RepoJournal
HashiCorp @hashicorp
126 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-07
stories 45
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

CONSUL-K8S PATCHES TWO CRITICAL TEMPLATE INJECTION VULNERABILITIES

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

hashibot-web Surabhi-1605 rajeshsc1 dependabot[bot]
4 people shipped this
hashibot-web @hashibot-web 3 cited Surabhi-1605 @Surabhi-1605 2 cited rajeshsc1 @rajeshsc1 1 cited dependabot[bot] @dependabot[bot] 1 cited

HashiCorp shipped emergency security upgrades to Jinja2 and pymdown-extensions across Consul Kubernetes, closing HTML attribute injection and Markdown processing vulnerabilities that could enable XSS attacks.

Two high-severity CVEs landed simultaneously in consul-k8s [1][2]. Jinja2 3.1.2 accepted malicious keys in the xmlattr filter, allowing attribute injection if user-controlled data reaches template rendering [3]. The pymdown-extensions flaw compounds the risk by processing untrusted Markdown through vulnerable filters [4]. Both fixes are in the gateway configuration layer, which means any Consul on Kubernetes deployment exposing user input through docs or templating is exposed. Patch immediately to 3.1.6 and 10.0 respectively. In parallel, actions-go-build shipped v1.1.2 [5] to address GitHub's Node.js 20 deprecation warnings and stay compatible with latest runner environments [6]. The update is automatic for consumers pinning @v1, so no deployment friction there. Pandora's Azure spec submodule bump [13] continues quiet API surface harmonization work, while web-unified-docs syncs continue across the public/private repos [7][8][9][10][11]. Nomad Autoscaler's scheduler fix [12] excludes ineligible nodes from capacity calculations, preventing phantom capacity from skewing autoscaling decisions.

Action items

References

  1. [1] security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195) (#5285) ↗ hashicorp/consul-k8s
  2. [2] security: upgrade pymdown-extensions 9.11 -> 10.0 to fix GHSA-jh85-wwv9-24hv (CVE-2023-32309) (#5291) ↗ hashicorp/consul-k8s
  3. [3] security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195) ↗ hashicorp/consul-k8s
  4. [4] security: upgrade pymdown-extensions 9.11 -> 10.0 to fix GHSA-jh85-wwv9-24hv (CVE-2023-32309) ↗ hashicorp/consul-k8s
  5. [5] v1.1.2 ↗ hashicorp/actions-go-build
  6. [6] SMRE-1068: Publish updated GitHub Actions versions to address Node.js 20 deprecation - v1.1.2 ↗ hashicorp/actions-go-build
  7. [7] Repo sync ↗ hashicorp/web-unified-docs
  8. [8] Repo sync ↗ hashicorp/web-unified-docs
  9. [9] Repo sync ↗ hashicorp/web-unified-docs
  10. [10] add import docs to tfe nav (#2382) hashicorp/web-unified-docs ↗
  11. [11] TF-37107 Add TFE deprecation notice for Redis 6.2 and 6.4 (#2334) hashicorp/web-unified-docs ↗
  12. [12] fix: exclude ineligible nodes from pool capacity calculations (#1286) ↗ hashicorp/nomad-autoscaler
  13. [13] build(deps): bump submodules/rest-api-specs from `fa74a24` to `ca1b73e` ↗ hashicorp/pandora

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul enables post-quantum key exchange by default the month in review Terraform providers widen AWS, Azure, and Google coverage while core clears Graph cruft
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on May 7, 2026?
HashiCorp shipped emergency security upgrades to Jinja2 and pymdown-extensions across Consul Kubernetes, closing HTML attribute injection and Markdown processing vulnerabilities that could enable XSS attacks. In total, 32 commits, 11 pull requests, and 2 releases landed.
Who contributed to HashiCorp on May 7, 2026?
4 developers shipped this update, including Surabhi-1605, rajeshsc1, hashibot-web, and dependabot[bot].
What were the notable HashiCorp updates?
security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195) (#5285), security: upgrade pymdown-extensions 9.11 -> 10.0 to fix GHSA-jh85-wwv9-24hv (CVE-2023-32309) (#5291), and security: upgrade Jinja2 3.1.2 -> 3.1.6 to fix GHSA-h5c8-rqwp-cp95 (CVE-2024-22195).
♥

$ log @hashicorp --recent

HashiCorp: no material update 2 shipped Terraform policy 0.3 docs land, Nomad 2.0.7 docs publish 23 shipped Alicloud plugin clears Dependabot backlog, Packer patches M5 crash 14 shipped Consul turns on post-quantum key exchange by default 50 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.