$ cat hashicorp/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
Consul and consul-ecs patch CVEs across the week
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Go standard library and x/crypto fixes dominate; TFE provider 0.82.0 adds registry artifact tag management.
v0.10.1 hashicorp/consul-ecs
The release notes list CVE-2026-39821, CVE-2026-39822 and CVE-2026-42505 in the Go standard library, with x/crypto bumped to v0.57.0 for CVE-2026-56854. If you run ECS task definitions built from consul-ecs, this is your upgrade target.
v6.68.0 hashicorp/terraform-provider-aws
Setting more than 3 items in `availability_zones` now fails at plan time rather than at apply; AWS rejected those requests anyway, so the change is called out as breaking but moves a failure earlier in your workflow. Keep it in mind if you have modules carrying 4 or more zones.
v0.82.0 hashicorp/terraform-provider-tfe
The new `r/tfe_registry_artifact_tag` resource manages tags bound to a registry artifact, covering modules, providers, and components, using replace-all semantics. Tag sets become declarative, so every existing tag must appear in config or it will be dropped.
fix(connect-inject/ camp): keep credential gateway healthy while Vault Agent restarts hashicorp/consul-k8s
A terminating gateway with Vault-sourced credential injection runs the Vault Agent as a regular container next to Envoy, and Kubernetes marks the pod NotReady whenever any single container is not ready, which interrupted traffic during Agent restarts. The fix keeps the gateway healthy through those restarts.
fix: updateOrCreateACLRole now updates role with desired policies ins… hashicorp/consul-k8s
`updateOrCreateACLRole` wrote back the stale object read from Consul instead of the desired state passed by the caller, so role policy assignments silently failed to change. If you drive ACL roles from Kubernetes, previously applied policy edits may not have taken effect.
chore(deps): Sec Vuln Fixes hashicorp/consul
Consul upgrades `github.com/klauspost/compress` from v1.18.6 to v1.18.7 for an out-of-bounds read in s2, CVE-2026-63209, and moves `go.mongodb.org/mongo-driver` from v1.17.7 to v1.17.10, among others. These land through the normal Consul release train.
fix(api-gateway): four correctness bugs in DNS, routing, and upstream limits hashicorp/consul
Four separate correctness bugs found while testing API Gateway DNS auto-registration, reproduced on live clusters in both the Kubernetes/agentless and VM/agentful deployment models. They affect DNS handling, routing, and upstream limits, so both deployment styles are immediately relevant.
`azurerm_storage_account` - deprecate `BlobStorage` and remove it from all tests (#33586) hashicorp/terraform-provider-azurerm
`BlobStorage` is deprecated and removed from all tests. If your storage account config still passes that account kind, start migrating now rather than when removal lands. Alongside: Nomad updated its release image to busybox 1.38.0, Azurerm documented `client_authentication_mode` for application gateway SSL profiles and `Direct` kind for monitor data collection rules, and HDS 7.0 shipped its ve...
$ ls hashicorp/week/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.