RepoJournal
HashiCorp @hashicorp
176 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-23
stories 8
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Snowflake and MongoDB Atlas plugins patch Go CVEs

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

Arjun K S Rohit Agrawal Anurag Sharma
3 people shipped this
Arjun K S @arjunkshashicorp 2 cited Rohit Agrawal @roh-a 2 cited Anurag Sharma @anurag5sh 1 cited

Two Vault database plugins moved to Go 1.27.3 and golang.org/x/net v0.60.0 plus golang.org/x/crypto v0.58.0 to clear a batch of Go vulnerability records, with the Cloud Foundry auth plugin following the same recipe.

[VAULT-50037] Upgrade dependencies to resolve security vulnerabilities hashicorp/vault-plugin-database-snowflake

by arjunkshashicorp

Bumps .go-version from 1.27.1 to 1.27.3 and lifts the indirect golang.org/x/net and golang.org/x/crypto modules to the versions Vault Enterprise carries, resolving GO-2026-6603, 6610, 6611, 6612 and 6617. The PR keeps vault/sdk and every other direct dependency untouched, so operators can pull it for v0.17.1 without a separate SDK reconciliation.

Update .go-version and dependencies to resolve security vulnerabilities - #172 hashicorp/vault-plugin-database-mongodbatlas

by roh-a

Applies the same Go 1.27.3 toolchain alongside golang.org/x/crypto v0.56.0 to v0.58.0 and golang.org/x/net v0.58.0 to v0.60.0, and also moves github.com/jackc/pgx/v5 from v5.9.1 to v5.9.2. The PR notes a clean local security scanner run.

Update .go-version and dependencies to resolve security vulnerabilities hashicorp/vault-plugin-auth-cf

by roh-a

vault-plugin-auth-cf runs the identical upgrade set, with the same pgx, x/crypto, x/net, x/sync, x/sys and x/text bumps on Go 1.27.3, which means all three plugins land on one x/crypto and x/net version if you build from source.

VAULT-50037: upgrade Go version and dependencies to resolve security vulnerabilities (#194) hashicorp/vault-plugin-database-snowflake

by Arjun K S

The Snowflake commit is the merged result of that dependency work: .go-version at 1.27.3 with x/net and x/crypto aligned to the Vault Enterprise 2.2.x line.

Update CODEOWNERS to include redhat team (#64) hashicorp/packer-plugin-kubevirt

by Anurag Sharma

Elsewhere, packer-plugin-kubevirt added the Red Hat team to CODEOWNERS, a review-routing change with no effect on the plugin's behavior.

Action items

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul provider patches two Go CVEs, adds 2.23.0 upgrade gate the month in review Consul patches four CVEs as Go bumps sweep repos
Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on October 23, 2026?
Two Vault database plugins moved to Go 1.27.3 and golang.org/x/net v0.60.0 plus golang.org/x/crypto v0.58.0 to clear a batch of Go vulnerability records, with the Cloud Foundry auth plugin following the same recipe. In total, 4 commits and 4 pull requests landed.
Who contributed to HashiCorp on October 23, 2026?
3 developers shipped this update, including Arjun K S, Rohit Agrawal, and Anurag Sharma.
What were the notable HashiCorp updates?
[VAULT-50037] Upgrade dependencies to resolve security vulnerabilities, Update .go-version and dependencies to resolve security vulnerabilities - #172, and Update .go-version and dependencies to resolve security vulnerabilities.
♥

$ log @hashicorp --recent

A copyright sweep is the whole day 2 shipped HashiCorp: no material update 2 shipped Application Design Center lands, workload identity pools grow two fields 46 shipped Consul CI breaks on jq 1.8 as Ubuntu 26.04 runners arrive 31 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.