Who contributed to HashiCorp on May 13, 2026?

3 developers shipped this update, including panman90, Surabhi-1605, and github-actions[bot].

What were the notable HashiCorp updates?

updating golang.org/x/net and toolchain version, fix: correct FIPS Consul version check in connect-init (CSL-13179) (#5252), and fix: correct FIPS Consul version check in connect-init (CSL-13179).

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CONSUL PATCHES 8 CVE CHAINS, K8S FIXES FALSE FIPS WARNINGS

By RepoJournal · Filed 06:01 UTC on May 13, 2026 · About HashiCorp

3 people shipped this

panman90 @panman90 1 cited

Surabhi-1605 @Surabhi-1605 1 cited

github-actions[bot] @github-actions[bot] 1 cited

Consul upgraded Go 1.26.3 to close eight chained CVEs in the standard library overnight, while consul-k8s 1.8.x stops firing misleading FIPS compliance warnings on every pod startup.

Consul patched eight Go CVEs [1] by upgrading to toolchain 1.26.3 and golang.org/x/net 0.53.0, blocking chains in the standard library that could affect service mesh stability. Meanwhile, consul-k8s [2] fixed a three-bug cascade in the FIPS version check that was spamming logs with false warnings—the original code hit a non-existent API endpoint, passed nil context, and had a missing else guard that fired warnings unconditionally [3]. Both fixes ship quietly but matter: one secures the foundation, the other stops noise that masks real FIPS compliance issues. On the docs side, Nomad 2.0.1 release notes are live [4] with new scheduler parameters, and Vault's MSSQL EKM provider backfilled a missing v0.3.2 bug fix entry [5] documenting a version reporting issue that could confuse SQL Server integrations.

Action items

→ Pull Consul with Go 1.26.3 toolchain into your next deploy hashicorp/consul [immediate]
→ Upgrade consul-k8s to 1.8.9+ if running FIPS builds to stop false warning spam hashicorp/consul-k8s [plan]
→ Review Nomad 2.0.1 release notes for scheduler parameter changes hashicorp/web-unified-docs [plan]

References

[1] updating golang.org/x/net and toolchain version ↗ hashicorp/consul
[2] fix: correct FIPS Consul version check in connect-init (CSL-13179) (#5252) hashicorp/consul-k8s
[3] fix: correct FIPS Consul version check in connect-init (CSL-13179) ↗ hashicorp/consul-k8s
[4] [PUBLISH] nomad/2.0.1 ↗ hashicorp/web-unified-docs
[5] docs(mssql): add missing v0.3.2 release note for version reporting fix (#2411) hashicorp/web-unified-docs

Quick answers

What shipped in HashiCorp on May 13, 2026?: Consul upgraded Go 1.26.3 to close eight chained CVEs in the standard library overnight, while consul-k8s 1.8.x stops firing misleading FIPS compliance warnings on every pod startup. In total, 17 commits and 10 pull requests landed.
Who contributed to HashiCorp on May 13, 2026?: 3 developers shipped this update, including panman90, Surabhi-1605, and github-actions[bot].
What were the notable HashiCorp updates?: updating golang.org/x/net and toolchain version, fix: correct FIPS Consul version check in connect-init (CSL-13179) (#5252), and fix: correct FIPS Consul version check in connect-init (CSL-13179).

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.