RepoJournal
HashiCorp @hashicorp
176 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-30
stories 7
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

consul-k8s patches CVEs, actions-go-build bumps x/crypto

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

anurag5sh Nagateja hc-github-team-es-release-engineering Lakshya Chandrakar
4 people shipped this
anurag5sh @anurag5sh 1 cited Nagateja @Nagateja2402 1 cited hc-github-team-es-release-engineering @hc-github-team-es-release-engineering 1 cited Lakshya Chandrakar @itslakshyaa 1 cited

Both of today's substantive changes are dependency-level security work: consul-k8s ships a release candidate resolving CVE-flagged grpc, crypto, and go-discover versions, while actions-go-build moves off a vulnerable golang.org/x/crypto.

v2.1.0-rc1 hashicorp/consul-k8s

by hc-github-team-es-release-engineering

The 2.1.0-rc1 notes patch API, grpc v1.83.2, golang.org/x/crypto v0.57.0, and go-discover v1.5.0 to address CVEs reported in binary and container scans. Release notes state Consul K8s 2.1.x is compatible with Consul 2.1.x and Consul Dataplane 2.1.x.

SMRE-1351 [actions-go-build] Severity Vulnerabilities (50203–50209) hashicorp/actions-go-build

by itslakshyaa

This bump takes golang.org/x/crypto from v0.37.0 to v0.52.0, clearing seven medium-severity issues covering SECVULN-50203 through SECVULN-50209, including GHSA-rm3j-f69w-wqmq (infinite loop on large channel writes) and GHSA-vgwf-h737-ff37 (server deadlock). Anyone pinning an older toolchain inherits that exposure.

Fix error reporting and cleanup in the ISO builder steps hashicorp/packer-plugin-kubevirt

by anurag5sh

Steps in the ISO builder printed errors with ui.Error but never recorded them in the state bag, so a failed build surfaced the misleading "bootable volume name not found in state", and with skip_create_image = true a failed build returned (nil, nil) and exited 0. Cleanup now only removes the ConfigMap and VM the build created, so a pre-existing resource with the same name survives a failed crea...

remove: drop 6 policies with no Security Hub control or CIS mapping value hashicorp/prewritten-terraform-policy-library

by Nagateja2402

Six policies added recently are gone, along with their policy test fixtures and docs. iam-user-group-membership-check duplicated iam-user-no-policies-check (both implement CIS 1.14/1.15 as Security Hub IAM.2), and the other five, including vpc-peering-least-access and cloudwatch-organizations-changes-alarm, carried no Security Hub control.

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul provider patches two Go CVEs, adds 2.23.0 upgrade gate the month in review Consul patches four CVEs as Go bumps sweep repos
Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on September 30, 2026?
Both of today's substantive changes are dependency-level security work: consul-k8s ships a release candidate resolving CVE-flagged grpc, crypto, and go-discover versions, while actions-go-build moves off a vulnerable golang.org/x/crypto. In total, 3 commits, 3 pull requests, and 1 releases landed.
Who contributed to HashiCorp on September 30, 2026?
4 developers shipped this update, including anurag5sh, Nagateja, hc-github-team-es-release-engineering, and Lakshya Chandrakar.
What were the notable HashiCorp updates?
v2.1.0-rc1, SMRE-1351 [actions-go-build] Severity Vulnerabilities (50203–50209), and Fix error reporting and cleanup in the ISO builder steps.
♥

$ log @hashicorp --recent

A copyright sweep is the whole day 2 shipped HashiCorp: no material update 2 shipped Application Design Center lands, workload identity pools grow two fields 46 shipped Consul CI breaks on jq 1.8 as Ubuntu 26.04 runners arrive 31 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.