Vaultwarden Releases: A Complete Guide

Vaultwarden releases happen on a security-driven schedule, not a fixed calendar. The latest version, v1.37.2, arrived on August 22, 2026, following 86 previous releases. With 67,000 GitHub stars and active maintenance, Vaultwarden's release model prioritizes security patches and compatibility updates. Understanding how to track, check, and install new releases is essential before you self-host your password manager.

Understanding Vaultwarden's Release Model

Vaultwarden uses semantic versioning: major.minor.patch (e.g., 1.37.2). Major versions indicate significant changes. Minor versions add features without breaking compatibility. Patch versions fix bugs and security issues. This format tells you immediately what to expect from each release.

Vaultwarden does not follow a calendar release schedule. Releases arrive when security patches are ready or features are complete. Patch releases (1.37.0 to 1.37.1 to 1.37.2) often ship within weeks of each other when vulnerabilities need fixing. Minor updates (v1.36 to v1.37) typically space 2-3 months apart. This means you may see nothing for 30 days, then three updates in 10 days.

The project maintains 67,000 GitHub stars and 3,200 forks. This community size means active development and peer review. Vaultwarden ships stable releases: there is no "beta" branch for users. When a version is released on GitHub, it is production-ready. The project's AGPL-3.0 license means the source code is public and anyone can audit it for security issues.

Recent history shows consistent momentum: v1.35.3 through v1.35.8 over five months, then v1.36.0 in May 2026, then v1.37.x series through August 2026. This pattern suggests Vaultwarden has matured beyond early experimental releases into stable, maintained software.

Finding Vaultwarden Releases

Vaultwarden hosts release artifacts in multiple places. GitHub is the primary source: github.com/dani-garcia/vaultwarden/releases lists every version with full changelog and download links. Each release includes checksums for verification.

Docker Hub (hub.docker.com/r/vaultwarden/server) is where most users pull the image. Docker image tags correspond to release versions: vaultwarden/server:latest pulls the most recent stable release, while vaultwarden/server:1.37.2 pins a specific version. This matters because you control when Docker pulls updates.

SourceForge mirrors binaries for users who prefer traditional downloads instead of Docker or building from source. Artifact Hub (artifacthub.io) provides Helm charts for Kubernetes deployments, useful if you run Vaultwarden in a cluster.

GitHub remains authoritative: if a version is on GitHub but not yet on Docker Hub, wait a few hours. Docker builds and publishes images after a GitHub release is tagged. If you build Vaultwarden from source using the official repository, you are pulling the latest code at the exact moment you clone.

Checking Your Current Vaultwarden Version

If you run Vaultwarden in Docker, check the version in multiple ways. The simplest: inspect the running container logs. When Vaultwarden starts, it prints the version number. Run:

docker logs <container-name> | grep "Vaultwarden"

This returns output like: "Vaultwarden 1.37.2 (Build #3)". The number after "Vaultwarden" is your version.

If you have access to the web interface, some deployments expose version info in the admin panel or status page, though Vaultwarden's default install does not advertise this in the web UI. The surest method is checking the logs.

For manual builds, check the binary directly:

/path/to/vaultwarden --version

For system package installations (rare, as most use Docker), your package manager shows the installed version:

apt show vaultwarden

or

pacman -Q vaultwarden

Knowing your current version matters when evaluating whether an update is critical. If you run v1.37.0 and v1.37.2 is released, the jump is a patch: likely safe. If v2.0 drops (hypothetically), that is a major version: expect breaking changes.

How Vaultwarden Updates Work

Vaultwarden updates involve two moving parts: the server and the web vault (browser UI). The server is the Vaultwarden application itself. The web vault is the JavaScript frontend that users interact with.

Each Vaultwarden release is tested against specific web-vault versions. For example, v1.37.2 requires web-vault 2026.8.0 or later. If your web-vault is too old, the server will not function correctly with new client libraries. Vaultwarden bundles compatible web-vault code, so if you update the server, the web vault updates automatically in most deployments.

