$ cat hashicorp/month/2026-09-01.log
the month in review · September 2026
Consul 2.1 rc1 ships post-quantum key exchange by default
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Vault Secrets Operator 1.6.0 removes HCP Vault Secrets CRDs entirely, and September's security cadence continued across Consul, Vault plugins, and consul-k8s.
v2.1.0-rc1 hashicorp/consul-k8s
Consul K8s 2.1.x pairs with Consul 2.1.x and Consul Dataplane 2.1.x, so plan a coordinated upgrade rather than moving the chart alone. The release note carries a security section updating the api submodule and Go dependencies. This is also the line where CNI DaemonSet tolerations became a Helm value and pre-configured Kubernetes auth methods landed.
v0.17.0 hashicorp/vault-plugin-database-snowflake
The plugin bumps thrift to v0.23.0 to resolve GHSA-wf45-q9ch-q8gh, plus a crypto upgrade for a separate security vulnerability. Rotate and redeploy the database secrets engine mounts if you pin plugin versions.
v0.18.0 hashicorp/vault-plugin-auth-kerberos
The auth plugin moves golang.org/x/crypto from 0.49.0 to 0.52.0 on top of the v0.17.1 changelog prep. Treat it as a routine dependency-cadence release, not a behavior change.
v2.11.0 hashicorp/go-tfe
PolicySetUpdateOptions TagSelectorMatchingLogic is now a NullableString, which finally makes it possible to clear that field. Some pagination parameter types in get responses were returning null, so callers parsing those payloads should re-test. Stack-level notification support is the new capability here.
v1.6.0 hashicorp/vault-secrets-operator
HCP Vault Secrets reached end-of-life on July 1, 2026, and this operator release removes HCPAuth and HCPVaultSecretsApp, their controllers, the credentials provider, RBAC manifests, Helm chart assets, and the hcp-sdk-go dependency. If you still run those CRDs, your upgrade path is to migrate to Vault-managed secrets first.
v0.14.0 hashicorp/vault-plugin-secrets-kubernetes
A steady plugin release after the v0.13.x changelog line, with security dependency updates folded into the vault plugin ecosystem releases this month. Nothing here changes how you configure the Kubernetes secrets engine.
v1.3.0 - Multi-Product Repository Support hashicorp/actions-generate-metadata
A releaseSubDir input lets one repository build multiple products, and the action auto-derives security-scan.hcl and release-metadata.hcl paths from it. If your release pipeline assumes one product per repo, this is the input that changes that assumption. It arrives as a breaking change to the action's interface.
Consul CNI DaemonSet Toleration Helm Value Enablement (#5562) hashicorp/consul-k8s
connectInject.cni.tolerations is now exposed as a Helm value, replacing the hard-coded tolerations block in the CNI DaemonSet. Operators on clusters that taint control-plane or addon nodes can now override scheduling instead of patching the daemonset by hand.
$ ls hashicorp/month/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.