lang/rust: Bump revisions after 1.80.1 PR: 2804907a55f95425
Vaultwarden -- Multiple vulnerabilitiesentered 2026-10-06
no CVE referenced
Fixed in main, not merged to 2026Q4: Vaultwarden -- Multiple vulnerabilities
Bitwarden compatible backend server
# pkg install vaultwardeninstalls 1.37.4_1 from latest; from quarterly (2026Q4) 1.37.2_1# cd /usr/ports/security/vaultwarden && make install clean# make -C /usr/ports/security/vaultwarden config # change options first
www, group www| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 1.37.4_1 | 1.37.4 | – |
| FreeBSD 15 | 1.37.4_1 | 1.37.4_1 | – |
| FreeBSD 14 | 1.37.4_1 | 1.37.4 | ✗ |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 1.37.2_1 | 1.37.2_1 | – |
| FreeBSD 14 | 1.37.2_1 | 1.37.2_1 | ✗ |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
pkg audit for the packaged version 1.37.4_1.| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-95814 | 8.6 | 2026-09-22 | Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members t… |
no CVE referenced
no CVE referenced
no CVE referenced
no CVE referenced
no CVE referenced
no CVE referenced
no CVE referenced
| PR | Summary | Status | Changed |
|---|---|---|---|
| 298265 | maintainer-feedback? security/vaultwarden: empty dirs in etc | New | 2026-09-07 |
lang/rust: Bump revisions after 1.80.1 PR: 2804907a55f95425
security/vaultwarden: Fix build with rust 1.80.0 PR: 280490a5d69cd830
security/vaultwarden: Security update to 1.32.0 PR: 280258 Reported by: Bernard Spilc80fe7dcaf
lang/rust: Bump revisions after 1.79.0 PR: 27970721476ca8a9
security/vaultwarden: Fix build with rust 1.79.0 PR: 279707 Approved by: portmgr (build fix blanket)2fbba8be22
lang/rust: Bump revisions after 1.78.0 PR: 2788342322b66100
security/vaultwarden: Exclude i386 build3b0aaecdbf
lang/rust: Bump revisions after 1.77.0 PR: 277786d632fbe55e
security/vaultwarden: Update to 1.30.5 PR: 277596 Reported by: brnrd@830a7e41cc
lang/rust: Bump revisions after 1.76.0 PR: 2769207f5a7b0e52
security/vaultwarden: fix packaging The ownership can and should only be done in the plist never directly in the make targets, make package should be executable as a regular user and this is the case in the cluster) PR: 276998 Reported by: freebsd@rail.eu.orgf8bbc28c40
security/vaultwarden: Update to 1.30.3 While there address PR:276739 by installing the static configfile sample to etc/rc.conf.d/vaultwarden.sample since www/vaultwarden/data/config.json is for dynamic changes via the UI. PR: 276745, 276739ee63c50e82
security/vaultwarden: Update to 1.30.1 PR: 275394 Approved by: Maintainer time-out615bd55777
lang/rust: Bump revisions after 1.75.0 PR: 276033109c3d4629
lang/rust: Bump revisions after 1.74.1 PR: 275243b2afd89fb2
security/vaultwarden: fix build on armv6/armv7 and i386 Disable LTO to avoid address space exhaustion. Approved by: portmgr (build fix blanket) MFH: 2023Q4a0dbba65ab
security/vaultwarden: Optionsify database backends * redo 687ab26524e52c866295a9ff5c7956fd5f71397f [1] * was reverted with 04ea2d6456297a759d2c3a887aa2001049397d7b [2] PR: 274049 [1], 274962 [2]4f5bbb33f2
category/port: Update Update security/vaultwarden to 1.28.0 Update www/vaultwarden-web_vault to 2023.10.0 PR: 274908, 274962 Reported by: Bernard Spil04ea2d6456
security/vaultwarden: Optionsize database backends PR: 274049 Approved by: maintainer timeout687ab26524
lang/rust: Bump revisions after 1.73.0 PR: 274499dd10dc88a7
security/vaultwarden: Update to 1.29.2 PR: 273520 Approved by: maintainer timeoutbf1349b101
security/vaultwarden: Make package rootdir friendly - Use @dir with ownership instead of executing chown in postexec We should never chown -R the data directory at install (because it's empty) or when we upgrade (not needed) - Fix the shipped configuration file, do not install it in etc/rc.conf.d, install it where vaultwarden will actually load it and use @sample Differential Revision: https://reviews.freebsd.org/D416024c7443125c
lang/rust: Bump revisions after 1.72.0 PR: 273331aba8da2be1
security/vaultwarden: Update to 1.29.1 PR: 272444 Reported by: Adrien <freebsd asdrip fr> Approved by: maintainer timeout8f4e15df60
lang/rust: Bump revisions after 1.71.0 PR: 272449cdf28617b4
lang/rust: Bump revisions after 1.70.0 PR: 271797e1d1045bc7
security/vaultwarden: Try to fix "failes to build with synth" RUN_DEPENDS should depend on a file not a directory. PR: 270974 Reported by: Matthias Pfaller20532b22c6
security/vaultwarden: Update to 1.28.1 While there use Makefile.crates This time try to use correct WEBVAULT_RUN_DEPENDS75a60849f5
lang/rust: Bump revisions after 1.69.0 PR: 2709533db55c4e97
security/vaultwarden: Revert "security/vaultwarden: Update to 1.28.1" This reverts commit e10176835ff3c700a74a8145e453de6a97db0b2e.31f9b29110
security/vaultwarden: Update to 1.28.1 While there use Makefile.cratese10176835f
security/vaultwarden: Update to 1.28.0 * Split web_vault into separate port PR: 270182 Approved by: Maintainer timeoutbca4679da2
devel/capnproto: Update 0.10.1 → 0.10.3 Also add tests. PR: 270533 Approved by: felix@userspace.com.au (maintainer)ed48bae687
lang/rust: Bump revisions after 1.68.0 PR: 270080ebf29acc6c
lang/rust: Bump revisions after 1.67.1 PR: 269336109e35fd59
*/*: Bump rust (cargo) ports to reflect on WITH_LTO Bump ports in tree so they get rebuilt with new default settings for cargo ports12f1c627d4
security/vaultwarden: Update to 1.27.0 This will fix the bug with web vault updated to 2022.12.0. PR: 268599 Reported by: Adrien9ed2950bc2
security/vaultwarden: Drop RUSTC_BOOTSTRAP Try the build without RUSTC_BOOTSTRAP PR: 258368 Reported by: Jan Beich0411212e76
security/vaultwarden: update web vault to v2022.12.0 PR: 268483 Reported by: Ralf van der Enden8a7ddc6de9
lang/rust: Bump revisions after 1.66.0 PR: 268415ba14e01a52
lang/rust: Bump revisions after 1.65.0 PR: 2676229bf6a99963
lang/rust: Bump revisions after 1.64.0 PR: 267173afe651cf62
security/vaultwarden: Update Update to 1.26.0 and web vault to 2022.10.0 PR: 266517 Reported by: Adrien <freebsd@asdrip.fr>9aa11e5627
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
rust: bring back update to 1.63 Revert back the revert of the update of rust and related commits This revert was drive by beside validation by portmgr via exp-run and not respectful of the etiquette we have between committers This reverts commit 8ecb1f8141144c1603eb4026122d2e60eeaccd64. This reverts commit 04d257baa182926cff158f32cf459e560426add0. This reverts commit 2757c63bd0e6d01f9f0657fe03bb3a7b49adcae2. This reverts commit 75f4713de5e3fbd1c6a0cb572e08121814a4072e. This reverts commit e88e592111c86fdd1c0ac8717dbef9342e15e27c. This reverts commit 783c056d7d681d66e2c5c59251c275d65274028e. With hat: portmgrb9b250f912
Revert "lang/rust: Bump revisions after 1.63.0" This reverts commit c7912d97754bb7aa9a18eb33df53f91cba4cd82d. PR: 265915783c056d7d
lang/rust: Bump revisions after 1.63.0c7912d9775
security/vaultwarden: Minor update Update to 1.25.2 PR: 265497 Reported by: Adrien9c1887b863
security/vaultwarden: Update Update to 1.25.1 & web vault to v2022.6.2 Add simplification from brnrd@ PR: 265288 Reported by: Ralf van der Endenceb328b320