Who contributed to HashiCorp on November 2, 2026?

2 developers shipped this update, including Abhishek Yadav and hariom-hashicorp.

What were the notable HashiCorp updates?

chore: bump golang.org/x/net to v0.62.0 (CVE-2026-78661, CVE-2026-97045) (#509), test: add provider upgrade test and manual workflow, and Update dependencies in go.mod and go version.

Nov 2, 2026

$ the-wire · showcase

Consul provider patches two Go CVEs and adds a 2.23.0 upgrade gate

By RepoJournal · Filed 06:56 UTC on November 2, 2026 · About HashiCorp · Composed from the cited sources · methodology

2 people shipped this

Abhishek Yadav @LordAbhishek 2 cited

hariom-hashicorp @hariom-hashicorp 2 cited

terraform-provider-consul bumps golang.org/x/net to v0.62.0 for CVE-2026-78661 and CVE-2026-97045 while a new acceptance test enforces that state written by the last SDK v1 release (2.23.0) plans clean against current builds.

chore: bump golang.org/x/net to v0.62.0 (CVE-2026-78661, CVE-2026-97045) (#509) hashicorp/terraform-provider-consul

by Abhishek Yadav

golang.org/x/net moves from v0.60.0 to v0.62.0 to close CVE-2026-78661 (quadratic complexity coalescing text nodes in html) and CVE-2026-97045 (missing ancestor namespace checks when rendering raw text). Per the PR, go mod tidy also raised the other golang.org/x modules x/net v0.62.0 requires.

test: add provider upgrade test and manual workflow hashicorp/terraform-provider-consul

by LordAbhishek

TestAccConsulProviderUpgrade applies each config against hashicorp/consul 2.23.0 from the registry, then runs PlanOnly with the branch build and fails on a non-empty plan; all 179 acceptance-test configs are covered, each on a fresh Consul server. That makes a state-compat regression from the SDK v1 migration a CI failure rather than a user report.

Update dependencies in go.mod and go version hashicorp/packer-plugin-kubevirt

by hariom-hashicorp

Go goes 1.26.8 to 1.26.10, with packer-plugin-sdk 0.6.11 to 0.6.13, go-cty 1.16.3 to 1.19.0, hcl/v2 2.24.0 to 2.25.0 and golang.org/x/crypto 0.57.0 to 0.58.0; the PR lands under hashicorp/deps/vuln-fix. Indirect modules follow, including AWS SDK v2 1.37.2 to 1.41.5 and go-getter 2.2.2 to 2.2.6.

Bump Go version to 1.26.10 and update dependencies hashicorp/packer-plugin-docker

by hariom-hashicorp

The same Go 1.26.10 and packer-plugin-sdk 0.6.13 bump reaches packer-plugin-docker, plus go-cty 1.16.3 to 1.19.0 and hcl/v2 2.24.0 to 2.25.0. Both Packer plugins now agree on the SDK version, which is what keeps builder and post-processor behavior consistent across them.

Action items

→ Rebuild terraform-provider-consul from a commit containing golang.org/x/net v0.62.0 to clear CVE-2026-78661 and CVE-2... hashicorp/terraform-provider-consul [plan]