$ ls hashicorp/reviews/ # the step-back reads
HashiCorp in review
One review per week (and month): what shipped, what broke, what to act on.
Nov 2–8, 2026 weekly [act] 8 stories
Consul provider patches two Go CVEs, adds 2.23.0 upgrade gate
The dependency bump sits behind a new acceptance test that proves state written by 2.23.0, the last SDK v1 release, still reads in the cu...
Oct 26–Nov 1, 2026 weekly [act] 8 stories
CVE-2026-5006 mitigation documented; Consul scanner turns failing
Four Consul repos now fail the security scan on any detected CVE, and consul-esm bumps Consul to v2.0.4 to clear three.
Oct 19–25, 2026 weekly [act] 8 stories
Consul closes cross-namespace ACL binding hole
Operators of consul-k8s multi-namespace deployments should treat the binding change as a breaking default; security bumps and a Stacks po...
Oct 12–18, 2026 weekly [plan] 8 stories
Terraform policy library reaches 1.0 with 546 policies
The general availability cut adds 151 policies, and consul-dataplane moved to x/net v0.60.0 to close HTTP/2 issues.
Oct 5–11, 2026 weekly [act] 8 stories
Consul and consul-ecs patch CVEs across the week
Go standard library and x/crypto fixes dominate; TFE provider 0.82.0 adds registry artifact tag management.
Oct 1–31, 2026 monthly [act] 8 stories
Consul patches four CVEs as Go bumps sweep repos
Vault closes a plugin_directory escape and the Kubernetes provider rejects null namespace labels from anyone on 3.x.
Sep 28–Oct 4, 2026 weekly [act] 8 stories
Terraform Kubernetes provider 3.3.0 rejects null namespace labels
Consul K8s 2.1.0-rc1 patches its API submodule, and Actions workflows move off seven vulnerable x/crypto versions.
Sep 21–27, 2026 weekly [act] 8 stories
Vault Secrets Operator 1.6.0 removes HVS support
The release drops the HCPAuth and HCPVaultSecretsApp CRDs after HCP Vault Secrets hit end-of-life on July 1, 2026.
Sep 14–20, 2026 weekly 8 stories
Consul enables post-quantum key exchange by default
The X25519MLKEM768 hybrid now covers Consul Connect Envoy sidecars and agent TLS, landing alongside OpenShift support for both Boundary H...
Sep 7–13, 2026 weekly [act] 8 stories
Consul patches six security flaws
Two pre-auth ACL bypasses and a memory exhaustion attack land in Consul, with backports to supported releases.
Sep 1–30, 2026 monthly [act] 8 stories
Consul 2.1 rc1 ships post-quantum key exchange by default
Vault Secrets Operator 1.6.0 removes HCP Vault Secrets CRDs entirely, and September's security cadence continued across Consul, Vault plu...
Aug 31–Sep 6, 2026 weekly [act]
Consul patches js-yaml, nanoid vulnerabilities
Plus Nomad and go-getter dependency bumps and a policy library cleanup across the week.
Aug 24–30, 2026 weekly
Azurerm burns linter violations, Nomad command overhaul leads quiet week
Terraform provider work dominated HashiCorp's week, with the Azure provider cutting hundreds of linter violations and adding an eventual ...
Aug 1–31, 2026 monthly
Terraform providers widen AWS, Azure, and Google coverage while core clears Graph cruft
August 2026 saw HashiCorp push significant feature depth across AWS, Azure, Google, and Nomad while Terraform core shed legacy graph inte...
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.