Who contributed to HashiCorp on May 20, 2026?

4 developers shipped this update, including santoshpulluri, LordAbhishek, sanikachavan5, and mrgupta7.

What were the notable HashiCorp updates?

deps(test-integ): upgrade testcontainers-go v0.22.0->v0.40.0, docker v24.0.5->v28.5.1, Enhanced AWS cleanup script, and Enhanced AWS cleanup script (#5208).

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CONSUL PATCHES THREE CONTAINER ESCAPE VULNERABILITIES, AWS CLEANUP OVERHAUL SHIPS

By RepoJournal · Filed 06:01 UTC on May 20, 2026 · About HashiCorp

4 people shipped this

santoshpulluri @santoshpulluri 2 cited

LordAbhishek @LordAbhishek 1 cited

sanikachavan5 @sanikachavan5 1 cited

mrgupta7 @mrgupta7 1 cited

Consul's test suite just pulled in fixes for three high-severity container escape CVEs by jumping testcontainers-go five major versions, while the AWS cleanup script got a complete rewrite to handle IAM policy exhaustion.

The big move came out of the Consul repo [1], where Dependabot flagged three HIGH CVEs in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) all allowing container escape. Rather than patch the leaf dependency, the team upgraded testcontainers-go from v0.22.0 to v0.40.0 and Docker from v24.0.5 to v28.5.1, pulling in the fixes transitively. That's the right call for a test dependency - get upstream's full fix, not a backport. Over in consul-k8s, the enhanced AWS cleanup script [2] [3] shipped after hitting IAM policy quota walls during Terraform provisioning. The rewrite adds cleanupIAMPolicies to sweep stale policies, removeRoleFromInstanceProfiles to resolve DeleteConflict errors, and switches to aws-sdk-go-v2. Vault SDK got a major bump in Consul [4], jumping from v0.7.0 to v0.25.1 alongside Vault API v1.12.2 to v1.16.0, with downstream bumps to Prometheus client and yamux. Two production fixes landed back-to-back in the gateway layer: one adds observability for gateway failures [5], while a more critical fix [6] stops 503 cluster_not_found errors when adding routes to busy API gateways by fixing how watch.Map.InitWatch cancels existing watches.

Action items

→ Verify testcontainers-go v0.40.0 in your integration test runs, especially if you're pulling container images hashicorp/consul [plan]
→ If you're running consul-k8s on AWS with large deployments, plan to upgrade for the IAM cleanup fixes hashicorp/consul-k8s [plan]
→ Deploy the gateway 503 fix [ref:7] if you're running API gateways with dynamic route updates hashicorp/consul [immediate]

References

[1] deps(test-integ): upgrade testcontainers-go v0.22.0->v0.40.0, docker v24.0.5->v28.5.1 ↗ hashicorp/consul
[2] Enhanced AWS cleanup script ↗ hashicorp/consul-k8s
[3] Enhanced AWS cleanup script (#5208) hashicorp/consul-k8s
[4] build(deps): bump github.com/hashicorp/vault/sdk from v0.7.0 to v0.25.1 ↗ hashicorp/consul
[5] add gateway failures ↗ hashicorp/consul
[6] fix: fixed 503 errors when adding routes to a busy gateway ↗ hashicorp/consul

Quick answers

What shipped in HashiCorp on May 20, 2026?: Consul's test suite just pulled in fixes for three high-severity container escape CVEs by jumping testcontainers-go five major versions, while the AWS cleanup script got a complete rewrite to handle IAM policy exhaustion. In total, 8 commits and 9 pull requests landed.
Who contributed to HashiCorp on May 20, 2026?: 4 developers shipped this update, including santoshpulluri, LordAbhishek, sanikachavan5, and mrgupta7.
What were the notable HashiCorp updates?: deps(test-integ): upgrade testcontainers-go v0.22.0->v0.40.0, docker v24.0.5->v28.5.1, Enhanced AWS cleanup script, and Enhanced AWS cleanup script (#5208).

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.