RepoJournal
HashiCorp

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

Keep up with HashiCorp in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sat 27 jun
  2. Sun 28 jun
  3. Tue 30 jun
  4. Wed 1 jul
  5. Thu 2 jul
  6. Fri 3 jul
  7. Sat 4 jul
  8. Sun 5 jul
  9. Mon 6 jul
  10. Tue 7 jul
  11. Wed 8 jul
  12. Thu 9 jul
  13. Fri 10 jul
  14. Sat 11 jul
  15. Sun 12 jul
  16. Mon 13 jul
  17. Tue 14 jul
  18. Wed 15 jul
  19. Thu 16 jul
  20. Fri 17 jul
  21. Sat 18 jul
  22. Sun 19 jul
  23. Mon 20 jul
  24. Tue 21 jul
  25. Wed 22 jul
  26. Thu 23 jul
  27. Fri 24 jul
  28. Sat 25 jul
  29. Sun 26 jul
  30. Mon 27 jul
Topics: Go Infrastructure Full archive →

The Wire · Showcase

HASHICORP PATCHES MARKDOWN DOS, SHIPS API GATEWAY AUTH CONTROLS

By RepoJournal · Filed · About HashiCorp

pajay-rao
1 person shipped this
pajay-rao @pajay-rao 1 cited

Consul-K8s locked down a remote denial-of-service vulnerability in Markdown while simultaneously shipping external authorization support to the API Gateway.

The security fix [1] upgraded Markdown from 3.3.7 to 3.8.1 to patch CVE-2025-69534, an uncaught AssertionError that crashes processors parsing malformed HTML input from untrusted sources. MkDocs rode along from 1.4.3 to 1.6.1 because older versions pinned incompatible Markdown versions. This is a ship-now patch for anything running the vendored gateway-api 0.7.1 docs toolchain. On the feature side, Consul-K8s merged external authorization (`ext_authz`) support for the API Gateway [2], adding a new `RouteAuthFilter` CRD that lets operators override gateway-wide auth policies on a per-route basis. A companion PR [3] enables the `RouteExtProc` CRD for Consul Enterprise, expanding the authorization chain to multi-port configurations. Homebrew tap saw five routine version bumps across the estate: Boundary Enterprise 1.0.1, Consul Terraform Sync 0.9.1, Dataplane 2.0.2, envconsul 0.14.0, and Consul ESM 0.11.0 [4][5][6][7][8]. In the Packer universe, the team dropped an unmaintained cryptography dependency by upgrading go-github from v33 to v75 [9], eliminating GO-2026-5932 in `golang.org/x/crypto/openpgp` which has no patch available and was only pulled in transitively. Packer-plugin-amazon released 1.8.2 to stabilize crypto version conflicts [10], though a follow-up PR nudged x/crypto to 0.54.0 [11] after discovering compatibility issues with the initial downgrade.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] security: upgrade Python deps in gateway-api 0.7.1 module (4 advisories) (#5473) hashicorp/consul-k8s
  2. [2] ext_authz support for api-gateway (#5444) hashicorp/consul-k8s
  3. [3] Enabling routeextproc crd and addition of it to httproutes ↗ hashicorp/consul-k8s
  4. [4] Bump boundary-enterprise to 1.0.1+ent hashicorp/homebrew-tap
  5. [5] Bump consul-terraform-sync to 0.9.1 hashicorp/homebrew-tap
  6. [6] Bump consul-dataplane to 2.0.2 hashicorp/homebrew-tap
  7. [7] Bump envconsul to 0.14.0 hashicorp/homebrew-tap
  8. [8] Bump consul-esm to 0.11.0 hashicorp/homebrew-tap
  9. [9] security: drop x/crypto/openpgp by upgrading go-github v33 -> v75 (#13676) hashicorp/packer
  10. [10] release: update version to 1.8.2 and remove prerelease tag (#690) hashicorp/packer-plugin-amazon
  11. [11] ADDED THE 0.54.0 crypto version (#692) hashicorp/packer-plugin-amazon

Quick answers

What shipped in HashiCorp on July 10, 2026?
Consul-K8s locked down a remote denial-of-service vulnerability in Markdown while simultaneously shipping external authorization support to the API Gateway. In total, 14 commits and 11 pull requests landed.
Who contributed to HashiCorp on July 10, 2026?
1 developer shipped this update, including pajay-rao.
What were the notable HashiCorp updates?
security: upgrade Python deps in gateway-api 0.7.1 module (4 advisories) (#5473), ext_authz support for api-gateway (#5444), and Enabling routeextproc crd and addition of it to httproutes.

More from @hashicorp

HashiCorp @hashicorp

BOUNDARY BUMPED TO 1.6.1 AS DEPENDABOT SWEEPS CI/CD

Terraform Provider Boundary ships version 1.6.1 with project alias and RDP recording updates while dependabot rolls out actions/checkout 7.0.1 across the stack.

dependabot Amit Kotagi
go 6 shipped 1-min read
HashiCorp @hashicorp

NOMAD ECOSYSTEM OPENS NIGHTLY BUILDS FOR EARLY TESTING

Both the Podman driver and Autoscaler shipped nightly snapshots overnight, signaling active development cycles and giving operators a chance to validate upcoming changes before stable release.

github-actions[bot]
go 2 shipped 1-min read
HashiCorp @hashicorp

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

hashimoon modular-magician
go 19 shipped 1-min read
HashiCorp @hashicorp

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

pajay-rao vivekpandeyHashi dependabot tanmay-hc
go 8 shipped 1-min read

Daily updates, in your inbox

Follow HashiCorp

Keep up with HashiCorp in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

langchain-oss-model-profiles langchain-oss-model-profiles[bot] saoudrizwan
ai-agents 16 shipped 2-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

github-actions[bot] dhiltgen timkhronos Pascal +10
llms 125 shipped 1-min read
CachyOS @CachyOS

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

Piotr Gorski github-actions Vladislav Nepogodin ptr1337 +7
infra 97 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

Benjamin Milde Alexander Gubarev lukaszsamson makoto-developer
elixir 10 shipped 1-min read
Want every project, not just this one?

We use privacy-friendly analytics (Google Analytics, IP-anonymized) to see which pages help readers. No ads, and we never sell your data. See our Privacy Policy.