RepoJournal
HashiCorp @hashicorp
176 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-07
stories 11
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

consul-ecs patches Go and x/crypto CVEs, nomad unblocks task startup

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

James Rasell hc-github-team-es-release-engineering schmichael Surabhi-1605 Rkabra7
5 people shipped this
James Rasell @jrasell 2 cited hc-github-team-es-release-engineering @hc-github-team-es-release-engineering 1 cited schmichael @schmichael 1 cited Surabhi-1605 @Surabhi-1605 1 cited Rkabra7 @Rkabra7

A consul-ecs patch release lands eight CVEs' worth of dependency upgrades while nomad removes a client-global lock that serialized every task start and stop.

v0.10.1 hashicorp/consul-ecs

by hc-github-team-es-release-engineering

consul-ecs v0.10.1 moves to Go 1.26.8 for CVE-2026-39821, CVE-2026-39822, and CVE-2026-42505, plus golang.org/x/crypto v0.57.0 (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662), golang.org/x/text v0.42.0 (CVE-2026-56852), and more. If you run the ECS integration, this is the drop to take.

client: concurrent proclib operations hashicorp/nomad

by schmichael

The process wrangler's parent cgroup for task processes was tracked in a client-global map with cleanup inside the task-shutdown critical section, which serialized all task shutdown and startup on the client. Moving those proclib operations to run concurrently removes that contention.

security: update application and container dependencies hashicorp/consul-dataplane

by Surabhi-1605

The dependency graph gets rebuilt: testcontainers-go to v0.44.0, integration tests migrate off the legacy docker/docker and containerd modules to the supported Moby API and client modules, and compress, x/crypto, x/net, x/sys, x/text, gRPC, and OpenTelemetry move to patched releases. The commit trail also shows a Go 1.27.1 bump walked back to 1.26.7, so the shipped build stays on 1.26.

ui: Update ajv, picomatch, braces, and minimatch dependencies. hashicorp/nomad

by jrasell

Nomad's UI dependency set picks up ajv, picomatch, braces, and minimatch updates driven by scanner findings.

test: Remove references of Travis and Appveyor. hashicorp/nomad

by jrasell

Long-unused Travis and Appveyor references come out of the Nomad test tree, and the boundary-worker-helm chart gains Route label support with the ops Route switched to reencrypt. Housekeeping, plus one chart behavior change worth a look if you template that worker.

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul provider patches two Go CVEs, adds 2.23.0 upgrade gate the month in review Consul patches four CVEs as Go bumps sweep repos
Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on October 7, 2026?
A consul-ecs patch release lands eight CVEs' worth of dependency upgrades while nomad removes a client-global lock that serialized every task start and stop. In total, 5 commits, 5 pull requests, and 1 releases landed.
Who contributed to HashiCorp on October 7, 2026?
5 developers shipped this update, including hc-github-team-es-release-engineering, Rkabra7, James Rasell, schmichael, and Surabhi-1605.
What were the notable HashiCorp updates?
v0.10.1, client: concurrent proclib operations, and security: update application and container dependencies.
♥

$ log @hashicorp --recent

A copyright sweep is the whole day 2 shipped HashiCorp: no material update 2 shipped Application Design Center lands, workload identity pools grow two fields 46 shipped Consul CI breaks on jq 1.8 as Ubuntu 26.04 runners arrive 31 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.