Who contributed to HashiCorp on May 25, 2026?

4 developers shipped this update, including sana-faraz, andyroyle, torarnv, and hariom-hashicorp.

What were the notable HashiCorp updates?

New resource 'tfe_org_max_token_ttl_policy' to create/update token time to live, v2.0.0, and v1.8.13.

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

TFE TOKEN POLICY LANDS, CONSUL K8S 2.0 BREAKS GROUND, SECURITY PATCHES ROLL

By RepoJournal · Filed 06:01 UTC on May 25, 2026 · About HashiCorp

4 people shipped this

sana-faraz @sana-faraz 1 cited

andyroyle @andyroyle 1 cited

torarnv @torarnv 1 cited

hariom-hashicorp @hariom-hashicorp 1 cited

Terraform Enterprise gains token TTL enforcement while Consul K8s ships its biggest breaking change yet, and three separate security updates patch Go vulnerabilities across the platform.

The Terraform provider for TFE just merged a new resource for token time-to-live policies [1], letting organizations enforce maximum lifespans on API tokens and auto-revoke anything that exceeds the limit. This is the credential hygiene upgrade teams have been waiting for. Meanwhile, Consul K8s 2.0.0 dropped today [2] with a breaking change to the API gateway controller and Go 1.26 to close security gaps, requiring compatibility checks against Consul 2.0.x before you upgrade. The same security hole that prompted the 2.0 release also hit the maintenance branches: both 1.8.13 and 1.9.8 patched x/net to 0.55.0 to resolve GO-2026-4918 [3] [4], along with a fix for incorrect FIPS version checks that was spamming logs. Over in Packer land, the SDK gained native support for macOS command and option keys in boot commands [6], finally making it natural to automate Mac builds. The Google Compute plugin fixed a serialization bug where empty ShieldedVMStateConfig was leaking into API requests [5], and the Amazon plugin has vulnerability patches in flight [7].

Action items

→ Upgrade Consul K8s to 1.8.13 or 1.9.8 immediately for GO-2026-4918 patch hashicorp/consul-k8s [immediate]
→ Review Consul K8s 2.0.0 compatibility matrix before next platform upgrade hashicorp/consul-k8s [plan]
→ Merge new TFE token TTL policy resource into your IaC workflow hashicorp/terraform-provider-tfe [plan]
→ Monitor packer-plugin-amazon PR #670 for vulnerability resolution hashicorp/packer-plugin-amazon [monitor]

References

[1] New resource 'tfe_org_max_token_ttl_policy' to create/update token time to live ↗ hashicorp/terraform-provider-tfe
[2] v2.0.0 ↗ hashicorp/consul-k8s
[3] v1.8.13 ↗ hashicorp/consul-k8s
[4] v1.9.8 ↗ hashicorp/consul-k8s
[5] fix: avoid sending empty ShieldedInstanceInitialState on image create ↗ hashicorp/packer-plugin-googlecompute
[6] Add bootcommand mappings for left/right command and option keys ↗ hashicorp/packer-plugin-sdk
[7] Vunerablity Fix for the crypto and net ↗ hashicorp/packer-plugin-amazon

Quick answers

What shipped in HashiCorp on May 25, 2026?: Terraform Enterprise gains token TTL enforcement while Consul K8s ships its biggest breaking change yet, and three separate security updates patch Go vulnerabilities across the platform. In total, 9 commits, 6 pull requests, and 3 releases landed.
Who contributed to HashiCorp on May 25, 2026?: 4 developers shipped this update, including sana-faraz, andyroyle, torarnv, and hariom-hashicorp.
What were the notable HashiCorp updates?: New resource 'tfe_org_max_token_ttl_policy' to create/update token time to live, v2.0.0, and v1.8.13.

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.