$ the-wire · showcase
Consul patches four CVEs, consul-k8s fixes a silently broken ACL role update
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
11 people shipped this
Heramba Limaye
@HerambLimaye
1 cited
binilvrgs
@binilvrgs
1 cited
hc-github-team-es-release-engineering
@hc-github-team-es-release-engineering
1 cited
Kit Ewbank
@ewbankkit
1 cited
katbyte
@katbyte
1 cited
MatthiasHuygelen
@MatthiasHuygelen
1 cited
sreallymatt
@sreallymatt
1 cited
teowa
@teowa
1 cited
sanikachavan5
@sanikachavan5
raystrand
@raystrand
Dirk Avery
@YakDriver
Consul's dependency sweep clears four CVEs while consul-k8s repairs an ACL role write-back bug that has been discarding policy links on every Helm upgrade, and Terraform providers land deprecations and new service support.
chore(deps): Sec Vuln Fixes hashicorp/consul
Bumps github.com/klauspost/compress to v1.18.7 (CVE-2026-63209, out-of-bounds read in s2), go.mongodb.org/mongo-driver to v1.17.10 (CVE-2026-88031, CVE-2026-2303), github.com/moby/go-archive to v0.3.0 (CVE-2026-17106), and github.com/go-openapi/swag to v0.27.1. If you build Consul from source or vendor these modules, the fixed versions are now what upstream ships.
fix: updateOrCreateACLRole now updates role with desired policies ins… hashicorp/consul-k8s
updateOrCreateACLRole was writing back the stale aclRole object read from Consul instead of the desired role passed by the caller, so ACL Role policy assignments were never updated on any re-run of server-acl-init, including every Helm upgrade. The two-line fix copies the existing state and applies the desired policies, meaning policies newly computed during a run are no longer silently discarded.
v6.68.0 hashicorp/terraform-provider-aws
In 6.68.0, aws_docdb_cluster and aws_rds_cluster now validate availability_zones at plan time to reject more than 3 items, matching what AWS already enforced at apply time. Configurations carrying lists longer than 3 that previously failed late will now fail at plan.
`azurerm_storage_account` - deprecate `BlobStorage` and remove it from all tests (#33586) hashicorp/terraform-provider-azurerm
azurerm_storage_account now deprecates the BlobStorage account kind and has removed it from all tests. Existing configurations using that kind keep working for now, but the provider is signaling the migration path off it.
New service: `lambdaweb` hashicorp/terraform-provider-aws
Adds a lambdaweb service to the AWS provider, expanding coverage into Lambda Web Adapter resources.
`azurerm_monitor_data_collection_rule` : Add support for kind `Direct` hashicorp/terraform-provider-azurerm
azurerm_monitor_data_collection_rule gains support for kind Direct.
`azurerm_application_gateway` - add support for the `client_authentication_mode` property in `ssl_profile` hashicorp/terraform-provider-azurerm
azurerm_application_gateway's ssl_profile block gains the client_authentication_mode property.
teamcity: cache terraform and providers on the agent hashicorp/terraform-provider-azurerm
TeamCity agents now keep a single copy of Terraform and each provider instead of re-downloading them per build and per test; with 20 tests concurrent, that had meant gigabytes of identical files written and deleted repeatedly.
Action items
- → Upgrade consul to a build containing the klauspost/compress v1.18.7, mongo-driver v1.17.10, go-archive v0.3.0, and go... hashicorp/consul [plan]
- → Review aws_docdb_cluster and aws_rds_cluster availability_zones lists for more than 3 entries before upgrading terraf... hashicorp/terraform-provider-aws [plan]
- → Replace the deprecated BlobStorage kind on azurerm_storage_account resources hashicorp/terraform-provider-azurerm [plan]
