RepoJournal
HashiCorp

@hashicorp

Terraform, Vault, Consul โ€” infra-as-code for ops teams

Pick a date

  1. Thu 28 may
  2. Fri 29 may
  3. Sat 30 may
  4. Sun 31 may
  5. Mon 1 jun
  6. Mon 8 jun
  7. Tue 9 jun
  8. Wed 10 jun
  9. Thu 11 jun
  10. Fri 12 jun
  11. Sat 13 jun
  12. Sun 14 jun
  13. Mon 15 jun
  14. Tue 16 jun
  15. Wed 17 jun
  16. Thu 18 jun
  17. Fri 19 jun
  18. Sat 27 jun
  19. Sun 28 jun
  20. Tue 30 jun
  21. Wed 1 jul
  22. Thu 2 jul
  23. Fri 3 jul
  24. Sat 4 jul
  25. Sun 5 jul
  26. Mon 6 jul
  27. Tue 7 jul
  28. Wed 8 jul
  29. Thu 9 jul
  30. Today 10 jul

The Wire ยท Showcase

HASHICORP PATCHES MARKDOWN DOS, SHIPS API GATEWAY AUTH CONTROLS

By RepoJournal ยท Filed ยท About HashiCorp

Consul-K8s locked down a remote denial-of-service vulnerability in Markdown while simultaneously shipping external authorization support to the API Gateway.

The security fix [1] upgraded Markdown from 3.3.7 to 3.8.1 to patch CVE-2025-69534, an uncaught AssertionError that crashes processors parsing malformed HTML input from untrusted sources. MkDocs rode along from 1.4.3 to 1.6.1 because older versions pinned incompatible Markdown versions. This is a ship-now patch for anything running the vendored gateway-api 0.7.1 docs toolchain. On the feature side, Consul-K8s merged external authorization (`ext_authz`) support for the API Gateway [2], adding a new `RouteAuthFilter` CRD that lets operators override gateway-wide auth policies on a per-route basis. A companion PR [3] enables the `RouteExtProc` CRD for Consul Enterprise, expanding the authorization chain to multi-port configurations. Homebrew tap saw five routine version bumps across the estate: Boundary Enterprise 1.0.1, Consul Terraform Sync 0.9.1, Dataplane 2.0.2, envconsul 0.14.0, and Consul ESM 0.11.0 [4][5][6][7][8]. In the Packer universe, the team dropped an unmaintained cryptography dependency by upgrading go-github from v33 to v75 [9], eliminating GO-2026-5932 in `golang.org/x/crypto/openpgp` which has no patch available and was only pulled in transitively. Packer-plugin-amazon released 1.8.2 to stabilize crypto version conflicts [10], though a follow-up PR nudged x/crypto to 0.54.0 [11] after discovering compatibility issues with the initial downgrade.

Action items

References

  1. [1] security: upgrade Python deps in gateway-api 0.7.1 module (4 advisories) (#5473) hashicorp/consul-k8s
  2. [2] ext_authz support for api-gateway (#5444) hashicorp/consul-k8s
  3. [3] Enabling routeextproc crd and addition of it to httproutes โ†— hashicorp/consul-k8s
  4. [4] Bump boundary-enterprise to 1.0.1+ent hashicorp/homebrew-tap
  5. [5] Bump consul-terraform-sync to 0.9.1 hashicorp/homebrew-tap
  6. [6] Bump consul-dataplane to 2.0.2 hashicorp/homebrew-tap
  7. [7] Bump envconsul to 0.14.0 hashicorp/homebrew-tap
  8. [8] Bump consul-esm to 0.11.0 hashicorp/homebrew-tap
  9. [9] security: drop x/crypto/openpgp by upgrading go-github v33 -> v75 (#13676) hashicorp/packer
  10. [10] release: update version to 1.8.2 and remove prerelease tag (#690) hashicorp/packer-plugin-amazon
  11. [11] ADDED THE 0.54.0 crypto version (#692) hashicorp/packer-plugin-amazon

Related across the cluster

For your repos

The showcase is a teaser.
Your wire is the product.

Same engine. Different stack. Below: what changes when the wire is yours.

Showcase wire

  • โ€ข14 famous open source orgs
  • โ€ขOne wire per day
  • โ€ขPublic, generic
  • โ€ขRead on the web, when you remember

Your wire

  • โ†’Up to 1,500 of your repos - orgs, deps, vendors
  • โ†’Morning and evening briefs
  • โ†’Action items routed to your team
  • โ†’Slack delivery, email, breaking-news CVE alerts

Want a hands-on demo first? Ask a current user for an invite link.