Who contributed to HashiCorp on May 14, 2026?

4 developers shipped this update, including Manishakumari-hc, bharath-k1999, sanikachavan5, and dependabot[bot].

What were the notable HashiCorp updates?

fix CVE GO-2026-4918 (#5308), fix CVE GO-2026-4918, and Unit Test cases fix control-plane/subcommand/sync-catalog- PASS.

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CONSUL-K8S PATCHES CRITICAL GO VULNERABILITY, RESTORES TEST SUITE

By RepoJournal · Filed 06:01 UTC on May 14, 2026 · About HashiCorp

4 people shipped this

Manishakumari-hc @Manishakumari-hc 2 cited

bharath-k1999 @bharath-k1999 1 cited

sanikachavan5 @sanikachavan5 1 cited

dependabot[bot] @dependabot[bot] 1 cited

Consul-K8s shipped a critical security fix for CVE GO-2026-4918 overnight while simultaneously restoring unit tests that had vanished from the main branch.

The golang.org/x/net dependency got upgraded to v0.53.0 to patch the vulnerability [1][2], a move that closes a known attack surface in any K8s deployment running Consul. Separately, the sync-catalog command test suite that had been stripped from main is now restored and passing [3]—a clean bill of health for a component critical to service mesh synchronization. Meanwhile, the team is moving forward on API Gateway enhancements: SDS support is now available at multiple override levels (default, listener, service route) with a new RouteTLSSdsFilter CRD [4], and scaling logic for the custom gateway rolled in [5], though that PR still needs test coverage and changelog documentation before merge. On the tooling side, VSCode Terraform bumped its GitHub Actions dependency [6], a routine maintenance item with no breaking changes for users.

Action items

→ Upgrade consul-k8s to patch CVE GO-2026-4918 before next production deploy hashicorp/consul-k8s [immediate]
→ Plan API Gateway SDS implementation if you're using custom gateways hashicorp/consul-k8s [plan]
→ Monitor custom gateway scaling PR—incomplete checklist, not ready yet hashicorp/consul-k8s [monitor]

References

[1] fix CVE GO-2026-4918 (#5308) hashicorp/consul-k8s
[2] fix CVE GO-2026-4918 ↗ hashicorp/consul-k8s
[3] Unit Test cases fix control-plane/subcommand/sync-catalog- PASS ↗ hashicorp/consul-k8s
[4] [Deprecate Ingress Gateway]sds support for api-gateway ↗ hashicorp/consul-k8s
[5] api-gateway-custom: add scaling support and openshift coverage ↗ hashicorp/consul-k8s
[6] Build(deps): Bump actions/github-script from 8.0.0 to 9.0.0 in the github-actions-breaking group across 1 directory ↗ hashicorp/vscode-terraform

Quick answers

What shipped in HashiCorp on May 14, 2026?: Consul-K8s shipped a critical security fix for CVE GO-2026-4918 overnight while simultaneously restoring unit tests that had vanished from the main branch. In total, 5 commits and 6 pull requests landed.
Who contributed to HashiCorp on May 14, 2026?: 4 developers shipped this update, including Manishakumari-hc, bharath-k1999, sanikachavan5, and dependabot[bot].
What were the notable HashiCorp updates?: fix CVE GO-2026-4918 (#5308), fix CVE GO-2026-4918, and Unit Test cases fix control-plane/subcommand/sync-catalog- PASS.

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.