Who contributed to HashiCorp on May 7, 2026?

4 developers shipped this update, including Surabhi-1605, rajeshsc1, hashibot-web, and dependabot[bot].

What were the notable HashiCorp updates?

security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195) (#5285), security: upgrade pymdown-extensions 9.11 -> 10.0 to fix GHSA-jh85-wwv9-24hv (CVE-2023-32309) (#5291), and security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195).

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CONSUL-K8S PATCHES TWO CRITICAL TEMPLATE INJECTION VULNERABILITIES

By RepoJournal · Filed 06:02 UTC on May 7, 2026 · About HashiCorp

4 people shipped this

hashibot-web @hashibot-web 3 cited

Surabhi-1605 @Surabhi-1605 2 cited

rajeshsc1 @rajeshsc1 1 cited

dependabot[bot] @dependabot[bot] 1 cited

HashiCorp shipped emergency security upgrades to Jinja2 and pymdown-extensions across Consul Kubernetes, closing HTML attribute injection and Markdown processing vulnerabilities that could enable XSS attacks.

Two high-severity CVEs landed simultaneously in consul-k8s [1][2]. Jinja2 3.1.2 accepted malicious keys in the xmlattr filter, allowing attribute injection if user-controlled data reaches template rendering [3]. The pymdown-extensions flaw compounds the risk by processing untrusted Markdown through vulnerable filters [4]. Both fixes are in the gateway configuration layer, which means any Consul on Kubernetes deployment exposing user input through docs or templating is exposed. Patch immediately to 3.1.6 and 10.0 respectively. In parallel, actions-go-build shipped v1.1.2 [5] to address GitHub's Node.js 20 deprecation warnings and stay compatible with latest runner environments [6]. The update is automatic for consumers pinning @v1, so no deployment friction there. Pandora's Azure spec submodule bump [13] continues quiet API surface harmonization work, while web-unified-docs syncs continue across the public/private repos [7][8][9][10][11]. Nomad Autoscaler's scheduler fix [12] excludes ineligible nodes from capacity calculations, preventing phantom capacity from skewing autoscaling decisions.

Action items

→ Upgrade Jinja2 to 3.1.6 and pymdown-extensions to 10.0 in all consul-k8s deployments immediately hashicorp/consul-k8s [immediate]
→ Review any consul-k8s documentation or API specs exposed to user input for XSS surface hashicorp/consul-k8s [immediate]
→ Update actions-go-build to v1.1.2 in CI pipelines if pinning to v1 hashicorp/actions-go-build [plan]

References

[1] security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195) (#5285) hashicorp/consul-k8s
[2] security: upgrade pymdown-extensions 9.11 -> 10.0 to fix GHSA-jh85-wwv9-24hv (CVE-2023-32309) (#5291) hashicorp/consul-k8s
[3] security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195) ↗ hashicorp/consul-k8s
[4] security: upgrade pymdown-extensions 9.11 -> 10.0 to fix GHSA-jh85-wwv9-24hv (CVE-2023-32309) ↗ hashicorp/consul-k8s
[5] v1.1.2 ↗ hashicorp/actions-go-build
[6] SMRE-1068: Publish updated GitHub Actions versions to address Node.js 20 deprecation - v1.1.2 ↗ hashicorp/actions-go-build
[7] Repo sync ↗ hashicorp/web-unified-docs
[8] Repo sync ↗ hashicorp/web-unified-docs
[9] Repo sync ↗ hashicorp/web-unified-docs
[10] add import docs to tfe nav (#2382) hashicorp/web-unified-docs
[11] TF-37107 Add TFE deprecation notice for Redis 6.2 and 6.4 (#2334) hashicorp/web-unified-docs
[12] fix: exclude ineligible nodes from pool capacity calculations (#1286) hashicorp/nomad-autoscaler
[13] build(deps): bump submodules/rest-api-specs from `fa74a24` to `ca1b73e` ↗ hashicorp/pandora

Quick answers

What shipped in HashiCorp on May 7, 2026?: HashiCorp shipped emergency security upgrades to Jinja2 and pymdown-extensions across Consul Kubernetes, closing HTML attribute injection and Markdown processing vulnerabilities that could enable XSS attacks. In total, 32 commits, 11 pull requests, and 2 releases landed.
Who contributed to HashiCorp on May 7, 2026?: 4 developers shipped this update, including Surabhi-1605, rajeshsc1, hashibot-web, and dependabot[bot].
What were the notable HashiCorp updates?: security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195) (#5285), security: upgrade pymdown-extensions 9.11 -> 10.0 to fix GHSA-jh85-wwv9-24hv (CVE-2023-32309) (#5291), and security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195).

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.