Major changes

• The project has changed license to the AGPLv3. If you're hosting a Vaultwarden instance, you now have a requirement to distribute the Vaultwarden source code to your users if they request it. The source code, and any changes you have made, need to be under the same AGPLv3 license. If you simply use our code without modifications, just pointing them to this repository is enough.
• Added support for Argon2 key derivation on the clients. To enable it for your account, make sure all your clients are using version v2023.2.0 or greater, then go to account settings > security > keys, and change the algorithm from PBKDF2 to Argon2id.
• Added support for Argon2 key derivation for the admin page token. To update your admin token to use it, check the wiki
• New alternative registries for the docker images are available (In BETA for now):
  • Github Container Registry: https://ghcr.io/dani-garcia/vaultwarden
  • Quay: https://quay.io/vaultwarden/server

What's Changed

• Remove patched multer-rs by @manofthepeace in https://github.com/dani-garcia/vaultwarden/pull/2968
• Removed unsafe-inline JS from CSP and other fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3058
• Validate YUBICO_SERVER string (#3003) by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3059
• Log message to stderr if LOG_FILE is not writable by @pjsier in https://github.com/dani-garcia/vaultwarden/pull/3061
• Update WebSocket Notifications by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3076
• Optimize config loading messages by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3092
• Percent-encode org_name in links by @am97 in https://github.com/dani-garcia/vaultwarden/pull/3093
• Fix failing large note imports by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3087
• Change text/plain API responses to application/json by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/3124
• Remove shrink-to-fit=no from viewport-meta-tag by @redwerkz in https://github.com/dani-garcia/vaultwarden/pull/3126
• Update dependencies and MSRV by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3128
• Resolve uninlined_format_args clippy warnings by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3065
• Update Rust to v1.66.1 to patch CVE by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3136
• Fix remaining inline format by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3130
• Use more modern meta tag for charset encoding by @redwerkz in https://github.com/dani-garcia/vaultwarden/pull/3131
• fix (2fa.directory): Allow api.2fa.directory, and remove 2fa.directory by @GeekCornerGH in https://github.com/dani-garcia/vaultwarden/pull/3132
• Optimize CipherSyncData for very large vaults by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3133
• Add avatar color support by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3134
• Add MFA icon to org member overview by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3135
• Minor refactoring concering user.setpassword by @sirux88 in https://github.com/dani-garcia/vaultwarden/pull/3139
• Validate note sizes on key-rotation. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3157
• Update KDF Configuration and processing by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3163
• Remove arm32v6-specific tag by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/3164
• Re-License Vaultwarden to AGPLv3 by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2561
• Admin password reset by @sirux88 in https://github.com/dani-garcia/vaultwarden/pull/3116
• "Spell-Jacking" mitigation ~ prevent sensitive data leak … by @dlehammer in https://github.com/dani-garcia/vaultwarden/pull/3145
• Allow listening on privileged ports (below 1024) as non-root by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/3170
• don't nullify key when editing emergency access by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/3215
• Fix trailing slash not getting removed from domain by @BlockListed in https://github.com/dani-garcia/vaultwarden/pull/3228
• Generate distinct log messages for regex vs. IP blacklisting. by @kpfleming in https://github.com/dani-garcia/vaultwarden/pull/3231
• allow editing/unhiding by group by @farodin91 in https://github.com/dani-garcia/vaultwarden/pull/3108
• Fix Javascript issue on non sqlite databases by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3167
• add argon2 kdf fields by @tessus in https://github.com/dani-garcia/vaultwarden/pull/3210
• add support for system mta though sendmail by @soruh in https://github.com/dani-garcia/vaultwarden/pull/3147
• Updated Rust and crates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3234
• docs: add build status badge in readme by @R3DRUN3 in https://github.com/dani-garcia/vaultwarden/pull/3245
• Validate all needed fields for client API login by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3251
• Fix Organization delete when groups are configured by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3252
• Fix Collection Read Only access for groups by @Misterbabou in https://github.com/dani-garcia/vaultwarden/pull/3254
• Make the admin session lifetime adjustable by @mittler-works in https://github.com/dani-garcia/vaultwarden/pull/3262
• Add function to fetch user by email address by @mittler-works in https://github.com/dani-garcia/vaultwarden/pull/3263
• Fix vault item display in org vault view by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/3277
• Add confirmation for removing 2FA and deauthing sessions in admin panel by @JCBird1012 in https://github.com/dani-garcia/vaultwarden/pull/3282
• Some Admin Interface updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3288
• Fix the web-vault v2023.2.0 API calls by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3281
• Fix confirmation for removing 2FA and deauthing sessions in admin panel by @dpinse in https://github.com/dani-garcia/vaultwarden/pull/3290
• Admin token Argon2 hashing support by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3289
• Add HEAD routes to avoid spurious error messages by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/3307
• Fix web-vault Member UI show/edit/save by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3315
• Upd Crates, Rust, MSRV, GHA and remove Backtrace by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3310
• Add support for /api/devices/knowndevice with HTTP header params by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/3329
• Update Rust, MSRV and Crates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3348
• Merge ClientIp with Headers. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3332
• add endpoints to bulk delete collections/groups by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/3354
• Add support for Quay.io and GHCR.io as registries by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3363
• Some small fixes and updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3366
• Update web vault to v2023.3.0 by @dani-garcia

New Contributors

• @manofthepeace made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2968
• @pjsier made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3061
• @am97 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3093
• @redwerkz made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3126
• @sirux88 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3139
• @dlehammer made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3145
• @BlockListed made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3228
• @kpfleming made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3231
• @farodin91 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3108
• @soruh made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3147
• @R3DRUN3 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3245
• @Misterbabou made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3254
• @mittler-works made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3262
• @JCBird1012 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3282
• @dpinse made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/3290

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.27.0...1.28.0