chore(deps): update vaultwarden/server docker tag to v1.35.5

[renovate]

This PR contains the following updates:

Package	Update	Change
vaultwarden/server	patch	1.35.4-alpine → 1.35.5-alpine

---

Release Notes

dani-garcia/vaultwarden (vaultwarden/server)

v1.35.5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

--- . Kustomization: flux-system/flux-system HelmRelease: applications/vaultwarden

+++ . Kustomization: flux-system/flux-system HelmRelease: applications/vaultwarden

@@ -15,13 +15,13 @@

         name: bjw-s-charts
         namespace: applications
       interval: 1h
   values:
     image:
       repository: vaultwarden/server
-      tag: 1.35.4-alpine
+      tag: 1.35.5-alpine
     service:
       main:
         ports:
           http:
             port: 80
     persistence:

[github-actions]

--- . HelmRelease: applications/vaultwarden Deployment: applications/vaultwarden

+++ . HelmRelease: applications/vaultwarden Deployment: applications/vaultwarden

@@ -25,13 +25,13 @@

       serviceAccountName: default
       automountServiceAccountToken: true
       dnsPolicy: ClusterFirst
       enableServiceLinks: true
       containers:
       - name: vaultwarden
-        image: vaultwarden/server:1.35.4-alpine
+        image: vaultwarden/server:1.35.5-alpine
         imagePullPolicy: null
         env:
         - name: DATABASE_URL
           valueFrom:
             secretKeyRef:
               key: POSTGRES_URL

[claude]

vaultwarden/server: v1.35.4-alpine → v1.35.5-alpine

Verdict: Safe to merge — security release, merge promptly

This is a security release. Three advisories are fixed (CVEs pending assignment):

• GHSA-937x-3j8m-7w7p — Unconfirmed Owner Can Purge Entire Organization Vault
• GHSA-569v-845w-g82p — Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
• GHSA-6j4w-g4jh-xjfx — Refresh tokens not invalidated on security stamp rotation

Release notes note: Admin templates have changed — update them if you override via templates. apps/vaultwarden/helmrelease.yaml has no template overrides configured, so this does not apply here.

No other breaking changes or deprecations affecting this deployment (PostgreSQL backend, signups disabled, no custom templates).

Sources consulted:

• https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5