RepoJournal
HashiCorp @hashicorp
113 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-03
stories 55
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Consul fixes front-end security vulnerabilities and provider adds S3 Object Lock support

By RepoJournal · Filed · About HashiCorp

gdavison rishabh-gupta-hashicorp reedloden ewbankkit danbr-ibm vpaul97 shashankNandigama
12 people shipped this
gdavison @gdavison 2 cited rishabh-gupta-hashicorp @rishabh-gupta-hashicorp 1 cited reedloden @reedloden 1 cited ewbankkit @ewbankkit 1 cited danbr-ibm @danbr-ibm 1 cited vpaul97 @vpaul97 1 cited shashankNandigama @shashankNandigama compliance-pr-automation-bot[bot] @compliance-pr-automation-bot[bot] itsjiyapatel @itsjiyapatel compliance-pr-automation-bot @compliance-pr-automation-bot mattschouten @mattschouten aimeeu @aimeeu

Two notable changes: Consul patched security vulnerabilities in its UI dependencies, and terraform-provider-aws now lets you enable S3 Object Lock without replacing the bucket.

Consul addressed security vulnerabilities in browserlist, postcss, and decode-uri-component, which are likely used in its UI build pipeline [1]. This is a security fix; you should update your Consul dependency to a release that includes this patch before your next deploy.

Terraform-provider-aws changed the aws_s3_bucket_object_lock_configuration resource so that adding S3 Object Lock to an existing bucket no longer forces a replacement [2]. Previously, enabling Object Lock would destroy and recreate the bucket; it now updates in place, which is important because S3 only allows Object Lock to be enabled at bucket creation, and AWS recently announced support for enabling it on existing buckets.

In other provider news, the aws_accountaccess_application resource saw its schema changed to match the AWS API [3], and tests for aws_key_pair were regenerated with a new SSH key pair helper [4][5]. These are routine but may affect your configuration if you use aws_accountaccess_application.

Finally, web-unified-docs added PDF download support for all HashiCorp Validated Design guides [6], and removed beta disclaimers for Terraform policy set tags, documenting the AND/OR tag match logic [7].

Action items

References

  1. [1] fix sec vuln for browserlist, postcss and decode-uri ↗ hashicorp/consul
  2. [2] r/aws_s3_bucket_object_lock_configuration: Don't force a replacement when enabling S3 Object Lock ↗ hashicorp/terraform-provider-aws
  3. [3] r/aws_accountaccess_application: Change schema to match API ↗ hashicorp/terraform-provider-aws
  4. [4] resource/aws_key_pair: Generates tag tests ↗ hashicorp/terraform-provider-aws
  5. [5] Merge pull request #49777 from hashicorp/td-test-generation-ssh-key-pair ↗ hashicorp/terraform-provider-aws
  6. [6] feat: add HVD PDF guides and asset pipeline support for PDFs ↗ hashicorp/web-unified-docs
  7. [7] IPE-1759: Remove beta disclaimer and document tag match logic for policy sets (#3285) ↗ hashicorp/web-unified-docs

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul patches js-yaml, nanoid vulnerabilities the month in review Terraform providers widen AWS, Azure, and Google coverage while core clears Graph cruft
Topics: Go Infrastructure Full archive →

Quick answers

What shipped in HashiCorp on September 3, 2026?
Two notable changes: Consul patched security vulnerabilities in its UI dependencies, and terraform-provider-aws now lets you enable S3 Object Lock without replacing the bucket. In total, 32 commits and 23 pull requests landed.
Who contributed to HashiCorp on September 3, 2026?
12 developers shipped this update, including shashankNandigama, rishabh-gupta-hashicorp, reedloden, gdavison, ewbankkit, compliance-pr-automation-bot[bot], itsjiyapatel, and compliance-pr-automation-bot, and 4 more.
What were the notable HashiCorp updates?
fix sec vuln for browserlist, postcss and decode-uri, r/aws_s3_bucket_object_lock_configuration: Don't force a replacement when enabling S3 Object Lock, and r/aws_accountaccess_application: Change schema to match API.
♥

$ log @hashicorp --recent

Copyright compliance sweep lands across HashiCorp repos 8 shipped HashiCorp: no material update 2 shipped Exec2 reports real RSS, fixes mountinfo permissions 10 shipped Provider SAML Site Auditor support, Consul vulnerability patches 22 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.