RepoJournal
HashiCorp @hashicorp
126 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-11
stories 12
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Vault auth plugins ship security dependency updates

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

hc-github-team-secure-vault-ecosystem Paras Gupta bharath-k1999 arjunkshashicorp
4 people shipped this
hc-github-team-secure-vault-ecosystem @hc-github-team-secure-vault-ecosystem 5 cited Paras Gupta @paras-gupta2 2 cited bharath-k1999 @bharath-k1999 2 cited arjunkshashicorp @arjunkshashicorp 2 cited

Hashicorp's Vault ecosystem plugins picked up coordinated Go 1.27.1 and dependency upgrades to close known vulnerabilities, while Consul backported changelog entries for its September 9, 2026 patch releases.

The Vault database plugin for Snowflake shipped v0.17.0, resolving GHSA-wf45-q9ch-q8gh by upgrading github.com/apache/thrift and pulling in x/crypto v0.56.0 along with gRPC v1.83.2 and other transitive updates [1][2]. The Go toolchain and minimum Go directive moved to 1.27.1, the Vault SDK advanced to v0.25.1, and gosnowflake stayed pinned at v1.19.0 to respect the Vault baseline [2]. The same release train also fixed pre-existing acceptance-test failures caused by Snowflake's MFA enforcement, which was rejecting password-only logins with error 390197; the tests now create service users with RSA public keys instead [3][4].

The Kerberos auth plugin bumped to v0.18.0 with the same Go 1.27.1 upgrade and Vault SDK v0.25.1 alignment, and its changelog notes the PR "updated dependencies to address vulnerabilities" alongside golang.org/x/crypto moving from 0.49.0 to 0.52.0 [5][6][7].

On the Consul side, release notes were added to main for versions 2.0.4, 1.22.12, and 1.21.18, documenting the September 9, 2026 patch releases [8][9]. The consul-dataplane repository followed with a post-release changelog backport onto main for the same cycle's dataplane versions, 2.0.4, 1.9.12, and 1.8.17; no dependency changes were needed there because go.mod and the Dockerfile already carried x/net 0.59.0, x/crypto 0.57.0, and grpc 1.83.2 [10][11].

Action items

References

  1. [1] v0.17.0 ↗ hashicorp/vault-plugin-database-snowflake
  2. [2] [VAULT-50062] Prepare v0.17.0 Release ↗ hashicorp/vault-plugin-database-snowflake
  3. [3] [VAULT-50062] Fix Snowflake acceptance tests for key-pair authentication ↗ hashicorp/vault-plugin-database-snowflake
  4. [4] test: use RSA in Snowflake acceptance tests (#192) ↗ hashicorp/vault-plugin-database-snowflake
  5. [5] v0.18.0 ↗ hashicorp/vault-plugin-auth-kerberos
  6. [6] chore: automated Go/dependency update via vault-plugin-release ↗ hashicorp/vault-plugin-auth-kerberos
  7. [7] chore: automated Go/dependency update via vault-plugin-release (#159) ↗ hashicorp/vault-plugin-auth-kerberos
  8. [8] Add release notes for versions 2.0.4, 1.22.12, and 1.21.18 ↗ hashicorp/consul
  9. [9] Add release notes for versions 2.0.4, 1.22.12, and 1.21.18 (#23919) ↗ hashicorp/consul
  10. [10] Changelog entries to main (#1289) ↗ hashicorp/consul-dataplane
  11. [11] Changelog entries to main ↗ hashicorp/consul-dataplane

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul enables post-quantum key exchange by default the month in review Terraform providers widen AWS, Azure, and Google coverage while core clears Graph cruft
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on September 11, 2026?
Hashicorp's Vault ecosystem plugins picked up coordinated Go 1.27.1 and dependency upgrades to close known vulnerabilities, while Consul backported changelog entries for its September 9, 2026 patch releases. In total, 5 commits, 5 pull requests, and 2 releases landed.
Who contributed to HashiCorp on September 11, 2026?
4 developers shipped this update, including Paras Gupta, hc-github-team-secure-vault-ecosystem, bharath-k1999, and arjunkshashicorp.
What were the notable HashiCorp updates?
v0.17.0, [VAULT-50062] Prepare v0.17.0 Release, and [VAULT-50062] Fix Snowflake acceptance tests for key-pair authentication.
♥

$ log @hashicorp --recent

HashiCorp: no material update 2 shipped Terraform policy 0.3 docs land, Nomad 2.0.7 docs publish 23 shipped Alicloud plugin clears Dependabot backlog, Packer patches M5 crash 14 shipped Consul turns on post-quantum key exchange by default 50 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.