Who contributed to HashiCorp on May 24, 2026?

1 developer shipped this update, including santoshpulluri.

What were the notable HashiCorp updates?

v2.0.0, v2.0.0, and deps: upgrade dependencies to address CVEs in golang.org/x/crypto and golang.org/x/net.

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CONSUL AND DATAPLANE 2.0 SHIP WITH CRITICAL CRYPTO PATCHES

By RepoJournal · Filed 06:01 UTC on May 24, 2026 · About HashiCorp

1 person shipped this

santoshpulluri @santoshpulluri 2 cited

HashiCorp shipped major versions across Consul, Consul-K8s, and Consul Dataplane overnight, all patching the same cryptographic vulnerabilities that hit the Go ecosystem this spring.

Consul v2.0.0 [2] and Consul Dataplane v2.0.0 [1] both land with mandatory upgrades to golang.org/x/crypto and golang.org/x/net, closing the CVEs that forced every Go shop to scramble weeks ago. Consul-K8s follows suit [3] with the same dependency chain remediation across all modules, replacing go-jose/v3 with v4 to fix GHSA-c5q2-7r4c-mv6g. The dataplane release also bumps the UBI base image to 9.8 [1] and suppresses spurious OSV scanner false positives in RHEL RPM paths [4], which matters if you're running supply chain scanning in production. On the breaking changes front: Consul 2.0 increases default HTTP timeouts from 30 seconds to 15 minutes [2], a significant shift for long-polling blocking queries that could affect your connection pooling assumptions. Envoy gets pinned to 1.37.2 and Go to 1.26 [2], so you're looking at a coordinated upgrade across your entire service mesh.

Action items

→ Upgrade Consul to 2.0.0 before next deploy - blocking query timeouts changed hashicorp/consul [immediate]
→ Patch Consul Dataplane to 2.0.0 in all environments hashicorp/consul-dataplane [immediate]
→ Update Consul-K8s controllers to pick up crypto patches hashicorp/consul-k8s [immediate]
→ Verify Envoy sidecar compatibility with 1.37.2 in staging hashicorp/consul [plan]

References

[1] v2.0.0 ↗ hashicorp/consul-dataplane
[2] v2.0.0 ↗ hashicorp/consul
[3] deps: upgrade dependencies to address CVEs in golang.org/x/crypto and golang.org/x/net ↗ hashicorp/consul-k8s
[4] chore: suppress OSV scanner false positives for UBI base RPM paths ↗ hashicorp/consul-dataplane

Quick answers

What shipped in HashiCorp on May 24, 2026?: HashiCorp shipped major versions across Consul, Consul-K8s, and Consul Dataplane overnight, all patching the same cryptographic vulnerabilities that hit the Go ecosystem this spring. In total, 2 commits, 2 pull requests, and 2 releases landed.
Who contributed to HashiCorp on May 24, 2026?: 1 developer shipped this update, including santoshpulluri.
What were the notable HashiCorp updates?: v2.0.0, v2.0.0, and deps: upgrade dependencies to address CVEs in golang.org/x/crypto and golang.org/x/net.

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.