Who contributed to HashiCorp on July 17, 2026?

7 developers shipped this update, including Paras Gupta, gdavison, sbldevnet, DanyStinson, subham-ibmhc, Surabhi-1605, and pajay-rao.

What were the notable HashiCorp updates?

fix debug token leak. (#23731), fix debug token leak, and feat(bedrockagent): add Managed Knowledge Base support (type=MANAGED).

@hashicorp

Terraform, Vault, Consul — infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CONSUL PLUGS TOKEN LEAK, AWS PROVIDER EXPANDS AI AND BEDROCK SUPPORT

By RepoJournal · Filed 06:57 UTC on July 17, 2026 · About HashiCorp

7 people shipped this

Paras Gupta @paras-gupta2 2 cited

gdavison @gdavison 2 cited

Surabhi-1605 @Surabhi-1605 2 cited

sbldevnet @sbldevnet 1 cited

DanyStinson @DanyStinson 1 cited

subham-ibmhc @subham-ibmhc 1 cited

pajay-rao @pajay-rao

Consul's debug logs were exposing ACL tokens in plaintext, a critical flaw now patched before it reaches production.

In brief

Consul patched a debug token leak that was leaking auth tokens in logs. If you're running this in prod, check your audit trail. This one's a must-update.
Terraform AWS provider adds Bedrock Agent support for Managed Knowledge Bases. RAG deployments just got a terraform-native path.
AWS provider now supports GuardDuty's AI_PROTECTION and AI_ANALYST features. Security tooling catching up to what AWS is actually shipping.
S3 bucket notifications can now list resources instead of querying one at a time. Sounds small, makes your terraform runs actually reasonable at scale.

The Consul team caught and fixed a token leak in debug logging where the full request URL, including plaintext ACL tokens in query parameters, was being logged [1] [2]. This is the kind of credential exposure that bypasses your security controls entirely, so patch immediately. On the AWS provider front, the team is shipping three meaningful expansions: Bedrock now supports managed knowledge bases [3], GuardDuty detectors can configure the new AI_PROTECTION and AI_ANALYST features [4], and S3 bucket notifications gain list operation support [5]. The secretsmanager_secret resource also underwent a refactor to remove the Read function from its List operation [6] [7], a subtle but important change for how the provider handles resource enumeration. Over in consul-k8s, the team implemented a deterministic patch-coverage merge gate that enforces 90% test coverage on new code in PRs [8] [9], removing the dependency on Codecov and making coverage decisions repeatable. This is the kind of CI hardening that prevents coverage regressions from slipping through.

Action items

→ Deploy Consul patch for token leak immediately - check your debug logs now hashicorp/consul [immediate]
→ Update terraform-provider-aws for Bedrock and GuardDuty AI feature support hashicorp/terraform-provider-aws [plan]
→ Review secretsmanager_secret resource behavior after refactor hashicorp/terraform-provider-aws [plan]
→ Monitor consul-k8s PR coverage enforcement for false positives hashicorp/consul-k8s [monitor]

References

[1] fix debug token leak. (#23731) hashicorp/consul
[2] fix debug token leak. ↗ hashicorp/consul
[3] feat(bedrockagent): add Managed Knowledge Base support (type=MANAGED) ↗ hashicorp/terraform-provider-aws
[4] guardduty: Add support for AI_PROTECTION and AI_ANALYST feature names ↗ hashicorp/terraform-provider-aws
[5] aws_s3_bucket_notification: Add list support ↗ hashicorp/terraform-provider-aws
[6] list resource/aws_secretsmanager_secret: Removes resource Read function from List ↗ hashicorp/terraform-provider-aws
[7] Merge pull request #48856 from hashicorp/td-no-read-in-list-secretsmanager-secret hashicorp/terraform-provider-aws
[8] ci: gate PR merges on >=90% patch coverage ↗ hashicorp/consul-k8s
[9] ci: gate PR merges on >=90% patch coverage (#5424) hashicorp/consul-k8s

Quick answers

What shipped in HashiCorp on July 17, 2026?: Consul's debug logs were exposing ACL tokens in plaintext, a critical flaw now patched before it reaches production. In total, 17 commits and 12 pull requests landed.
Who contributed to HashiCorp on July 17, 2026?: 7 developers shipped this update, including Paras Gupta, gdavison, sbldevnet, DanyStinson, subham-ibmhc, Surabhi-1605, and pajay-rao.
What were the notable HashiCorp updates?: fix debug token leak. (#23731), fix debug token leak, and feat(bedrockagent): add Managed Knowledge Base support (type=MANAGED).

CONSUL CLOSES PRs SLOWER, GITHUB ACTIONS ALIGN ACROSS HASHICORP

Consul's stale PR automation just got a lot less aggressive, giving maintainers 90 days before a PR starts gathering dust instead of 60.

go 4 shipped 1-min read

@hashicorp 2 days ago

TERRAFORM AWS PROVIDER GETS SMARTER LIST OPERATIONS, PACKER AZURE FIXES DATA DISK COLLISIONS

The Terraform AWS provider is shedding redundant Read calls from List operations, while Packer Azure solves a long-standing limitation around mixed data disk deployments.

go 80 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AZURE PROVIDER SHIPS BREAKING CHANGES, CRYPTO PATCHES ROLL ACROSS SDK

Terraform's Azure provider is deprecating Redis Enterprise resources and auto-deleting Service Bus defaults, while HashiCorp's core libraries patch Go crypto vulnerabilities across the stack.

go 34 shipped 1-min read

@hashicorp 4 days ago

GOLANG DEPENDENCIES TIGHTENED ACROSS HASHICORP STACK

Three core HashiCorp projects pulled in upstream Go library updates overnight, including a critical semaphore fix that could prevent panics in concurrent workloads.