Who contributed to HashiCorp on May 16, 2026?

2 developers shipped this update, including hashi-divyansh and modular-magician.

What were the notable HashiCorp updates?

fix(deps): upgrade Go toolchain and dependencies to resolve 14 CVEs (#1298), feat(apm/influxdb): add JWT Bearer authentication via shared secret for influxdb 1.x, and test: `keyvault` - test fixes for 5.0 deprecated properties (#32398).

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

NOMAD AUTOSCALER PATCHES 14 CVES WHILE AZURE PROVIDER READIES 5.0

By RepoJournal · Filed 06:01 UTC on May 16, 2026 · About HashiCorp

2 people shipped this

modular-magician @modular-magician 5 cited

hashi-divyansh @hashi-divyansh 1 cited

Nomad Autoscaler shipped security fixes for 14 vulnerabilities across Go toolchain and dependencies overnight, while Azure provider teams finalize deprecated property cleanup ahead of major version release.

The critical patch [1] upgrades Go 1.25.6 to 1.25.10 and golang.org/x/net to v0.53.0, resolving XSS vulnerabilities in html/template, DoS issues in net/mail, and panic conditions on Windows. This one hits immediately if you're running Nomad Autoscaler in production. Separately, the InfluxDB APM plugin landed JWT Bearer authentication support [2] for InfluxDB 1.x deployments using shared-secret signing, a feature request that's been waiting for the right implementation. On the Terraform front, Azure provider continues scaffolding for version 5.0 with keyvault test fixes [3] addressing deprecated properties, while a parallel effort [4] unblocks container app environment names starting with digits, solving a real naming constraint that was frustrating users. The Google Beta provider is undergoing significant test infrastructure refactoring [5][6][7][8][9], migrating from client library patterns to direct HTTP calls and consolidating bootstrap functions into service packages, clearing technical debt before the next major release cycle.

Action items

→ Patch Nomad Autoscaler immediately - 14 CVEs resolved in Go toolchain and net libraries hashicorp/nomad-autoscaler [immediate]
→ Test InfluxDB APM JWT authentication if using InfluxDB 1.x with shared secrets hashicorp/nomad-autoscaler [plan]
→ Review Azure provider 5.0 migration timeline - deprecated keyvault properties being cleaned hashicorp/terraform-provider-azurerm [monitor]

References

[1] fix(deps): upgrade Go toolchain and dependencies to resolve 14 CVEs (#1298) hashicorp/nomad-autoscaler
[2] feat(apm/influxdb): add JWT Bearer authentication via shared secret for influxdb 1.x ↗ hashicorp/nomad-autoscaler
[3] test: `keyvault` - test fixes for 5.0 deprecated properties (#32398) hashicorp/terraform-provider-azurerm
[4] `azurerm_container_app_environment` - allow names that start with a digit (#32267) hashicorp/terraform-provider-azurerm
[5] Migrate compute instance `*_test.go.tmpl` test files to use direct HTTP rather than a client library ↗ hashicorp/terraform-provider-google-beta
[6] Moved SetupProjectsAndGetAccessToken to a dedicated package ↗ hashicorp/terraform-provider-google-beta
[7] Add migration center report config resource and tests ↗ hashicorp/terraform-provider-google-beta
[8] Remove test-only Framework resources ↗ hashicorp/terraform-provider-google-beta
[9] Moved remaining bootstrap functions to service packages ↗ hashicorp/terraform-provider-google-beta

Quick answers

What shipped in HashiCorp on May 16, 2026?: Nomad Autoscaler shipped security fixes for 14 vulnerabilities across Go toolchain and dependencies overnight, while Azure provider teams finalize deprecated property cleanup ahead of major version release. In total, 13 commits, 18 pull requests, and 3 releases landed.
Who contributed to HashiCorp on May 16, 2026?: 2 developers shipped this update, including hashi-divyansh and modular-magician.
What were the notable HashiCorp updates?: fix(deps): upgrade Go toolchain and dependencies to resolve 14 CVEs (#1298), feat(apm/influxdb): add JWT Bearer authentication via shared secret for influxdb 1.x, and test: `keyvault` - test fixes for 5.0 deprecated properties (#32398).

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.