$ the-wire · showcase
Provider SAML Site Auditor support, Consul vulnerability patches
By RepoJournal · Filed · About HashiCorp
Two releases landed today: Terraform's TFE provider gains Site Auditor SAML management and drops the frozen go-tfe v1 client, while Consul fixes confirmed grpc and crypto vulnerabilities.
Terraform provider for TFE added `attr_site_auditor` and `site_auditor_role` to `tfe_saml_settings` in both resource and data source, mirroring the admin role pair, so the Site Auditor role can be managed as code instead of through the admin UI only [1]. The same PR migrated both components from go-tfe v1 to go-tfe/v2 v2.8.0, because v1 lacked Site Auditor fields [1]. This is a breaking change for any code pinning the old client. A follow-up commit merged the change into the repo [2].
Consul fixed three vulnerabilities found in a scan: GO-2026-6355 in golang.org/x/crypto@v0.55.0, GHSA-vp52-pcj8-j9qc in google.golang.org/grpc@v1.82.1, and GO-2026-6354 in golang.org/x/crypto as well [3]. No upgraded versions are reported in the input, so verify the resolved dependency versions in the PR before deploying. Separately, a backport brings CAMP feature structs into the community edition, but the testing example shows that `consul services register` with an AI service still returns "ai is ent only feature" in this build, so expected Enterprise gating remains .
In config-inspect, provider requirements now accept constant variable references, following the earlier extension to locals . Nomad saw two internal fixes: the vault hook renewal loop now runs on the task's kill context instead of the client-shutdown-only context, which should stop that loop leaking on task stops [4], and the leader cancelable eval reaper now reuses an existing channel rather than creating a new one, removing a race between leader election and the eval handler [5]. Nomad also lowered the reschedule delay minimum from 5 seconds to 1 second, and returns a warning when a value below 5 seconds is combined with unlimited attempts [6]. "This is to inform them of potential scheduling thrashing in situations where the allocation has an underlying problem," the PR description states [6].
Action items
- → Update to go-tfe/v2 v2.8.0 when consuming tfe_saml_settings if you need Site Auditor attributes hashicorp/terraform-provider-tfe [plan]
- → Check Consul dependency bumps for the three reported grpc and crypto vulnerabilities hashicorp/consul [immediate]
- → Review Nomad jobs using reschedule delays between 1 and 5 seconds for thrashing hashicorp/nomad [monitor]
References
- [1] Add Site Auditor SAML attributes and migrate tfe_saml_settings to go-tfe/v2 ↗ hashicorp/terraform-provider-tfe
- [2] Merge pull request #2201 from hashicorp/tg/tfe_saml_settings_on_go-tfe ↗ hashicorp/terraform-provider-tfe
- [3] Fixing grpc and crypto sec vulns ↗ hashicorp/consul
- [4] vault hook: use task kill context for vault hook ↗ hashicorp/nomad
- [5] leader: Fix potential race condition in cancelable eval reaper. ↗ hashicorp/nomad
- [6] job: Allow setting the reschedule delay as low as one second. ↗ hashicorp/nomad
