RepoJournal
HashiCorp @hashicorp
176 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-23
stories 8
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

dependabot sanikachavan5
2 people shipped this
dependabot @dependabot 6 cited sanikachavan5 @sanikachavan5 2 cited

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

Sanika Chavan shipped a fix [1] [2] that ensures only alive members get marked as joined in FloodJoins, addressing a regression in the serf flooder. The patch includes two new regression tests for graceful leave and failure scenarios across WAN topologies. Meanwhile, vault-secrets-operator is pulling in a gRPC 1.82.1 update [5] that stops reading from connections flooded by HTTP/2 frames, a security hardening that should land before your next VSO release. The operator is also tracking routine dependency bumps across google.golang.org/api [4] and go-openapi/runtime [3] to stay current on backward-compatible updates. Across the wider HashiCorp stack, hil and go-syslog are both picking up actions/checkout 7.0.1 [7] [8] to patch an unsafe PR check, and hil is moving to actions/setup-go 7.0.0 [6] which migrates to ESM. Activity this period: 1 commit and 7 PRs across 4 repos, mostly dependency hygiene.

Action items

References

  1. [1] ensure only alive members are treated as joined in FloodJoins ↗ hashicorp/consul
  2. [2] ensure only alive members are treated as joined in FloodJoins (#23709) ↗ hashicorp/consul
  3. [3] Bump github.com/go-openapi/runtime from 0.32.5 to 0.32.6 in the gomod-backward-compatible group ↗ hashicorp/vault-secrets-operator
  4. [4] Bump google.golang.org/api from 0.289.0 to 0.290.0 in the gomod-backward-compatible group across 1 directory ↗ hashicorp/vault-secrets-operator
  5. [5] Bump google.golang.org/grpc from 1.82.0 to 1.82.1 ↗ hashicorp/vault-secrets-operator
  6. [6] Bump actions/setup-go from 6.5.0 to 7.0.0 in the github-actions-breaking group ↗ hashicorp/hil
  7. [7] Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions-backward-compatible group ↗ hashicorp/hil
  8. [8] [chore] : Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group ↗ hashicorp/go-syslog

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul provider patches two Go CVEs, adds 2.23.0 upgrade gate the month in review Consul patches four CVEs as Go bumps sweep repos
Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on July 23, 2026?
Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences. In total, 1 commits and 7 pull requests landed.
Who contributed to HashiCorp on July 23, 2026?
2 developers shipped this update, including sanikachavan5 and dependabot.
What were the notable HashiCorp updates?
ensure only alive members are treated as joined in FloodJoins, ensure only alive members are treated as joined in FloodJoins (#23709), and Bump github.com/go-openapi/runtime from 0.32.5 to 0.32.6 in the gomod-backward-compatible group.
♥

$ log @hashicorp --recent

A copyright sweep is the whole day 2 shipped HashiCorp: no material update 2 shipped Application Design Center lands, workload identity pools grow two fields 46 shipped Consul CI breaks on jq 1.8 as Ubuntu 26.04 runners arrive 31 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.