The Wire · Showcase
CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD
By RepoJournal · Filed · About HashiCorp
Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.
Sanika Chavan shipped a fix [1] [2] that ensures only alive members get marked as joined in FloodJoins, addressing a regression in the serf flooder. The patch includes two new regression tests for graceful leave and failure scenarios across WAN topologies. Meanwhile, vault-secrets-operator is pulling in a gRPC 1.82.1 update [5] that stops reading from connections flooded by HTTP/2 frames, a security hardening that should land before your next VSO release. The operator is also tracking routine dependency bumps across google.golang.org/api [4] and go-openapi/runtime [3] to stay current on backward-compatible updates. Across the wider HashiCorp stack, hil and go-syslog are both picking up actions/checkout 7.0.1 [7] [8] to patch an unsafe PR check, and hil is moving to actions/setup-go 7.0.0 [6] which migrates to ESM. Activity this period: 1 commit and 7 PRs across 4 repos, mostly dependency hygiene.
One email a day. Unsubscribe in one click.
What actually shipped in HashiCorp, written up every day — commits, pull requests, releases, and security advisories.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Review and merge Consul WAN flood fix before next release hashicorp/consul [immediate]
- → Pull gRPC 1.82.1 into vault-secrets-operator on next dependency sync hashicorp/vault-secrets-operator [plan]
- → Validate actions/setup-go 7.0.0 ESM migration in hil CI hashicorp/hil [monitor]
References
- [1] ensure only alive members are treated as joined in FloodJoins ↗ hashicorp/consul
- [2] ensure only alive members are treated as joined in FloodJoins (#23709) hashicorp/consul
- [3] Bump github.com/go-openapi/runtime from 0.32.5 to 0.32.6 in the gomod-backward-compatible group ↗ hashicorp/vault-secrets-operator
- [4] Bump google.golang.org/api from 0.289.0 to 0.290.0 in the gomod-backward-compatible group across 1 directory ↗ hashicorp/vault-secrets-operator
- [5] Bump google.golang.org/grpc from 1.82.0 to 1.82.1 ↗ hashicorp/vault-secrets-operator
- [6] Bump actions/setup-go from 6.5.0 to 7.0.0 in the github-actions-breaking group ↗ hashicorp/hil
- [7] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions-backward-compatible group ↗ hashicorp/hil
- [8] [chore] : Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ hashicorp/go-syslog