RepoJournal
HashiCorp @hashicorp
176 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-24
stories 6
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

CONSUL AND DATAPLANE 2.0 SHIP WITH CRITICAL CRYPTO PATCHES

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

santoshpulluri
1 person shipped this
santoshpulluri @santoshpulluri 2 cited

HashiCorp shipped major versions across Consul, Consul-K8s, and Consul Dataplane overnight, all patching the same cryptographic vulnerabilities that hit the Go ecosystem this spring.

Consul v2.0.0 [2] and Consul Dataplane v2.0.0 [1] both land with mandatory upgrades to golang.org/x/crypto and golang.org/x/net, closing the CVEs that forced every Go shop to scramble weeks ago. Consul-K8s follows suit [3] with the same dependency chain remediation across all modules, replacing go-jose/v3 with v4 to fix GHSA-c5q2-7r4c-mv6g. The dataplane release also bumps the UBI base image to 9.8 [1] and suppresses spurious OSV scanner false positives in RHEL RPM paths [4], which matters if you're running supply chain scanning in production. On the breaking changes front: Consul 2.0 increases default HTTP timeouts from 30 seconds to 15 minutes [2], a significant shift for long-polling blocking queries that could affect your connection pooling assumptions. Envoy gets pinned to 1.37.2 and Go to 1.26 [2], so you're looking at a coordinated upgrade across your entire service mesh.

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul provider patches two Go CVEs, adds 2.23.0 upgrade gate the month in review Consul patches four CVEs as Go bumps sweep repos
Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on May 24, 2026?
HashiCorp shipped major versions across Consul, Consul-K8s, and Consul Dataplane overnight, all patching the same cryptographic vulnerabilities that hit the Go ecosystem this spring. In total, 2 commits, 2 pull requests, and 2 releases landed.
Who contributed to HashiCorp on May 24, 2026?
1 developer shipped this update, including santoshpulluri.
What were the notable HashiCorp updates?
v2.0.0, v2.0.0, and deps: upgrade dependencies to address CVEs in golang.org/x/crypto and golang.org/x/net.
♥

$ log @hashicorp --recent

A copyright sweep is the whole day 2 shipped HashiCorp: no material update 2 shipped Application Design Center lands, workload identity pools grow two fields 46 shipped Consul CI breaks on jq 1.8 as Ubuntu 26.04 runners arrive 31 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.