rate limit & other fixes by [@dani-garcia](https://github.com/dani-garcia) in [#7472](dani-garcia/vaultwarden#7472) ##### New Contributors - [@mfw78](https://github.com/mfw78) made their first contribution in [#7061](dani-garcia/vaultwarden#7061) - [@user71424q](https://github.com/user71424q) made their first contribution in [#7191](dani-garcia/vaultwarden#7191) - [@kvdb](https://github.com/kvdb) made their first contribution in [#7283](dani-garcia/vaultwarden#7283) - [@pilotstew](https://github.com/pilotstew) made their first contribution in [#7358](dani-garcia/vaultwarden#7358) - [@TriplEight](https://github.com/TriplEight) made their first contribution in [#6991](dani-garcia/vaultwarden#6991) - [@tom27052006](https://github.com/tom27052006) made their first contribution in [#7442](dani-garcia/vaultwarden#7442) **Full Changelog**: <dani-garcia/vaultwarden@1.36.0...1.37.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/418

BlackDex requested changes Jun 6, 2026

View reviewed changes

Comment thread src/db/models/send.rs Outdated

kvdb force-pushed the fix/send-hideemail-non-null branch from 2e101af to 2c97b41 Compare June 9, 2026 14:34

BlackDex approved these changes Jun 21, 2026

View reviewed changes

BlackDex self-assigned this Jul 7, 2026

BlackDex merged commit fddc16d into dani-garcia:main Jul 7, 2026
9 checks passed

Navigation Menu

Uh oh!

fix(sends): emit hideEmail as non-null boolean in sync response - #7283

fix(sends): emit hideEmail as non-null boolean in sync response#7283
BlackDex merged 1 commit into
dani-garcia:mainfrom
kvdb:fix/send-hideemail-non-null

kvdb commented Jun 1, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kvdb commented Jun 1, 2026

Problem

Fix

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants