RepoJournal
HashiCorp @hashicorp
126 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-18
stories 14
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Alicloud plugin clears Dependabot backlog, Packer patches M5 crash

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

hc-github-team-secure-vault-ecosystem Jeremy Schoemaker sanyaraj2424 Hari hashicorp-copywrite
5 people shipped this
hc-github-team-secure-vault-ecosystem @hc-github-team-secure-vault-ecosystem 2 cited Jeremy Schoemaker @shoemoney 1 cited sanyaraj2424 @sanyaraj2424 1 cited Hari @hariom-hashicorp 1 cited hashicorp-copywrite @hashicorp-copywrite

Hashicorp's day splits cleanly in two: a security-driven dependency sweep in the Alicloud builder plugin that required a Go toolchain bump, and a verified crash fix for Packer on Apple M5 hardware, with the rest of the wire carrying routine Go and dependency maintenance.

Upgrade dependencies to resolve Dependabot security alerts hashicorp/packer-plugin-alicloud

by hariom-hashicorp

Closes every open Dependabot alert (#32-#60) by moving grpc to v1.83.2, golang.org/x/crypto to v0.56.0, golang.org/x/net to v0.58.0, golang.org/x/oauth2 to v0.36.0, go-ntlmssp to v0.1.1, go-jose/v4 to v4.1.4, and ulikunitz/xz to v0.5.15. The toolchain bump to Go 1.26.8 in go.mod and .go-version is not optional: the new dependency versions require it, and it also clears several stdlib CVEs flagg...

fix(deps): bump go-m1cpu v0.1.5 to v0.2.1 for M5 fix (#13696) hashicorp/packer

by Jeremy Schoemaker

Jeremy Schoemaker bumped go-m1cpu from v0.1.5 to v0.2.1 at go.mod:368 to stop a CGO SIGSEGV on Apple M5, with the fix confirmed RED to GREEN. If you build Packer or its plugins on an M5 Mac, this is the commit that makes it stop crashing.

v0.14.0 hashicorp/vault-plugin-secrets-kubernetes

by hc-github-team-secure-vault-ecosystem

The Kubernetes secrets plugin releases v0.14.0, rolling up release prep for v0.13.0 and v0.13.1 plus a go-jose/v4 bump from 4.1.3 to 4.1.4. Vault users pinning this plugin should note the tag is the first to include all three.

chore: automated Go/dependency update via vault-plugin-release hashicorp/vault-plugin-secrets-kubernetes

by hc-github-team-secure-vault-ecosystem

The same plugin's automated release tooling moves it to Go 1.27.1 and raises go-version to v1.9.0, vault/api to v1.23.0, and vault/sdk to v0.25.1, with the automated security scan reporting no violations and nothing exceeding the Vault Enterprise ceiling.

module dependency upgrade hashicorp/packer-plugin-scaffolding

by sanyaraj2424

The scaffolding plugin takes an unspecified module dependency upgrade. Quiet by design, but it is the template downstream plugin authors copy, so stale pins propagate.

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul enables post-quantum key exchange by default the month in review Terraform providers widen AWS, Azure, and Google coverage while core clears Graph cruft
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on September 18, 2026?
Hashicorp's day splits cleanly in two: a security-driven dependency sweep in the Alicloud builder plugin that required a Go toolchain bump, and a verified crash fix for Packer on Apple M5 hardware, with the rest of the wire carrying routine Go and dependency maintenance. In total, 7 commits, 6 pull requests, and 1 releases landed.
Who contributed to HashiCorp on September 18, 2026?
5 developers shipped this update, including hc-github-team-secure-vault-ecosystem, Jeremy Schoemaker, sanyaraj2424, Hari, and hashicorp-copywrite.
What were the notable HashiCorp updates?
Upgrade dependencies to resolve Dependabot security alerts, fix(deps): bump go-m1cpu v0.1.5 to v0.2.1 for M5 fix (#13696), and v0.14.0.
♥

$ log @hashicorp --recent

HashiCorp: no material update 2 shipped Terraform policy 0.3 docs land, Nomad 2.0.7 docs publish 23 shipped Consul turns on post-quantum key exchange by default 50 shipped Three Vault secrets plugins cut release changelogs 6 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.