Client compatibility is another layer. Vaultwarden aims to stay compatible with the official Bitwarden mobile and desktop clients. A new Vaultwarden release may improve sync protocols or fix issues that prevent older clients from working. For a deep comparison of how Vaultwarden and Bitwarden handle updates and stability, see Vaultwarden vs Bitwarden. Check release notes to see if your client version is still supported.

Breaking changes happen occasionally but are rare. When they occur, the GitHub release notes flag them clearly. Example: v1.36.0 required database schema changes that older installations needed to run migration scripts for. These details always appear in the release notes.

The rule of thumb: minor and patch version updates are safe for most users. Major version updates require reading the changelog and planning maintenance time.

Updating to a New Release

If you run Vaultwarden in Docker, updating is simple. Pull the new image and restart the container. The exact steps depend on how you deployed it.

For Docker Compose, edit your docker-compose.yml and change the image tag:

image: vaultwarden/server:1.37.2

Then:

docker-compose pull
docker-compose up -d

For a standalone Docker container, remove the old one and start a new one with the new image:

docker stop vaultwarden
docker rm vaultwarden
docker pull vaultwarden/server:1.37.2
docker run -d --name vaultwarden -p 80:80 vaultwarden/server:1.37.2

If you are using Kubernetes and Helm, update your values.yaml with the new image tag and run:

helm upgrade vaultwarden gissilabs/vaultwarden --values values.yaml

For manual builds from source, clone the official Vaultwarden repository and compile:

git clone https://github.com/dani-garcia/vaultwarden vaultwarden-repo
cd vaultwarden-repo
cargo build --release

Database migrations happen automatically on startup for most updates. If a release requires manual database changes, the release notes will explicitly state this. Read release notes before updating anything beyond patch versions.

Downtime considerations: stopping Vaultwarden means users cannot access their passwords during the update. For production systems, plan updates during off-hours or use health checks and gradual rollouts (blue-green deployment) to minimize impact.

Security Releases and Advisories

Vaultwarden takes security seriously. When vulnerabilities are reported, they are handled through GitHub Security Advisories (GHSA). These are private reports before public disclosure, giving the Vaultwarden team time to patch before attackers learn of the issue.

Once a fix is ready, Vaultwarden tags a new release and GitHub publishes the advisory. The advisory includes:

• Severity level (critical, high, medium, low)
• Affected versions
• Fix version
• Workarounds for users who cannot update immediately

Critical security releases ship within days of discovery. You should apply them within 48 hours if possible. High-severity patches warrant updates within a week. Medium and low severity can wait for your regular maintenance window.

Vaultwarden's GitHub page lists all security advisories. Look for the "Security" tab on the repository. Subscribe to GitHub notifications for that repository to get alerts the moment an advisory is published.

Do not wait for announcements on forums or social media. GitHub is the authoritative source. If you are deploying Vaultwarden for a team, build automation to test and stage security updates immediately.

Staying Informed About New Releases

Watch the GitHub repository to get instant notifications when a new release is tagged. Click the "Watch" button on github.com/dani-garcia/vaultwarden and select "Releases only" to avoid email overload from non-release activity.

Many Vaultwarden users follow Reddit's r/vaultwarden community, which announces major releases. The community discusses update experiences and catches issues that the developers may have missed.

WinterFlow (winterflow.io/catalog/vaultwarden) aggregates Vaultwarden releases with short summaries, useful if you prefer a curated view over raw GitHub changelogs.

The official Vaultwarden documentation (vaultwarden.net) and community forums link to release discussions. The community connects through Discourse and Matrix chat, where long-time users hang out and discuss update strategies.

For structured feeds, GitHub releases provide an Atom feed. Visit the releases page at github.com/dani-garcia/vaultwarden/releases and append.atom to the URL. This gives you a decoupled way to monitor releases without logging into GitHub or email.

The bottom line: do not rely on a single channel. Combine GitHub notifications, RSS feeds, and community forums to catch release announcements reliably.

When Managed Hosting Makes Sense

Self-hosting Vaultwarden means you own the update schedule. You test, stage, and deploy each release. This is powerful but adds operational overhead.

Opsily provides managed Vaultwarden hosting, handling release updates, security patches, and infrastructure maintenance. New versions are deployed automatically after testing, so you do not have to manage Docker images, database migrations, or downtime coordination.

This matters for two reasons. First, security releases require speed. If a critical vulnerability is disclosed, Opsily applies the fix within hours. DIY self-hosting requires you to be online and responsive. Second, consistency: Opsily backs up your data, applies patches during maintenance windows, and rolls back if something goes wrong.

If you have a small team, infrequent time for maintenance, or uncomfortable with infrastructure operations, managed hosting trades operational burden for cost. If you prefer complete control, enjoy systems administration, or have compliance requirements that forbid cloud dependencies, self-hosting Vaultwarden with careful release management is the right choice.

If you want to evaluate Vaultwarden against other password manager solutions, check out Vaultwarden as a Bitwarden alternative. For managed hosting options, explore Opsily's Vaultwarden platform.

Frequently Asked Questions

What are the latest updates for Vaultwarden?

As of September 2026, v1.37.2 is the latest stable release, released on August 22, 2026. You can check the latest version on GitHub at github.com/dani-garcia/vaultwarden/releases or via Docker by running docker pull vaultwarden/server:latest and checking the logs. Each release includes security patches, bug fixes, and sometimes new features. New releases arrive when ready, not on a fixed schedule.

Can I self-host Vaultwarden?

Yes. Vaultwarden is designed specifically for self-hosting. It is an unofficial Bitwarden-compatible server, meaning it is compatible with Bitwarden clients (mobile apps, browser extensions, desktop clients) but runs on your own infrastructure. Self-hosting means you control the data, the update schedule, and the server location. Most users deploy Vaultwarden with Docker on a VPS or home server.

Does Vaultwarden need Docker?

No, but Docker is the most common deployment method. Vaultwarden can be built from source and run as a binary on Linux. You can also use system packages (Arch Linux, for example, has a vaultwarden package in AUR). Kubernetes Helm charts, systemd services, and bare-metal installations are all possible. Docker is popular because it simplifies dependencies and updates: a single docker pull and restart gets you the new version.

Is Vaultwarden secure?

Vaultwarden is security-audited and widely used. It is compatible with Bitwarden's encryption protocols. The code is open-source under AGPL-3.0, so anyone can review it. Security vulnerabilities are handled through GitHub advisories, not swept under the rug. That said, self-hosting adds responsibility: you must keep the server updated, back up the database, and use HTTPS. Running Vaultwarden requires infrastructure competence.

How do I know if a Vaultwarden release is safe to apply?

Check the GitHub release notes. Read the "What's Changed" section for security fixes, bug fixes, and new features. Look for any "Breaking changes" warnings. If the release is a patch update (1.37.0 to 1.37.1), it is almost always safe. If it is a minor or major update, plan maintenance time. Test in a staging environment first if you can.

What if I find a security issue in Vaultwarden?

Report it privately to the Vaultwarden maintainers via GitHub's security advisory process (not a public issue). Go to the repository, click "Security," then "Report a vulnerability." Give the team time to develop and test a fix before public disclosure. This responsible disclosure helps Vaultwarden users stay safe.

Can I roll back to an older version if an update breaks things?

Yes, with caveats. If you use Docker, pull the old image tag and restart. If you built from source, checkout the old git tag and rebuild. Database migrations are trickier: some updates are not reversible. Always back up your database before updating. If a rollback fails, you may need to restore from backup.

The Bottom Line

Vaultwarden releases follow a security-driven schedule, not a calendar. The latest stable version is v1.37.2 (August 22, 2026), with 86 versions released over the project's lifespan. Tracking releases is straightforward: GitHub is the source of truth, Docker Hub distributes the images, and RSS feeds keep you informed. Updates take minutes in Docker and require planning for downtime.

Self-hosting means owning the update cycle. Security releases need fast turnaround. Database backups and testing protect against broken updates. If update management feels like overhead, managed hosting shifts that burden to a provider.

Ready to deploy? Get started with Opsily's managed Vaultwarden hosting.