$ cat hashicorp/week/2026-09-14.log
the week in review · Sep 14 – Sep 20, 2026
Consul enables post-quantum key exchange by default
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The X25519MLKEM768 hybrid now covers Consul Connect Envoy sidecars and agent TLS, landing alongside OpenShift support for both Boundary Helm charts.
feat(connect): enabling Post-Quantum Cryptography (PQC) hybrid key exchange across Consul Connect Envoy service mesh sidecars. hashicorp/consul
Part 1 of CSL-15591 turns on X25519MLKEM768 (NIST FIPS 203) hybrid key exchange across Connect Envoy sidecars and Consul agent TLS communication, with new configuration introduced to control it. Default-on means the mesh's transport handshakes change without an opt-in from you; check your Envoy builds and version pins before upgrading.
Add OpenShift support to boundary-controller Helm chart hashicorp/boundary-controller-helm
The Boundary Controller chart now omits fixed runAsUser and fsGroup when OpenShift is enabled, touching deployment, db-init, db-migrate, db-repair, and bootstrap-admin jobs. The worker chart already worked this way, so controller and worker now deploy on OpenShift under the same restricted-SCC assumptions.
Icu 18817 backup hashicorp/boundary-worker-helm
The worker chart gains values.openshift.yaml, an OpenShift Route template for TCP passthrough to the worker proxy port, and switches the proxy Service to ClusterIP so the Route carries external traffic. If you run Boundary workers on OpenShift, that replaces the NodePort or LoadBalancer wiring you were maintaining yourself.
v0.14.0 hashicorp/vault-plugin-secrets-kubernetes
The Kubernetes secrets plugin moves to v0.14.0 after the v0.13.x line, with the release pull requests carrying an automated Go 1.27.1 bump and dependency updates including hashicorp/go-version v1.9.0 and vault/api v1.23.0. The changelog itself ships nothing new for operators of the plugin.
Upgrade dependencies to resolve Dependabot security alerts hashicorp/packer-plugin-alicloud
All open Dependabot alerts, numbered 32 through 60, are resolved by bumping grpc to v1.83.2, golang.org/x/crypto to v0.56.0, x/net to v0.58.0, and x/oauth2 to v0.36.0. These are the transitive Go dependencies your builds inherit, so rebuild the plugin rather than pinning around them.
fix(deps): bump go-m1cpu v0.1.5 to v0.2.1 for M5 fix (#13696) hashicorp/packer
go-m1cpu moves from v0.1.5 to v0.2.1 to fix a CGO SIGSEGV on Apple M5 hardware, a fix the PR describes as verified RED to GREEN. Anyone building Packer the provider or the plugin on M5 Macs hits this crash without the bump.
Terraform Docs for Terraform policy 0.3 (#3403) hashicorp/web-unified-docs
The 0.3 docs add the requirement for attrs or prior_attrs in resource policytest blocks, the anytrue and alltrue functions, use of required_providers to validate resource mocks, and new stacks metadata. Policy authors on 0.2 should read these before bumping the policy language version.
Add release hygiene workflow hashicorp/consul
A release hygiene workflow scans PR descriptions and every changed source or config file for internal Jira ticket IDs, scanning two surfaces and excluding BUSL and MPL because they are SPDX license identifiers that show up in every file header. Alongside it, a client-side check at commit time blocks IDs like IPENG-123 from reaching the community-edition repo in the first place, and the remainin...
$ ls hashicorp/week/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.