RepoJournal
HashiCorp

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

What actually shipped in HashiCorp, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

By RepoJournal · Filed · About HashiCorp

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

Sanika Chavan shipped a fix [1] [2] that ensures only alive members get marked as joined in FloodJoins, addressing a regression in the serf flooder. The patch includes two new regression tests for graceful leave and failure scenarios across WAN topologies. Meanwhile, vault-secrets-operator is pulling in a gRPC 1.82.1 update [5] that stops reading from connections flooded by HTTP/2 frames, a security hardening that should land before your next VSO release. The operator is also tracking routine dependency bumps across google.golang.org/api [4] and go-openapi/runtime [3] to stay current on backward-compatible updates. Across the wider HashiCorp stack, hil and go-syslog are both picking up actions/checkout 7.0.1 [7] [8] to patch an unsafe PR check, and hil is moving to actions/setup-go 7.0.0 [6] which migrates to ESM. Activity this period: 1 commit and 7 PRs across 4 repos, mostly dependency hygiene.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] ensure only alive members are treated as joined in FloodJoins ↗ hashicorp/consul
  2. [2] ensure only alive members are treated as joined in FloodJoins (#23709) hashicorp/consul
  3. [3] Bump github.com/go-openapi/runtime from 0.32.5 to 0.32.6 in the gomod-backward-compatible group ↗ hashicorp/vault-secrets-operator
  4. [4] Bump google.golang.org/api from 0.289.0 to 0.290.0 in the gomod-backward-compatible group across 1 directory ↗ hashicorp/vault-secrets-operator
  5. [5] Bump google.golang.org/grpc from 1.82.0 to 1.82.1 ↗ hashicorp/vault-secrets-operator
  6. [6] Bump actions/setup-go from 6.5.0 to 7.0.0 in the github-actions-breaking group ↗ hashicorp/hil
  7. [7] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions-backward-compatible group ↗ hashicorp/hil
  8. [8] [chore] : Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ hashicorp/go-syslog

Quick answers

What shipped in HashiCorp on July 23, 2026?
Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences. In total, 1 commits and 7 pull requests landed.
Who contributed to HashiCorp on July 23, 2026?
2 developers shipped this update, including sanikachavan5 and dependabot.
What were the notable HashiCorp updates?
ensure only alive members are treated as joined in FloodJoins, ensure only alive members are treated as joined in FloodJoins (#23709), and Bump github.com/go-openapi/runtime from 0.32.5 to 0.32.6 in the gomod-backward-compatible group.

More from @hashicorp

Daily updates, in your inbox

Follow HashiCorp

What actually shipped in HashiCorp, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

Want every project, not just this one?