1.37.0

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

• SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
• Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
• Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
• Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
• Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
• Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3)
• Organization Import Authorization [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr] (Medium, 4.3)
• Organization Data Enumeration via the Manager role [GHSA-rqf8-2568-r7mc] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

• OpenDAL S3 parameter support by @txase in #6127
• Fix SSO Cookie path by @BlackDex in #7187
• fix email 2fa for bw cli by @stefan0xC in #7225
• sso_auth improvements by @Timshel in #7197
• Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in #7061
• Switch to xx-cargo by @dfunkt in #6640
• Updates and fixes by @BlackDex in #7235
• Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in #7200
• Serve Apple app site association file by @user71424q in #7191
• Update Rust, Crates and GHA by @BlackDex in #7307
• Fix enforce blocked by @Timshel in #7246
• Admin password recovery endpoint change by @Timshel in #7270
• fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in #7283
• Org membership delete remove Invitation by @Timshel in #7284
• [v2026.5.0] Registration request update by @Timshel in #7295
• [v2026.5.0] PutPolicy now using vnext format by @Timshel in #7296
• 2026.6.0 send support by @Timshel in #7346
• Add SSO_AUTHORIZE_BODY by @Timshel in #7357
• Add pm-26340-linux-biometrics-v2 feature flag by @pilotstew in #7358
• improve CI by @TriplEight in #6991
• Misc updates and fixes by @BlackDex in #7406
• Remove old compatibility code by @Timshel in #7434
• Fix compilation with newer rust-musl version by @dfunkt in #7453
• Fix Custom Role CSS for new dialog markup by @tom27052006 in #7442
• Remove unused fields by @Timshel in #7458
• Update API response, crates and GHA by @BlackDex in #7470
• Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in #7472

New Contributors

• @mfw78 made their first contribution in #7061
• @user71424q made their first contribution in #7191
• @kvdb made their first contribution in #7283
• @pilotstew made their first contribution in #7358
• @TriplEight made their first contribution in #6991
• @tom27052006 made their first contribution in #7442

Full Changelog: 1.36.0...1.37.0