What shipped in HashiCorp on May 1, 2026?

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

BOUNDARY PATCHES CRITICAL DATABASE DEPENDENCY ACROSS ALL VERSIONS

By RepoJournal · Filed 14:15 UTC on May 1, 2026 · About HashiCorp

Boundary shipped emergency security updates across v0.19, v0.20, and v0.21 to address four critical PostgreSQL driver vulnerabilities that could affect every deployment.

All three active Boundary versions [1][2][3] patched the same set of jackc/pgx vulnerabilities (GHSA-j88v-2chj-qfwx, GO-2026-4771, GO-2026-4772, GHSA-9jj7-4m8r-rfcm) plus NTLMSSP authentication flaws that expose connections to manipulation. The v0.21.3 release [1] also introduced support for IBM Passport Advantage Online licensing to expand Boundary Enterprise eligibility, alongside a new debug flag for pprof endpoints. Terraform providers across AWS are undergoing systematic hardening: five services (Kendra, IVS Chat, IoT, FIS, Firehose) [4][5][6][7][8] replaced deprecated Node.js Lambda runtimes to satisfy lint checks and prepare for runtime EOL. The Azure provider shipped v4.71.0 [9] with new CDN Frontdoor security policy data source and updated storage API to 2025-08-01, while the team continues building list resource support for subnet operations. Nomad's scheduler got a critical fix [10] for a NUMA-aware device allocation bug that caused false node exhaustion during task preemption—stale allocator state was persisting across eviction, triggering phantom resource limits that blocked valid workload placement.

Action items

→ Upgrade Boundary to v0.21.3, v0.20.3, or v0.19.5 immediately—all versions received the same PostgreSQL driver patch hashicorp/boundary [immediate]
→ Verify your Nomad clusters aren't affected by the device scheduler bug if you use NUMA-aware scheduling with multi-device tasks hashicorp/nomad [plan]
→ Plan Azure provider upgrade to v4.71.0 for new CDN security policies and storage API alignment hashicorp/terraform-provider-azurerm [plan]
→ Monitor Terraform AWS provider for completed Node.js runtime replacements across all services hashicorp/terraform-provider-aws [monitor]

References

[1] Boundary v0.21.3 — PostgreSQL driver security patches
[2] Boundary v0.19.5 — PostgreSQL driver security patches
[3] Boundary v0.20.3 — PostgreSQL driver security patches
[4] Terraform AWS Kendra — deprecated Node.js runtime replacement
[5] Terraform AWS IVS Chat — deprecated Node.js runtime replacement
[6] Terraform AWS IoT — deprecated Node.js runtime replacement
[7] Terraform AWS FIS — deprecated Node.js runtime replacement
[8] Terraform AWS Firehose — deprecated Node.js runtime replacement
[9] Terraform Azure v4.71.0 — CDN Frontdoor and storage API updates
[10] Nomad scheduler — stale device allocator bug fix

Quick answers

What shipped in HashiCorp on May 1, 2026?: Boundary shipped emergency security updates across v0.19, v0.20, and v0.21 to address four critical PostgreSQL driver vulnerabilities that could affect every deployment. In total, 87 commits, 23 pull requests, and 4 releases landed.

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.